# internal/app/verify

Package verify owns the CI-side receipt verification use case.

## Run

```go
func Run(ctx context.Context, envelope receipt.Envelope, trusted trust.TrustedKeys, policy Policy, ports Ports) (Result, error)
```

Run verifies every receipt invariant against current reality.

## AcceptanceResult

```go
type AcceptanceResult struct {
	ID       string
	Status   string
	ExitCode int
}
```

AcceptanceResult is one observed acceptance rerun result.

- `ID: string`: 
- `Status: string`: 
- `ExitCode: int`: 

## AcceptanceRunner

```go
type AcceptanceRunner interface {
	RunAcceptance(context.Context, []receipt.Acceptance) ([]AcceptanceResult, error)
}
```

AcceptanceRunner re-runs recorded acceptance commands.

- `RunAcceptance: func(context.Context, []receipt.Acceptance) ([]AcceptanceResult, error)`: 

## AncestryChecker

```go
type AncestryChecker interface {
	IsAncestor(context.Context, string, string) (bool, error)
}
```

AncestryChecker verifies base\_commit ancestry against the explicit target.

- `IsAncestor: func(context.Context, string, string) (bool, error)`: 

## Policy

```go
type Policy struct {
	TargetCommit    string
	MaterialRef     string
	MaterialOnly    bool
	CI              bool
	MinIndependence string
}
```

Policy controls pure verify invariants.

- `TargetCommit: string`: 
- `MaterialRef: string`: 
- `MaterialOnly: bool`: 
- `CI: bool`: 
- `MinIndependence: string`: 

## Ports

```go
type Ports struct {
	Snapshotter       Snapshotter
	AcceptanceRunner  AcceptanceRunner
	AncestryChecker   AncestryChecker
	SignatureVerifier SignatureVerifier
}
```

Ports groups the narrow verification ports.

- `Snapshotter: Snapshotter`: 
- `AcceptanceRunner: AcceptanceRunner`: 
- `AncestryChecker: AncestryChecker`: 
- `SignatureVerifier: SignatureVerifier`: 

## Result

```go
type Result struct {
	Passed bool
	Reason string
}
```

Result is the structured verification verdict.

- `Passed: bool`: 
- `Reason: string`: 

## SignatureVerifier

```go
type SignatureVerifier interface {
	Verify(receipt.Envelope, trust.TrustedKeys) error
}
```

SignatureVerifier verifies detached receipt signatures.

- `Verify: func(receipt.Envelope, trust.TrustedKeys) error`: 

## Snapshot

```go
type Snapshot struct {
	TreeSHA     string
	BaseCommit  string
	FileDigests map[string]string
	Ignored     []string
}
```

Snapshot is the recomputed tree state.

- `TreeSHA: string`: 
- `BaseCommit: string`: 
- `FileDigests: map[string]string`: 
- `Ignored: []string`: 

## SnapshotInput

```go
type SnapshotInput struct {
	Scope        []string
	SnapshotMode string
	BaseRef      string
	TargetRef    string
}
```

SnapshotInput scopes verification fingerprinting.

- `Scope: []string`: 
- `SnapshotMode: string`: 
- `BaseRef: string`: 
- `TargetRef: string`: 

## Snapshotter

```go
type Snapshotter interface {
	Snapshot(context.Context, SnapshotInput) (Snapshot, error)
}
```

Snapshotter recomputes the checked-out tree fingerprint.

- `Snapshot: func(context.Context, SnapshotInput) (Snapshot, error)`: