A validation refusal and the trust decision it requires. The diagnostic is
attached where the refusal originates, so adding a reason cannot leave a
downstream classifier incomplete.
The engine names itself with this domain over its own bytes, and the
bootstrap recomputes the same value over the binary it validated. One
definition, so the two can never drift apart and silently stop matching.
The trusted bootstrap’s validation, in the contract’s order: choose from
the closed platform table, resolve the reported commit to its reported
tree, resolve the metadata, manifest, artifact, every lockfile, and every
runtime path as regular non-symlink blobs in that tree, require the parsed
manifest to carry the constrained digest, require every recorded lockfile
to recompute from the tree’s bytes, verify every mode and checksum, verify the
selected binary’s plain SHA-256 and domain-separated engine digest, and
require the executable’s own header to name the same platform. Nothing is
downloaded, installed, discovered, or resolved through PATH.