osyra_ome.verify.receipt

Private pre-release / network boundary: The currently usable customer surface is offline verification of an existing signed artifact against an out-of-band trust anchor. Memory/network RPC APIs and host snippets on this page describe protocol and interface shape; the public Edge bridge, package publication, and release acceptance remain pending. Do not treat api.osyra.ai:443 examples as a released customer route.

client.verify.receipt — verify a SignedClaim receipt locally (v0.1).

**This is the C1 / CRYPTO-2 verify re-model (ENG-2228) — the Python equivalent of the AP00014 TypeScript ``verifyReceipt`` re-model.**

Wire-truth, byte-verified

A receipt's signature is a **DETACHED bare Ed25519 signature** over the wire signing-preimage bytes VERBATIM. The preimage is the Form-B 2-tuple

canonical_cbor([tstr("osyra-ome-claim-v1"), claimMap])

(the dsTag-wrapped form; the claim 2-tuple wire shape is frozen by ADR-157 (Form-B claim 2-tuple, 9-field short-key, body-OUT) + ADR-008, while the canonical-CBOR strict-decode rules C1-C7 applied to the preimage are ``AP00011-OME-FILE-FORMAT-V1.md`` §4.2). The signature is a DETACHED sibling of these bytes — it is NOT embedded inside ``claimMap`` — and verification runs as

Ed25519.verify(trusted_pub_key, signature, preimage_bytes)

over the supplied ``preimage_bytes`` EXACTLY as received. The preimage is canonical-decoded ONLY to confirm its shape (a 2-tuple) + bind the dsTag (reject if ``tag != DS_TAG_CLAIM``); it is **NEVER re-encoded**. A re-encode could diverge from the signed bytes (a canonicalization- substitution gap) → this verifier closes CRYPTO-2 by signing/verifying the wire bytes themselves.

This matches the Go reference oracle (``ome-proto/go`` ADR-045 / ADR-157) and the TS sibling (``AP00014/src/verify/kernel.ts``) byte-for-byte: the cross-language claim-preimage KAT (``tests/kat/verify-v1/``) replays the SAME Go-minted ``preimageHex`` / ``sigHex`` / ``signerPubHex`` vectors under all four implementations.

Trust anchor (CRYPTO-1 / threat-model A1, ENG-2221)

The caller MUST supply the trusted 32-byte Ed25519 public key (``trusted_pub_key``). There is no in-band signer-key trust: a ``SignedClaim`` envelope's embedded ``signer_pub`` is attacker-controlled (anyone can self-sign with their own keypair), so it is NEVER consulted as a trust anchor here. Mirror of TS ``verifyReceipt(preimage, signature, trustedPubKey)`` — a missing/short trusted key fails closed (raises).

BREAKING (v1.0.0 alpha)

The previous surface ``verify_receipt(receipt_bytes, *, expected_signer_pub=...)`` decoded a SignedClaim *envelope* map and RE-ENCODED the inner bare claim to obtain the preimage — the exact CRYPTO-2 bug. The new surface takes the detached preimage + signature + trusted key directly. When you hold a :class:`~osyra_ome.types.SignedClaim` model, pass its ``encoded_cbor`` (the detached wire preimage) + ``sig`` + a caller-trusted key: ``verify_receipt(signed.encoded_cbor, signed.sig, trusted_pub_key)``.

Imports ONLY from ``osyra_ome.verify._kernel`` (BC-13 isolation guard).

Functions

verify_receipt

def verify_receipt(preimage_bytes: bytes, signature: bytes, trusted_pub_key: bytes) -> bool

Verify a SignedClaim receipt: a DETACHED bare-Ed25519 signature.

The signature covers the wire signing-preimage bytes VERBATIM — the Form-B 2-tuple ``canonical_cbor([tstr("osyra-ome-claim-v1"), claimMap])`` (claim 2-tuple wire shape per ADR-157 + ADR-008; canonical-CBOR strict-decode per ``AP00011-OME-FILE-FORMAT-V1.md`` §4.2). Verification is::

Ed25519.verify(trusted_pub_key, signature, preimage_bytes)

over ``preimage_bytes`` exactly as supplied — **the preimage is NEVER re-encoded** (that is the CRYPTO-2 fix). The preimage is canonical- decoded only to confirm its 2-tuple shape and to bind the dsTag (a Claim signature must never be accepted as a Witness/Bundle — cross- protocol confusion guard).

Args: preimage_bytes: The raw wire signing-preimage bytes (the bytes the signature attests). For a :class:~osyra_ome.types.SignedClaim this is its encoded_cbor field. signature: The 64-byte detached Ed25519 signature. trusted_pub_key: The 32-byte Ed25519 public key the caller trusts (the trust anchor — CRYPTO-1 / A1). The envelope's in-band signer_pub is attacker-controlled and is NOT used here.

Returns: True iff the signature verifies over preimage_bytes under trusted_pub_key; False on a genuine Ed25519 verify-false over a well-formed, correctly-tagged preimage.

Raises: OmeWireFormatError: the preimage is not bytes, is empty, is not strict-canonical CBOR, is not a 2-tuple, or carries the wrong dsTag (cross-protocol confusion). OmeVerifyError: signature is not 64 bytes, trusted_pub_key is not 32 bytes / not a valid Ed25519 point.