{"bench_date":"2026-10-26","bench_version":"scoped-rebench-2","checks":[{"evidence":"revocation_check(card-bench-002, supplied copy) -> LIST_VERIFICATION_FAILED (hash_valid T, sig_valid F, provenance_valid F, provenance='unverified — signer_fingerprint does not match this deployment's findings fingerprint (foreign or laundered fingerprint)'). Absent ref (never-zzz-999) on same list -> LIST_VERIFICATION_FAILED (no NOT_LISTED grant). Prior run-2 repro inverted.","id":"B1a","name":"D4 repro v1: fingerprint-laundered recomputed list (fake entry appended, list_hash recomputed, signer_fingerprint='00'*32, genuine signature retained)","verdict":"pass"},{"evidence":"hit -> LIST_VERIFICATION_FAILED (provenance='unverified — list carries no signature'); absent ref -> LIST_VERIFICATION_FAILED. No affirmative headline on unverifiable list.","id":"B1b","name":"D4 repro v2: signature + signer_fingerprint stripped, list_hash recomputed over fake entry","verdict":"pass"},{"evidence":"hit (card-foreign-777) -> LIST_VERIFICATION_FAILED; absent ref -> LIST_VERIFICATION_FAILED (definitive negative also capped). Prior NOT_LISTED leak closed.","id":"B1c","name":"D4 repro v3: foreign from-scratch unsigned epoch-9 list (issuer foreign-issuer-x, attacker-computed hash)","verdict":"pass"},{"evidence":"hit + absent -> LIST_VERIFICATION_FAILED; product sig_valid F (under deployment key), provenance_valid F, provenance names fingerprint mismatch. Attacker-valid signature grants nothing.","id":"B1d","name":"D4 repro v4: foreign list validly signed under bench attacker key (bench-side verifies VALID under attacker key), fingerprint=attacker fingerprint","verdict":"pass"},{"evidence":"Bench-built flow (primary revokes card-bench-001, successor revokes key-bench-001, counter-notice on att-bench-001, epochs 1-2 published; epoch-2 signature + list_hash verify BENCH-SIDE under bench findings key): supplied copy -> card-bench-001 REVOKED_BY_ISSUER, att-bench-001 COUNTER_NOTICED, card-bench-002 NOT_LISTED; list_verification='passed', provenance_valid T, records_match=null (by design, supplied path).","id":"G1","name":"genuine-path controls, supplied path: findings-signed epoch-2 list exactly as before","verdict":"pass"},{"evidence":"No-copy check -> REVOKED_BY_ISSUER / COUNTER_NOTICED / NOT_LISTED identical to supplied; records_match T, provenance_valid T.","id":"G2","name":"genuine-path controls, stored/local path","verdict":"pass"},{"evidence":"State-file tamper limited to stored list signer_fingerprint='00'*32 (fingerprint is a meta field: list_hash excludes it; entries/records untouched) -> stored check: LIST_VERIFICATION_FAILED for hit AND absent ref, with hash_valid T, records_match T, sig_valid T, provenance_valid F. Provenance is a first-class independent gate on the stored path — D4 fix applies there too, not only hash/records.","id":"G3","name":"stored path: provenance-only failure caps even when hash + records pass","verdict":"pass"},{"evidence":"Field audit over 14 captured outputs (genuine supplied/stored, D4 v1-v4 hit+absent, stored-provonly, rotated, cross-deployment, delta): list_provenance (non-empty string), list_provenance_valid (bool), list_signature_valid, list_hash_valid, list_records_match present in every output; values truthful vs bench-side recompute in each (e.g. v1-v4: prov F / rec_match null; stored-provonly: prov F / rec_match T / hash T / sig T; genuine: prov T). DOC: README states 'records_match = null there by design' + supplied path 'gates on provenance (signature) + hash' + trust root 'fingerprint is THIS deployment's findings fingerprint (v0 own-issuer trust root)'; server.py revocation_check tool description states 'list_records_match is null there by design' + provenance gate wording — doc text exists verbatim and matches observed behavior exactly.","id":"F1","name":"new surfaces: list_provenance_valid / list_provenance present + truthful in ALL variants; supplied records_match=null posture documented + matching","verdict":"pass"},{"evidence":"Deployment with old findings key issues + publishes genuine epoch-1 list; second server instance with NEW findings key+pubkey checks the supplied old list -> LIST_VERIFICATION_FAILED (hit and absent), provenance_valid F, provenance='unverified — signer_fingerprint does not match this deployment's findings fingerprint (foreign or laundered fingerprint)'. ADJUDICATION (observation, NOT a defect): cap is the intended v0 posture per README/tool-desc own-issuer trust root (fingerprint must be THIS deployment's current findings fingerprint; no