Module verify 

The verifier: given a repository and an allowed_signers, what does a valid attestation cover for the tree checked out there?

SPEC.md is the contract; this module and verify.sh are two implementations of it, kept honest by tests/conformance.sh.

Every failure is the same failure. No note, no signers file, an unreadable key, a tree that moved, a signature that does not verify — all mean “not covered”, and not covered means the caller runs its tests. Nothing here can let an untested tree skip CI; it can only cost a redundant run. That is why this module returns verdicts rather than errors.

Structs

Verdict

What the verifier concluded, and how it got there.

Constants

MAX_VERIFICATIONS

How many signatures one invocation verifies, over every candidate. A verification is one call of [verify]; blocks the cheap checks reject and blocks already judged do not count.

Functions

covered_gates

The uniform rule, as a pure function: a gate of a verified block is covered if the block’s tree IS the checked-out tree, or its canonical tree is the checked-out one’s, or if the block claims a fingerprint for that gate equal to the one computed here.

default_signers

Where a repository keeps its allowed_signers when the caller does not say.

evaluate

The whole decision, trail included.

resolve_signers

A caller-supplied signers path, resolved the way the default is: relative to the REPOSITORY ROOT, not the working directory. Absolute paths pass through.