Bind Janus invariants L2, L3, L9; update economy and covenant labels

CONFORMANCE.md

@@ -27,8 +27,8 @@ Statuses are stated per the architecture's honesty rule. Built member-layer work
 | Record is **dialog-sealed** — what two members agreed, not what one asserts | **Built** | Dual-seal verification over canonical bytes; self-dialog rejected at construction |
 | **No PII in the commons**; narrative stays member-local and erasable | **Built** | Commons types carry hashes, keys, and instants only; erasable content lives in a type-disjoint member-local store |
 | **Witnessing** with structural independence; a single-witness deployment is a labeled stand-in | **Built (stand-in)** | Witness countersignatures with pairwise-independence verification; the StandIn label is computed, not asserted |
-| Covenant: **never average**; full distribution; symmetric; gates whether-never-how-much | **Stub, labeled** | `internal/covenant` package doc declares the non-negotiable invariants it must satisfy when built; built implementation in review |
-| Economy: balances a **deterministic function of the sealed record**; zero-sum; escrow-first; earned-never-bought | **Stub, labeled** | `internal/economy` package doc declares the invariants; built implementation in review |
+| Covenant: **never average**; full distribution; symmetric; gates whether-never-how-much | **Built, except the trust gate** | `internal/covenant`: full distribution per relation, never averaged (`TestInvariant_L8_NoScalarAggregation`); No Trust requires a justifying comment hash; answers annotate, never erase (`TestAnswersCloseTheSymmetryBreach`). "Never how much" holds: the credit limit is never derived from standing (`TestInvariant_L9_OperatorSetUniformLimit`). **Not yet wired:** "gates whether" — no spend path consults standing before admitting a trust-based trade |
+| Economy: balances a **deterministic function of the sealed record**; zero-sum; escrow-first; earned-never-bought | **Built** | `internal/economy`: replay re-derives every balance (`TestOpenReplaysHistory`, `TestOpenDetectsTamper`); zero-sum (`TestInvariant_L1_ZeroSumBalance`); escrow-first, one governed switch (`TestPostRejectedInEscrowMode`, `TestModeSwitchIsOneRecord`); earned never bought (`TestInvariant_L2_EarnedNeverBought`); sovereign unit (`TestInvariant_L3_SovereignUnits`); one operator-set limit (`TestInvariant_L9_OperatorSetUniformLimit`) |
 | **Single participant identity** — one member, simultaneously contributor and consumer | Design-binding | No producer/consumer split exists in any schema or type; binds every member surface as it lands |
 | **Forkability** | Built | Consumes the coordination protocol at a published version tag; no coordinator is privileged |
 
@@ -39,14 +39,17 @@ Tests that bind an ID from the Janus invariant registry (`jfa-conformance-suite.
 | Registry ID | Test | What it adds beyond the package's existing tests |
 |---|---|---|
 | **L1** — each exchange moves two balances netting to zero | `internal/economy` `TestInvariant_L1_ZeroSumBalance` | Concurrent payers across two ledgers sharing one store; per-record netting; replay reproduces every balance |
+| **L2** — earned never bought, never redeemable for fiat | `internal/economy` `TestInvariant_L2_EarnedNeverBought` | The ledger API, record union, and every record field are pinned to allowlists; the ledger imports only the standard library and canon; no buy/redeem/cash-out/payout verb or route exists in the module, and no function both touches the fiat rail and builds a spend; at runtime escrow holds no credit and a balance rises only by a payer-signed spend |
+| **L3** — sovereign units, no conversion | `internal/economy` `TestInvariant_L3_SovereignUnits` | One key yields unlinkable accounts per platform; a spend signed for one platform never posts on, or re-points to, another, and a foreign spend in a store makes it refuse to open; platform identity lives in no governed field; no conversion, rate, peg, or bridge surface exists |
 | **L6** — no update-in-place, no delete; dismissal is annotation | `internal/record` `TestInvariant_L6_AppendOnly` (dismissal half: `internal/covenant` `TestAnswersCloseTheSymmetryBreach`) | A correction appends and leaves the corrected entry and all earlier proofs intact; an in-place rewrite done directly on storage fails consistency against a checkpoint taken before it; a module-wide source scan finds no update or delete verb on any append-only type — tracked by name (Store/Log/Ledger/Book) or by an "append-only" doc comment, with `market.Catalog` and `techtree.Tree` pinned so they cannot drop out of scope |
 | **L7** — commons holds hashes, types, timestamps, references only | `internal/record` `TestInvariant_L7_CommonsSchema` | Every commons type, field by field, admits only byte arrays, unsigned integers, `time.Time`, and `[]byte` fields named in an explicit allowlist of ed25519 keys and signatures — no string, map, interface, float, or unlisted `[]byte`; every allowlisted field, padded with a memo, fails verification against a passing unpadded control and never enters a log |
 | **L8** — full distribution carried; no scalar score anywhere | `internal/covenant` `TestInvariant_L8_NoScalarAggregation` | Two members with equal means and different shapes stay distinguishable; a module-wide source scan for score-named or float-returning exported functions, score-like JSON tags, and float fields in reputation packages |
+| **L9** — one uniform limit, set by the operator, never from reputation | `internal/economy` `TestInvariant_L9_OperatorSetUniformLimit` | Policy carries exactly one limit and nothing per-account; members and operator-held keys hit the same floor before and after a change; only the Genesis stewards' quorum moves it; the ledger cannot import the covenant and no function that sets the limit reads standing (residual named: a limit computed from standing in a separate helper is not seen by the per-function scan) |
 
 ## Stand-ins and open residuals
 
 - **Single-witness StandIn.** Every witnessed checkpoint today has fewer than two independent witnesses; the record layer computes and reports this label structurally. Live federation is the architecture's open problem 2 — the keystone build.
-- **Covenant and economy are stubs on main.** Their package docs carry the binding invariants; the built implementations are in the open, stacked PRs and must satisfy those docs to merge.
+- **Covenant trust gate not yet wired.** Covenant and economy are built on main and bound to registry tests (see above). The one open half is the covenant's "gates whether": no spend path yet consults a member's standing before admitting a trade on trust. "Never how much" is enforced; "whether" is a named gap, not a claim.
 - **Record domain-tag rename** (product naming) is pending and must land **before any durable persistence** — retagging after durable logs exist would be a rewrite.
 - **Named record residuals** (steganographic floor, timestamp covert channel, witness amnesia, liveness gap) are documented in the record package doc rather than pretended away.
 - **Contributor node — Executor seam built; runtime implementations pending.** `internal/contribute` fixes the node-contribution contract (Executor / ServiceExecutor / Registry / NodeContract) with two invariants enforced by tests: a scavenged node accepts only preemptible executors (owner-never-interrupted), and a Service workload requires pinned placement. `cmd/cloudy-agent` runs it end to end with a **real** Storage executor (opaque sealed shards + the `internal/storage` proof-of-possession) and **placeholder** Compute/Service executors. The heavy runtime port from the coordinator's transitional `internal/agent` — Docker executor, gopsutil hardware sampling, opt-out/allowlist/printers, and the agent→cloudyd→`/v0` relay — is the named next step and lands *behind* this seam without changing it.