Module verify 

Verify — the core verifier. Mirrors the Go reference verify.go exactly.

Functions

verify_bundle

verify_bundle is the entry point. Audit hook (SPEC §17.3) wraps the inner verifier so it fires on every call — success AND failure — and its errors are swallowed so auditing never alters the verdict.

verify_streamed_turn

Fast-path verifier for streamed turns that present a SessionToken in place of the full cert chain. Checks HMAC, validity window, challenge freshness, and hybrid challenge signature against token.agent_pub_key. The chain is NOT re-verified — that’s the point of the token.

verify_transaction_receipt

Verify a TransactionReceipt: envelope checks, per-party bundle verification, and party signature verification over the canonical signable.