AdeAtlas
Invariants / DC-NODE-01

DC-NODE-01

DC derived enforced

Per-peer session isolation: one peer session's failure (decode error, validity reject, rollback-too-deep, protocol violation) halts only that peer's session. The orchestrator continues serving other peers and producing blocks. No cross-peer state sharing; each peer session owns its own working memory.

Source

docs/planning/phase4-n-k-orchestrator-binary-invariants.md §1 (I-3)

Enforcement trace

Code

Tests 5

  • crates/ade_runtime/tests/orchestrator_peer_isolation.rs::peer_session_isolation_holds_under_failure
  • crates/ade_runtime/tests/orchestrator_peer_isolation.rs::peer_session_per_peer_state_does_not_cross
  • crates/ade_runtime/tests/orchestrator_peer_isolation.rs::peer_disconnect_removes_only_that_peer
  • crates/ade_runtime/src/orchestrator/peer_session.rs::tests::peer_session_isolation_across_two_concurrent_tasks
  • crates/ade_runtime/src/orchestrator/core.rs::tests::step_per_peer_decode_error_isolates

CI 1

Cross-references

CN-CONS-08DC-CONS-20

Strengthened in

PHASE4-N-KPHASE4-N-L

Evidence notes

PHASE4-N-K S2+S4 (2026-05-26) routed per-peer state through OrchestratorState::per_peer_receive / per_peer_server (BTreeMap keyed by PeerId). Decode/validity errors emit PeerSessionHalted (closed reason discriminant) and remove only that peer's entry; other peers + producer continue. RED tokio task in peer_session.rs owns its own mpsc::Receiver; no shared mutable state across tasks (enforced by ci/ci_check_peer_session_isolation.sh).