AdeAtlas
Invariants / DC-NODE-21

DC-NODE-21

DC derived enforced

Adoption certificate is rung-1 evidence-only, never forge authority. The file-based operator adoption certificate is a rung-1 RED EVIDENCE-ONLY shim. It MAY prove relay adoption for the transcript / bounty bundle, but MUST NEVER control forge-base selection (DC-NODE-20 derives the forge base from the local durable ChainDB tip) or any durable authority, and MUST NEVER appear in multi-producer, preprod, or production forge paths. It MUST be removed or replaced by node-local selected-chain / fork-choice authority (DC-CONS-03) before rung 2 / preprod. Hard removal boundary: the shim exists ONLY because Ade does not yet have full multi-producer fork-choice + peer-state lifecycle; it must not creep back into later slices as authority. Relay adoption is evidence for the bounty proof, never a forge-loop precondition.

Source

docs/planning/local-selected-durable-chain-forge-base-invariants.md

Introduced in
PHASE4-N-AH

Enforcement trace

Code

Tests 3

  • caughtup_self_admit_enters_extend_directly_no_cert
  • forge_base_selected_transcript_witnesses_local_tip
  • local_spine_cert_file_absent_from_replay_surface

CI 2

Cross-references

DC-NODE-20DC-NODE-18DC-NODE-19DC-CONS-03

Evidence notes

ENFORCED at PHASE4-N-AH close (2026-06-08): S2 (050237e9) FULLY DELETED read_adoption_cert / parse_hex32 / VenueAdoptionCertificate / --adoption-cert-path -- the cert parser is GONE, not just demoted; ci_check_cert_evidence_only.sh asserts no cert token in the forge path, ci_check_node_path_fidelity.sh keeps the --mode node flag set honest (28->29 reconcile). Run-4 transcript: cert_path_present=false x461, cert_path_present:true count = 0. DECLARED at /invariants (2026-06-08, user-approved). Separated from DC-NODE-20 (OQ-20-3) because 'cert is evidence-only, never authority' is independently enforceable and needs a hard rung-2 removal boundary -- folding it into DC-NODE-20 would make it easier for the shim to creep back into later slices as authority. Enforced when the slice demotes read_adoption_cert to a transcript-only evidence record (off the forge-base path) + a CI gate asserts the cert never feeds forge-base selection and never appears in multi-producer/preprod/production. Hard follow-up: replace/remove before rung 2 / preprod; the cert can never become chain-selection or durable authority.