{"battery":{"B14_oracle_spot":"PASS — both directions byte-identical unknown_tool (see operator_surface_confusion)","B2_chain_tamper_spot":"PASS — two fresh on-disk shapes against a Rig D-built 3-receipt chain: (1) edit sealed status_as_served in ledger.jsonl -> fresh load verify_chain = (False, 'receipt_hash at seq 1'); (2) drop the middle receipt -> fresh load = (False, 'seq at position 1')","B4_unchanged_read_spot":"PASS — identical re-read: UNCHANGED, revalidated true, chain length stays 1","B7_refusal_battery_rerun":"PASS — full re-run with Rig C shapes plus fresh shapes (see fix_verification.P-D1). Name probes were not re-run (unchanged code path, card -1 PASS); key-refusal sub-item that capped card -1 now passes on 14/14 verbs, top-level and nested","false_positive_sweep":"PASS — zero legitimate-traffic refusals. witness_verify of the REAL NYC receipt + REAL person-bearing payload snapshot (applicant_name / owner_name / contractor_name keys at depth) returns RECEIPT_VERIFIED via stdio AND via handle(); citizen session_open with a mandate whose route scopes carry holder slots named applicant_name / owner_name / contractor_name OPENS (direct and handle() paths); checklist_get with a rich nested context block serves the artifact VERBATIM; plain coverage_list / checklist_list / watch_list / receipt_get all behave as card -1","key_variants_fresh":"PASS as exact-match law, recorded as observation P-O4 — case variants (Project_Description, PROJECT_DESCRIPTION, Project, projectDescription, PERSON, Person_Name), whitespace-padded, NBSP, zero-width-space, and unicode-lookalike keys (Cyrillic/Greek/fullwidth substitutions) are NOT refused: they are distinct JSON member names outside the closed sets, no verb reads them under any spelling, and they are inert in every shape probed (served responses byte-equivalent to the same call without the key). Refusal is key-shaped: fence names embedded in STRING VALUES (notes, comments, a chain_id literally equal to 'project_description', the query word 'project') never trip the fence","operator_surface_confusion":"PASS — operator verb names on the agent surface (with fence keys attached) return the generic unknown_tool payload BYTE-IDENTICAL to gibberish; agent verb names + session_open on the operator surface likewise; a T3-signed mandate_issue carrying fence keys top-level AND nested inside the signed mandate body ISSUES on the operator surface (guard absent there by construction, B14 pin holds; the fence keys are inside the signed params, inert data)","robustness":"PASS — non-object arguments (list / bare string) never crash the server (list carrying a fence dict refuses by name; bare string is inert for an arg-less verb); a raw 3000-deep nested value at request root level parses and the server answers and stays live; duplicate benign keys serve normally","suite_smoke":"PASS — bench re-run: unittest discovery 43/43 OK (builder's +3 guard tests included); smoke.py: SMOKE PASS both surfaces"},"bench_date":"2026-10-26","bench_version":"Scoped re-bench of the fix round ONLY (P-D1 + P-D2), fresh shapes per house law: Rig D (bench-owned, rig_d_rebench.py) — B7 full re-run (7 fence shapes x 14 agent verbs) + case/whitespace/unicode-lookalike key variants, string-value embedding, extreme nesting (in-args to depth 250, root-level raw depth 3000), arrays-of-arrays, duplicate raw-JSON keys, non-object arguments, operator-surface confusion incl. T3-signed operator call carrying fence keys, false-positive sweep on legitimate rich traffic (real NYC receipt + person-bearing payload via witness_verify on both stdio and handle() paths; citizen session_open with person-slot-bearing mandate scopes), P-D2 independent audit (own person-value scan, structural key scan, spec-only recompute, receipt byte-identity vs 37a228d), regression spot (B2 two on-disk shapes, B4 unchanged-read, B14 oracle both directions), suite + smoke re-run","builder_claims_audit":{"deep_scan_exact_closed_sets":"CONFIRMED — _deep_find_keys recurses dicts + lists; membership is exact string equality against PROJECT_KEYS / PERSON_QUERY_KEYS in permits_engine.py","guard_hoisted_handle_agent_every_verb":"CONFIRMED by code read (handle(): deep_key_scan + _guard_params under SURFACE == 'agent' before tools[name] dispatch; per-verb calls remain) and by the 98-call Rig D battery","pd2_proof_reissue":"CONFIRMED independently (see fix_verification.P-D2); receipt chain byte-identical claim verified against git object 37a228d, not taken on trust","replication_51of57_pre_57of57_post":"NOT RE-RUN as stated (builder-internal rig); the bench's own 98-call superset passes 98/98 post-fix, which is the operative evidence","suite_43_of_43":"CONFIRMED (bench re-run)"},"defects":[],"environment":"local","fix_verification":{"P-D1":"CLOSED — _guard_params is hoisted into handle() on the agent surface (pre-dispatch, after the name check) and deep-scans dicts + lists at any depth with EXACT matches against the closed PROJECT_KEYS / PERSON_QUERY_KEYS sets. Rig D B7 core: 7 shapes (top-level project_description / person / scope_of_work / person_name, nested meta.project, list-wrapped [[{project_description}]], deep-dict permits_needed) x all 14 agent verbs = 98 calls, EVERY one refuses by the correct name (REQUIREMENTS_SYNTHESIS_REFUSED / PERSON_SEARCH_REFUSED). Builder's claimed 57/57 replication is subsumed and exceeded. Depth: fence key at nesting depth 100 and 250 refuses by name; arrays-of-arrays refuse; duplicate fence keys in raw JSON refuse; fence keys inside a list-valued arguments payload refuse before verb dispatch. No crash or hang at any depth probed; server live after every hostile shape","P-D2":"CLOSED — proof/live-read-20261026.json re-issued: structural key scan finds NO payload_snapshot_canonical key and NO person-field keys anywhere in the artifact (the string survives only as prose in the correction note / reissue block describing its removal); payload held solely in the payload store, referenced by payload_snapshot_ref (pointer + source_payload_hash). Independent audit: bench person-value scan (values taken from the store-held snapshot: a business name + two individuals) finds ZERO values in any proof/ file; spec-only canonical recompute of the store payload == 29bde8248b6e021b5112fb14b186937e224a0c26e381e1a9667eac68ad38c6f9 and receipt_hash recomputes from the body; receipt block is canonically BYTE-IDENTICAL to the 37a228d original (git show comparison); bench re-ran recompute.py against receipt + store payload -> RECEIPT_VERIFIED, exit 0. Correction note proof/CORRECTION-20261026.md is accurate against the card -1 record on every checkable point (defect id, fields named, public-record mitigation stated without leaning on it, custody law cited, receipt unchanged claim TRUE)"},"history":[{"card":"eclipse-permits-mcp-2026-10-26.json","note":"First bench, full section 15 battery: mechanism certified-grade (live re-derive, change law, tamper, fences as absences, N-check NOVELTY_PROVEN); capped by P-D1 MED (every-verb project/person key refusal on 3/14 verbs) + P-D2 LOW (proof-artifact payload custody). Scoped fix + re-bench of B7 (and P-D2 artifact re-issue) is the path to CERTIFIED(local) at the stated scope","verdict":"PARTIAL"},{"card":"eclipse-permits-mcp-2026-10-26-2.json","note":"Scoped re-bench of the fix round (commit c4e7e18): P-D1 CLOSED (guard hoisted to handle(), deep exact-match scan; 98/98 Rig D B7 calls refuse by name; zero false positives on legitimate rich traffic incl. the real person-bearing payload; operator surface unguarded by construction, oracle byte-identical both directions); P-D2 CLOSED (proof re-issued, payload store-referenced only; independent recompute + byte-identity vs 37a228d verified; correction note accurate). Regression spot B2/B4/B14 PASS; suite 43/43 + smoke re-run PASS. CERTIFIED(local) at the card -1 stated scope; Accela leg = FIXTURE conformance only, FL dogfood exit gate remains owner-side and outside the verdict","verdict":"CERTIFIED"}],"n_check":{"evidence":"Fix