# AWP Invariant Candidates

These are evidence-derived candidates for canonical AWP invariants and gates. Lane E does not edit the cited canonical specs; owning lanes should consume/ratify them through normal convergence.

## Urgent I0/I1 candidates

| ID | Candidate invariant | Evidence | Primary affected specs | Lane | Current target status |
|---|---|---|---|---|---|
| INV-FIRE-001 | A Workspace cannot enter destructive cleanup until all recoverable outputs/WIP are durably collected **or** an attributable explicit abandonment is persisted; cleanup uses exact resource generation/identity and fails closed on ambiguity. | OD-001, OD-002, OD-030 | `architecture/workspace-execution.md`, `domains/agents.md`, `domains/changes.md`, threat model T6 | C + A | Principle specified; destructive race/collection tests still required. |
| INV-FIRE-002 | Result collection must detect recoverable Git/WIP state outside the declared transport set. A nested Git repository/worktree/dirty candidate that would be excluded prevents successful terminal collection/cleanup. | OD-005 | `architecture/workspace-execution.md`, `workflows/factory-execution.md`, `workflows/task-to-merge.md` | C | Evidence exposes an implementation trap not made explicit enough by path-level wording. |
| INV-FIRE-003 | Trusted publication/merge consumes exact immutable ChangeSet/base/candidate identity from an isolated trusted context; unrelated workspace refs/dirty state cannot influence enumeration or fetch. | OD-004, OD-009, OD-028 | `domains/changes.md`, `domains/repositories-vcs.md`, `security-and-trust.md`, `task-to-merge.md` | B | Strongly specified; provider implementation test mandatory. |
| INV-FIRE-004 | Any provider mutation whose response is ambiguous is reconciled by operation/candidate/provider identity before retry; repeated delivery yields exactly one externally visible mutation. | OD-006 | `adapter-contracts.md`, `persistence-and-transactions.md`, `durable-execution.md`, `task-to-merge.md` | B + A | Strongly specified; exact ambiguous-success test mandatory. |
| INV-FIRE-005 | For one logical Account/Connection credential, at most one mutable refresh/session authority is active. Authority handoff fences/deactivates the old owner before the new owner can refresh. | OD-007, OD-008 | `domains/accounts-models-providers.md`, `integrations-and-connections.md`, `security-and-trust.md` | B | Explicitly specified; security concurrency test mandatory. |
| INV-FIRE-006 | Logical workflow/Attempt/resource ownership is generation/lease based. No heartbeat/child/external mutation occurs before ownership claim; stale generation cannot mutate current state after restart/replacement. | OD-003, OD-019 | `durable-execution.md`, `persistence-and-transactions.md`, `workspace-execution.md` | C + A | Direction specified; exact generation/fencing behavior should be proven. |
| INV-FIRE-007 | Work can remain queued durably without occupying a waiting worker/process/pod. Admission/placement applies concurrency and resource ceilings before allocating execution resources. | OD-003, OD-016 | `domains/work-queue.md`, `architecture/workspace-execution.md`, `ci-and-runner-boundary.md` | A + C | Architectural fit is strong; resource-bound test should be explicit. |
| INV-FIRE-008 | A Machine/runner is eligible for an Attempt only when the exact required execution profile (runtime/image/tool/capability/trust) is attested current. One ineligible host does not create fleet-wide outage if other eligible hosts exist. | OD-011, OD-012 | `domains/cluster.md`, `workspace-execution.md`, `ci-and-runner-boundary.md` | C | Partly specified via PlacementDecision/MachineCapability; failure localization test needed. |
| INV-FIRE-009 | UI/transport may never advance lifecycle beyond authoritative state. `accepted`, `queued`, `running`, `blocked`, `deployed`, `failed`, `stale`, and `unknown` remain semantically distinct. | OD-014, OD-025 | `event-audit-realtime.md`, `control-surfaces.md`, relevant UI specs | D + A | Principles present; projection E2E tests required. |
| INV-FIRE-010 | Durable history/evidence remains queryable after executor/resource deletion, quarantine and control-plane restart; discovery checkpoints may optimize scanning but cannot replace loading canonical history. | OD-010, OD-020 | `persistence-and-transactions.md`, `domain-model.md`, `event-audit-realtime.md` | A + C + D | Core persistence design supports it; restart-history acceptance needed. |

