{
 "tool": "eclipse-constellation-mcp",
 "version": "0.1.0",
 "bench_date": "2026-10-25",
 "bench_version": "0.1.0",
 "environment": "local",
 "qualifier": "local",
 "verdict": "CERTIFIED(local)",
 "checks": [
  {
   "id": "K1",
   "name": "undeclared target invisible to every tool",
   "verdict": "pass",
   "evidence": "target_list shows only the declared self-vm; policy_evaluate on 'ghost-vm' -> DENY (target_declared fail); probe_target on 'ghost-vm' -> error 'not declared \u2014 undeclared targets are invisible'"
  },
  {
   "id": "K2",
   "name": "anonymous actor DENY",
   "verdict": "pass",
   "evidence": "policy_evaluate with an empty actor -> DENY; identity_bound check fails: 'identity is bound, never anonymous'"
  },
  {
   "id": "K3",
   "name": "destructive DENY without snapshot receipt",
   "verdict": "pass",
   "evidence": "destroy with no snapshot_receipt_seq -> DENY; snapshot_precondition fails: 'no snapshot receipt, no mutation'"
  },
  {
   "id": "K4",
   "name": "ALLOW after snapshot evaluation (Tier-2 mutation)",
   "verdict": "pass",
   "evidence": "snapshot_create evaluation -> ALLOW (receipt seq 4); resize citing that receipt -> ALLOW with snapshot_precondition pass ('snapshot receipt 4, 0s old (fresh)')"
  },
  {
   "id": "K5",
   "name": "destroy with fresh snapshot: snapshot gate opens, Tier-3 approval gate is the only remaining DENY",
   "verdict": "pass",
   "evidence": "destroy citing the fresh snapshot receipt: snapshot_precondition PASSES; verdict stays DENY with human_approval as the ONLY failing check \u2014 v0.1 is observe-only and the Tier-3 approval channel is not wired (by design, stated in the verdict's reasons)"
  },
  {
   "id": "K6",
   "name": "stale snapshot re-DENY (1s freshness window)",
   "verdict": "pass",
   "evidence": "bench policy with snapshot_fresh_seconds=1: snapshot_create -> ALLOW (seq 1); after 2.1s the same receipt cited for resize -> DENY, snapshot_precondition fails as stale ('snapshot receipt 1 is stale: 2s old > 1s freshness window')"
  },
  {
   "id": "K7",
   "name": "free-form command refused; fixed-template probe runs",
   "verdict": "pass",
   "evidence": "probe_target with a 'command' argument -> refused ('free-form remote commands are refused'); a shell string as a probe name -> refused ('unknown probe'); the fixed 'identity' template over the declared local channel -> ok=true with parsed host identity"
  },
  {
   "id": "K8",
   "name": "receipt chain valid; tamper detected",
   "verdict": "pass",
   "evidence": "receipt_list chain_valid=true over 7 receipts; in-process verify agrees; one forged verdict in a deep copy -> false (tamper detected)"
  },
  {
   "id": "U1",
   "name": "auth enforced",
   "verdict": "na",
   "evidence": "local stdio transport: no credential layer exists to test; process ownership is the boundary (actor identity binding is exercised in K2)"
  },
  {
   "id": "U2",
   "name": "schema valid",
   "verdict": "pass",
   "evidence": "tools/list returns exactly the 5 tools, each with inputSchema type object + properties + required"
  },
  {
   "id": "U3",
   "name": "no undeclared network/execution surface",
   "verdict": "pass",
   "evidence": "the bench-exercised registry declares exactly one target on the 'local' channel and no ssh target; probes dispatch only fixed templates over declared channels (K7), and undeclared targets are refused before any transport exists (K1). ssh execution is untested by design \u2014 no sshd on this host"
  },
  {
   "id": "U4",
   "name": "no secret leak",
   "verdict": "pass",
   "evidence": "no secret patterns in 14 tool outputs"
  },
  {
   "id": "U5",
   "name": "sane errors",
   "verdict": "pass",
   "evidence": "unknown tool -> error; undeclared probe target -> error; malformed line survived (target_list answers); unknown method -> -32601"
  },
  {
   "id": "U6",
   "name": "process health",
   "verdict": "pass",
   "evidence": "initialize answered in 72 ms; ping ok"
  },
  {
   "id": "U7",
   "name": "audit completeness (DENYs are receipts too)",
   "verdict": "pass",
   "evidence": "ledger holds both ALLOW and DENY evaluation receipts (refusals are receipts too); 7 receipts, seq strictly increasing, chain valid"
  },
  {
   "id": "U8",
   "name": "bench isolation",
   "verdict": "pass",
   "evidence": "workspace product state byte-identical before/after bench"
  }
 ],
 "notes": [
  "Observe-only v0.1: no mutation code paths exist; policy_evaluate returns ALLOW/DENY evaluations and nothing executes. Tier-3 (destructive) evaluations cannot ALLOW in v0.1 by design \u2014 the human approval channel is not wired.",
  "ssh channel live execution is NOT tested by design: this host runs no sshd, the product declares no ssh target in v0.1, and the Eclipse Connect droplet migration is owner-gated per spec. Probes were exercised over the declared 'local' channel only."
 ],
 "history": "append-only; prior runs retained in results/"
}