CN-FORGE-01

CN derived enforced

The producer-mode forge handler is a closed transition from CoordinatorEvent::RequestForge { slot, kes_period, ledger_snapshot_ref, chain_tip } to exactly one of three ForgeResult variants: ForgeSucceeded { slot, artifact } where artifact.bytes decodes via Ade's BLUE block decoder AND self_accept(artifact, chain_tip, ledger_snapshot) returns Accepted; ForgeNotLeader { slot, vrf_output_fingerprint }; or ForgeFailed { slot, structured_error }. No other outcome is permitted. ForgeSucceeded MUST NOT be emitted if self_accept rejects the artifact — the handler emits ForgeFailed { SelfAcceptRejected } instead. Empty-block forging is the explicit scope; mempool integration is out of scope for the rule's enforcement evidence.

Source: docs/planning/phase4-n-r-invariants.md §1 (I1, I9); §2 (N1); §5 (state transitions)
Cluster: PHASE4-N-R-A
Introduced in: PHASE4-N-R-A

Enforcement trace

Code

Tests 8

zero_stake_answer_emits_forge_not_leader
kes_period_outside_window_emits_forge_failed_kes_period_mismatch
full_stake_answer_reaches_self_accept_and_rejects
run_real_forge_is_byte_identical_across_two_runs
forge_block_accepts_empty_mempool
forge_block_empty_mempool_produces_empty_body
produce_mode_starts_runs_three_slots_and_exits_via_max_slots
forge_to_self_accept_succeeds

CI 2

Cross-references

Strengthened in

Attack rationale

Cardano-specific: forging a block that fails self-accept and broadcasting it would propagate an invalid block to peers, breaking the chain. Forging without a self-accept gate is a forged-by-error attack vector.

Evidence notes

N-R-A's A4 integration tests cover 3 of the 4 ForgeResult branches (NotLeader, KesPeriodMismatch, SelfAcceptRejected). The 4th (ForgeSucceeded) is structurally guaranteed by the closed pipeline (the only path to Succeeded is past the self_accept = Accepted gate at step 6); asserting end-to-end ForgeSucceeded requires the KES-signs-real-unsigned-header bridge — a future-cluster deliverable explicitly out of N-R-A scope. The replay-byte-identity test (run_real_forge_is_byte_identical_across_two_runs) anchors DC-FORGE-01 against the full pipeline. PHASE4-N-W discharged the open obligation: with the KES-signs-real-unsigned-header bridge (N-S-A) and the producer Praos VRF migration (N-W) both landed, forge_to_self_accept_succeeds asserts end-to-end ForgeSucceeded — the producer forges a Conway block its own validator accepts via verify_praos_vrf.