{
 "tool": "eclipse-crosswalk-mcp",
 "version": "0.1.0",
 "bench_date": "2026-10-26",
 "bench_version": "0.1.0",
 "environment": "local",
 "qualifier": "local",
 "verdict": "CERTIFIED(local)",
 "checks": [
  {
   "id": "C1",
   "name": "as-of resolution across superseded pairs; proposed never resolves as current",
   "verdict": "pass",
   "evidence": "both shipped superseded pairs resolve historically: co-effective as_of 2025-06-01 -> v1 ('1 February 2026'), as_of 2026-10-25 -> v2 ('30 June 2026', versions_available [1,2]); eu-annexiii-timing 2025 -> v1 ('2 August 2026'), 2026 -> v2 ('2 December 2027'); search as_of agrees. The proposed 4 CCR 1340 record resolves resolved_as_current=False / current_obligation=False today AND at 2027-06-15, in provision and search, and backs no obligation in any of the four role maps \u2014 proposed text never resolves as a current obligation; change events render as data (3, each with affects_obligations + affects_clocks)"
  },
  {
   "id": "C2",
   "name": "role scoping: same provision, different sets per role; role-less refuses BY NAME",
   "verdict": "pass",
   "evidence": "the SAME provision (EU Art. 50) yields disjoint obligation sets by role: provider={ob-eu-art50-provider}, deployer={ob-eu-art50-deployer}, and the full EU sets are disjoint with every link role-stamped; role-less queries (missing AND blank) refuse ROLE_REQUIRED by name on map and coverage \u2014 roles are never merged; unknown roles refuse ROLE_UNKNOWN; CO statutory 'developer' duties ride under provider WITH the disclosure in the obligation title, while role='developer' itself refuses by name (adjudicated B-XW-4, NOTES)"
  },
  {
   "id": "C3",
   "name": "classification candidates: incomplete facts, fact-hash, stale-flag, determination empty",
   "verdict": "pass",
   "evidence": "complete facts render ANNEX_III_CANDIDATE with criteria shown and facts_hash == the bench-recomputed sha256(canon(facts)) (a8060471072e...); incomplete bench facts AND the shipped partial-facts fixture system both render CLASSIFICATION_FACTS_INCOMPLETE with candidate=None and the missing facts named \u2014 never a guessed tier; a fact change for the same system returns stale_flagged=True citing the previous hash (the earlier candidate is not silently recomputed), and re-running the changed facts clears the flag; the determination field is '' with owner 'customer role' in every variant"
  },
  {
   "id": "C4",
   "name": "banned-language law: planted verdict carriers quarantined at render (fixture + imported + facts)",
   "verdict": "pass",
   "evidence": "three independent planted carriers \u2014 the shipped fixture deployer's source note, a bench-imported inventory note, and a verdict string planted as a classification fact \u2014 are ALL quarantined at render (the field is replaced by a quarantine marker); a scan of every output produced so far finds none of the 11 bench-restated \u00a72.2 banned phrases"
  },
  {
   "id": "C5",
   "name": "clock computation recomputed BY HAND bench-side (business/calendar/fixed/annual)",
   "verdict": "pass",
   "evidence": "every due date recomputed BY HAND bench-side from the shipped calendar (holidays ['2026-01-01', '2026-07-03', '2026-12-25']) matches: incident window Fri 2026-10-23 +15 business days -> 2026-11-13; guidance cadence 2026-01-01 +90 calendar days -> 2026-04-01; CO annual 2026-06-30 +365d -> 2027-06-30; Art. 50 fixed date 2026-08-02 from its provision record; computation strings show their inputs and rule/guidance types are distinct in the rule records"
  },
  {
   "id": "C6",
   "name": "guidance vs rule past-due language; TRIGGER_UNRESOLVED loud",
   "verdict": "pass",
   "evidence": "a guidance cadence 207 days past its computed due date renders CADENCE_ELAPSED with cadence language only, while a rule clock past its fixed date renders PAST_DUE \u2014 and the word for a legal breach appears NOWHERE in any output of the run so far (full-output scan); a trigger-dependent rule opened without a trigger renders TRIGGER_UNRESOLVED in the open result, in clock_status (note: shown loudly, never silently), and as an exception row \u2014 loud on every surface, due_date null"
  },
  {
   "id": "C7",
   "name": "coverage honesty + no-inventory org-level mapping with gap stated",
