Module verify 

Host-side end-to-end provenance-digest verification (SPEC.md §6.2, §F5; issue #12) — the bytes half of F5.

contextgraph-types’ is_well_formed_digest and the provider-facing frame-validity check together enforce F5’s grammar (sha256:<64 lowercase hex>). Neither can say whether a digest actually matches the bytes it claims to cover: that requires re-reading the source, which only a host can do. This module is that verifier.

It is not Host::verify_frames: that asks the provider whether a held frame is still current (context/verify, §9). This re-reads local bytes the host can see and hashes them itself, trusting no one — the two are different guarantees that happen to share the verb.

Digested bytes (§6.2)

The digest covers the exact UTF-8 source bytes addressed by uri + range at read time, with no normalization: no line-ending translation, no trailing-newline adjustment. Provenance without a range digests the whole resource. Only file provenance is held to F5 — a derivation or episode link has no addressable bytes.

Range grammar

SPEC.md §6.2 does not fix a range grammar; the only convention in this codebase is line ranges, L<start> or L<start>-<end> (1-indexed, inclusive), which this verifier supports. A line’s bytes include its terminating \n as it appears on disk (host-defined, since the spec is silent on terminator inclusion); no \r is ever stripped, honoring the “no line-ending translation” clause. An unrecognized range grammar is an honest Unreadable, never a silent whole-file fallback that would digest the wrong bytes.

Scope and safety

This is a host API a host invokes deliberately, over sources it trusts — not an automatic re-read of any uri a provider names. Re-reading a provider-supplied path is a capability decision (path confinement, consent) the host runtime does not yet make (see the filesystem-confinement note in the crate docs), so this is deliberately not wired into Host::query_all. Wiring it into an end-to-end host-side conformance gate — with confinement — is tracked by the host-side harness (issue #14). It is a synchronous utility; a caller on an async path wraps it in spawn_blocking.

Enums

DigestVerification

The outcome of verifying one file-provenance digest against the bytes it addresses (SPEC.md §6.2). Evidence-carrying rather than a bare bool, so a failure says exactly what diverged.

Functions

verify_file_provenance

Verify every file-provenance digest a frame declares against the bytes on disk, returning one (provenance index, outcome) per file entry in provenance order.

verify_provenance_digest

Re-read the bytes one file-provenance entry addresses and check their sha256 against its declared digest (SPEC.md §6.2, §F5).