Invariants / DC-ANCHOR-01

DC-ANCHOR-01

DC derived enforced

BootstrapAnchor canonical CBOR round-trip: encode + decode preserves all 6 fields byte-identically. SCHEMA_VERSION = 1 in the encoded bytes; unknown version on decode is fail-fast.

Source

docs/planning/phase4-n-m-ledger-seed-invariants.md §7 (#5)

Enforcement trace

Tests 7

  • crates/ade_ledger/src/bootstrap_anchor/anchor.rs::tests::bootstrap_anchor_round_trips_via_canonical_cbor
  • crates/ade_ledger/src/bootstrap_anchor/anchor.rs::tests::bootstrap_anchor_encode_two_runs_byte_identical
  • crates/ade_ledger/src/bootstrap_anchor/anchor.rs::tests::bootstrap_anchor_decode_rejects_unknown_version
  • crates/ade_ledger/src/bootstrap_anchor/anchor.rs::tests::bootstrap_anchor_decode_rejects_trailing_bytes
  • crates/ade_ledger/src/bootstrap_anchor/anchor.rs::tests::bootstrap_anchor_decode_rejects_short_buffer
  • crates/ade_ledger/src/bootstrap_anchor/anchor.rs::tests::bootstrap_anchor_decode_rejects_wrong_outer_array_length
  • crates/ade_ledger/src/bootstrap_anchor/anchor.rs::tests::bootstrap_anchor_decode_rejects_short_hash

Cross-references

Strengthened in

Evidence notes

PHASE4-N-M-A S2 (2026-05-26): canonical CBOR with SCHEMA_VERSION=1; encode/decode is the SOLE pub pair; fail-fast on unknown version, wrong array length, short hash, trailing bytes. PHASE4-N-F-A (2026-05-30): the same version-gated byte-canonical sole-codec discipline is mirrored by the anchor-bound SeedEpochConsensusInputs sidecar codec (CN-CINPUT-01).