Function verify_provenance_digest 

pub fn verify_provenance_digest(provenance: &Provenance) -> DigestVerification

Re-read the bytes one file-provenance entry addresses and check their sha256 against its declared digest (SPEC.md §6.2, §F5).

Returns NotFileProvenance for a non-file link (F5 does not bind it), Unreadable when the addressed bytes cannot be read, and otherwise Verified or Mismatch. A grammar-malformed declared digest simply cannot equal a well-formed hash, so it surfaces as Mismatch; digest grammar is the provider-facing frame-validity check’s job, not this one’s.

use contextgraph_host::verify::{verify_provenance_digest, DigestVerification};
// provenance: file:///repo/src/net.rs, range L120-160, digest sha256:<64 hex>
match verify_provenance_digest(&provenance) {
    DigestVerification::Verified => { /* the bytes still hash as claimed */ }
    DigestVerification::Mismatch { expected, actual } => { /* tampered or moved */ }
    other => { /* not a file link, or unreadable */ }
}