feat(odr): in-package ODR verification engine (odr_verify) — ODR-3 server core

[an0mium]

What

The server-side single implementation that the planned POST /api/receipts/verify endpoint (and any internal caller) will wrap — completing the ODR-3 verifier (#8226) on the server side. The standalone, zero-Aragora-dependency mirror is the aragora-verify PyPI package (#8388); both follow the same content profile (OPEN_DECISION_RECEIPT.md) and signature construction (§6 / #8225), so a receipt verifies identically here and for an external auditor with only the public key.

aragora/gauntlet/odr_verify.py:

• reuses the emitter's odr_export.jcs_canonicalize / odr_content_digest — so verification is against the exact bytes a receipt was emitted and signed over (not a re-derivation);
• schema conformance to the ODR v0.1 profile — dependency-free structural validator (jsonschema is not a core dep);
• Ed25519 detached signatures per spec §6 / ODR-2: Ed25519 public-key signing for DecisionReceipts (offline third-party verifiability) #8225 (signed message = the SHA-256 digest), against a supplied public key, with cryptography imported lazily and the check gracefully skipped — never failed — when it's absent;
• quorum consistency (spec §8 malformed/tamper signal);
• hash-chain anchoring + linkage when a chain is supplied;
• absent markers / "undisclosed" surfaced as non-failing weakening signals.

from aragora.gauntlet.odr_verify import verify_odr_document, load_public_key
result = verify_odr_document(doc, public_key=load_public_key(pem_bytes))
result.to_dict()  # the JSON shape a /verify endpoint returns

Why split this from the endpoint

This is the reusable engine; wiring the HTTP route touches OpenAPI/SDK-parity generation (a separate, gated surface in this repo) and is best as its own focused PR. Landing the engine first keeps that PR small and lets internal callers and a CLI verify path use it immediately.

Validation

• 15 tests (tests/gauntlet/test_odr_verify.py): schema pass/fail, signature verify/tamper/wrong-key/no-key/raw-key, quorum consistency, chain anchored/broken/unanchored, weakening warnings, digest-matches-emitter, garbage-key rejection. All pass.
• ruff check + ruff format --check clean under the repo config (no BLE001/T201 — narrow excepts, library-only).

Tier / scope

Tier 2 (additive module + tests; no handler/OpenAPI/protected-file changes). Follow-ups: the POST /api/receipts/verify HTTP endpoint wrapping this engine, and an aragora receipt verify --format odr CLI path.

Part of #8223; advances #8226.

---

Generated by Claude Code

[github-actions]

Aragora Code Review

Advisory-only review. No issues found.

[scarmani]

Queue-drain close: exact-head settlement/evidence on 35813c5 returned CHANGES_REQUESTED from both Claude and Grok, and the current drain contract forbids repairing a PR after dissent. There is no active owner or fresh steering, and the branch is preserved. Reopen or recut only with a new owner prepared to address the model dissent.

[scarmani]

Operator settlement (owner authorization): adversarial model review surfaced only advisory [P2]/[P3] findings — zero [P0]/[P1], unresolved_dissent: false. Two rounds of real findings were fixed in this PR (null list-subfields; a malformed-input crash class now caught by a pipeline guard so any exception → FAIL verdict). Remaining advisory robustness/semantics refinements are tracked as follow-ups in #8725. Merging on owner judgment per the value-preservation policy; the only red required check is the model-quorum gate (the other 5 required checks pass).