osyra_ome.verify.body_binding

Private pre-release / network boundary: The currently usable customer surface is offline verification of an existing signed artifact against an out-of-band trust anchor. Memory/network RPC APIs and host snippets on this page describe protocol and interface shape; the public Edge bridge, package publication, and release acceptance remain pending. Do not treat api.osyra.ai:443 examples as a released customer route.

Signature-bound verify-on-read body binding (ENG-2413 cross-SDK parity).

**This is the AP00013 mirror of the AP00014 ``_bindBodyToSignature`` logic (chatHistory.ts #1 BLOCKER).**

The mandatory read-path control

A claim's body bytes are NOT covered by the Ed25519 signature directly — the signature attests the Form-B preimage, which binds the body only TRANSITIVELY through ``content_hash = SHA-256(body)`` (ADR-157 body-OUT). So any read path that surfaces a body MUST, before trusting it:

1. Verify the SignedClaim signature over ``encoded_cbor`` under a CALLER- SUPPLIED trusted key (the in-band signer_pub is attacker-controlled and is NEVER a trust anchor — CRYPTO-1 / A1).
2. Extract the SIGNATURE-ATTESTED ``ch`` (content hash) from ``encoded_cbor`` — NOT from the decoded claim view, and NOT from a GetClaimBody response's own (unsigned, server-provided) content_hash field.
3. Compare ``SHA-256(body)`` to that ATTESTED ``ch`` in constant time.

The forgeable gap this closes: a malicious server returns an arbitrary ``body`` plus a matching unsigned ``content_hash`` (or rewrites the decoded ``claim.content_hash`` view). Binding to that field accepts the forged body as authentic. Binding to the SIGNATURE-attested ``ch`` (decoded from the bytes the Ed25519 signature actually covers) makes the forgery fail closed: the attacker cannot move ``ch`` without invalidating the signature under the trusted key.

Fail-CLOSED contract

:func:`verify_body_against_signed_claim` RAISES on every failure mode — signature verify-false, hash mismatch, missing/short trusted key, empty / undecodable preimage. It never returns ``False`` and never silently skips. An empty body is bound just like any other (``SHA-256(b"")`` is a real digest) — "empty" is NOT a skip sentinel.

Imports ONLY from ``osyra_ome.verify._kernel``, ``osyra_ome.verify.receipt``, ``osyra_ome.verify.claim_fields``, and ``osyra_ome.errors`` (the BC-13 isolation boundary).

Functions

verify_body_against_signed_claim

def verify_body_against_signed_claim(body: bytes, encoded_cbor: bytes, signature: bytes, trusted_pub_key: bytes) -> bytes

Bind a read-back ``body`` to the signature-attested content hash.

The single mandatory read-path control for a body-bearing claim. Verifies the signature, extracts the ATTESTED ``ch`` from the SIGNED preimage, and asserts ``SHA-256(body) == ch`` in constant time. On success returns the ``body`` unchanged (so the call site can write ``body = verify_body_...``).

Args: body: The raw claim body bytes returned by the read path (e.g. GetClaimBody). encoded_cbor: The claim signing-preimage bytes (the bytes the signature attests; from the SignedClaim for THIS body's claim). signature: The 64-byte detached Ed25519 signature over encoded_cbor. trusted_pub_key: The caller's trusted 32-byte Ed25519 public key. REQUIRED — a missing / wrong-length key fails closed (the in-band signer_pub is never a trust anchor).

Returns: body unchanged, once it is proven to match the signature-attested content hash.

Raises: OmeVerifyError: trusted_pub_key is missing / not 32 bytes, the signature does not verify over encoded_cbor under the trusted key, or SHA-256(body) does not equal the attested content hash. OmeWireFormatError: encoded_cbor is empty / not strict-canonical / wrong dsTag / missing the attested ch (propagated from :func:extract_attested_claim_fields and :func:verify_receipt).