Platform-wide invariant checks over the registered tatara catalog. Each invariant walks the capability registries, asserting properties no single domain can verify alone (no duplicate keywords, every dep ref resolves, every schema parses, every compliance framework is known). New domains are validated automatically; new invariants are one function each.