AdeAtlas
Invariants / DC-EVIDENCE-05

DC-EVIDENCE-05

DC derived enforced

Replayable post-switch branch-continuity verdict (PHASE4-N-AO S10). After a ForkChoiceWin adoption at tip X, a GREEN pure reducer derive_post_switch_continuity(events) -> PostSwitchContinuity classifies Ade's OWN validated admitted-block lineage into a closed verdict { ContinuesSelectedBranch | Diverged | BrokenLineage | DanglingForkChoiceWin | InsufficientEvidence } -- no free-form strings. ContinuesSelectedBranch REQUIRES: unbroken prev_hash lineage from X across every post-X block_admitted (admitted[i].prev_hash == admitted[i-1].hash; the first post-switch follow block chains to X.hash), no diverged after X, and every fork_choice_selected{win} paired to a terminal (applied|failed|superseded). prev_hash is the admitted block's VALIDATED header field (decoded.prev_hash -- the same canonical parent link S7's walk consumes via get_block_by_hash), NEVER peer-supplied; the peer's tip is NEVER an input to the verdict. REPLAY-EQUIVALENT: given the same post-switch admitted-block bytes and the same applied fork-switch point, the reducer yields a byte-identical PostSwitchContinuity. The reducer is the SINGLE implementation behind both the hermetic replay test and the live CE-AO-6 gate (ci/ci_check_post_switch_convergence_window.sh invokes the post_switch_continuity bin) -- no Rust/Python drift. GREEN, observe-only: PostSwitchContinuity is NEVER consumed by select_best_chain / walk_to_durable_lca / apply_fork_switch / pump_block / the forge fence; the node does not use it to select chains -- CI and /cluster-close use it to enforce the release gate.

Source

docs/clusters/PHASE4-N-AO/S10-post-switch-branch-continuity.md (S10) + docs/planning/phase4-n-ao-ce-ao-6-live-gap.md

Introduced in
PHASE4-N-AO

Enforcement trace

Code

Tests 11

  • crates/ade_node/src/post_switch_continuity.rs::tests::continuity_ok_yields_continues_selected_branch
  • crates/ade_node/src/post_switch_continuity.rs::tests::broken_parent_link_yields_broken_lineage
  • crates/ade_node/src/post_switch_continuity.rs::tests::post_switch_diverged_yields_diverged
  • crates/ade_node/src/post_switch_continuity.rs::tests::win_without_terminal_yields_dangling
  • crates/ade_node/src/post_switch_continuity.rs::tests::continuity_verdict_ignores_peer_tip
  • crates/ade_node/src/post_switch_continuity.rs::tests::post_switch_continuity_replays_byte_identical
  • crates/ade_node/src/post_switch_continuity.rs::tests::release_window_passes_on_validated_prefix
  • crates/ade_node/src/post_switch_continuity.rs::tests::release_window_passes_on_agreed_descendant
  • crates/ade_node/src/post_switch_continuity.rs::tests::release_window_prefix_requires_a_followed_descendant
  • crates/ade_node/src/post_switch_continuity.rs::tests::release_window_terminal_outside_window_fails
  • crates/ade_node/tests/live_fork_choice_ai_s4bii.rs (new_tip_prev == decoded.prev_hash fidelity assertion)

CI 1

Cross-references

DC-EVIDENCE-04DC-EVIDENCE-01DC-NODE-30DC-NODE-34DC-NODE-36DC-NODE-38CN-CONS-03CN-CONS-01

Attack rationale

Exact-tip agreement (DC-EVIDENCE-04's original terminal) is a test-harness artifact: a clean healthy follow run emits ONLY lagging because the live producer never pauses for the follower to touch its exact tip, so a CE-AO-6 flip predicated on exact agreement either never fires (false-negative on a correct node) or is gamed by freezing the venue. Worse, the original terminal checked NOTHING about the chain between X and the agreed event -- a node that switched to X then silently rolled back below X or jumped to a different branch could still surface an agreed somewhere and pass. The branch-continuity verdict closes both gaps: it forces every post-X admitted block to chain from X via its OWN validated prev_hash (a rollback-below-X or branch-jump surfaces as BrokenLineage/Diverged), and it accepts the honest catching-up terminal (validated prefix + peer ahead) without a lucky moment. Keeping the verdict's inputs to Ade's own admitted lineage (peer tip excluded) prevents a dishonest peer from manufacturing a passing transcript; replay-equivalence + a single shared implementation prevent the gate and the audited invariant from drifting; observe-only containment keeps the evidence from ever becoming authority.

Evidence notes

Declared at PHASE4-N-AO S10. Motivated by the 2026-06-13 scout run: a clean two-producer follow run (no switch) emitted ONLY lagging verdicts (peer perpetually 30-80 slots ahead), zero agreed, zero diverged -- a perfectly healthy follower the exact-tip gate would reject. To be flipped at S10 close via ci/ci_check_post_switch_convergence_window.sh (invoking the reducer bin) + hermetic tests (continuity-OK->ContinuesSelectedBranch, broken-parent->BrokenLineage, post-X diverged->Diverged, win-without-terminal->DanglingForkChoiceWin, ignores-peer-tip, and post_switch_continuity_replays_byte_identical). The CE-AO-6 live flip of CN-CONS-03 is the refined DC-EVIDENCE-04 gate, whose terminal is derived from this verdict.