covenant-invoica: capability-gated, audit-logged connector for Invoice + settlement

.env.example

@@ -77,3 +77,10 @@ REDIS_URL=redis://localhost:6379
 # COVENANT_ACEDATA_ALLOW=acedata.search     # comma-separated tool allowlist; empty = all
 # COVENANT_ACEDATA_IMAGE_MODEL=flux-pro
 # COVENANT_ACEDATA_MUSIC_MODEL=chirp-v4
+# Invoica money + compliance provider (covenantd). Off by default; the API key
+# is a Bearer credential, keep it off-repo. Settlement stays on Invoica's rail;
+# Covenant scopes, brokers, and audits the call. Registers the invoica.* tools.
+# COVENANT_INVOICA_ENABLED=true
+# COVENANT_INVOICA_API_KEY=                   # Invoica API key (Bearer); required to enable
+# COVENANT_INVOICA_BASE_URL=https://api.invoica.ai
+# COVENANT_INVOICA_CHAIN=solana               # default settlement chain stamped on new invoices

agent-os/Cargo.toml

@@ -23,6 +23,7 @@ members = [
     "crates/covenant-metaplex",
     "crates/covenant-sns",
     "crates/covenant-acedata",
+    "crates/covenant-invoica",
     "crates/covenant-sap-bridge",
     "crates/covenant-stake-keeper",
     "crates/covenantd",

agent-os/crates/covenant-invoica/Cargo.toml

@@ -0,0 +1,22 @@
+[package]
+name = "covenant-invoica"
+version = "0.0.0"
+edition.workspace = true
+license.workspace = true
+authors.workspace = true
+repository.workspace = true
+description = "Invoica provider for Covenant. Wraps Invoica's invoicing, settlement, and tax REST API as audit-logged, capability-gated MCP tools, with the daemon brokering the API key so the agent never holds it."
+
+[dependencies]
+covenant-mcp = { path = "../covenant-mcp" }
+async-trait = { workspace = true }
+serde = { workspace = true }
+serde_json = { workspace = true }
+thiserror = { workspace = true }
+tracing = { workspace = true }
+reqwest = { workspace = true }
+tokio = { version = "1", features = ["time"] }
+
+[dev-dependencies]
+tokio = { version = "1", features = ["rt-multi-thread", "macros", "time"] }
+wiremock = "0.6"