Function verify_push 

pub fn verify_push(
    new_tips: &[Hash],
    mode: ClosureMode,
    source: &mut impl ObjectSource,
    known: impl FnMut(&Hash) -> bool,
) -> Result<PushReport, VerifyError>

Verify the history a push introduces, before refs move.

Breadth-first from every id in new_tips over crate::ops::graph::children(obj, mode), fetching each id at most once from source. Every fetched object is deserialized and its id re-derived; each commit, remix and tag has its signature checked. Remix sources and Delta.base_hash are never followed. Everything wrong is collected into the PushReport rather than stopping at the first problem, so a server can reject with a complete reason.

Repository isolation (PRD §6.5)

• source MUST serve only this repository’s members plus the objects of the push being verified. A source backed by a global content store, or by another repository, turns this check into a cross-repo existence oracle and lets a push “close” over objects its repository never held.
• known(id) is a frontier: ids for which it returns true are neither fetched nor descended. It MUST return true only for objects whose whole closure in this mode was already verified in this repository — never for “exists somewhere”, and never for an object merely present in the pushed pack. A known tip is skipped entirely, including its commit/remix/tag type check; the caller’s index already knows that object’s type.

Errors

Only a source error, or VerifyError::TooManyClosureObjects once the walk reaches more than crate::pack::MAX_ENTRIES ids (frontier stops included). Verification failures are report entries, not errors.