{
 "tool": "eclipse-fathom-mcp",
 "version": "0.1.0",
 "bench_date": "2026-10-25",
 "bench_version": "0.1.0",
 "environment": "local",
 "qualifier": "local",
 "verdict": "CERTIFIED(local)",
 "checks": [
  {
   "id": "F1",
   "name": "registry tamper: audit-date edit fails verification NAMING the entry; get/list fail closed",
   "verdict": "pass",
   "evidence": "one audit-date edit (2022-01 -> 2022-02) in aave-lend-ethereum: registry_verify invalid with failed_entries == ['aave-lend-ethereum'] exactly; registry_list AND registry_get (for an UNtampered entry) both fail closed with REGISTRY_INVALID naming the tampered entry \u2014 no partial-trust reads"
  },
  {
   "id": "F2",
   "name": "wrong-key rebuild: fresh-keypair release does NOT verify against the pinned product pubkey",
   "verdict": "pass",
   "evidence": "bench rebuilt the release from the seed entries and re-signed with a FRESH keypair: entry hashes and release hash still recompute (content is self-consistent), but against the PINNED product pubkey the release_signature check fails and the signer fingerprint does not match the pin \u2014 a self-consistent forgery does not verify; list fails closed"
  },
  {
   "id": "F3",
   "name": "divergence edge: 1.99% renders a number, exactly 2.00% still renders, 2.01% renders DIVERGENT (headline null, both sources shown)",
   "verdict": "pass",
   "evidence": "tolerance edge found honestly (divergence = |oracle-feed|/oracle, strict >): 1.99% -> OK with headline HF 1.6 recomputed; exactly 2.00% -> still OK (edge inclusive); 2.01% -> DIVERGENT with headline health_factor and liquidation_distance_pct both null, both per-source HFs shown (1.6 / 1.5678), and no averaged field anywhere in the row"
  },
  {
   "id": "F4",
   "name": "health factor recomputed independently from raw fixture values (builder's 1.65 not trusted)",
   "verdict": "pass",
   "evidence": "recomputed from the RAW fixture file (no builder numbers trusted): supplied 10 ETH x 3200 = 32000, LT 0.825, borrowed 16000 USDC -> HF 26400/16000 = 1.65, distance 39.39%; independent-feed HF recomputed with per-source prices (ETH 3190 / USDC 0.9997) = 1.6453; server matches both to the rounded digit"
  },
  {
   "id": "F5",
   "name": "allowance_audit: bench grants ranked by value-at-risk; UNLIMITED + UNRESOLVED labeled",
   "verdict": "pass",
   "evidence": "bench grants ranked exactly by value-at-risk [10000, 6400, 4000, 2000]: unlimited Permit2 grant tops the list at full balance, resolved to a Uniswap Permit2 registry entry (citation verified independently: the cited entry contains this spender, tier RT-1 \u2014 the address-keyed index cites one of the three chain entries carrying the canonical Permit2 address, here the base entry for an ethereum grant; all cited facts true, tier identical across the colliding entries); unlimited grant to an unknown spender ranks second at its WETH balance value (6400) labeled UNRESOLVED; finite grants value at min(amount, balance); summary totals recomputed: 4 grants, 2 unlimited, 2 unresolved, 22400 total"
  },
  {
   "id": "F6",
   "name": "lookalikes: bench middle-char flip and same-prefix/suffix variants flagged LOOKALIKE",
   "verdict": "pass",
   "evidence": "bench-generated variants of the Aave Pool address: a single MIDDLE-char flip (39/40 positional matches) and a same-first-6/same-last-6 twin with an entirely different middle BOTH return LOOKALIKE naming the real Registry address; the genuine address still returns REGISTERED and an all-9s address NOT_REGISTERED"
  },
  {
   "id": "F7",
   "name": "key material refused in every field shape; probe strings absent from outputs, state, receipts",
   "verdict": "pass",
   "evidence": "4 probe shapes \u2014 bare 64-hex in a note field, xprv-shaped string as entry_id, 12-word seed-phrase shape as asset, bare hex nested in a list argument \u2014 ALL refused with KEY_MATERIAL_REFUSED before tool logic; exactly 4 key_material_refused incident receipts written; probe strings absent from every response, the receipt ledger, and the state file"
  },
  {
   "id": "F8",
   "name": "output lint quarantines a planted yield promise in a registry TRUST NOTE (new location)",
   "verdict": "pass",
