verify_signature: propagate verify_commitment's precise reason field

Knock-on of the malformed-input label cleanup: ``verify_signature`` was
hardcoding ``reason="unsupported_spec_version"`` whenever ``spec_status``
came back as ``"unsupported"``, which now overwrites the more specific
``"envelope_not_a_json_object"`` diagnostic that ``verify_commitment``
emits for non-dict input. The fix is a one-line change — fall back to
the generic reason only when ``verify_commitment`` didn't supply one.

Regression test pins ``verify_signature(None, engine)["reason"]``.

Suite: 230 passed, 21 skipped.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: vilenarios

ario_mlflow/verify.py

@@ -479,7 +479,11 @@ def verify_signature(envelope: dict, proof_engine: ProofEngine) -> dict:
         "legacy_envelope": legacy,
     }
     if spec_status == "unsupported":
-        out["reason"] = "unsupported_spec_version"
+        # Propagate the more precise diagnostic from verify_commitment when
+        # available (e.g. ``envelope_not_a_json_object`` for malformed input);
+        # fall back to the generic ``unsupported_spec_version`` when the
+        # envelope had a real-but-unknown spec major.
+        out["reason"] = result.get("reason", "unsupported_spec_version")
     return out
 
 

tests/test_plugin_smoke.py

@@ -442,6 +442,23 @@ def test_verify_signature_wrapper_surfaces_spec_version_state(tmp_path):
     assert out["reason"] == "unsupported_spec_version"
 
 
+def test_verify_signature_surfaces_specific_reason_for_non_dict_input(tmp_path):
+    """``verify_signature`` should pass the precise diagnostic from
+    ``verify_commitment`` through (``envelope_not_a_json_object`` for
+    malformed input) rather than always overwriting with the generic
+    ``unsupported_spec_version``. ``ok=False`` is the safety guarantee;
+    the precise ``reason`` is for diagnostics."""
+    from ario_mlflow.verify import verify_signature
+
+    engine = ProofEngine(str(tmp_path / "priv"), str(tmp_path / "pub"))
+    out = verify_signature(None, engine)
+    assert out["ok"] is False
+    assert out["signature_valid"] is False
+    assert out["spec_version_status"] == "unsupported"
+    assert out["legacy_envelope"] is False
+    assert out["reason"] == "envelope_not_a_json_object"
+
+
 def test_verify_commitment_rejects_underscore_injection_on_agent_envelope(tmp_path):
     """Profile-conditional ``_*`` strip: only mlflow envelopes are lenient.