Honesty Invariants

Scope: the fail-closed rules the platform holds everywhere (coded, not just documented). Status: as of 2026-11-09 Blueprint sources: AGENTS.md (Mandatory Architectural Mandates), module doc comments across apps/agent-bff/src, docs/commercialization/41_WEEK_IN_REVIEW_2026-11-08.md

Facts

• Zero bespoke tables. All domain entities map into claim, truth_node/truth_edge, resource/resource_edge, integration_entity (Stratum 356). If unmappable → STOP and ask the user (source: AGENTS.md mandate 1).
• Declarative-first. Lookups, thresholds, packs, maps live in NATS KV (SOVEREIGN_LOOKUPS/SOVEREIGN_SCENARIOS/SOVEREIGN_TEMPLATES) or datasets; runtime never reads disk (mandate 4); scenarios load from SOVEREIGN_SCENARIOS and orchestrate via Kestra + Camel (mandate 5).
• No smoke code. No mocks, synthetic fixtures-as-truth, dummy coordinates, or hardcoded card/metric values. Every line production-grade (mandate 10/12).
• Fail closed. Infrastructure errors → 502/503/422/throw (never synthetic "OPTIMAL"/"APPROVED"/deterministic fallbacks — mandate 6); payloads that don't match a real contract → 400 (mandate 7); unavailable engine → invent_refuse_live refusal (universal on module responses).
• Soft≠LIVE honesty. Soft apply = validate + plan, zero writes (writes only onto real canonical facts when explicitly designed). Nothing sets live_gate_met/infra_ready without REAL probe results (see claims readiness: all five probes must genuinely pass) — env flags alone never count; and infra-ready is not rollout (see D-06 readiness).
• Fake-test prohibition. Tests asserting magic numbers from non-existent engines are fakes; never code to satisfy them — flag them (mandate 8). Module tests use injected fakes of the contract (failures simulate, successes mirror real shapes), never of infrastructure results.
• Price honesty. No invented prices/savings percentages; pilot SKU prices stay unpublished until a real product decision.
• AI honesty. Hooks never advance governance on their own unless require_for_advance; default-off; engine-down → hook-only refuse (CLAIMAI-00).
• Event-spine honesty. spine consumers never mutate PoCE/claim state; PoCE steps come only from the guarded path, never from consumer receipts (zero-Surreal-write rule in claims-event-consumer.js).

Open items / gaps

• Invariants are enforced per-module (each response carries invent_refuse_live/live_gate_met where relevant); there is no cross-cutting lint that catches a future module missing them.