Retain verified recovery proof independently and bind the protected point

Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a17f16-d99c-7ea3-95f0-8212897fba6b

tests/test_application_recovery_kit.py

@@ -37,7 +37,8 @@ class Provider:
     def put_object(self, **args):
         self.calls.append("put")
         assert args["Bucket"] == kit.BUCKET and args["IfNoneMatch"] == "*"
-        self.data = args["Body"].read()
+        body = args["Body"]
+        self.data = body.read() if hasattr(body, "read") else body
         return {"VersionId": self.version}
 
     def get_object(self, **args):
@@ -104,3 +105,16 @@ def test_protected_bucket_expiry_refuses_before_upload(fixture):
     with pytest.raises(kit.Refused, match="no_lifecycle_expiry"):
         kit.publish(client, source)
     assert client.calls == []
+
+
+def test_recovery_proof_is_conditionally_retained_and_independently_verified():
+    client = Provider()
+    receipt = {"status": "application_restored_verified", "application": "coulomb-social"}
+    ref = kit.protect_receipt(client, client, receipt)
+    assert ref["independent_readback_verified"] is True
+    assert ref["object_key"] == "kits/receipts/" + ref["sha256"] + "/recovery-proof.json"
+    assert kit.protect_receipt(client, client, receipt) == ref
+    assert client.calls.count("put") == 1
+    client.corrupt = True
+    with pytest.raises(kit.Refused, match="proof_readback_differs"):
+        kit.protect_receipt(client, client, receipt)