   "verdict": "pass",
   "evidence": "coverage renders unmapped FIRST (key order) and first-class: CO deployer with only a risk-management record supplied -> mapped 1 / partial 0 / unmapped 2 (impact assessment, consumer notice), each unmapped row naming its missing evidence types; with no inventory linked, obligation_map renders at organization (role-level) scope with the gap stated verbatim ('no system inventory linked \u2014 mapping is role-level only'); with the fixture inventory linked the gap disappears and system links carry customer provenance, never blended with the editorial link provenance"
  },
  {
   "id": "C8",
   "name": "evidence pack: seeded gaps mandatory, suppress_gaps refused AND receipted, hash recomputed bench-side",
   "verdict": "pass",
   "evidence": "suppress_gaps=True refuses SUPPRESS_GAPS_REFUSED by name, builds no pack, and the attempt exists as exactly one refusal receipt; a clean build's mandatory gap section contains all three seeded unmapped CO deployer obligations plus the inventory gap (gap_count 4), the pack standing carries 'determination and sign-off: [customer role]', and the pack closes with a hash-chained receipt: pack_hash recomputed bench-side (sha of prev receipt hash + canon(core)) matches the stored hash and the ledger receipt that carries it; verify reports hash_valid + chain valid"
  },
  {
   "id": "C9",
   "name": "[verify] flags preserved on every rendered surface (library + clocks)",
   "verdict": "pass",
   "evidence": "all six [verify]-flagged library records render verify=True + verify_note, and every clock surface preserves the flag"
  },
  {
   "id": "C10",
   "name": "denylist: no filing/determination/submission tool; exact 14-tool surface; NO banking content (Codex cross-contamination)",
   "verdict": "pass",
   "evidence": "tools/list is exactly the 14 \u00a76.5 tools; all 41 denylisted names (19 builder + 22 bench additions incl. file/submit/determine/classify/certify/suppress shapes) refused -32602 \u2014 no filing, submission, regulator-channel or determination tool exists; cross-contamination check: none of 11 Codex corpus strings (CFR citations, FinCEN, OFAC, Basel, SAR, beneficial ownership, ...) appears in server.py / crosswalk_engine.py / library_data.py / fixture data / any tool output, and a library search for 'bank' returns 0 \u2014 separate repo, separate data (\u00a74.2)"
  },
  {
   "id": "C11",
   "name": "hostile guards: parse_time offset-less refusals on every time param; coerce_int_param probes",
   "verdict": "pass",
   "evidence": "offset-less datetimes refuse TIME_OFFSET_REQUIRED BY NAME on every time parameter (library_search.as_of, library_provision.as_of, library_changes.since, clock_open.trigger_date, clock_status.as_of, clock_exceptions.as_of \u2014 6/6); invalid calendar dates and non-string times refuse TIME_FORMAT; Z-form, explicit-offset and bare-date forms are accepted \u2014 no timestamp is ever guessed. coerce_int_param (Blackbox pattern): bool / non-numeric string / non-integral float / list / dict refuse LIMIT_FORMAT and RECEIPT_SEQ_FORMAT by name on both int params, while int-shaped strings and integral floats are accepted"
  },
  {
   "id": "C12",
   "name": "refusal state-purity: domain byte-identical, only refusal receipts appended",
   "verdict": "pass",
   "evidence": "a 10-probe refusal battery refuses every probe by name; domain state (clocks / classifications / packs, canonical JSON) is BYTE-IDENTICAL afterwards \u2014 the only growth is exactly 10 refusal receipts and the receipt chain (bench-recomputed) still verifies"
  },
  {
   "id": "C13",
   "name": "audit: receipt chain recomputed bench-side; receipt/pack/fact-hash tamper detected",
   "verdict": "pass",
   "evidence": "the receipt ledger (60 receipts) recomputes bench-side end to end: GENESIS-anchored, seqs contiguous, every hash = sha(prev + canon(entry)) and receipt_list agrees; tampering one receipt detail in a COPIED state flips chain_valid to False on a fresh server; emptying a pack's gaps in a copy flips its hash_valid to False (gaps_present stays True on the emptied key \u2014 cosmetic, B-XW-6); forging the stored fact-set hash for a system surfaces on the next candidate as stale_flagged=True with previous_facts_hash = the forged value \u2014 tampering is detected and displayed, never silently trusted"
