{
 "tool": "eclipse-stage-mcp",
 "version": "0.1.0",
 "bench_date": "2026-10-25",
 "bench_version": "0.1.0",
 "environment": "simulator",
 "qualifier": "simulator",
 "verdict": "CERTIFIED(simulator)",
 "checks": [
  {
   "id": "S1",
   "name": "retail record invisible despite a LIVE portal; refusal identical to unknown id",
   "verdict": "pass",
   "evidence": "the retail record's portal_url is the live dev stub \u2014 a direct GET proves it answers (dev_mode=true, power=on) \u2014 yet console_list omits xbox_retail_01, and device_info/app_list/power_control on it all refuse CONSOLE_NOT_ENROLLED; normalized for the id, the retail refusal is byte-identical to an unknown id's: invisible is invisible, not merely uncommandable"
  },
  {
   "id": "S2",
   "name": "portal dev-mode mismatch refused by name",
   "verdict": "pass",
   "evidence": "the enrolled dev console reads cleanly when registry and portal agree (dev_mode=true, receipted); the bench registry attests xbox_mismatch_01 as Dev Mode but its portal reports dev_mode=false, and the bridge refuses with PORTAL_NOT_DEV_MODE \u2014 the registry's word alone never suffices, the portal must agree on every read"
  },
  {
   "id": "S3",
   "name": "input sequence atomicity: poisoned sequence sends nothing",
   "verdict": "pass",
   "evidence": "the sequence [A, TypePassword, B] is refused INPUT_NOT_IN_VOCABULARY and the stub's input log \u2014 read directly from the portal, bypassing the bridge \u2014 is still EMPTY: the whole sequence validated before anything was sent, so not even the leading valid A leaked through; a clean [A] then sends exactly one event"
  },
  {
   "id": "S4",
   "name": "screenshot SHA-256 parity: tool = fixture = receipt",
   "verdict": "pass",
   "evidence": "three-way SHA-256 parity over the 3850-byte frame: the tool result's hash, an independent hash of the shipped fixture PNG, and the hash recorded in the screenshot_captured receipt all agree (d16bfd4c2dc619a5...), and the base64 payload decodes to the fixture bytes exactly \u2014 a playtest record can cite the exact frame seen"
  },
  {
   "id": "S5",
   "name": "Tier-3 restart denial leaves boot_count untouched",
   "verdict": "pass",
   "evidence": "restart without a token returns status=denied, code CONFIRMATION_REQUIRED at Tier 3, and the stub's boot_count \u2014 read directly from the portal \u2014 is still 1: the denial never reached the console, though it IS receipted (power_denied). The fixture token then executes the same call (boot_count 2), proving the gate is the human confirmation, not a broken path"
  },
  {
   "id": "S6",
   "name": "binary package payload refused by name",
   "verdict": "pass",
   "evidence": "an install payload carrying a data_base64 field is refused by name (PACKAGE_BINARY_REFUSED) at the bridge, and the console still holds exactly its 2 fixture apps \u2014 no binary-shaped payload moves through this bridge, in either layer"
  },
  {
   "id": "S7",
   "name": "posture denylist: exactly the 8 bridge tools",
   "verdict": "pass",
   "evidence": "tools/list is exactly the 8 bridge tools; direct calls to credential_read and retail_exploit are refused as Stage-forbidden \u2014 the bridge has no credential, profile, or retail-exploit surface, by design and permanently"
  },
  {
   "id": "S8",
   "name": "receipt chain valid; tamper detected",
   "verdict": "pass",
   "evidence": "receipt_list reports chain_valid over 7 receipts (console reads, input, screenshot, power denial + action); the product verifier confirms it, and a deep copy with one altered receipt detail verifies false"
  },
  {
   "id": "U1",
   "name": "auth enforced",
   "verdict": "na",
   "evidence": "local stdio transport: no credential layer exists to test; process ownership is the boundary"
  },
  {
   "id": "U2",
   "name": "schema valid",
   "verdict": "pass",
   "evidence": "tools/list returns exactly the 8 bridge tools, each with inputSchema type object + properties + required"
  },
  {
   "id": "U3",
   "name": "loopback-only portal surface",
   "verdict": "pass",
   "evidence": "the bridge's only HTTP surface is urllib against registry-declared portal_url values; every URL in the bench registry is 127.0.0.1 loopback (the product stub) \u2014 channels are declared in the registry, never improvised, and v0.1 declares loopback only"
  },
  {
   "id": "U4",
   "name": "no secret leak",
   "verdict": "pass",
   "evidence": "no secret patterns in 17 tool outputs (screenshot base64 scanned as well)"
  },
  {
   "id": "U5",
   "name": "sane errors",
   "verdict": "pass",
   "evidence": "unknown power action refused by name (POWER_ACTION_UNKNOWN); unknown console -> CONSOLE_NOT_ENROLLED; malformed line survived (console_list answers); unknown method -> -32601"
  },
  {
   "id": "U6",
   "name": "process health",
   "verdict": "pass",
   "evidence": "initialize answered in 103 ms; ping ok"
  },
  {
   "id": "U7",
   "name": "audit completeness",
   "verdict": "pass",
   "evidence": "ledger covers the run in order (['console_list', 'device_info', 'remote_input', 'screenshot_captured', 'power_denied', 'power_restart'] present as a subsequence); 8 receipts, seq strictly increasing, chain valid \u2014 reads, input, the screenshot hash, the Tier-3 denial AND the confirmed restart are all in the one audit chain"
  },
  {
   "id": "U8",
   "name": "bench isolation",
   "verdict": "pass",
   "evidence": "workspace product state byte-identical before/after bench"
  }
 ],
 "notes": [
  "Simulator scope: the console is the product's local Device Portal-shaped stub on loopback; no real console exists in v0.1 and none was contacted. Real Device Portal parity (auth, payload shapes, powered-off behavior) is [verify] on owner hardware.",
  "The bench registry is bench-owned: the retail record points at the LIVE dev stub's URL on purpose, so S1 tests invisibility against an answering portal. The shipped registry is read, never written."
 ],
 "history": "append-only; prior runs retained in results/"
}