CN-PROD-01

CN derived enforced

Producer-mode listener completes the N2N handshake (CN-SESS-02) on every accepted inbound connection before any mini-protocol traffic is exchanged. Pre-handshake socket bytes never reach the n2n_server reducers; handshake failure fail-closes the connection. Bytes from a peer that has not completed handshake are dropped at the boundary.

Source: docs/planning/phase4-n-q-invariants.md §1 (I1, I6); §2 (N1, N15)
Cluster: PHASE4-N-Q
Introduced in: PHASE4-N-Q

Enforcement trace

Code

Tests 1

n2n_listener_loopback_handshake_succeeds

CI 1

ci_check_n2n_server_no_signing_dep.sh

Cross-references

Strengthened in

Open obligation

PHASE4-N-R-B B3 closed the in-process dispatch arm (no more _ => {} absorption). PHASE4-N-S-B B4 closed the transmit-back-to-peer wire: OutboundCommand closed enum + PerPeerOutbound Arc<RwLock<BTreeMap<PeerId, Sender>>> map + MuxPump::outbound_relay tokio::select! arm + dispatch_server_frame_event_to_outbound (uses BLUE reducers + typed ServerReply, NOT pre-encoded Vec). The full produce_mode dispatch → MuxPump session-aware encoder → TCP socket path is mechanically backed. CI gate ci/ci_check_no_produce_mode_direct_transport_writes.sh forbids byte-tunneling. UPDATE 2026-05-29: produce_mode now WIRES peer_outbound: Some(..) at listener startup (crates/ade_node/src/produce_mode.rs) — the prior 'operator wiring is the C-deliverable' remainder is CLOSED. The full produce_mode dispatch → MuxPump session-aware encoder → TCP socket path is mechanically backed and wired end-to-end; the remaining live-half work is operator-pass execution, tracked in CN-CONS-06 / RO-LIVE-01.