DC-EVIEW-10

DC derived enforced

The window driver (S3f-2): advance the reduced UTxO checkpoint + the cert/delegation state forward over a window of ordered blocks, then aggregate per-pool stake. drive_window_aggregate sequences the PROVEN pieces in order -- per block: reduced_block_delta (== reduce(track_utxo), DC-EVIEW-04/04b) -> the checkpoint's apply_block_delta, and advance_cert_state (== process_block_certificates) threading cert_state + gov_state exactly as rules.rs does; then once: sum_base_credential_stake -> aggregate_pool_stake (DC-EVIEW-05) over the advanced delegation map. CRITICALLY it starts from the bootstrap LedgerState's cert state (the manifest-bound DC-EVIEW-09 import), NOT an empty map, so PRE-bootstrap delegators are counted -- the verified gap's fix made operative. Fail-closed (WindowDriverError::{Checkpoint|Ledger|Aggregate}): any step error aborts the window without producing a partial/wrong stake distribution. RED orchestration of individually-proven deterministic transforms; the per-step correctness is the proven pieces, the driver adds the in-order sequencing.

Source: docs/clusters/EPOCH-CONSENSUS-VIEW/SLICE-3f-activation.md (S3f-2); docs/clusters/EPOCH-CONSENSUS-VIEW/SLICE-3b-replay-window-materialization.md
Introduced in: EPOCH-CONSENSUS-VIEW-S3f-2

Enforcement trace

Code

Tests 2

empty_window_aggregates_bootstrap_state
real_conway_block_drive_equals_composed_pieces

CI 1

ci_check_eview_window_driver.sh

Cross-references

Strengthened in

Attack rationale

The driver must (a) start from the bootstrap cert state, NOT an empty map -- the gate pins bootstrap_state.clone() (an empty start would silently drop every pre-bootstrap delegator, the exact verified gap DC-EVIEW-09 fixed); (b) sequence the proven pieces faithfully -- the real-conway-block test asserts drive == (build_from + apply_block_delta(reduced_block_delta) + advance_cert_state + sum + aggregate) composed by hand, so the driver cannot silently reorder/skip a step; (c) thread cert_state AND gov_state exactly as rules.rs (ledger-faithful); (d) fail closed -- every checkpoint/ledger/aggregate error maps to a WindowDriverError, never a partial aggregate. The driver is RED orchestration but every transform it calls is deterministic + individually proven (no new nondeterminism).

Evidence notes

Introduced at EPOCH-CONSENSUS-VIEW S3f-2 (2026-06-21), unblocked by DC-EVIEW-09 (the bootstrap cert state is now populated, so the window starts from the real delegation map). 2 hermetic tests + ci_check_eview_window_driver.sh; cargo test -p ade_runtime --lib (421) green, no regression. The full-epoch correctness is the boundary-aligned live oracle (NOT pure coding -- needs a real Conway epoch boundary); the hermetic tests prove the orchestration sequences the (already byte-exact-vs-cardano, DC-EVIEW-05) pieces correctly. Next: S3f-3 (the ledger_view rebind seam) + S3f-4 (the live flip: the block-source wiring + feeding the bound view to leader election), gated on the two live proofs.