## Additional candidates

| ID | Candidate invariant | Evidence | Affected specs | Lane | Current target status |
|---|---|---|---|---|---|
| INV-FIRE-011 | Mutable branch names and process-local workspace state are never execution/publication provenance; exact revision/digest is recorded before execution and collection. | OD-004, OD-028 | `repositories-vcs.md`, `changes.md` | B + A | Specified. |
| INV-FIRE-012 | Destructive publication safety checks consume structured complete tree/diff/digest data, never human-oriented truncated log output. | OD-028 | `changes.md`, `security-and-trust.md` | B | Implied; security regression test warranted. |
| INV-FIRE-013 | Provider endpoint/discovery observation is refreshable; network timeout/auth failure invalidates stale connection state and triggers bounded rediscovery/reconciliation without changing domain identity. | OD-021 | `adapter-contracts.md`, `event-audit-realtime.md`, `integrations-and-connections.md` | B + D | General reconciliation specified; endpoint rediscovery is adapter-specific. |
| INV-FIRE-014 | Every durable event/outbox stream has restart-monotonic sequence/identity; reopening after a torn final record cannot reuse an emitted sequence. | OD-023 | `persistence-and-transactions.md`, `event-audit-realtime.md` | A | Atomic event/outbox specified; restart-tail test candidate. |
| INV-FIRE-015 | Same logical operation key plus same fingerprint returns/reconciles the same operation; same key plus conflicting fingerprint fails closed. | OD-018; Overdeck incremental-delivery acceptance evidence | `transport-and-contracts.md`, `persistence-and-transactions.md` | A + B/C | General idempotency specified; fingerprint-conflict test useful. |
| INV-FIRE-016 | Incident/resolution emission is edge/idempotency based: unchanged observed failure does not create unbounded duplicate Incident/ResolutionAttempt work. | OD-018, OD-019 | `domains/incidents-resolvers.md`, `incident-to-resolution.md` | A (I8 owner later) | Target semantics need implementation when Incident automation activates. |
| INV-FIRE-017 | Repeated recovery recipe execution that does not improve declared postcondition escalates/blocks rather than looping indefinitely. | OD-017, OD-030 | `incidents-resolvers.md`, `incident-to-resolution.md` | A/C later | Direction specified, recurrence threshold open. |
| INV-FIRE-018 | A successful recovery recipe records exact target, actions, observed postcondition and resulting state; command exit alone is insufficient. | OD-017, OD-030 | `incident-to-resolution.md` | A/C later | Explicitly specified. |
| INV-FIRE-019 | Agent/provider process exit is not Task success. Completion evaluates declared semantic outputs/evidence; already-satisfied/no-op is distinguishable from missing output/failure. | OD-027 | `factory-execution.md`, `domains/work.md`, `domains/verification.md` | A + B/C | Explicitly specified at principle level. |
| INV-FIRE-020 | A retry/fallback creates immutable Attempt provenance and cannot silently change provider/account/model for the active Attempt. | OD-008, session/routing history | `domains/agents.md`, `accounts-models-providers.md` | B + A | Explicitly specified. |
| INV-FIRE-021 | A provider/runner infrastructure failure is represented separately from a product/test failure and cannot be turned into product red/green evidence by retry policy. | OD-011, OD-012, OD-027 | `domains/ci.md`, `domains/verification.md`, `ci-resolution.md` | C + A | Explicitly specified. |
| INV-FIRE-022 | Source commit, Artifact digest, Release identity, Deployment attempt and observed runtime version are separately stored and traceable; downstream state never rewrites upstream identity. | OD-022, OD-024 | `artifacts-provenance.md`, `releases.md`, `deployments.md` | A/C (I6) | Strongly specified. |
| INV-FIRE-023 | Artifact promotion requires manifest/content/entrypoint verification appropriate to its type before activation, and failed activation preserves the previous known-good runtime. | OD-022 | `artifacts-provenance.md`, `merge-to-production.md`, `deployments.md` | C/A (I6) | Supply-chain evidence specified; type-specific runtime-content gate is candidate detail. |
| INV-FIRE-024 | Deployment completion requires read-back of observed target/runtime identity; Git/release success alone cannot mark Deployment successful. | OD-024, OD-014 | `deployments.md`, `deployment-resolution.md` | C/A (I6) | Reconciliation specified; explicit acceptance test needed when activated. |
| INV-FIRE-025 | Realtime clients carry sequence/revision state and re-query authoritative read model on detected gap/reconnect; stale cached data is marked stale until reconciled. | OD-021, OD-025 | `event-audit-realtime.md`, UI specs | D + A | Explicitly specified. |
| INV-FIRE-026 | Critical failure class/cause/retry/evidence fields survive persistence → application → transport → UI projection. Missing/partial/malformed are explicit, not collapsed into generic success/error. | OD-025 | `domains/ci.md`, `domains/agents.md`, `event-audit-realtime.md`, UI specs | A + D | Target UX requires rich evidence; projection contract test needed. |
| INV-FIRE-027 | Every non-terminal durable operation exposes current stage, last-progress timestamp, and a bounded lease/deadline or explicit rationale for unbounded human wait. | OD-013, OD-014 | `durable-execution.md`, `work-queue.md`, UI specs | A + C + D | Pieces exist; cross-domain consistency is a candidate clarification. |
| INV-FIRE-028 | Browser/session disconnect never cancels durable work implicitly; resumption reattaches to durable identity and does not duplicate execution. | OD-015 | `control-surfaces.md`, `human-in-the-loop.md`, `advisory-conversation.md` | A + D | Explicitly specified for control surfaces/approvals; apply consistently to I1 runs. |
| INV-FIRE-029 | Current Work/Task/Plan ownership, last activity, blocker and next action are queryable without consulting chat transcript/model context. | OD-015, OD-029 | `domains/work.md`, `work-queue.md`, `projects.md`, UI specs | A + D | Strong product alignment; concrete read-model/UI acceptance needed. |
| INV-FIRE-030 | Human Approval/Decision is required only by policy/authority/intent semantics; recoverable infrastructure state uses bounded reconcile/retry/resolver flow and remains visible without forcing owner relays. | OD-014, OD-029 | `approvals-decisions.md`, `policy-autonomy.md`, `incident-to-resolution.md` | A + D | Target architecture supports this. |

## Invariant count

- **Candidate invariants:** 30
- **Urgent for I0/I1 lanes:** 10
- **Already strongly expressed in current AWP target specs:** most of the architectural principles above.
- **Main evidence-driven delta:** turn those principles into mandatory executable gates, especially INV-FIRE-001/002/004/005/006/008/009/010.