Function resolve_org_root 

pub fn resolve_org_root(
    directory: &dyn OrgKeyDirectory,
    org: &str,
    my_secret: &StaticSecret,
    my_user_id: &str,
    trusted: &[VerifyingKey],
) -> Result<Option<ResolvedOrgRoot>, OrgKeyDirectoryError>

Resolve org’s K_org for a member from their published wraps. See the module docs for the fail-closed return contract and the trust this holds.

Selection: newest epoch first (the directory’s contract), and within an epoch the first wrap that unwraps under a trusted key wins — safe because every trusted granter wraps the IDENTICAL K_org (it is the org master, not a per-granter secret), so which trusted-signed candidate is chosen cannot change the bytes. A lower epoch is selected only when every newer wrap fails to unwrap (i.e. the member was not re-granted at the newer epoch) — correct fail-closed selection.