From d9a244dc772a67a6427f3e44ca5c3c231681fdde Mon Sep 17 00:00:00 2001 From: Marius Argatu Date: Sun, 12 Jul 2026 16:42:58 +0300 Subject: [PATCH] demo: add a frozen invariant the pipeline is meant to catch Adds INV-8 to the frozen spec and nothing else. The verify job's drift gate is expected to fail here (frozen but uninventoried), which is the whole point: a change to specs/ cannot pass CI until the new rule is accounted for. This branch is a live demonstration, not for merge. --- specs/invariants.md | 1 + 1 file changed, 1 insertion(+) diff --git a/specs/invariants.md b/specs/invariants.md index 6dfc2bd..485fc05 100644 --- a/specs/invariants.md +++ b/specs/invariants.md @@ -11,5 +11,6 @@ These must hold after every request, under any request sequence. The verificatio | INV-5 | State changes only along the state machine table; nothing is reachable from `VOIDED` or `REFUNDED` | | INV-6 | The state machine preconditions are enforced: an illegal operation returns `409` and changes nothing, no state change, no ledger entries | | INV-7 | Every intent in state `AUTHORIZED` or beyond has at least one ledger entry pair carrying its `payment_intent_id` | +| INV-8 | (demo) The sum of a merchant's captured amounts never exceeds its lifetime authorized total | The catalog of metamorphic relations (MR-1 and following) that exercise these invariants lives in `docs/design.md` ยง5.6; it is not duplicated here.