pub fn verify(root: &Path) -> Result<VerifyReport>Expand description
Verifies a bundle in place.
Every descriptor value is untrusted until validated. The checks run in order and any failing step refuses the whole bundle, naming every offender that step found: descriptor schemas plus division and run id validation, the normative layout at every depth, checksum framing and the checksum chain with the listed set proven equal to the enumerated tree before anything is hashed by name, complete newline-terminated shards, the rules snapshot bound to the effective records, artifact identity through the pure path mapping with hashes and no unreferenced mirror file, the portable collision check, and exact named count and coverage agreement.