commit c4e7e18 touches server.py (guard placement/scan), tests/test_surface.py (+3 tests), and the proof artifact pair only — README, server.json, tool descriptions and every public claim surface are byte-untouched, so the claim surface the card -1 N-check measured is undiluted. The fix strengthens the fence the novelty claim rests on (witness grammar over sealed receipts, no synthesis anywhere) rather than adding any retrieval or vendor-shaped surface","verdict":"NOVELTY_PROVEN (card -1, reaffirmed)"},"name_status":"CONDITIONAL (working name 'Eclipse Permits' — brand section 3 screen owed, owner item O1; gates public surface only)","notes":["Rig D durable at ~/workspace/cyan-eclipse/test-bench/permits-bench/rig_d_rebench.py (stdlib only; temp state dirs; product tree untouched — git status clean at c4e7e18 after the bench)","Rig D raw-depth note: the 3000-deep value was placed at request ROOT level (beside params), not inside arguments; in-arguments depth was proven to 250 (fence refuses, benign serves). Recorded as-is rather than overstated","The fix round's own /tmp test-copy practices were not audited; no leaks observed in the product tree"],"observations":[{"detail":"The fence refuses the closed key sets by EXACT member name only. Case/whitespace/unicode-lookalike variants are different parameter names, are read by no verb under any spelling, and cannot carry a project description into any code path — the protective outcome (spec 11: no verb accepts a project description) holds. But neither spec 11 nor spec 5.3 states the exact-match law; it lives in the engine comment + fix commit. Same class as card -1 P-O1 (cache law in a docstring): write the exact-match + closed-set law into the spec at the next amendment so the construction claim is auditable from the spec alone. If a future verb ever reads params case-insensitively, this observation must be re-graded as a defect","id":"P-O4","name":"Guard exact-match law is construction-accurate but spec-silent"},{"detail":"git grep finds the store snapshot's business-name value in fixtures/nyc/3765466.json — the as-served Socrata source record used as the section 7.6 onboard fixture set (person-bearing fixtures are a spec 7.6 conformance requirement; card -1 B-onboard NYC passed on this basis). The two individuals' names from the payload snapshot appear NOWHERE in the tracked tree. This is source-side input data, distinct from P-D2 (our derived payload snapshot released through a shared proof artifact); not a defect. Recorded so the grep hit is never mistaken for a P-D2 recurrence","id":"P-O5","name":"Tracked NYC fixture holds the as-served public record (source-side, by design)"},{"detail":"Unchanged by the fix round; the cache law still lives only in the engine docstring. Fold into the same spec amendment as P-O4","id":"P-O1 (carried)","name":"Chain-verify cache timing — graded AS DESIGNED on card -1; spec-currency note still open"},{"detail":"Outside this verdict (see scope_verdicts.accela_citizen_leg)","id":"P-O2 (carried)","name":"Section 7.7 Florida dogfood exit gate outstanding — by design, owner-session-bound"},{"detail":"Unchanged; polish, not soundness (card -1)","id":"P-O3 (carried)","name":"witness_verify verdict string presumes a presented chain"}],"qualifier":"local","scope_verdicts":{"accela_citizen_leg":"CERTIFIED at FIXTURE conformance only — as card -1. The section 7.7 Florida dogfood exit gate (owner's own Accela account, >=1 real chain, >=2 reads) remains OUTSTANDING and owner-side; it is outside this verdict and not counted as a defect","capped_by":null,"dual_source_leg":"OUT OF CERTIFIED SCOPE (card -1) — no dual-route jurisdiction at P0; refusal path benches correctly","mechanism_witnessed_ledger":"CERTIFIED-GRADE (card -1, undisturbed by the fix — fix diff touches server.py guard placement/scan + tests + proof artifact only; README and server.json claim surfaces byte-untouched)"},"tool":"eclipse-permits-mcp","verdict":"CERTIFIED","version":"0.1.0 (P0, commit c4e7e18 on 37a228d)"}