Where are the header checks from the chain specification in PBFT?

[Vtec234]

This isn't so much an issue as it is a question from the code audit. The chain specification, section 4.2 "Permissive BFT Header Processing" specifies some checks to do when processing the block header, and among them:

2. We check that the current block is being issued for a slot no later than the current slot (as
determined by the system clock).
3. We check that the previous block hash contained in the block header corresponds to the
known hash of the previous block.

While I could see the other processing rules in applyChainState, I couldn't find these two, so this issue is to ask where they are implemented. There are checks in ChainFragment that seem to implement rule 3, but how does control from PBFT.hs reach them?

[mrBliss]

Note that the ChainSync client downloads block headers and does some processing.

2. This is checked in the ChainSync client: https://github.com/input-output-hk/ouroboros-network/blob/5c25acf9b89d3b4adc6235c50f25f61ce14a5d96/ouroboros-consensus/src/Ouroboros/Consensus/ChainSyncClient.hs#L402
   Also see https://github.com/input-output-hk/ouroboros-network/blob/5c25acf9b89d3b4adc6235c50f25f61ce14a5d96/ouroboros-consensus/src/Ouroboros/Consensus/Node.hs#L126 https://github.com/input-output-hk/ouroboros-network/blob/5c25acf9b89d3b4adc6235c50f25f61ce14a5d96/ouroboros-consensus/src/Ouroboros/Consensus/NodeNetwork.hs#L151 We allow some configurable amount of clock skew, e.g., we won't reject a header that is one slot in the future because the node's clock might be a few seconds late.
3. The check in ChainFragment is triggered by https://github.com/input-output-hk/ouroboros-network/blob/5c25acf9b89d3b4adc6235c50f25f61ce14a5d96/ouroboros-consensus/src/Ouroboros/Consensus/ChainSyncClient.hs#L413
   which uses the AnchoredFragments (which wraps ChainFragment) :> constructor. This check should indeed be done sooner and throw a proper exception instead of using error.

[Vtec234]

Thank you for the comprehensive answer, this clears up all confusion on my part. The issue can be closed via the PR.