Invariants / DC-LEDGER-10

DC-LEDGER-10

DC derived enforced

Credential identity is faithful end-to-end: a stake/committee/DRep credential is a closed sum over {KeyHash, ScriptHash} of a 28-byte hash, never a tag-erased Hash28. Both era certificate decoders preserve the key/script discriminant (an unknown tag is a deterministic reject); the credential type makes a discriminant-less credential unrepresentable on the BLUE authority path (no Hash28->credential coercion); CertState (registrations/delegations/rewards) and ConwayGovState (vote_delegations/committee_hot_keys/drep_expiry) key on the discriminated credential, so a key-hash and a script-hash credential sharing 28 bytes are distinct authoritative-state keys (matching cardano-node's Credential-keyed UMap/VState); and the canonical fingerprint serializes the discriminant so two states differing only in a credential's key/script tag fingerprint differently. The discriminated representation is a deliberate cert-state + gov-state fingerprint migration (T-DET-01). Default scope is Shelley+; Byron is included only if proven to have an affected credential surface.

Source: Cardano ledger spec (Credential = key|script across UTXOW/DELEG/GOVCERT; CIP-1694); IDD illegal-states-unrepresentable + determinism doctrine
Cluster: CL-LEDGER-VERDICT
Authority surface: BLUE credential representation fidelity

Enforcement trace

Code

Tests 20

shelley_credential_preserves_discriminant
conway_credential_preserves_discriminant
unknown_credential_tag_rejects
discriminant_changes_fingerprint
keyhash_scripthash_same_bytes_are_distinct_certstate
keyhash_scripthash_same_bytes_are_distinct_govstate
discriminant_changes_fingerprint_corpus
credential_accumulation_replays_byte_identical
committee_keyhash_scripthash_do_not_cross_resolve
committee_keyhash_scripthash_same_bytes_distinct
committee_discriminant_changes_fingerprint
drep_keyhash_scripthash_do_not_cross_resolve
drep_vote_discriminant_changes_fingerprint
enactment_committee_changes_keyhash_scripthash_distinct
update_committee_decodes_removed_added_threshold
update_committee_keyhash_scripthash_members_distinct
update_committee_decode_rejects_malformed
update_committee_structured_fields_change_fingerprint
enact_update_committee_keyhash_scripthash_distinct
committee_oracle_mainnet_575_576_noop_agreement

CI 1

ci_check_credential_discriminant_closed.sh

Cross-references

Strengthened in

Open obligation

Real-chain agreement of the discriminated COMMITTEE credential keys vs cardano-node is now CONFIRMED (committee_oracle_mainnet_575_576_noop_agreement): the mainnet Conway 575/576 ledger-state snapshots (in s3://ade-corpus-snapshots, gitignored locally) show the interim committee is exactly 7 ScriptHash members (expiry 580, quorum 2/3) and our loader parses every member as ScriptHash, never a defaulted KeyHash. Real-chain agreement of the NON-committee discriminated keys (vote_delegations / drep_expiry in the Credential-keyed UMap/VState) remains environment-blocked pending those extractions; reclassified per tier doctrine, same posture as DC-LEDGER-08/DC-LEDGER-09/DC-TXV-06. Declared non-goals (separate work, not this cluster): withdrawal / required-signer / address credential discriminant, the Hash28-keyed stake-distribution snapshot, and the Byron credential surface. FOLLOW-UPS surfaced by the per-cluster security review (bounded to non-goal surfaces, NOT regressions): (a) governance.rs committee resolution stays hash-level because the committee member/vote types (committee, committee_votes) were not in OQ5 scope while committee_hot_keys was — when those types are discriminated, replace the .hash() comparisons with full-credential equality and add a (KeyHash X / ScriptHash X) cross-resolution negative test; (b) the shelley/cert.rs unknown-cert zero-hash KeyHash placeholder (pre-existing, ignored by apply_cert) should be closed when the Shelley cert grammar is closed. COMMITTEE-CRED-FIDELITY (strengthened_in) closed the committee member/vote surface (a) above; remaining follow-ups from its security review: (c) RESOLVED by DREP-VOTE-FIDELITY (strengthened_in) — drep_votes is now StakeCredential and governance.rs lookup_stake resolves DRep stake by exact variant (no key/script OR-fallback); spo_votes stays Hash28 (pools are always key-hash, permanent non-goal); (d) RESOLVED by ENACTMENT-COMMITTEE-FIDELITY then WIRED by ENACTMENT-COMMITTEE-WRITEBACK (both strengthened_in) — EnactmentEffects.committee_changes is StakeCredential-typed AND committee enactment is now live: GovAction::UpdateCommittee is structured (removed set + added map of discriminated cold credentials, no opaque raw bytes), the snapshot-loader decode is fail-closed on an unknown credential tag, and apply_committee_enactment writes the committee back at the epoch boundary (NoConfidence dissolve + UpdateCommittee remove/add/quorum) without re-collapsing the map. Real-chain committee parse + no-op write-back agreement is oracle-confirmed at the mainnet 575->576 boundary (committee_oracle_mainnet_575_576_noop_agreement); the positive committee-CHANGE case is reality-blocked (mainnet enacted no committee change in this range), not environment-blocked; (e) GREEN loader mk_credential defaults tag!=1 to KeyHash (contained to ade_testkit, cannot reach the node binary) — could reject unknown tags instead; note the NEW UpdateCommittee cold-credential decode (parse_cold_credential) IS fail-closed on unknown tags, so (e) now applies only to the older mk_credential helper.