{
 "tool": "eclipse-deepfield-mcp",
 "version": "0.1.0",
 "bench_date": "2026-10-25",
 "bench_version": "0.1.0",
 "environment": "local",
 "qualifier": "local",
 "verdict": "CERTIFIED(local)",
 "checks": [
  {
   "id": "D1",
   "name": "unlisted table is absent-equivalent (schema + read)",
   "verdict": "pass",
   "evidence": "schema_read on the real-but-unlisted internal_secrets is indistinguishable from a nonexistent table: same BLOCKED verdict, same reason modulo the queried name itself ('table not visible: <T>'), no schema returned; query_read on both -> BLOCKED identically; zero rows from either"
  },
  {
   "id": "D2",
   "name": "PII masks applied before results exit",
   "verdict": "pass",
   "evidence": "customers row exits masked: email partial ('***' + last-2 only), ssn hash ('sha256:\u2026'), phone null; the raw fixture values appear nowhere in the tool output"
  },
  {
   "id": "D3",
   "name": "cost gate both directions (scan refused, index runs)",
   "verdict": "pass",
   "evidence": "full scan of the 150-row leads table under bench max_scan_rows=100 -> BLOCKED before execution ('cost gate: full scan of 'leads' (150 rows) exceeds max_scan_rows=100 \u2014 refused before execution; plan: SCAN leads'); the indexed rank lookup runs and returns 2 row(s)"
  },
  {
   "id": "D4",
   "name": "literal-smuggled writes blocked in the read path",
   "verdict": "pass",
   "evidence": "a write smuggled behind a literal-terminated SELECT (multi-statement) -> BLOCKED; a CTE-headed DELETE in the read tool -> BLOCKED (classified write); leads still holds all 150 rows afterwards"
  },
  {
   "id": "D5",
   "name": "dry-run / execute affected-count parity",
   "verdict": "pass",
   "evidence": "dry-run reports 3 affected rows and rolls back (deadline unchanged on re-read); execute under the bench mandate commits exactly 3 \u2014 dry-run/execute parity \u2014 and the new deadline reads back"
  },
  {
   "id": "D6",
   "name": "mandate rejections: token, expiry, cap, scope",
   "verdict": "pass",
   "evidence": "all four mandate abuses refused with BLOCKED verdicts: unknown token ('no mandate matches'), expired mandate, 3-row dry-run under a 1-row cap, and a sources-table dry-run under a leads-only mandate; the targeted rows are verifiably unchanged"
  },
  {
   "id": "D7",
   "name": "Postgres entries fail closed with ERROR verdicts",
   "verdict": "pass",
   "evidence": "db_list declares the Postgres entry; schema_read, query_read and write_dryrun against it ALL return fail-closed ERROR verdicts ('adapter unavailable (fail-closed): psql binary not found \u2014 Postgres live path is [verify: no server/driver on this host]') \u2014 no data, no pass, no exception. Postgres live path NOT tested (no server/driver on this host)"
  },
  {
   "id": "D8",
   "name": "receipts carry SQL hash only \u2014 no raw-SQL field",
   "verdict": "pass",
   "evidence": "26 receipts listed; all 9 query-path BLOCKED receipts carry sql_hash (the 2 schema_read blocks take no SQL and carry null by design); a recursive key walk finds NO 'sql' field anywhere in the receipt set, and the smuggled statement text from D4 appears nowhere \u2014 hashes and counts only"
  },
  {
   "id": "D9",
   "name": "receipt chain valid; tamper detected",
   "verdict": "pass",
   "evidence": "receipt_list chain_valid=true over 26 receipts; in-process verify agrees; one altered row-count in a deep copy -> false (tamper detected)"
  },
  {
   "id": "U1",
   "name": "auth enforced",
   "verdict": "na",
   "evidence": "local stdio transport: no credential layer exists to test; process ownership is the boundary (write authority binding is exercised in D6)"
  },
  {
   "id": "U2",
   "name": "schema valid",
   "verdict": "pass",
   "evidence": "tools/list returns exactly the 7 tools, each with inputSchema type object + properties + required"
  },
  {
   "id": "U3",
   "name": "no undeclared network surface",
   "verdict": "pass",
   "evidence": "server.py contains no network or third-party driver call sites (stdlib sqlite3 only); the Postgres adapter sits behind its driver interface and fails closed on this host (D7) \u2014 no undeclared network surface"
  },
  {
   "id": "U4",
   "name": "no secret leak",
   "verdict": "pass",
   "evidence": "no secret patterns in 29 tool outputs; bench mandate tokens never echo back"
  },
  {
   "id": "U5",
   "name": "sane errors",
   "verdict": "pass",
   "evidence": "unknown tool -> error; unknown database -> BLOCKED verdict (not a crash); malformed line survived (db_list answers); unknown method -> -32601"
  },
  {
   "id": "U6",
   "name": "process health",
   "verdict": "pass",
   "evidence": "initialize answered in 72 ms; ping ok"
  },
  {
   "id": "U7",
   "name": "audit completeness (BLOCKED + ERROR receipted)",
   "verdict": "pass",
   "evidence": "ledger receipts cover OK, BLOCKED and ERROR outcomes alike (refusals and failures are receipted, not silent); 27 receipts, seq strictly increasing, hash chain valid"
  },
  {
   "id": "U8",
   "name": "bench isolation",
   "verdict": "pass",
   "evidence": "workspace product state byte-identical before/after bench"
  }
 ],
 "notes": [
  "SQLite adapter exercised live against bench-owned copies of the synthetic fixtures. Bench policy tightens the cost gate (max_scan_rows=100 vs the shipped 10000) so both gate directions are observable on a 150-row table.",
  "Postgres LIVE path is NOT tested and must not be inferred: no Postgres server, psql, or Python driver exists on this host. The bench verifies only the fail-closed posture \u2014 every tool against the policy's Postgres entry returns an ERROR verdict, never data and never a pass. Live verification is spec phase P1.",
  "MySQL/MariaDB, SQL Server, MongoDB, Redis, warehouse and vector adapters are not built (roadmap P1-P4) and were not tested."
 ],
 "history": "append-only; prior runs retained in results/"
}