Function run_node_local

node/src/args.rs:431–448

(
    context: tokio::Context,
    flags: RunFlags,
    checkpoint: Option<ConsensusState>,
    checkpoint_parent_block: Option<Block>,
)

    NoCheckpoint,
    /// A checkpoint and a finalized-headers chain are present; verify the
    /// checkpoint against the chain before installing it.
    Verify,
    /// A checkpoint was supplied without a finalized-headers chain and the
    /// operator opted into importing it unverified.
    SkipUnsafe,
    /// A checkpoint was supplied without a finalized-headers chain and
    /// verification was not waived; refuse to start.
    RefuseUnverified,
}

/// Decide how to treat checkpoint artifacts at startup.
///
/// Requiring a finalized-headers chain by default is what closes the
/// unauthenticated-import hole (#214): once the chain is present, the
/// signature-verified terminal header authenticates every byte of the checkpoint
/// through the checkpoint-hash binding, so the decoded consensus state cannot be
/// tampered with. A bare checkpoint with no chain is refused unless the operator
/// explicitly waives verification.
pub(crate) fn classify_checkpoint_startup(
    has_checkpoint: bool,
    has_headers_chain: bool,