Security invariants

1. Every value a method or policy judges is welded to a root the kernel recomputes from the same plaintext.
2. No record is created without its signatories' authority, derived only as in §4.3 (malicious-method test: a method that creates a record with a foreign signatory fails in K, not in the method).
3. No record or note is consumed twice; no bound note is spent without its owning record.
4. Conservation per asset per fragment, including flows and fee; a permissive method cannot mint (cheap-asset substitution test).
5. Every flow is matched exactly once, across fragments only.
6. Program isolation: a method of program A cannot consume or create records of program B.
7. Every actor and every new stakeholder is an admitted, unrevoked party.
8. Every envelope decrypts for its stakeholder (encryption-consistency test with wrong-key and malformed cases).
9. Function privacy: two transactions with different programs produce identically shaped calldata and events.
10. A kernel proof cannot be replayed into another transaction (manifest_hash binds everything) or another FI (fi_index signed in W).
11. All of [Weld spec §9](/protocol/security-invariants) for the policy layer, unchanged.