{
 "tool": "certbridge-mcp",
 "version": "0.1.0",
 "bench_date": "2026-10-24",
 "bench_version": "0.1.0",
 "environment": "staging",
 "qualifier": "staging",
 "verdict": "CERTIFIED(staging)",
 "checks": [
  {
   "id": "C4",
   "name": "not-yet transports",
   "verdict": "pass",
   "evidence": "hostbridge placement and cpanel-uapi install both return explicit declared-not-live errors"
  },
  {
   "id": "C5",
   "name": "renewal-due detection",
   "verdict": "pass",
   "evidence": "10-day PEM -> renewal_due true (days_left 10.0); 90-day PEM -> renewal_due false (days_left 90.0); self-signed detected"
  },
  {
   "id": "C1",
   "name": "staging order end-to-end",
   "verdict": "pass",
   "evidence": "staging account created (kid on acme-staging, environment STAGING); order pending with 1 authorization URL(s)"
  },
  {
   "id": "C2",
   "name": "challenge byte-exact",
   "verdict": "pass",
   "evidence": "challenge file served over local HTTP byte-identical to key authorization (token XyNY6lbYSJl8..)"
  },
  {
   "id": "C3",
   "name": "staging/production labeling",
   "verdict": "pass",
   "evidence": "staging outputs carry STAGING environment (observed in C1); env_label returns 'production' for non-staging URLs (static); no production account created"
  },
  {
   "id": "C6",
   "name": "audit append-only and complete",
   "verdict": "pass",
   "evidence": "audit actions in order ['certificate_status_checked', 'certificate_status_checked', 'account_registered', 'order_created', 'challenges_computed', 'challenge_placed']; jsonl mirror exists with 6 lines == total 6"
  },
  {
   "id": "U1",
   "name": "auth enforced",
   "verdict": "na",
   "evidence": "local stdio transport: no credential layer exists to test; process ownership is the boundary"
  },
  {
   "id": "U2",
   "name": "schema valid",
   "verdict": "pass",
   "evidence": "tools/list returns exactly the 9 tools, each with inputSchema type object + properties + required"
  },
  {
   "id": "U3",
   "name": "no unscoped fetch",
   "verdict": "pass",
   "evidence": "network call sites only inside the Acme client (CA directory/order/auth URLs): [(154, 'Acme'), (159, 'Acme')]"
  },
  {
   "id": "U4",
   "name": "no secret leak",
   "verdict": "pass",
   "evidence": "no secret patterns in 9 tool outputs; account key material stays in state dir (present on disk: True)"
  },
  {
   "id": "U5",
   "name": "sane errors",
   "verdict": "pass",
   "evidence": "unknown CA -> error; unknown tool -> error; malformed line survived; unknown method -> error -32601"
  },
  {
   "id": "U6",
   "name": "process health",
   "verdict": "pass",
   "evidence": "initialize answered in 88 ms; ping ok"
  },
  {
   "id": "U8",
   "name": "bench isolation",
   "verdict": "pass",
   "evidence": "workspace product state byte-identical before/after bench"
  }
 ],
 "notes": [],
 "history": "append-only; prior runs retained in results/"
}