Function compute_verifies

atomic-cli/src/commands/intent/list.rs:177–196

The DID-match-then-verify rule for an intent. Pure over its inputs so it can be unit-tested without a global `IdentityStore`. - `attested` None ⇒ `Na`. - `attested` Stale ⇒ `Na` (staleness is surfaced by the attested column; there is nothing fresh to cryptographically verify — do NOT feed a Stale node to `verify`, which would report `✗` on a changed-but-validly-signed node). - `attested` Fresh: -

(attested: &bridge::Attestation, verifier: Option<&Verifier>)

///       would be a false negative);
///     - same signer ⇒ run `verify`: `Ok` ⇒ `Yes`, `Err` ⇒ `No`.
fn compute_verifies(attested: &bridge::Attestation, verifier: Option<&Verifier>) -> Verifies {
    let node = match attested {
        bridge::Attestation::Fresh(node) => node,
        bridge::Attestation::Stale(_) | bridge::Attestation::None => return Verifies::Na,
    };
    let verifier = match verifier {
        Some(v) => v,
        None => return Verifies::Na,
    };
    // DID pre-check FIRST: a different (or absent) signer is `–`, not `✗`.
    match node.attributed_to.as_deref() {
        Some(signer) if signer == verifier.did => {}
        _ => return Verifies::Na,
    }
    // Same signer ⇒ the only path that can yield `✗` is a real hash/sig failure.
    match atomic_canonical::verify(node, &verifier.public_key) {
        Ok(()) => Verifies::Yes,
        Err(_) => Verifies::No,
    }
}

/// Classify a loaded attestation into the `attested` column token.
fn classify(attested: &bridge::Attestation) -> Attested {