CN-PROD-02
CN derived enforcedProducer slot loop never signs a block whose KES period has rotated past current_period. Slot → KES period is a pure function of (slot, genesis_kes_anchor, slots_per_kes_period); the coordinator fail-closes (slot_missed event + log) when wall-clock has advanced past the target slot before forge completes. No retroactive forge. The GREEN coordinator never owns or stores private signing material — it emits a closed RequestForge { slot, kes_period, ledger_snapshot_ref, chain_tip } effect; the RED producer shell either returns an AcceptedBlock via a ForgeSucceeded event or a structured ForgeFailed { slot, structured_error } event. KesSecret / VrfSigningKey / ColdSigningKey never enter CoordinatorState. T-tier key-custody boundary.
- Source
docs/planning/phase4-n-q-invariants.md §1 (I3, I4, I7, I8); §2 (N4, N5, N8, N9); §5
- Cluster
- PHASE4-N-Q
- Introduced in
- PHASE4-N-Q
Enforcement trace
Code
Tests 16
- init_emits_started_event_and_zero_other_effects
- slot_tick_emits_request_forge_and_log
- forge_succeeded_emits_broadcast_and_log
- forge_not_leader_emits_log_and_clears_pending
- forge_failed_emits_slot_missed_with_mapped_reason
- stale_forge_result_after_new_tick_drops_with_slot_missed
- kes_period_out_of_range_errors
- shell_init_rejects_malformed_opcert_hot_vkey_length
- shell_init_rejects_kes_period_below_opcert_start
- shell_kes_sign_at_current_period_succeeds_and_verifies
- shell_kes_sign_at_wrong_period_errors
- shell_kes_advance_to_evolves_key_one_way
- shell_debug_redacts_secret_fields
- zero_stake_answer_emits_forge_not_leader
- kes_period_outside_window_emits_forge_failed_kes_period_mismatch
- full_stake_answer_reaches_self_accept_and_rejects