Governance Receipt Verdict (security/governance_receipt_verdict.py)

Projects run-receipt verification into a verdict document that distinguishes integrity-only trust-on-first-use passes from operator-pinned key verification. Reuse when exposing receipt verification results without reducing them to a boolean.

# Source: https://github.com/sipyourdrink-ltd/bernstein | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
# Provided via justclaw.it.com; keep this notice with the code.
"""What a dropped receipt actually proves, said in the verdict itself (#5067).

:func:`~bernstein.core.replay.run_receipt.verify_run_receipt` already draws the
distinction that matters here: a pass against the key *embedded in the receipt*
is trust-on-first-use and proves the file is internally consistent, while a
pass against a key the operator pinned out of band additionally proves who
produced it. The CLI says which tier it reached; nothing projected that
distinction into a document, so any second surface wrapping the verifier would
have had a boolean to render and would have 

... (truncated -- full source via MCP)