# Proven Invariants Invariants are properties the system asserts must *always* hold. Where [[Detection Rules]] catch deviation, invariants catch violation of structural truth — if an invariant breaks, the world is not as the controller believes it to be. The kernel defines 15 candidate invariants, of which **6 (I1–I6) are PROVEN** under the [[Frozen Evidence Baseline]]. "Proven" here means demonstrated to hold across the validation corpus deterministically — not asserted in a slide. The remaining invariants are carried as hypotheses, not claims. > [!note] Proven vs. claimed > The discipline of separating proven (I1–I6) from unproven is the same evidence discipline as the [[Evidence Hierarchy]]: a capability is only counted once it sits at a defensible rung. This honesty about scope is itself part of the product's credibility. A broken invariant feeds the [[Four-State Trust Machine]] just as a fired rule does, but it carries stronger semantics: invariant violation is evidence of a fundamental integrity failure, often routing trust toward `UNTRUSTED` or `SAFE_STATE`. --- Related: [[Integrity Kernel MOC]] · [[Detection Rules]] · [[Frozen Evidence Baseline]] · [[Evidence Hierarchy]] · [[Four-State Trust Machine]]