{
 "tool": "eclipse-codex-mcp",
 "version": "0.1.0",
 "bench_date": "2026-10-25",
 "bench_version": "0.1.0",
 "environment": "local",
 "qualifier": "local",
 "verdict": "CERTIFIED(local)",
 "checks": [
  {
   "id": "C1",
   "name": "deadline arithmetic recomputed independently (SAR/CTR/Reg E; holiday cluster + weekend trigger)",
   "verdict": "pass",
   "evidence": "every date recomputed independently from bench inputs matches: SAR Sat 2026-10-24 +30d -> 2026-11-23 (max +60d -> 2026-12-23); CTR 2026-11-25 +15d -> 2026-12-10; Reg E Fri 2026-11-20 +10 business days across the bench holiday cluster (11-26/11-27) -> 2026-12-08; +45d completion -> 2027-01-04; new-account 20bd -> 2026-12-22 with +90d -> 2027-02-18; Reg E report Mon 2026-11-23 +3bd across the cluster -> 2026-11-30"
  },
  {
   "id": "C2",
   "name": "guidance cadence can never read BREACH; a rule clock past due must",
   "verdict": "pass",
   "evidence": "a rule clock (SAR, trigger 2026-09-01, due 2026-10-01) reads BREACH at 2026-10-25, while a guidance-only bench state driven 56 days past its 90-day cadence reads CADENCE_OVERDUE_GUIDANCE and the substring BREACH appears nowhere in its clock_status / clock_exceptions / clock_escalations / deadline_compute outputs"
  },
  {
   "id": "C3",
   "name": "as-of resolution: superseded text by date; an NPRM never resolves as current",
   "verdict": "pass",
   "evidence": "as_of 2025-06-15 resolves the superseded v1 text (history keeps both versions); as_of 2026-06-15 resolves v2; explicit version=v1 still reads the old text; a citation carrying ONLY an NPRM record refuses NO_LIVE_VERSION today and at 2027-06-15 \u2014 proposed text never resolves as current"
  },
  {
   "id": "C4",
   "name": "CDD/CTA + cross-citation merges refused; a same-citation duplicate merges",
   "verdict": "pass",
   "evidence": "CDD/CTA merge refused in BOTH directions and a plain cross-citation pair refused (OBLIGATION_MERGE_FORBIDDEN), self-merge refused, while the same-citation duplicate merges cleanly (state=merged, merged_into set, receipted) \u2014 the guard blocks divergence without over-blocking"
  },
  {
   "id": "C5",
   "name": "OFAC: exact/alias/swap/misspelling flagged; disposition is the officer's, recorded verbatim",
   "verdict": "pass",
   "evidence": "exact, alias, and token-swapped queries all flag BENCH-SDN-001; a one-letter misspelling flags it as a fuzzy NEAR-match (flagged, never silent); a clean name returns NO_MATCH; disposition without officer_ref is refused, an off-vocabulary disposition is refused, a disposition on a NO_MATCH screening is refused \u2014 and the officer's note is stored byte-identical to what the officer wrote"
  },
  {
   "id": "C6",
   "name": "stale screening list announces LIST_STALE",
   "verdict": "pass",
   "evidence": "list provenance renders (id, version, retrieval, entry count); screened at 2027-03-01 against a 2026-10-24 snapshot with a 30-day freshness bound the result announces LIST_STALE instead of quietly trusting it; at 2026-10-25 it reads CURRENT"
  },
  {
   "id": "C7",
   "name": "evidence pack: gap suppression refused AND receipted; gaps mandatory",
   "verdict": "pass",
   "evidence": "passing suppress_gaps is refused by name (GAP_SUPPRESSION_REFUSED) and the attempt exists afterward as a gap_suppression_attempt_refused receipt; a clean build over one sound + two defective bench obligations carries exactly the two gaps (UNMAPPED, MISSING_EVIDENCE) in its mandatory gap section and verifies valid"
  },
  {
   "id": "C8",
   "name": "redaction stays visible on both pack surfaces, marked REDACTED",
   "verdict": "pass",
   "evidence": "redaction without reason+actor is refused (omission at transport -32602 naming both args; present-but-empty at the engine as REDACTION_REQUIRES_REASON_AND_ACTOR); with both, the item REMAINS in the pack on both surfaces (3 obligation entries, 2 gap entries \u2014 counts unchanged), marked redacted with the actor and receipt sequence, and the pack still verifies valid"
  },
  {
   "id": "C9",
   "name": "banned-output lint fires on bench-planted carriers (provision title, obligation note)",
   "verdict": "pass",
   "evidence": "both bench-planted carriers \u2014 a provision TITLE and an obligation NOTE, in two different banned classes \u2014 are quarantined at render: the field is replaced by a hash-only marker whose slug label never reproduces the phrase (sha256 of each original matches the marker's original_sha256), the phrases appear nowhere in the outputs or the receipt ledger, and each quarantine is itself receipted"
  },
  {
   "id": "C10",
