{"battery":{"absence_audit":"PASS — network imports in odp_client.py only; zero ppubs mentions in code; zero Patent Center code path; WAF/cookie shapes appear only inside guards.py's forbidden-key list; fence banned-vocab grep clean outside fence.py's own lists","diff_engine":"PASS — pure renumber yields 2x RENUMBERED_ONLY; split and merge shapes mechanical; engine equals the bench independent implementation on 300/300 randomized claim sets including number-reuse, duplicate-text, split and merge shapes","fence_battery":"PARTIAL — by-construction fence holds (no verdict is ever produced; served payloads are sealed records only), and 7 of 15 verdict-ask shapes refuse VERDICT_REFUSED by name on all 3 get verbs; 8 shapes are served instead of refused = PW-D2","independent_verifier":"PASS — third implementation written from spec text only (shares only the Ed25519 signature primitive): every package signature OK; per-feed set integrity OK on cardinality AND set; census counts re-derived equal manifest counts; records_root OK; all derived artifacts (ledger/chain/receipt) re-derived BYTE-IDENTICAL for all 4 subject packages + V1","operator_rig":"9/9 PASS — surface exactly 3 verbs; agent verb refused; no-approval, forged-signature, params-swapped and tool-swapped approvals all APPROVAL_INVALID; valid params-bound approval appends; nonce replay refused; drift copy ends 5 EXTERNAL_CONTEXT + 8 WITNESSED untouched","server_rig":"75 PASS / 3 FAIL — the 3 fails are one battery (PW-D2) counted once per get-verb. Passing includes: 13 renamed vendor verbs all -32602 byte-identical; ledger hash-chain links valid and date-ordered; FEE_WINDOW_OPEN always derived:true with derivation_rule named; lapse sentence, recordation sentence, claim shape and section-2.1 descriptor byte-identical to spec; live:true refuses LIVE_LOOKUP_REFUSED naming the latest anchor on all 3 get verbs; identifier battery (malformed / unpublished / not-sealed / not-in-snapshot / snapshot-not-found all refused by name); deep-key scan refuses credential-shaped keys; benign questions do not refuse","tamper_battery":"PASS, all refused by name — (1) equal-count substitution: RECOMPUTE_DIVERGES at feeds[APPLICATION_DATA].record_set; (2) drop-one-feed + duplicate-another at equal total: RECOMPUTE_DIVERGES at feeds[PUBLICATION_XML].record_set; (3) derived-flag flip in a sealed ledger: RECOMPUTE_DIVERGES at derived/ledger.json; (4) prev-manifest record_count flip: CHAIN_LINK_MISMATCH; (5) canon flip: CANON_MISMATCH; (6) RETIRED marker file: SNAPSHOT_RETIRED; (7) retired snapshot served: SNAPSHOT_RETIRED on manifest_verify and snapshot_status. Every package validated RECOMPUTE_MATCH pristine before tampering"},"bench_date":"2026-10-26","bench_version":"verity-full-bench-1","builder_claims_audit":{"anchors":"CONFIRMED — patsnap-anchor-20261020-44a750021372 (30 records, 2 EXCLUDED_NAMED named by locator) + patsnap-anchor-20261026-103474d00bc6 (7 records: APPLICATION_DATA 4, ASSIGNMENT_BULK 2, PTAB_FEED 1); 8 WITNESSED drift records covering all 8 section-9.2 SOURCE_* classes + 4 EXTERNAL_CONTEXT genesis records, separated by record_type and never merged in served output","census_claims":"CONFIRMED — fixture corpus 39 records (APPLICATION_DATA 25, ASSIGNMENT_BULK 5, GRANT_XML 5, PTAB_FEED 3, PUBLICATION_XML 1); 17 distinct transaction codes as served; bench independently re-probed the ODP API without a key: HTTP 401 Unauthorized, exactly as the census states; no corpus storage figure published (Step-0 law honoured); O7 mirror decision correctly left open pending first authenticated bulk pull","retrieval_3_of_9":"CONFIRMED — 33% as claimed; the 3 retrieval-shaped verbs return sealed derived artifacts by number only","runtime_no_network_except_2_sealing_verbs":"CONFIRMED AND STRONGER — no module in the server imports odp_client at all; acquisition lives only in odp_client.py + scripts/run_census.py; no-network serve test PASS (socket creation hard-blocked, all verb classes serve)","standalone_verifier_V1_V2":"CONFIRMED — shipped verifier.py returns RECOMPUTE_MATCH on all 6 sealed packages; the V2 equal-count substitution package refuses RECOMPUTE_DIVERGES naming record fixture:grant/A","subjects_A_to_D":"CONFIRMED — A ledger 21 events with the lapse sequence whole (EXPIRED_FEE_RELATED mid-sequence, REVIVED_AFTER_FEE_LAPSE, FEE_PAID after revival; never terminal); divergence receipt carries all 5 diff classes with the LIMITATION_ADDED span byte-exact; chain A 4 entries + 2 BETWEEN gaps with exact observed strings; B divergence refuses NO_PUBLICATION_BASELINE by name; chain B serves NO_RECORDED_CONVEYANCES as state, not error; C HEAD gap; D PTAB outcome_as_served verbatim","suite_38_of_38":"CONFIRMED — bench re-ran the shipped suite: 38/38 OK; stdio smoke PASS","tools_12_9_agent_ro_plus_3_operator_t3_disjoint":"CONFIRMED — agent surface serves exactly the 9 spec verbs; operator verbs absent (-32602, byte-identical bodies); operator surface serves exactly its 3 verbs; ECDSA/Ed25519 verified approvals exercised end-to-end (operator rig 9/9)"},"canon_notes_rulings":{"note_1_diff_matching_order":"RULED: builder's text-hash-first order is CORRECT / intended. Spec 7.3 defines RENUMBERED_ONLY as 'matched by text hash'. Bench constructed the disagreement shape (baseline {1:'alpha widget', 2:'beta widget'} -> granted {1:'beta widget', 2:'gamma widget'}): text-hash-first yields RENUMBERED_ONLY(claim 1 from baseline claim 2) + CANCELLED_IN_PROSECUTION(1) + ADDED_IN_PROSECUTION(2); number-first yields 2x AMENDED and makes RENUMBERED_ONLY unreachable whenever a number is reused — contradicting the class definition. Engine equals the independent implementation on the shape and on 300/300 randomized sets.","note_2_duplicate_assertions":"RULED: INTENDED, not a defect. Spec 6.1 pins each event to its asserting record (source_record_hash + snapshot per event); no suppression rule exists; the ledger witnesses RECORDS, not facts-in-the-world. Fixture evidence: subject A GRANTED x2 (grant record + ISSUE transaction, distinct hashes), PUBLISHED x2 (publication record + PUB-A1 transaction). Caveat for the card record: consumers must not read event-class counts as fact counts; worth a spec note at next amendment, not a fix.","note_3_private_portal_reading":"CONFIRMED as specced — grep-verified: no Patent Center code path exists at P0 (gate D4 over C2 honoured)."},"defects":[{"detail":"Anchor-1 manifest carries excluded_records[].reason = null for both exclusions and excluded_reason_histogram {\"null\": 2}. Spec 5.3 requires per-snapshot excluded records WITH reason codes, counted in the manifest. Bench repro: derive.canonicalize_record on the fixture raws returns BAD_SOURCE_DATE (fixture:appdata/BADDATE) and NO_SUBJECT_LINK (fixture:grant/ORPHAN) — the sealed manifest should carry exactly those codes. Root cause: seal.py _canon unpacks canonicalize_record's failure tuple wrongly (takes the 2nd element, None, instead of the 3rd, the reason). Mitigating: records ARE named by locator and excluded_count 2 is correct; only the reason codes are lost. Builder's test asserts reasons at the canonicalize layer only — the sealed-manifest layer is untested; fix-round regression must read the SEALED manifest (bench shape).","id":"PW-D1","severity":"MED","title":"Sealed manifest exclusion reasons are null"},{"detail":"server.py _guard_live_and_verdict compiles fence.VERDICT_ASK_TERMS as whole-word matches, so stems never match longer words and several full forms are absent. 8 of 15 bench ask shapes were SERVED (sealed payload returned) instead of refused, identically on subject_ledger_get, claims_divergence_get and assignment_chain_get: 'does it infringe their product?', 'is the patent still alive and strong?', 'validity opinion?', 'infringement analysis?', 'is it infringed?', 'enforceability?', 'infringing products?', 'patent validity check'. 