  },
  {
   "id": "N1",
   "name": "N-check: Credo/Holistic-style GRC export cannot become law or a verdict; surface audit",
   "verdict": "pass",
   "evidence": "N-CHECK \u2014 novel mechanism (one line): a versioned obligation library with as-of resolution + a role dimension + fact-hash-bound candidates whose determination is permanently empty/customer-owned + mandatory pack gaps \u2014 imported data can LINK to editorial obligations, it can never BECOME law or a verdict. Distinguishing results: a Credo/Holistic-style GRC export (unversioned obligation rows, a dashboard verdict string in its notes, a vendor determination field) fed as imported inventory changes NOTHING structural: obligation_map returns exactly the 8 editorial deployer obligations (no vendor row becomes an obligation), the verdict strings are quarantined at render (zero banned phrases in the outputs), the vendor's unversioned provision ids refuse PROVISION_NOT_FOUND and search finds no vendor content in the library \u2014 unversioned content never resolves as current law \u2014 and the candidate built from vendor facts still carries determination='' owned by 'customer role' with the planted determination value quarantined. A GRC incumbent, whose export rows ARE its obligations and whose dashboard verdict IS its output, fails every limb. Surface audit: 4/14 tool names carry vendor-verb shapes (['library_search', 'evidence_pack_verify', 'receipt_list', 'receipt_verify']) = 29% < 80% novelty bar"
  },
  {
   "id": "U1",
   "name": "auth enforced",
   "verdict": "na",
   "evidence": "no credential layer exists on the local stdio transport to test (process-ownership is the boundary, stated never assumed); the capability absences stand in for it \u2014 role refusals (C2), suppression refusal (C8), T3 denylist (C10)"
  },
  {
   "id": "U2",
   "name": "schema valid",
   "verdict": "pass",
   "evidence": "tools/list returns exactly the 14 tools, each with inputSchema type object + properties + required; required sets are exactly {provision_id}, {rule_id}, {as_of}, {as_of} where the spec sketch binds them and empty elsewhere"
  },
  {
   "id": "U3",
   "name": "no network surface (source-level)",
   "verdict": "pass",
   "evidence": "server.py + crosswalk_engine.py + library_data.py contain no network or process call sites \u2014 the local-only X0 claim is structural (stdlib hashlib/json/re/datetime only)"
  },
  {
   "id": "U4",
   "name": "no secret leak",
   "verdict": "pass",
   "evidence": "no secret patterns in 145 tool outputs or in the bench state file"
  },
  {
   "id": "U5",
   "name": "sane errors (schema fuzz + hostile inventory entries + raw transport junk)",
   "verdict": "pass",
   "evidence": "malformed inputs refuse BY NAME: 12 named probes; schema-enumerated fuzz 167 wrong-type probes across all 14 tools with zero -32603 / raw-exception escapes (11 benign accepts); hostile inventory entries refuse by name with domain state unchanged; garbage lines draw a response and the server answers ping + -32601 for an unknown method afterwards"
  },
  {
   "id": "U6",
   "name": "process health",
   "verdict": "pass",
   "evidence": "initialize answered in 68 ms with serverInfo eclipse-crosswalk 0.1.0; ping returns {}; process alive at suite end"
  },
  {
   "id": "U7",
   "name": "audit completeness + global banned/determination scan over ALL outputs",
   "verdict": "pass",
   "evidence": "the ledger is complete: receipt_list count (239) equals the state file, chain_valid True, and every act class of the run is receipted (obligation_mapped, classification_candidate, clock_opened, evidence_pack_built, refusal). GLOBAL CLOSING SCANS over all 334 outputs of the run: zero \u00a72.2 banned phrases, and every 'determination' field anywhere (recursive walk) is '' with owner 'customer role' \u2014 the determination stayed customer-owned in every output, not just the classification surface"
  },
  {
   "id": "U8",
   "name": "bench isolation",
   "verdict": "pass",
   "evidence": "workspace product state byte-identical before/after bench"
  }
 ],
 "notes": [
