Recompute checkpoint selection before trusting its receipt

A checkpoint-selection receipt should not be trusted merely because its selected path and hashes are internally consistent. The consumer must independently recompute the declared metric ordering and deterministic tie-break across every candidate, then require the selected artifact hashes to be a subset of the complete training artifact receipt and the path to remain inside the artifact root. This prevents a validly hashed but non-winning or path-swapped checkpoint from reaching evaluation. The approach assumes candidate metrics themselves are already bound to the training result.

Applies when: a training job chooses one candidate checkpoint for sealed evaluation or deployment. Keywords: checkpoint selection receipt winner artifact hash path traversal metrics