AdeAtlas
Invariants / DC-NODE-18

DC-NODE-18

DC derived enforced

Successor extension after an explicit adoption certificate (single-producer, single successor). After initial peer catch-up against a real peer tip (DC-NODE-15) AND explicit relay-adoption evidence for Ade's first successor -- an operator/harness-supplied RED venue-adoption certificate naming the adopted own tip, matched by chain-point identity (hash + block_no), NEVER inferred from self-admit -- single-producer Ade may forge the next successor on its OWN durable adopted spine WITHOUT requiring a relay echo (re-announce) of the adopted block back over the follow link. A successor is adoptable by induction (it extends an already-adopted parent; the relay is a pure follower of Ade's chain). Valid ONLY while the venue is explicitly single-producer: the relay is non-producing, Ade is the sole block producer, and no competing candidate chain is admitted. A gate-APPLICABILITY refinement, NOT a weakening of fork-choice; multi-producer behaviour stays out of scope and belongs to chain-selection authority (DC-CONS-03); the followed-peer-tip signal still may not select/replace/reorder/prefer chains. Fails closed if the venue is not explicitly declared single-producer. SCOPE BOUNDARY (live-proven core only): this rule asserts ONLY the successor-extension-after-adoption-certificate authority. It does NOT assert sustained production past k, relay ImmutableDB settlement, follow-link liveness, or forge-loop continuation after a follow-link EOF -- those are adjacent liveness/loop-lifecycle obligations deferred to DC-NODE-19.

Source

docs/planning/single-producer-extend-own-spine-invariants.md

Introduced in
PHASE4-N-AF

Enforcement trace

Code

Tests 5

  • forge_mode_transitions_are_total_and_deterministic
  • extend_own_spine_forges_on_durable_tip_without_followed_equality
  • single_producer_fence_fails_closed
  • extend_own_spine_two_runs_byte_identical
  • forge_mode_after_admit_only_advances_on_real_admit

CI 1

Cross-references

DC-NODE-15DC-NODE-17DC-CONS-03DC-NODE-10DC-CONS-24DC-NODE-12T-REC-05

Strengthened in

PHASE4-N-AH

Evidence notes

Rung-1 Finding B fix (2026-06-07), introduced after OQ-1 disproved DC-NODE-17-as-fix (the relay does NOT re-announce Ade's own adopted block). ENFORCED for the SCOPED core invariant ONLY (successor extension after an explicit adoption certificate -- see the statement SCOPE BOUNDARY); NOT for sustained-past-k. Tier=derived (Cardano-compatibility/liveness for the C2-LOCAL single-producer relay spine); the true-tier laws underneath are unchanged. HERMETIC ENFORCEMENT: ci/ci_check_single_producer_extend_own_spine.sh + 6 ade_node node_sync tests -- forge-mode state machine total/deterministic; promotion requires an explicit certificate matched by chain-point identity (hash+block_no), never self-admit-inferred, slot ignored; extend forges on the durable tip without followed==durable; fail-closed SingleProducerFenceViolation on each of 5 conditions; warm-start replay byte-identical over a K=3 own-forged chain (T-REC-05); forge_mode_after_admit advances ONLY on an actual admit (not on a not_leader tick). BLUE UNCHANGED: pump_block durable admission stays authoritative+idempotent (DC-NODE-16); ledger/chain_dep/WAL unchanged; successor construction derives from the evolved admitted spine (DC-NODE-10/DC-CONS-24); chain selection (DC-CONS-03) stays the sole follow/fork authority. LIVE CORE PROOF (CE-AF-6a; C2-LOCAL cardano-testnet magic 42, run c2t7, 2026-06-07; docs/evidence/phase4-n-af-extend-own-spine.{md,jsonl}): Ade forged block 11 -> the non-producing Haskell relay adopted it -> the operator/harness wrote the RED venue-adoption certificate (11 327 7e67cd0d...) -> Ade promoted (own_tip == cert by chain-point identity) -> Ade forged block 12 from its OWN durable adopted spine -> the relay adopted block 12, with NO echo of block 11 back to Ade. Two live-surfaced loop bugs were found + fixed en route, BOTH missed by the hermetic suite + the IDD/security reviews (the live gate's value): (1) the post-forge mode advancement fired on a not_leader tick (forged=true but nothing admitted), wrongly promoting before any block; (2) the cert promotion used full TipPoint equality incl. slot instead of chain-point identity. DEFERRED, NOT claimed here (CE-AF-6b): sustained production past k, relay ImmutableDB settlement, follow-link liveness, and forge-loop continuation after the Ade->relay follow link EOFs. The c2t7 run stopped at 2 blocks because that follow link EOF'd (relay idle timeout; no keep-alive) and the loop currently treats the follow source as a lifecycle authority -- scoped to DC-NODE-19 (single-producer extend-mode loop continuation after follow EOF), which touches DC-NODE-05 (forge subordinate to the sync spine). OQ-KA (follow-link keep-alive) remains a separate non-blocking diagnostic.