Verify the immutable captured request under an explicit policy and label.
:policy accepts a valid RequestSeal.Policy, a zero-arity function, or an
exported {module, function, args}. Functions and MFAs return a policy directly
and run once per eligible request, after capture and parser checks, before
key resolution. Their returned policy is validated; invalid policies reject
with :invalid_options. Exceptions, throws, and exits reject with the bounded
:response_rejected error. No callback diagnostics are retained. Resolution
runs synchronously; callers own deadlines for external work.
Requires :policy, :label, and :on_reject (:continue or
{:halt, status} with final status in 200..599). Optional :assign is an atom
or nil; only success is assigned. Private state retains {:ok, verification}
or {:error, adapter_error}. No authenticated identity is implicitly authorized.
Missing capture returns :not_captured; a prior attempt returns
:already_verified before any resolver or replay callback. Core rejections
are :request_rejected with a bounded RequestSeal.Error source.
Replacing the captured replay adapter, a partially drained replay, or a
handed-out digest inconsistent with the full captured body rejects with
:parser_order before resolver or replay callbacks. The RequestSeal reader's
invocation is tracked separately from adapter reads. Pass-through parsers
that leave the body unread do not impose a replay requirement, even when
they fetch empty body params. Wrapper transformations after a read remain
caller-controlled and cannot be observed by this check. Unexpected exceptions
return a bounded :response_rejected adapter error without source details.
Required or selected covered @request-target, @target-uri, and @query
reject with :unsupported_component before resolver, freshness, or replay
callbacks: the captured Plug values do not establish exact target evidence.