osyra_ome.verify.oeraser

Private pre-release / network boundary: The currently usable customer surface is offline verification of an existing signed artifact against an out-of-band trust anchor. Memory/network RPC APIs and host snippets on this page describe protocol and interface shape; the public Edge bridge, package publication, and release acceptance remain pending. Do not treat api.osyra.ai:443 examples as a released customer route.

OERaseR (VerifiedForgetting) offline re-decision — the DPA / auditor verify path.

Apache-2.0 verify surface (per design §2.5 + ADR-043 β). A never-in-the-loop third party — a Data-Protection Authority, a DPO, an EDPB Coordinated-Enforcement-Framework right-to-erasure assessor, a SOC-2 / EU-AI-Act auditor, or a data-subject's counsel — re-decides a verifiable cryptographic-erasure receipt **offline, with no call to OSYRA**, from the receipt's ``oeraser-body`` bytes (carried in the ``.ome`` portable bundle).

This is the byte-identical Python sibling of the Go reference re-decider (``AP00016-verifier-svc/internal/verifier/oeraser``) and the Java OME emitter (``AP00011 OeraserEvidence``). The frozen cross-language KAT (ENG-2316) is the oracle: the same ``oeraser-body`` bytes the Go re-decider accepts MUST re-derive byte-identically here. A single divergent byte breaks a committed root and the re-decision fails closed.

What it re-decides (design §3.1; the four legs ∧ the terminal weld, in fail-closed order):

LEG 1 — erasurePinned the disclosed scope + authorization + pinned retention policy

• pre/post live-keystore roots hash to the committed erasure_root (a swapped input ⇒ ERASURE_ROOT_MISMATCH); the pinned policy is a deterministic disclosed rule that governs the erasure scope (else UNVERIFIABLE_POLICY). LEG 2 — retentionPermits re-running the deterministic retention fold over the disclosed authorization PERMITS deletion (an active legal-hold ⇒ LEGAL_HOLD_ACTIVE; within-window with no Art-17 basis ⇒ RETENTION_FORBIDS). LEG 3 — keyDestroyed the disclosed post-erasure live-key-hash set is canonical (sorted, duplicate-free), re-derives the committed post_keystore_root, EXCLUDES key_id = H(K) (the wrapping key is provably gone), AND the destruction attestation verifies under a relying-party-PINNED key-destruction authority. An unpinned / un-verifying authority fails closed (KEY_NOT_DESTROYED). LEG 4 — noResurrection the disclosed post-erasure write-log re-derives the committed writelog_root and no later write re-introduced the erased scope (RESURRECTION_DETECTED). TERMINAL — erasure_binding the committed ``erasure_bound`` welds (erasure_id ‖ data_class ‖ erasure_root ‖ key_id ‖ verdict=ERASED).

Honest scope (load-bearing — the same legal shield the Go reference carries): OERaseR re-decides crypto-erasure CONFORMANCE over the COVERED copy, NOT that the datum left every physical medium; ``noResurrection`` is a FLAT forward write-log scan, NOT transitive derivation-closure over reach(X) (deferred, ENG-2318) — V1 does NOT discharge GDPR Art-17(2) (derived copies). The verdict binds to the ATTESTED key-destruction; a forged destruction attestation is the upstream attestor's threat (the disclosed seam — that is exactly why the relying party MUST pin the destruction-authority key(s) it trusts).

Diagnostics: every reject raises :class:`OmeVerifyError` (cryptographic / leg failure) or :class:`OmeWireFormatError` (structural / canonical / shape failure) carrying the SAME ``OSY-EAT-NNNN`` code the Go re-decider emits, so an auditor gets identical offline and on-substrate diagnostics. The function returns ``True`` only on a full accept and NEVER returns ``False`` — fail-closed, so a caller cannot accidentally trust an un-decided receipt.

Boundary: this re-decides the ``oeraser-body`` (the frozen ENG-2316 KAT unit). Locating and COSE-verifying the enclosing EAT envelope inside a live ``.ome`` bundle (the envelope signature + the workspace-partitioned single-use nonce burn) is the EAT-verify layer; the live end-to-end path against a real OME-emitted receipt is ENG-2336 (related, out of scope here). A caller that already holds the verified opaque body bytes re-decides them directly.

Functions

verify_oeraser

def verify_oeraser(oeraser_body: bytes, *, destruction_authority_pubkeys: Sequence[bytes], now: int) -> bool

Re-decide an OERaseR verified-forgetting receipt body, offline and fail-closed.

Re-derives the four legs (erasurePinned ∧ retentionPermits ∧ keyDestroyed ∧ noResurrection) + the erasure_binding terminal weld over the disclosed witnesses in ``oeraser_body``, trusting ONLY the relying-party-pinned key-destruction authority set. Byte-identical to the Go reference (``AP00016``) + Java emitter (``AP00011``) — the frozen ENG-2316 KAT is the cross-language oracle.

Args: oeraser_body: The canonical-CBOR oeraser-body bytes (§4.2.1) — the opaque EAT receipt body. The frozen ENG-2316 KAT unit. destruction_authority_pubkeys: The relying party's PINNED set of 32-byte raw Ed25519 key-destruction-authority public keys (rotation-tolerant — the attestation must verify under ANY one). An EMPTY set fails closed: with no pinned authority, the keyDestroyed leg cannot be satisfied (KEY_NOT_DESTROYED). This is the trust anchor — the DPA pins the authority it trusts, NOT the controller's say-so. now: The attested clock value (unsigned-64-bit seconds) the retention window is evaluated against. Supplied by the relying party; the re-decision NEVER reads a clock of its own, so it is reproducible offline.

Returns: True on a full accept (all four legs + the terminal weld passed). NEVER returns False — every reject raises, so a caller cannot accidentally trust a receipt that did not fully re-decide.

Raises: OmeWireFormatError: the body is not strict-canonical CBOR, or violates the fixed keyasint schema / a field byte-length (OSY-EAT-6308), or now / destruction_authority_pubkeys are the wrong type. OmeVerifyError: a leg or the terminal weld failed — carries the same OSY-EAT-NNNN code the Go re-decider emits (6370 KEY_NOT_DESTROYED, 6371 RETENTION_FORBIDS, 6372 LEGAL_HOLD_ACTIVE, 6373 ERASURE_ROOT_MISMATCH, 6374 TOMBSTONE_INCONSISTENT, 6375 RESURRECTION_DETECTED, 6376 UNVERIFIABLE_POLICY).