Function validate 

pub fn validate(
    action: &Repository,
    resources: &mut GitResources,
    constraint: &ExecutionConstraintDescriptor,
    bootstrap_bytes: &[u8],
) -> Result<Validated, Refusal>

The trusted bootstrap’s validation, in the contract’s order: choose from the closed platform table, resolve the reported commit to its reported tree, resolve the metadata, manifest, artifact, every lockfile, and every runtime path as regular non-symlink blobs in that tree, require the parsed manifest to carry the constrained digest, require every recorded lockfile to recompute from the tree’s bytes, verify every mode and checksum, verify the selected binary’s plain SHA-256 and domain-separated engine digest, and require the executable’s own header to name the same platform. Nothing is downloaded, installed, discovered, or resolved through PATH.

Errors

The first refusal above. A refusal always precedes execution.