Function verify_extra_scoped 

pub fn verify_extra_scoped(
    repo: &Path,
    scope: &Path,
    base: Option<&str>,
    extra_scopes: &[PathBuf],
    excludes: &[PathBuf],
) -> Result<Verification>

Verify the committed attestation at repo, joining extra freshness roots outside scope into the “latest code commit” walk (#333).

extra_scopes are repo-root-relative directories — a shared source tree that is a sibling of the package (a native core bound into several language bindings), which no scope at-or-below the attestation directory can reach. Their commits count as code just like commits under scope, so a change to the shared tree stales an attestation whose own subtree it doesn’t touch. excludes are repo-root-relative directories carved back out of that union — a feature-gated subtree (a core cli/ compiled out of the bindings) whose changes must not stale them. Because the roots may lie outside the package subtree — that’s the point — the descendant constraint stays on scope only.

The freshness rule is unchanged: the attestation must name the newest in-range commit touching the union of scope and extra_scopes, minus excludes. base diff-scopes the walk exactly as in verify_since. Empty extra_scopes and excludes are byte-identical to verify_since.