   "name": "screening path contains no egress (source-level, span-attributed)",
   "verdict": "pass",
   "evidence": "core_engine.py contains zero egress call sites anywhere \u2014 and specifically none inside screen_lookup / screen_disposition_record / screen_list_info; its imports are difflib/hashlib/json/re/datetime only, so screening is local by construction, not by policy"
  },
  {
   "id": "C11",
   "name": "T3 denylist: builder set + bench additions all refused; exact 21-tool surface",
   "verdict": "pass",
   "evidence": "tools/list is exactly the 21 R0 tools; all 42 denylisted names (23 builder + 19 bench additions incl. freeze_account / close_account shapes) are refused -32602 \u2014 filing, determination, freeze/close, auto-clear, and gap-suppression capabilities are absent, not gated"
  },
  {
   "id": "U1",
   "name": "auth enforced",
   "verdict": "na",
   "evidence": "no credential layer exists on the local stdio transport to test (process-ownership is the boundary, stated never assumed); the capability absences stand in for it \u2014 officer-ref dispositions (C5), suppression refusal (C7), T3 denylist (C11)"
  },
  {
   "id": "U2",
   "name": "schema valid",
   "verdict": "pass",
   "evidence": "tools/list returns exactly the 21 R0 tools, each with inputSchema type object + properties + required"
  },
  {
   "id": "U3",
   "name": "no network surface (source-level)",
   "verdict": "pass",
   "evidence": "server.py + core_engine.py contain no network call sites \u2014 the local-only R0 claim (screening and library run inside the institution boundary) is structural"
  },
  {
   "id": "U4",
   "name": "no secret leak",
   "verdict": "pass",
   "evidence": "no secret patterns in 97 tool outputs"
  },
  {
   "id": "U5",
   "name": "sane errors",
   "verdict": "pass",
   "evidence": "unknown citation / clock rule / clock instance each refuse with a named error; a garbage line on the transport is survived and an unknown method returns -32601, with the server still answering afterward"
  },
  {
   "id": "U6",
   "name": "process health",
   "verdict": "pass",
   "evidence": "initialize answered in 51 ms with serverInfo eclipse-codex 0.1.0; ping returns {}; process alive at suite end"
  },
  {
   "id": "U7",
   "name": "audit completeness (chain valid; tamper detected)",
   "verdict": "pass",
   "evidence": "the ledger accumulated 20 receipts across the suite's actions (provision versions, merges, screenings, dispositions, suppression refusal, pack build/redaction, quarantines, clock opens), chain_valid reported and independently recomputed, GENESIS-anchored \u2014 and a copy with one altered receipt detail verifies chain_valid false on a fresh server"
  },
  {
   "id": "U8",
   "name": "bench isolation",
   "verdict": "pass",
   "evidence": "workspace product state byte-identical before/after bench"
  }
 ],
 "notes": [
  "Local scope: bench-owned synthetic fixture institution (Bench Fictional Bank, N.A.) written by this suite; no real bank data, no real OFAC list, no regulator contact exists in the product or the bench.",
  "R1 \u2014 first live chapter inside a design-partner institution, gated on a signed design partner and a counsel review of claims/output language \u2014 is owner-gated and not tested; it stands in the manifest not_tested list.",
  "U1 is na: local stdio transport has no credential layer to test (process-ownership boundary); the capability absences a credential layer would guard are probed directly in C5 (officer-ref), C7 (suppression), and C11 (denylist).",
  "Re-bench history: run 1 FAILED (U5 subscript-before-guard). Run 2 (retained append-only) FAILED on C8 only \u2014 a bench-suite assertion bound to the pre-fix refusal shape: omission of reason/actor now refuses at the transport (-32602 naming both args, the fix's own sanctioned semantics), so C8 was updated to accept the transport refusal for omission AND to probe present-but-empty reason/actor against the engine named refusal. Run 3 is the standing card. Independent hammer (bench-side, /tmp): 132 wire cases over all 18 id-like (tool,param) pairs x 7 shapes \u2014 zero -32603, zero raw-value messages, zero exception text.",
  "Product observation (non-failing, disclosed): a whitespace-only redaction reason ('   ') is accepted \u2014 reason/actor are checked present + non-empty, not strip-validated. No crash, no leak; the redaction is still receipted with a named actor. Recommendation (strip-validation of reason/actor) routed to the builder as a bench note; it is outside the U5 class and outside C8's letter."
 ],
 "history": "append-only; prior runs retained in results/"
}