7 shapes refuse correctly (valid / owns / dead / freedom to operate / enforceable / claim scope / cover). Spec 12.4 + 15.7: verdict-shaped requests refuse VERDICT_REFUSED by name, never a softer output. Severity note: no verdict is produced — the by-construction fence holds; the defect is failure to refuse by name.","id":"PW-D2","severity":"MED","title":"VERDICT_REFUSED guard evaded by ordinary word forms"},{"detail":"derive._event copies reason text onto EVERY transaction/PTAB event; spec 6.1 allows reason_as_served only for ABANDONED, else null. verifier.py follows the spec (ABANDONED-only, recomputes event_id accordingly). Bench repro: subject A RESP record + synthetic reason text yields an engine event carrying the text — on such data the engine's own sealed ledger would RECOMPUTE-DIVERGE under the shipped verifier. Unreachable at fixture scope (proven: no fixture record carries reason text on a non-ABANDONED event; the independent verifier matched all packages). Reachable at live ODP ingest. Ruling: spec governs; the engine is the outlier (one-line fix).","id":"PW-D3","severity":"LOW","title":"Engine deviates from spec 6.1 on reason_as_served; engine and shipped verifier disagree"},{"detail":"data/drift.jsonl: every WITNESSED record carries prior_snapshot_id == current_snapshot_id == patsnap-anchor-20261026-103474d00bc6 (anchor 2); the prior must be patsnap-anchor-20261020-44a750021372 (anchor 1). Spec 9.2: each drift record pins prior + current snapshot IDs. Root cause: server.py t_anchor_seal captures the anchors list reference, the new snapshot ID is appended to that same list, and derive.compute_drift is then called with anchors[-1] — by then the NEW anchor — as the prior ID. prev_snapshot_hash, prior fingerprint and all classes/elements/prior/current VALUES are correct (bench verified each against the two manifests' fingerprints: supplemental-exam added, ptab-legacy removed, pct_reference_as_recorded added, transaction_actor_code removed, PTAB type text->code, fee_schedule semantics, access and coverage changes); only the prior-ID pin is wrong, on all 8 records. Serving is unaffected (source_drift_list filters on current_snapshot_id), and the offline verifier does not cover drift.jsonl — nothing downstream catches it.","id":"PW-D4","severity":"MED","title":"All 8 WITNESSED drift records pin the wrong prior snapshot"}],"environment":"Bench executed on the house VM during an intermittent exec write-latch episode (EPERM/silent-zero on exec-spawned writes; file-tool writes healthy). All bench copies were validated RECOMPUTE_MATCH pristine before any tamper; the product tree was never written by the bench and verified intact after (manifest 7209 B, records 17832 B, index 2440 B).","fix_verification":null,"history":["2026-10-26: full bench #1 (this card) — PARTIAL(local, FIXTURE scope). Fix round owed: PW-D1, PW-D2, PW-D4 (+ PW-D3 rider), then scoped re-bench attacking the fix code with fresh shapes."],"n_check":{"detail":"0 of 12 tools are renamed vendor verbs; 13 vendor-verb probes (patent_search, status_lookup, maintenance_fee_calculator, get_patent_pdf, portfolio_monitor, assignment_lookup, ptab_lookup, check_validity, ...) all refused -32602 byte-identical. Strip-the-seal test: remove seal/sequence/recompute and no verb remains. Verdict-field hunt over ALL sealed artifacts (manifests, ledgers, receipts, chains, drift records): zero verdict/risk/score/enforceability/ownership fields under any name (the only 'scope' key is the drift surface name, a spec 9.2 field; 'verdict' appears only in verify-verb responses, the spec 11 output shape). Adding any such field would be a schema 2.0 break per 5.1 — none present.","verdict":"NOVELTY_PROVEN"},"name_status":"Working name internal; listing gated on O1 section-3 + TM screen (owner). No listing action in this bench.","notes":"Certification scope caps at local, FIXTURE scope per builder flag 3 (Accela-style fixture-conformance wording): the sealing/derivation/verification engine is fully exercised and independently recomputed; the corpus is fixture extracts because live ODP ingest is measured blocked without an operator ODP key (MyODP + USPTO.gov + ID.me — operator item). First live seal + O7 backfile-mirror decision wait on that key. Exit at this scope is not a listing: O1 name screen gates listing.","o_bar_measurements":{"O3_event_vocab_coverage":"17 distinct transaction codes as served in the fixture corpus; 16/17 mapped (94.1%) across mapping tables v1+v2; FX-9921 lands UNMAPPED_SOURCE_EVENT with the code verbatim — never dropped, never force-fit. Every event class in every sealed ledger is inside the closed 6.2 vocabulary (25 classes).","O4_divergence_diff_bar":"Subject A receipt hand-checked (all 5 classes; LIMITATION_ADDED span byte-exact substring of granted claim 1, positionally absent from baseline claim 1; counts 5->5, independent 1->1) + engine-vs-independent agreement 300/300 randomized claim sets (100% precision/recall against the independent reference on this sample).","O5_conveyance_vocab":"3 distinct conveyance texts as served in the sealed sample; 2 covered by the 8.2 table (ASSIGNMENT OF ASSIGNORS INTEREST, SECURITY INTEREST); 1 lands UNMAPPED_CONVEYANCE verbatim (CONFIRMATORY LICENSE — subject A chain entry 4). NAME_CHANGE / MERGER / RELEASE / CORRECTIVE_RECORDATION classes are table-ready but unexercised by fixtures (fixture-scope limit, stated)."},"observations":[{"detail":"Spec 15.4's strict global reading of LIMITATION_ADDED span absence is unsatisfiable for repeated-token texts (2 spans in the 300-set property run recur elsewhere in their baseline claims under any positional token diff). The positional reading is the only coherent one; engine and independent implementation agree 300/300; subject A's real span satisfies even the strict reading. Spec-wording amendment candidate, not a builder defect.","id":"PW-O1"},{"detail":"APPROVAL_INVALID (operator-surface refusal) is not in spec 12.4's closed 12-code list. It is the house verified-approval pattern (cf. Roll/Permits); spec-amendment candidate.","id":"PW-O2"},{"detail":"RECEIPT_MALFORMED is in the closed refusal vocabulary but has no reachable input path (no verb accepts a presented artifact). Named-but-unreachable code; note only.","id":"PW-O3"},{"detail":"Manifest source_file_hashes carries per-record SOURCE hashes (for CORRECTION records, the pre-canonicalization source hash — anchor 2 lists ba6bcd11 where records.jsonl carries canonical 884f30de). Naming inherited from spec 5.4 wording; behaviour is consistent and recompute-verified.","id":"PW-O4"},{"detail":"Merkle odd-node rule (duplicate-last) is underdetermined by spec 5.4; engine, shipped verifier and bench independent implementation all implement it identically. Canon-annex candidate.","id":"PW-O5"}],"qualifier":"PARTIAL(local, FIXTURE scope) — mechanism certified-grade; certification withheld on three MED defects (PW-D1, PW-D2, PW-D4). Scope language binding: CERTIFIED scope caps at local, FIXTURE scope — every seal is FIXTURE_SIGNED under fixture keys over fixture extracts; live ODP ingest is MEASURED BLOCKED (bench re-verified HTTP 401 without an operator ODP key) and no live seal exists.","scope_verdicts":{"certification":"WITHHELD pending fix round on PW-D1/PW-D2/PW-D4 (PW-D3 as rider) + scoped re-bench","mechanism":"CERTIFIED-GRADE at fixture scope — sealed legal-status event ledger, claims as-filed vs as-granted divergence receipts, assignment-chain witness, source-drift witness; all derivations independently recomputed byte-identical","n_check":"NOVELTY_PROVEN"},"tool":"eclipse-patent-witness-mcp","verdict":"PARTIAL","version":"0.1.0 (P0, HEAD 4ab3edd)"}