Function verify_audience 

pub fn verify_audience(
    envelope: &NotarizationEnvelope,
    verifier_id: &str,
    act_coordinates: Option<&AudienceChannelBinding>,
) -> Result<(), AphError>

§8.3’s audience step (RFC 0003 §1): when the envelope names who may accept it, this verifier had better be that party.

The semantics, in refusal order:

• audience ABSENT: admitted. Absence is the producer’s decision to issue a bearer credential, never an oversight the verifier forgives.
• audience.id differs from verifier_id: refused, APH_E017.
• audience.channelBinding present: every member it names — kind included — must equal the same-named member of act_coordinates, the delivery coordinates of the act this verifier is being asked to perform. A member the act’s coordinates lack is a MISMATCH, and act_coordinates being None entirely is a mismatch too: a verifier that cannot determine the act’s coordinates MUST reject rather than skip, exactly as one that cannot determine its own identity must — which is why verifier_id is a required parameter rather than an Option this function politely tolerates.

A comparison, not cryptography: nothing here checks a signature, and the caller runs this AFTER signature verification (§8.3 ordering).