Invariants / DC-LEDGER-09

DC-LEDGER-09

DC derived enforced

Conway governance-certificate accumulation is a closed, total, era-versioned transition into ConwayGovState: every governance-affecting Conway cert that B4 owner-tagged to ConwayGovState (vote-delegation tags 9/10/12/13 -> vote_delegations; committee tags 14/15 -> committee_hot_keys; DRep tags 16/17/18 -> drep_expiry) resolves to exactly one explicit ConwayGovState mutation or a structured reject -- never observed-and-dropped, never flattened, never with payload fields lost. B5 mutates only governance-owned fields; it does not touch B4-owned CertState and does not double-apply the delegation/pool half of composite certs (10/12/13). DRep expiry is computed only from an explicit gov-env (current epoch + drepActivity); a missing required env input is a structured fail-fast, never a defaulted expiry. A cert that cannot be applied propagates a structured LedgerError and halts the block transition; incomplete or best-effort accumulation is a forbidden fail-open. ConwayGovState becomes a deterministic function of (boundary-loaded base then replayed block-stream cert effects) rather than a frozen snapshot -- a deliberate, oracle-confirmable fingerprint migration (T-DET-01).

Source: Cardano ledger spec (Conway CDDL gov cert tags 9..18; CONWAY CERTS/GOVCERT/COMMITTEE transitions; CIP-1694); IDD fail-fast + closed-surface doctrine
Cluster: CL-LEDGER-VERDICT
Authority surface: BLUE Conway governance-state accumulation

Enforcement trace

Code

Tests 17

gov_apply_total_over_18_tags
composite_gov_half_applied_once_certstate_untouched_by_b5
drep_expiry_uses_epoch_plus_activity
env_free_gov_certs_need_no_env
drep_register_missing_env_is_fail_fast
drep_expiry_overflow_is_fail_closed
gov_apply_is_deterministic
gov_cert_env_present_ok
gov_cert_env_missing_drep_activity_is_fail_fast
gov_accumulation_applies_drep_registration_into_gov_state
gov_apply_error_halts_accumulation
positive_synthetic_gov_state_accumulates
gov_state_accumulation_replays_byte_identical
adversarial_drep_register_update_missing_env_rejected
adversarial_drep_expiry_overflow_rejected
adversarial_decode_layer_rejects_guard_gov_path
adversarial_double_resign_is_deterministic

CI 1

ci_check_gov_cert_accumulation_closed.sh

Cross-references

Open obligation

Real epoch-576 governance-state (VState)-vs-cardano-node oracle is environment-blocked (epoch-576 UMap/ledger snapshot absent; see corpus/gov_state/README.md, corpus/cert_state/README.md, corpus/validity/conway_epoch576/README.md). Reclassified environment-blocked per tier doctrine — same constraint as DC-LEDGER-08/DC-TXV-06/DC-TXV-03. Mechanical closure shipped: native total gov dispatch + env fail-fast + checked DRep-expiry arithmetic (DRepActivityOverflow) + block-path accumulation (gov_state carried forward, observe-and-drop removed) + synthetic positive/replay/adversarial corpus. The GOVCERT committee-membership tx-validity gate is a declared separable follow-up (OQ-3), not part of this accumulation closure. KNOWN LIMITATION newly promoted to authority by B5 (OQ-5, pre-existing decoder behavior, NOT introduced here): ConwayGovState keys gov state on bare Hash28; the codec collapses the key/script credential discriminant (ade_codec decode_stake_credential drops the type tag), so a key-hash and script-hash credential sharing 28 bytes are indistinguishable in vote_delegations/committee_hot_keys/drep_expiry. cardano-node keys on the full discriminated Credential. 28-byte collision is not cheaply forgeable; carrying the discriminant into StakeCredential/DRep is a separate cross-cutting follow-up (touches the whole credential surface), tracked here per the per-cluster security review.