{
 "tool": "eclipse-envoy-mcp",
 "version": "0.1.0",
 "bench_date": "2026-10-25",
 "bench_version": "0.1.0",
 "environment": "local",
 "qualifier": "local",
 "verdict": "CERTIFIED(local)",
 "checks": [
  {
   "id": "E1",
   "name": "three-key binding: every subset NOT BOUND with missing keys named; full set binds",
   "verdict": "pass",
   "evidence": "all enumerated subsets NOT BOUND with missing keys named exactly ({} -> 3 missing; approval -> 2; +delegation -> 1 [wallet_mandate]; mandate-only and delegation+mandate rooms still missing owner_approval); full three-key set binds room 1"
  },
  {
   "id": "E2",
   "name": "no binding tool exists on either surface (dispatch-table enumeration + direct calls)",
   "verdict": "pass",
   "evidence": "dispatch tables disjoint (12 external / 24 operator); zero tool names contain any of sign/commit/pay/transfer/fund/wire/settle/contract/approve; 9 operator verbs refused by direct call on the external surface; 7 invented binding tools refused on both"
  },
  {
   "id": "E3",
   "name": "NDA gate: owner record opens + render log cites it; asserted/forged/wrong-party/ghost refusals byte-identical",
   "verdict": "pass",
   "evidence": "no-NDA / forged-id / wrong-counterparty-id / ghost-fact refusals are byte-identical ({\"status\": \"not_available_at_your_tier\"}); non-owner NDA entry refused; owner-entered record nda_86804b63e129 opens the render and the disclosure log cites that record id"
  },
  {
   "id": "E4",
   "name": "publication lint: bench-poisoned identity renders NOTHING (named block, zero facts)",
   "verdict": "pass",
   "evidence": "bench-poisoned identity ('ACME Defense Systems' appended to a T-public fact): identity_get REFUSED with PUBLICATION_LINT_BLOCKED naming the term \u2014 no card, no facts, no partial render"
  },
  {
   "id": "E5",
   "name": "typosquat: own R1 record + similarity flag; honest org's tier + disclosure history untouched",
   "verdict": "pass",
   "evidence": "bench homoglyph lookalike (CopperIine / copperliine.example) registered as its OWN record at R1 with similarity_flags[0].similar_to = copperline.example; honest org still R2 and its disclosure log (facts + entry count) is unchanged across the lookalike's arrival \u2014 zero inherited history"
  },
  {
   "id": "E6",
   "name": "40-question crawl: uniform refusals, zero above-tier facts, pattern visible in log",
   "verdict": "pass",
   "evidence": "40/40 crawl questions (7 above-tier ids x4 + 12 ghosts) refused with ONE identical shape; hostile org's fact_ids_ever_rendered = []; the pattern is visible as exactly 40 disclosure_refused events in the audit log"
  },
  {
   "id": "E7",
   "name": "inquiry flood creates ZERO owner-gate items",
   "verdict": "pass",
   "evidence": "30-inquiry flood from the hostile org: 25 opened (form-class), 5 rate-limited, owner_gate_items delta = 0 (2 -> 2) \u2014 no counterparty action created owner work"
  },
  {
   "id": "E8",
   "name": "envelope replay refused + receipted; cross-room citation confirms nothing",
   "verdict": "pass",
   "evidence": "valid envelope stored; the SAME envelope replayed -> refused, with a replay event receipted in the audit chain; citing room A's draft hash inside room B stored as data only \u2014 room B draft_versions stays 1, nothing adopted or confirmed"
  },
  {
   "id": "E9",
   "name": "global kill stops engagement, identity keeps serving; SAM status byte-check",
   "verdict": "pass",
   "evidence": "SAM fact byte-check: carries exactly 'renewal submitted, activation pending', no Active claim; under global kill, capability_exchange refused while identity_get still serves the signed corporate card; owner reinstate restores"
  },
  {
   "id": "E10",
   "name": "rate-card render carries shape only \u2014 no amounts anywhere in the tier view",
   "verdict": "pass",
   "evidence": "R2 tier view renders 12 facts incl. ratecard.shape; amount scan ($ figures, USD, per-hour) over EVERY rendered fact: zero hits \u2014 shape only, no numbers originate"
  },
  {
   "id": "U1",
   "name": "auth enforced",
   "verdict": "na",
   "evidence": "operator-channel authentication is process ownership in E0 (stdio); spec 11.2 defers attributable-principal auth to the E1 build \u2014 stated in the manifest not_tested, never assumed"
  },
  {
   "id": "U2",
   "name": "schema valid on both surfaces",
   "verdict": "pass",
   "evidence": "tools/list on both surfaces: every tool carries a name + inputSchema (12 external, 24 operator)"
  },
  {
   "id": "U3",
   "name": "no network surface (source-level)",
   "verdict": "pass",
   "evidence": "server.py source scan: no urllib.request/urlopen/requests/http.client/socket/subprocess call sites \u2014 the only urllib import is urlparse (string parsing)"
  },
  {
   "id": "U4",
   "name": "no secret leak",
   "verdict": "pass",
   "evidence": "secret scan over all bench outputs + the state file: no credential-shaped strings (private keys are generated into the bench key dir and never rendered)"
  },
  {
   "id": "U5",
   "name": "sane errors",
   "verdict": "pass",
   "evidence": "missing-arg call and unknown-tool call both return structured errors; no tracebacks or stack data in any payload"
  },
  {
   "id": "U6",
   "name": "process health",
   "verdict": "pass",
   "evidence": "ping answers on both surface processes; initialize latency recorded at setup (external + operator servers healthy)"
  },
  {
   "id": "U7",
   "name": "audit completeness (chain + herald_call events)",
   "verdict": "pass",
   "evidence": "audit_review verifies the hash chain; 111 events recorded incl. herald_call ops ['cards.sign_card', 'cards.verify_card', 'gateway_delegate.reference'] (Herald consumed by import, not forked); zero settlement/payment event kinds exist"
  },
  {
   "id": "U8",
   "name": "bench isolation",
   "verdict": "pass",
   "evidence": "workspace product state byte-identical before/after bench"
  }
 ],
 "notes": [
  "Local scope: E0 is fully offline \u2014 counterparties are bench-minted fixture orgs on .example domains with local 1024-bit keys; the card/JWS verification exercised is the production Herald machinery, the fetch is the fixture seam.",
  "E1 (hosted endpoint, real counterparty pilot, directory listings) is owner-gated and not tested; the manifest not_tested list carries it verbatim.",
  "U1 is na: the operator channel's authentication is process ownership in E0 (the standing note); spec 11.2 requires attributable-principal receipts at E1."
 ],
 "history": "append-only; prior runs retained in results/"
}