  "Local scope (X0): library + mapper + deadline engine over fixture/synthetic deployers, bench state in /tmp; no real customer data, no regulator contact. Gate X1 (live customer data: counsel review + design partner, spec \u00a76.8) is owner-gated, not tested, in manifest not_tested.",
  "U1 is na: local stdio transport has no credential layer to test (process-ownership boundary); capability absences stand in for it (role refusals C2, suppression refusal C8, denylist C10).",
  "DEVIATION ADJUDICATED \u2014 no ECDSA pack signing: SOUND vs spec. \u00a76.4 closes a pack with a 'Herald-shape hash-chained receipt' \u2014 a hash chain, not a signature mandate. The build ships pack_hash = sha(prev_receipt_hash + canon(core)) and a ledger receipt carrying that hash; C8 recomputes it bench-side and C13 proves tamper breaks it. Residual, recorded: a fully re-hashed forged pack+ledger is out of scope for local v0 (Blackbox tail-truncation honesty pattern). Not a defect.",
  "DEVIATION ADJUDICATED \u2014 [verify] flags on clock surfaces: DEFECT, backlog B-XW-2 (MEDIUM). Library records preserve the flag (verify field + note on all six flagged records, C9 pass limb). Clock surfaces drop it: (a) clock_rules for co-effective carries NO marker, though its provision v2 verify_note names the effective date itself as the flagged item; (b) clock instances (open/status/exceptions, and pack clock_history) for eu-annexiii-apply, co-effective and eu-incident-window render the flagged date/window with no marker at all. That breaks the README's own claim that flagged items 'carry that flag in the record and in rendered output'. C9 FAILS on this limb.",
  "DEVIATION ADJUDICATED \u2014 EU incident window: DEFECT, backlog B-XW-3 (MEDIUM). Rule eu-incident-window carries a 15-business-day window under structured provision_id eu-art26, while its own title says '[verify window against Article 73 at build]' \u2014 Art. 73 is the incident-reporting article, Art. 26 is deployer duties, and no Art. 73 provision record exists in the library. The arithmetic is correct (C5); the structured citation linkage is not, and the flag drops in instances (B-XW-2).",
  "DEVIATION ADJUDICATED \u2014 CO 'developer' mapped under provider role: ACCEPTED for v0, backlog B-XW-4 (LOW). The mapping is disclosed in the obligation title itself ('(developer role in the Colorado chapter)'), and a role='developer' query refuses ROLE_UNKNOWN by name rather than silently merging into provider (C2) \u2014 honest refusal, not silent mis-mapping. Spec \u00a76.2's per-regime role variants are not implemented in the v0 vocabulary; add a developer alias/recorded-variant in v0.2.",
  "DEFECT \u2014 hostile inventory entries: backlog B-XW-1 (HIGH). A non-object entry in a caller-supplied inventory list, probed with a system_ref, escapes as a raw -32603 AttributeError in obligation_map AND classification_candidates (_system_by_ref calls .get on the entry) \u2014 contradicting the named-refusal / sane-error law and the server's own refusal-purity invariant (the escape path skips even the refusal receipt). No state is corrupted (asserted in U5), but U5 FAILS.",
  "OBSERVATION (low, B-XW-5): a superseded record resolved at a historical as_of renders current_obligation=True \u2014 defensible as-of semantics (it WAS in force on that date), but the field name invites misreading outside its as_of context; rename/document in v0.2.",
  "OBSERVATION (low, B-XW-6): evidence_pack_verify reports gaps_present=True for a tampered pack whose gaps list was emptied (it checks key presence); the fraud is still caught \u2014 hash_valid flips False (C13) \u2014 so the boolean is cosmetic, not a verification bypass.",
  "Run 1 card retained append-only: C1 read untestable \u2014 a BENCH-SUITE assertion bound library_search results to the library_provision wrapper shape (search results are bare records). Suite assertion fixed; no product code was touched between runs. Run 2 is the standing card.",
  "OBSERVATION (low, B-XW-7): classification facts are presence-checked, not type-checked (a list-valued intended_purpose counts as present and is hashed as recorded). No tier is guessed and the determination stays empty; type-validating fact values is a v0.2 hardening."
 ],
 "history": "append-only; prior runs retained in results/"
}