DC-CRYPTO-06
DC derived enforcedAde-native KES envelope is the sole accepted hot-signing-key envelope format. Closed grammar ade.kes.seed.v1: load-bearing fields {format, role, crypto, seed_32, period_idx, format_version} are validated with #[serde(deny_unknown_fields)]; optional metadata {genesis_hash, network_magic, created_at_slot, created_by} is ignored but does not break load. The loader returns closed AdeKesEnvelopeError variants for every unsupported shape (UnknownEnvelopeFormat, WrongKeyRole, UnsupportedCryptoTag, MissingSeed32, MalformedSeed32, MalformedPeriodIdx, PeriodIdxOutOfRange, UnsupportedFormatVersion, MalformedJson). No fallback parser. No heuristic guess. Private-key bytes never appear in any error/log surface.
- Source
docs/clusters/PHASE4-N-O/S1.md §1; docs/active/op-ops-04-ade-native-kes-flow.md (operator spec verbatim)
- Introduced in
- PHASE4-N-O
Enforcement trace
Tests 16
- parse_round_trips_serialize
- parse_round_trips_at_nonzero_period
- parse_rejects_unknown_format
- parse_rejects_wrong_role
- parse_rejects_unsupported_crypto
- parse_rejects_unsupported_format_version
- parse_rejects_missing_seed_32
- parse_rejects_malformed_seed_32_length
- parse_rejects_uppercase_seed_hex
- parse_rejects_period_idx_overflow
- parse_accepts_period_idx_boundary
- parse_rejects_unknown_load_bearing_field
- parse_accepts_optional_metadata_fields
- parse_rejects_malformed_json
- serialize_does_not_leak_extra_fields
- envelope_error_carries_no_seed_bytes