key-history/rollover chain exists in v0). Wording labels the list UNVERIFIED, never tampered/forged — no mislabel. Operational consequence noted for owner: a findings-key rotation invalidates all previously published lists at check time until lists are re-published under the new key; a rollover/key-history mechanism is a future-phase design decision, out of v0 scope.","id":"ROT","name":"fresh angle: genuine list signed under a ROTATED findings key (old-key list vs new-key server)","verdict":"pass"},{"evidence":"Deployment B (own findings key, same bench registry/records) publishes epoch-3 list; bench-side signature verifies VALID under B's key. Presented to A-key server -> LIST_VERIFICATION_FAILED (hit and absent), provenance_valid F, fingerprint-mismatch provenance text. Capped per own-issuer trust root, as specified.","id":"XDEP","name":"fresh angle: cross-deployment genuine list (validly signed under deployment B's findings key, presented to deployment A)","verdict":"pass"},{"evidence":"(a) Genuine epoch-2 list with delta.added=[fake entry] + list_hash recomputed + genuine signature/fingerprint retained -> LIST_VERIFICATION_FAILED (delta is inside the signed/hashed body; tamper breaks signature gate). (b) Foreign attacker-signed delta-bearing list capped in B1d. (c) Delta-only object presented as list_copy (no full) -> LIST_COPY_INVALID by name. No delta path bypasses the provenance gate.","id":"DELTA","name":"fresh angle: delta forms under the same gate","verdict":"pass"},{"evidence":"Fresh state dir: supplied genuine epoch-2 check answered REVOKED_BY_ISSUER, NO state.json created. Corrupt state file ('{not json'): supplied genuine check answered REVOKED_BY_ISSUER, corrupt bytes byte-identical after. D1 closure holds.","id":"C10s","name":"C10 spot regression: fresh-dir purity + corrupt-state supplied-list answer","verdict":"pass"},{"evidence":"Main-server transport log: raw -32603 count 0, INTERNAL_ERROR count 0. All refusals in scope named (LIST_VERIFICATION_FAILED headline / LIST_COPY_INVALID).","id":"ESC","name":"run-global escape scan (this run)","verdict":"pass"}],"defects":[],"environment":"local","history":"append-only; prior runs retained in results/ (eclipse-revoke-mcp-2026-10-26.json = run 1 FAILED D1-D3; eclipse-revoke-mcp-2026-10-26-2.json = run 2 FAILED D4)","notes":["VERDICT: CERTIFIED(local) — scoped score 13 pass / 0 fail of 13 checks. D4 is CLOSED: all four run-2 repro variants (fingerprint-laundered recomputed, stripped sig/fingerprint, foreign unsigned epoch-9, foreign validly-attacker-signed) now cap at LIST_VERIFICATION_FAILED for hits AND absent refs; genuine paths (supplied + stored) return REVOKED_BY_ISSUER / COUNTER_NOTICED / NOT_LISTED exactly as before; stored provenance-only failure caps independently of hash+records. Combined with run-2 closures (D1 C10, D3 C17 verified there and spot-held here), all defects D1-D4 on the retained cards are closed. Lines outside this scope stand as scored on prior cards.","OBSERVATION (non-defect, owner decision for a future phase): findings-key rotation invalidates previously published lists at check time (ROT) — v0 has no key-history/rollover; the cap wording is honest ('unverified'), so this is a documented posture consequence, not a mislabel or a D-class defect.","Method: bench-owned fixtures only — independent ECDSA sign/verify + canon/sha recompute in /tmp/revoke_rebench2/bench.py; servers spawned per-deployment (main, tampered-state, old-key, new-key, deployment-B, fresh, corrupt) with env-pointed state/issuers/key/pubkey; product data/ and shipped fixtures untouched. Fake entry = run-2 D4 repro entry verbatim (card-bench-002 / rev_foreign1 / record_hash 'ab'*32).","Local scope only, as prior cards: external distribution / emergency classes / live push NOT BUILT and not tested; production findings-key custody is a local seed key — gated, not certified here; U1 remains na."],"qualifier":"local","run":3,"scope":"Scoped re-bench #2 of prior FAILED cards (eclipse-revoke-mcp-2026-10-26.json D1-D3 RETAINED; eclipse-revoke-mcp-2026-10-26-2.json D4 RETAINED): C13/B1 provenance battery + genuine-path controls + new-surface fields/docs + fresh angles (key rotation, cross-deployment, delta) + C10 purity spot regression. All other prior lines stand un-re-scored. Product exercised ONLY via stdio transport (subprocess); bench-owned independent ECDSA impl, keys, registry in /tmp/revoke_rebench2; shipped fixtures/product data never used as state.","tool":"eclipse-revoke-mcp","verdict":"CERTIFIED(local)","version":"0.1.0"}