Given a script address, is it possible to decode the Haskell/Plutus code of said script? How can you verify a script does what someone says it will do?
On if it's possible to decode the Plutus code of a given contract, there's a possible duplicate of this question here: Can blockchain viewers read the source code of a smart contract if they know its address?.
In case that you want to verify that a compiled code sitting in the blockchain is what their creators claim to be (given that it comes from an open-source project), and you know the Plutus version they used and any other parameters needed, you could recompile the code and compare the resulting script hash with the hash on the blockchain, thus verifying the code is the same.
I'm afraid straight reading of source code from the blockchain right now is not possible. We can expect more tools and possibilities on reading contract's source code in the future since we are still in the "early days" of Cardano's smart contracts.