   "evidence": "bench-signed registry (valid under its own bench pin) carrying a planted trust note with a yield promise + safety claim + recommendation for lido-stake-ethereum: registry_get returns the trust_note QUARANTINED in place; none of the three planted phrases survive anywhere in the output; lint_flags name all three banned classes \u2014 the lint holds in the registry location, not only the builder's indexer note"
  },
  {
   "id": "F9",
   "name": "denylist: exactly the 10 D0 read tools; no execution/draft/sign tool exists",
   "verdict": "pass",
   "evidence": "tools/list is exactly the 10 D0 read tools; 26 forbidden names (swap/lend/borrow/stake/bridge/execute/sign/approve/set_allowance/draft_tx/prepare_tx/transfer/vote/import_key/place_order/wallet_create et al.) each refused by direct call with -32602 \u2014 no execution, draft, or signing surface exists"
  },
  {
   "id": "U1",
   "name": "auth enforced",
   "verdict": "na",
   "evidence": "local stdio transport has no credential layer to test \u2014 process ownership is the boundary (the standing U1 note); live RPC transport is unshipped per the manifest not_tested"
  },
  {
   "id": "U2",
   "name": "schema valid",
   "verdict": "pass",
   "evidence": "tools/list: all 10 tools carry a name and an object inputSchema with properties/required"
  },
  {
   "id": "U3",
   "name": "no network surface (source-level)",
   "verdict": "pass",
   "evidence": "source scan of server.py + chain_adapter.py + registry_sig.py: zero network/process call sites (no urllib/socket/requests/http.client/urlopen/subprocess) \u2014 fixture transport only"
  },
  {
   "id": "U4",
   "name": "no secret leak",
   "verdict": "pass",
   "evidence": "secret scan over all bench outputs + both bench state files: no credential-shaped strings; the registry release private key never appears (verification used the pinned public key only)"
  },
  {
   "id": "U5",
   "name": "sane errors",
   "verdict": "pass",
   "evidence": "unknown contract -> NOT_REGISTERED refusal; unknown portfolio -> SNAPSHOT_NOT_FOUND naming the fixture transport honestly; malformed address -> ADDRESS_FORMAT; all structured errors, no tracebacks"
  },
  {
   "id": "U6",
   "name": "process health",
   "verdict": "pass",
   "evidence": "ping answers; initialize latency 50 ms recorded at setup"
  },
  {
   "id": "U7",
   "name": "audit completeness (receipt chain + counts)",
   "verdict": "pass",
   "evidence": "fresh ledger: 3 calls -> exactly 3 receipts in order (registry_verified, depeg_watch_read, address_checked); receipt_list itself emits none; hash chain verifies end to end"
  },
  {
   "id": "U8",
   "name": "bench isolation",
   "verdict": "pass",
   "evidence": "workspace product state byte-identical before/after bench"
  }
 ],
 "notes": [
  "Local scope: D0 ships the fixture transport only \u2014 all reads ran against bench-owned fixture portfolios and registries in /tmp; no live chain was queried.",
  "Live RPC reads are NOT tested: no live transport exists in the package (the seam + contract are the D0 deliverable); the manifest not_tested carries this verbatim.",
  "U1 is na: local stdio transport \u2014 process ownership is the boundary; no credential layer exists to test.",
  "Divergence tolerance edge measured honestly: divergence is |oracle-feed|/oracle per asset; exactly 2.00% renders a headline number (comparison is strict >), 2.01% renders DIVERGENT.",
  "Run 1 PARTIAL card retained append-only: its F5 untestable was a bench-suite assertion defect (the suite assumed the citation would name the ethereum entry for the canonical Permit2 address, which three chain entries share; the product's address-keyed index cites one of them). Suite fixed to verify the citation independently; run 2 is the standing card. No product code touched.",
  "F5 product observation (non-failing): spender resolution is chain-agnostic \u2014 an ethereum-chain grant to the canonical Permit2 address was cited to uniswap-swap-base. Every cited fact was true and the tier is identical across the colliding entries in this release, but chain-aware resolution is recommended before D1, where tiers could diverge per chain."
 ],
 "history": "append-only; prior runs retained in results/"
}