Invariant selection is a difficult problem. We take a step towards
a systematic definition of invariants by specifying heuristics which
have worked well for our own verification efforts. The focus of our
heuristics is on invariants that need to hold true when the customer,
CUST, accepts the attestation report and reaches the final commit
state. The invariants are generated and evaluated in order, following
the three rules: