AdeAtlas
Invariants / DC-EVIEW-11

DC-EVIEW-11

DC derived enforced

The deterministic, fail-closed epoch-rebind seam (S3f-3), strengthening DC-EPOCH-03. DC-EPOCH-03 fails the forge closed past the seed-epoch boundary (the recovered eta0 is the seed-epoch nonce, stale past it). This seam adds the ONLY sanctioned crossing: the recovered seed-epoch view stays authoritative until, AT the deterministic epoch transition (a candidate slot in the IMMEDIATE next epoch, seed_epoch+1), a fully-bound MATCHING N+1 EpochConsensusView atomically promotes. decide_epoch_rebind (PURE / deterministic) returns KeepCurrent within the seed epoch; Promote(view) only when the slot is the immediate next epoch AND the supplied bindings ARE that epoch's context AND the view matches them (all 7 bindings + verify_canonical_hash, via EpochConsensusView::matches); else FailClosed{Unlocatable|NotImmediateNext|NoBoundView|ViewMismatch}. The live seam in the node-forge wall passes None for the bound view (S3f-4 supplies it), so OffEpoch fails closed EXACTLY as the pre-seam wall -- NO leader-election behaviour change, no early/silent activation, no fallback. It never promotes a wrong-network/era/epoch/point/commitment/nonce/phase or tampered (hash-invalid) view.

Source

docs/clusters/EPOCH-CONSENSUS-VIEW/SLICE-3f-activation.md (S3f-3); user directive 2026-06-21 (narrow fail-closed rebind safety slice)

Introduced in
EPOCH-CONSENSUS-VIEW-S3f-3

Enforcement trace

Code

Tests 9

  • simulated_transition_promotes_bound_n1_view
  • same_epoch_keeps_current
  • off_epoch_without_bound_view_fails_closed
  • not_immediate_next_fails_closed
  • unlocatable_fails_closed
  • rejects_each_wrong_binding
  • rejects_tampered_view_wrong_hash
  • replay_equivalent_deterministic
  • crash_restart_redrives_same_decision_both_sides

CI 1

Cross-references

DC-EPOCH-03DC-EVIEW-07DC-EVIEW-08DC-EVIEW-10

Attack rationale

The seam must NEVER (a) promote outside the immediate next epoch -- the reducer pins e == seed_epoch+1 (NotImmediateNext else); (b) promote a view that is not the N+1 context -- requires bindings.epoch == e AND view.matches (all bindings + verify_canonical_hash), so wrong-network/era/epoch/point/commitment/nonce/phase or a tampered hash-invalid view all FailClosed(ViewMismatch); (c) promote without a bound view -- None -> FailClosed(NoBoundView), the current live default, byte-identical to the pre-seam wall; (d) change live behaviour before S3f-4 -- the wall passes None and the Promote arm is an empty no-op (CI-pinned). The reducer is PURE (no I/O/clock/rand/float), so the decision is replay-equivalent and re-derivable across crash/restart from the durable inputs -- no hidden seam state. The current view stays authoritative until an atomic promotion; an unprovable view is INERT.

Evidence notes

Introduced at EPOCH-CONSENSUS-VIEW S3f-3 (2026-06-21). A narrow live-path SAFETY slice: the rebind seam exists + is hermetically proven, but is INERT live (the wall passes None). 9 proofs in epoch_rebind.rs + ci_check_eview_epoch_rebind.sh; cargo test -p ade_node --lib (333) green, and the pre-existing forge-admission tests (node_forge_off_epoch_slot_fails_closed, forge_epoch_admission_*) stay green -- byte-identical behaviour confirmed. The boundary event is needed only to prove the FINAL flip (S3f-4), not to build/prove the seam. Strengthens DC-EPOCH-03 (the OffEpoch wall now routes through the rebind reducer, still fail-closed). Next: S3f-4 (the small final wiring/activation slice) + the live boundary proofs.