INVARIANTS & ASSUMPTIONS — Unified Agent OS

### INV-1: Tenant Isolation - **Statement:** No tenant can access another tenant's data, secrets, sessions, or compute - **Why:** Trust is the product. A single leak destroys the business. - **What breaks:** Customer trust, legal liability, SOC 2 compliance - **Canary:** Cross-tenant query audit log; any query touching tenant_id != session.tenant_id triggers immediate alert ### INV-2: Model Provider Neutrality - **Statement:** AgentOS must never hard-depend on a single LLM provider - **Why:** Vendor lock-in kills adoption. Users switch models constantly. - **What breaks:** Customer freedom, competitive positioning - **Canary:** If removing any single provider's SDK breaks more than one subsystem, invariant is violated ### INV-3: API-First Surface - **Statement:** Every user-facing feature must be accessible via API before (or simultaneously with) any UI - **Why:** API-first ensures composability, testability, and third-party integration - **What breaks:** Automation users can't access UI-only features; testing becomes browser-dependent - **Canary:** UI PR without corresponding API endpoint = blocked ### INV-4: Session Cost Accountability - **Statement:** Every token consumed must be attributed to a specific session, tenant, and budget - **Why:** Cost transparency is a core value prop. Untracked spend erodes trust. - **What breaks:** Billing accuracy, budget enforcement, cost optimization - **Canary:** If `sum(session_costs)` diverges from `provider_invoice` by >2%, investigate ### INV-5: Graceful Degradation - **Statement:** Failure of any single subsystem (Pulse, Heartbeat, Dreams) must not crash the platform - **Why:** Agents run 24/7; cascading failures are unacceptable - **What breaks:** Platform uptime, customer operations - **Canary:** Circuit breaker open for >5 minutes on any subsystem = P1 alert