Optional ash_hooks inbound RFC 9421 verification bridge (Elixir 1.20).

A consumer's AshHooks.Provider.verify_signature/3 delegates to verify_signature/4 with an explicit policy and label. :policy is a RequestSeal.Policy or an arity-two function resolving a policy from the provider context's tenant and nonempty binary secret/key reference. RequestSeal never interprets that reference as key material or authorizes an application action.

The provider context must supply method, absolute request URI, and a headers map. This map has already lost duplicate lines and ordering; the helper cannot recover them and returns only the provider's :ok/error contract. Prefer RequestSeal.Plug.Capture and RequestSeal.Plug.Verify before ash_hooks ingress to retain ordered headers, exact body bytes, and facts. The RequestSeal reader replays unchanged bytes to AshHooks.BodyReader. Provider errors never expose key references, body bytes, or callback errors.