CN-CINPUT-02
CN constraint enforcedThe SeedEpochConsensusInputs sidecar MUST be populated ONLY through the single shared ade_runtime::seed_epoch_lineage::persist_seed_epoch_consensus_inputs authority — the anchor-fp-keyed SnapshotStore surface (put_seed_epoch_consensus_inputs), built via the GREEN merge (merge_seed_epoch_consensus_inputs) and the A1 sole encoder, with the A3a WAL provenance append — called ONLY by the verified-bootstrap composition sites (genesis_bootstrap / mithril_bootstrap / the operator admission pre-seed ade_node::admission::bootstrap). PHASE4-N-F-G-I extracted the populator into this single authority (was inline-per-composer) and added the admission pre-seed caller, so a --mode node WarmStart recovers a forge-capable store seeded purely from the shared --json-seed + import_live_consensus_inputs path. The forge-time consensus-inputs path (produce_mode / import_live_consensus_inputs / pool_distr_view_from_consensus_inputs / --consensus-inputs-path) MUST NOT build or put the sidecar, nor append its WAL provenance. Enforced by a data-flow-resistant containment gate (global call-site scan, not a bypassable RHS grep). This does NOT forbid diagnostic import of LiveConsensusInputsCanonical (fixtures / pinning tests / first-run verified-bootstrap extraction may still exist); it forbids that import from populating, proving, or substituting for the recovered sidecar on any bounty-primary path. NOTE: this rule constrains POPULATION + the forge-time fence only; it does NOT assert that the producer CONSUMES the recovered surface — producer consumption is deferred to PHASE4-N-F-C and no registry rule is introduced for it in this close.
- Source
docs/clusters/PHASE4-N-F-A/cluster.md; A2-bootstrap-population-containment.md; A3a-wal-provenance-entry.md
- Cluster
- PHASE4-N-F-A
- Introduced in
- PHASE4-N-F-A
Enforcement trace
Code
- crates/ade_runtime/src/seed_epoch_lineage.rs
- crates/ade_runtime/src/genesis_bootstrap.rs
- crates/ade_runtime/src/mithril_bootstrap.rs
- crates/ade_node/src/admission/bootstrap.rs
- crates/ade_runtime/src/seed_consensus_merge.rs
- crates/ade_runtime/src/seed_consensus_provenance.rs
- ci/ci_check_consensus_input_provenance.sh
Tests 4
- bootstrap_persists_anchor_keyed_seed_consensus_inputs
- bootstrap_seed_inputs_merge_fails_closed_on_missing_vrf_or_stake
- snapshot_store_keyed_sidecar_is_disjoint_from_slot_snapshots
- persist_writes_anchor_keyed_sidecar_and_recoverable_wal_provenance
Cross-references
Strengthened in
Attack rationale
If the forge-time operator bundle could populate (or be read as) the recovered sidecar, the 'recovered Ade state' guarantee would collapse into a relabeled operator input — the laundering class the cluster exists to prevent. The containment gate blocks the populate-side mechanically; the consume-side fence landed in PHASE4-N-F-C (CN-CINPUT-03).