# MEYER INVARIANT CHECKS -- I1 through I4

**Purpose:** Predicate text for the four Meyer-style runtime invariants executed in Layer 3. Each is asserted on every tick; violation triggers the Circuit Breaker per `CIRCUIT_BREAKER_SPEC.md`. Platform fallbacks: `PLUGIN_HOST_FALLBACKS.md`.

**Source:** Meyer, B. (1992). "Applying Design by Contract." *IEEE Computer* 25(10). Every public feature's entry/exit preserves the class invariant; violation detected at the boundary.

---

## I1 -- Path Invariant

**Predicate:** For every filesystem event `e`, `e.path` is inside `e.actor_plugin.owned_path_globs`.

**Event source:** Linux `inotify` on `IN_CREATE|IN_DELETE|IN_MODIFY|IN_ATTRIB|IN_MOVED_FROM|IN_MOVED_TO` or `auditd` (`auditctl -w <path> -p war`); macOS fsevents; no event API -> hash-poll at documented period.

**Evaluation:** Canonicalize `e.path` (follow symlinks). Resolve `e.actor_plugin`. Match canonical path against the actor's globs. No match = violation.

**Classification:** write outside glob -> integrity-breaking; read outside glob across RAM <-> Evaluator -> doctrinal-breach; reversible metadata-only on non-baseline-tracked file, same plugin -> recoverable.

**Out-of-scope for I1:** Content drift of baseline-tracked files -> I4. I1 catches illegal *reach*, not illegal *content*.

---

## I2 -- State-Namespace Invariant

**Predicate:** For every state read/write `op`, `op.key` startswith at least one prefix in `op.caller.owned_state_key_prefixes`.

**Evaluation point:** State-manager boundary. Public read/write functions evaluate BEFORE dispatch and BEFORE returning.

**Platform:** Kernel namespaces (`CLONE_NEWNS|NEWPID|NEWNET`) verified via `lsns` / `/proc/<pid>/ns/<type>` when available. In-process hosts fall back to the manifest-prefix assertion; the prefix-claim IS the namespace, the assertion IS the enforcement.

**Classification:** write to non-owned prefix -> integrity-breaking; read of non-owned prefix -> doctrinal-breach (structural reach regardless of direction).

**Log fields:** `caller.plugin_id`, `owned_state_key_prefixes`, `op.key`, `op.type`, `op.value_hash` (if write), timestamp, baseline reference.

---

## I3 -- Retrieval-Surface Invariant

**Predicate:** For every retrieval call `r`, `r.capability_token` is issued to `r.caller` AND `r.capability_token.surface_id` is inside `r.caller.allowed_retrieval_capabilities`.

**Evaluation point:** Retrieval-call hook, pre-dispatch. Every engine/cache/index/vector-store/embedding-store/model-API/DB-connection presents a token; the hook checks owner-match AND surface-match before dispatch.

**Platform:** WASI / WaVe strongest; Jif equivalent. No capability runtime -> wrapper-enforced tokens issued at install, verified at each hook; wrapper is the only entry point.

**Classification:** Any mismatch -> integrity-breaking. No "soft" mode. Valid token + wrong caller identity = forgery; trip global breaker, rotate catalog.

---

## I4 -- Library-Content Invariant

**Predicate:** For each plugin, recomputed Merkle root over the library tree equals baseline root captured in Layer 2.

**Cadence:** Every Evaluator run start; every install/upgrade; configurable periodic. Cadence declared in run manifest, baseline-tracked.

**Computation:** Enumerate declared library paths; SHA-256 per file; balanced Merkle tree over sorted path -> hash mapping; root is the invariant value.

**Classification:** Mismatch -> integrity-breaking. Identify drift leaves in the violation record. **Do NOT auto-rebaseline** -- that would mask drift and is itself integrity-breaking.

**Baseline tampering:** Baseline artifact is in the plugin's Merkle tree; tampering changes the root, caught at next recompute.

---

## Cross-Invariant Rules

**Fail-fast precedence:** I1/I2/I3 trip at event boundary; I4 at next cadence check. Shorter I4 cadence shortens the drift window.

**Evidence log:** Every evaluation -- pass or fail -- writes a structured record (`plugin_id`, `invariant_id`, predicate inputs, verdict, baseline reference). Absence of a pass-log is a detectable anomaly (silent gap = broken tick loop).

**No soft failure:** Invariant holds or does not. Missing data / partial evaluation / unresolved primitive gap = violation with classification integrity-breaking. An uncertain invariant provides no guarantee.
