{
 "tool": "eclipse-zenith-mcp",
 "version": "0.1.0",
 "bench_date": "2026-10-25",
 "bench_version": "0.1.0",
 "environment": "simulator",
 "qualifier": "simulator",
 "verdict": "CERTIFIED(simulator)",
 "checks": [
  {
   "id": "Z1",
   "name": "FTMS fixtures verified both directions + hand-recomputed treadmill frame",
   "verdict": "pass",
   "evidence": "all 5 data fixtures and 9 control-point fixtures verify in BOTH directions (parse(hex) == hand-computed expected AND build(expected, flags) == hex), so a codec error cannot agree with itself; independently, this suite rebuilt the treadmill_run frame by hand from its documented derivation (flags 0x018C; 1234x0.01 km/h; 5432 m as u24; 50x0.1 pct incline; 29x0.1 ramp; 210/640/11 energy; HR 152) and got the fixture's exact bytes, which the codec parses back to 12.34 km/h / 5432 m / 5.0 pct / 2.9deg / 210 kcal / 152 bpm; the set-speed frame is likewise hand-derived (0x02 + 1000 as u16 = 02e803)"
  },
  {
   "id": "Z2",
   "name": "unenrolled ghost equipment invisible",
   "verdict": "pass",
   "evidence": "the simulator itself knows treadmill_ghost (a direct socket read proves it exists at the equipment layer), yet registry_list shows exactly the 4 enrolled devices and telemetry_read on the ghost refuses DEVICE_NOT_ENROLLED \u2014 unenrolled equipment is invisible, not merely uncommandable"
  },
  {
   "id": "Z3",
   "name": "session + Tier-3 speed set under token",
   "verdict": "pass",
   "evidence": "session starts (Tier 1) and set_speed 2.0 km/h \u2014 exactly at the policy max delta from rest \u2014 executes at Tier 3 under the fixture confirmation token; telemetry parsed by the bridge codec reads the belt at 2.0 km/h"
  },
  {
   "id": "Z4",
   "name": "dead-man control case: heartbeat inside window, belt keeps moving",
   "verdict": "pass",
   "evidence": "control case: 3 sim-seconds pass with the session's heartbeat fresh inside the 5 s policy threshold \u2014 the direct equipment read and the bridge's own telemetry both show the belt still at 2.0 km/h, the tick reports no dead-man firing, and the ledger holds ZERO safety_action receipts: the rule does not fire inside its window"
  },
  {
   "id": "Z5",
   "name": "dead-man: starved heartbeat stops the belt at the equipment, one safety receipt",
   "verdict": "pass",
   "evidence": "starve case: with NO bridge contact, a direct 6 s tick on the simulator fires the dead-man rule at the equipment layer (lapse 6.0 s > threshold 5 s) and the direct state read \u2014 taken before the bridge is touched again \u2014 already shows the belt at 0.0: the machine stopped itself, not the bridge. The bridge's next read syncs the event into EXACTLY ONE safety_action receipt recording the lapse and threshold"
  },
  {
   "id": "Z6",
   "name": "speed gate ordering: token, then ceiling, then delta",
   "verdict": "pass",
   "evidence": "the three gates fire in their designed order, each receipted as a denial: (1) set_speed 10.0 with NO token -> CONFIRMATION_REQUIRED (the Tier-3 human gate precedes all value checks); (2) 17.0 WITH a token -> SPEED_CEILING_EXCEEDED naming the device ceiling 16.0 (ceiling precedes delta, though 17.0 also violates the ramp bound); (3) 5.0 WITH a token, under every ceiling -> SPEED_DELTA_EXCEEDED (a 5.0 km/h step vs the 2.0 policy max delta from the stopped belt)"
  },
  {
   "id": "Z7",
   "name": "session ceiling binds below the device ceiling",
   "verdict": "pass",
   "evidence": "a session ceiling of 20.0 is refused at start (SESSION_CEILING_ABOVE_DEVICE \u2014 a session ceiling may only sit at or below the device ceiling 16.0); a 6.0 session ceiling starts, and set_speed 7.0 under a valid token then denies SPEED_CEILING_EXCEEDED naming the SESSION ceiling \u2014 the tighter bound binds, token or no token"
  },
  {
   "id": "Z8",
   "name": "bad-tier config rejected at load (exit 2)",
   "verdict": "pass",
   "evidence": "a bench registry classifying treadmill set_speed at Tier 2 \u2014 below its Tier-3 spec floor \u2014 makes the server exit 2 at load with TIER_BELOW_FLOOR on stderr, before serving a single call: the ladder is load-bearing at startup, not advisory at call time"
  },
  {
   "id": "Z9",
   "name": "receipt chain valid; tamper detected",
   "verdict": "pass",
   "evidence": "receipt_list reports chain_valid over 14 receipts (sessions, control allows + denials, telemetry, the safety action, workouts); the product verifier confirms it, and a deep copy with one altered receipt detail verifies false"
  },
  {
   "id": "U1",
   "name": "auth enforced",
   "verdict": "na",
   "evidence": "local stdio transport: no credential layer exists to test; process ownership is the boundary"
  },
  {
   "id": "U2",
   "name": "schema valid",
   "verdict": "pass",
   "evidence": "tools/list returns exactly the 7 bridge tools, each with inputSchema type object + properties + required"
  },
  {
   "id": "U3",
   "name": "no external network surface (Unix socket only)",
   "verdict": "pass",
   "evidence": "server.py's only socket is AF_UNIX to the local simulator process (ECLIPSE_ZENITH_SIM_SOCK or a bridge-spawned simulator on a temp socket); there is no AF_INET, urllib, requests, or http.client surface \u2014 no external network exists in the bridge"
  },
  {
   "id": "U4",
   "name": "no secret leak",
   "verdict": "pass",
   "evidence": "no secret patterns in 19 tool outputs (the confirmation token appears in none \u2014 it is hash-checked, never echoed or stored)"
  },
  {
   "id": "U5",
   "name": "sane errors",
   "verdict": "pass",
   "evidence": "unknown session -> UNKNOWN_SESSION error; unenrolled device -> DEVICE_NOT_ENROLLED; malformed line survived (registry_list answers); unknown method -> -32601"
  },
  {
   "id": "U6",
   "name": "process health",
   "verdict": "pass",
   "evidence": "initialize answered in 81 ms; ping ok"
  },
  {
   "id": "U7",
   "name": "audit completeness + workout data-rights block",
   "verdict": "pass",
   "evidence": "ledger covers the run in order (['session_started', 'session_control', 'telemetry_read', 'safety_action', 'session_control_denied', 'workout_recorded'] present as a subsequence); 14 receipts, seq strictly increasing, chain valid; the 2 workout record(s) carry the Data Rights Ledger block at rank a_first_party_exhaust \u2014 the session receipt is the training log, provenance attached"
  },
  {
   "id": "U8",
   "name": "bench isolation",
   "verdict": "pass",
   "evidence": "workspace product state byte-identical before/after bench"
  }
 ],
 "notes": [
  "Simulator scope: NO Bluetooth and no real hardware exist on this VM; the equipment side is the product's local simulator process speaking FTMS-shaped frames over a Unix socket. Real per-model FTMS variance is [verify] per machine at enrollment.",
  "The dead-man probes (Z4/Z5) drive the simulator DIRECTLY on its socket \u2014 ticks and state reads bypass the bridge \u2014 so the belt stop is observed at the equipment layer before any bridge call can receipt it."
 ],
 "history": "append-only; prior runs retained in results/"
}