{
 "tool": "hostbridge-mcp",
 "version": "0.1.0",
 "bench_date": "2026-10-27",
 "bench_version": "0.1.0",
 "environment": "local-real (real filesystem docroot served by a real HTTP server process; live-host TCP probe)",
 "qualifier": "local-real",
 "verdict": "CERTIFIED(local-real)",
 "checks": [
  {
   "id": "H1",
   "name": "scope binding",
   "verdict": "pass",
   "evidence": "site bound to ONE docroot (This connection is bound to ONE docroot (public_html) for bench.local.); docroot is a real directory on disk (/tmp/w2bench/hostbridge/home/docroots/site_78c725a43e, exists=True); deploy to unknown site errors"
  },
  {
   "id": "H2",
   "name": "dry run touches nothing",
   "verdict": "pass",
   "evidence": "dry run reports 3 files, diff +3 added; docroot still empty on disk; live HTTP GET /index.html -> 404 (nothing served)"
  },
  {
   "id": "H3",
   "name": "deploy pipeline (real FS + live HTTP serving)",
   "verdict": "pass",
   "evidence": "v1 deployed byte-exact on real FS and served live over HTTP (GET /index.html 200, bytes == v1); v2 diff +1 ~1 -1 correct and live HTTP bytes switched to v2; receipt honestly labels SIMULATOR transport"
  },
  {
   "id": "H4",
   "name": "rollback exact (disk + live HTTP)",
   "verdict": "pass",
   "evidence": "rollback restored v1 bytes exactly on disk (no new.txt) AND live HTTP serves v1 bytes again; current_deploy == v1 deploy"
  },
  {
   "id": "H5",
   "name": "smoke test real HTTP",
   "verdict": "pass",
   "evidence": "product smoke_test against the real running HTTP server: 2/3 passed; missing path ok=false, no crash (independently confirmed by harness HTTP GETs in H3/H4)"
  },
  {
   "id": "H6",
   "name": "probe caveat (local listener + live host)",
   "verdict": "pass",
   "evidence": "local real listener: open webmail port -> tcp-connect ok with transport-level-only caveat; unknown channel handled; LIVE host probe cetech.ai returned per-channel results without crash [uapi: tcp-connect ok (56ms) \u2014 transport-level ; ssh: tcp-connect ok (0ms) \u2014 transport-level o; webmail: tcp-connect ok (0ms) \u2014 transport-level o]"
  },
  {
   "id": "H7",
   "name": "not-yet transports",
   "verdict": "pass",
   "evidence": "sftp transport returns explicit declared-not-live error, not success -- remote transports are NOT built in v0.1.0; this pass certifies no remote-deploy claim"
  },
  {
   "id": "H8",
   "name": "corrupt zip",
   "verdict": "pass",
   "evidence": "corrupt zip rejected with error; live site still serves v1 bytes (nothing deployed)"
  },
  {
   "id": "H9",
   "name": "audit append-only and complete",
   "verdict": "pass",
   "evidence": "audit actions in order ['site_registered', 'deploy_dry_run', 'deployed', 'rolled_back', 'smoke_test']; pre-rollback entries byte-identical after later ops"
  },
  {
   "id": "U1",
   "name": "auth enforced",
   "verdict": "na",
   "evidence": "local stdio transport: no credential layer exists to test; process ownership is the boundary"
  },
  {
   "id": "U2",
   "name": "schema valid",
   "verdict": "pass",
   "evidence": "tools/list returns exactly the 6 tools, each with inputSchema type object + properties + required"
  },
  {
   "id": "U3",
   "name": "no unscoped fetch",
   "verdict": "pass",
   "evidence": "network call sites only in t_probe_channels and t_smoke_test: [(96, 't_probe_channels'), (204, 't_smoke_test'), (206, 't_smoke_test')]"
  },
  {
   "id": "U4",
   "name": "no secret leak",
   "verdict": "pass",
   "evidence": "no secret patterns in 14 tool outputs"
  },
  {
   "id": "U5",
   "name": "sane errors",
   "verdict": "pass",
   "evidence": "missing args -> error; unknown tool -> error; malformed line survived; unknown method -> error -32601"
  },
  {
   "id": "U6",
   "name": "process health",
   "verdict": "pass",
   "evidence": "initialize answered in 417 ms; ping ok"
  },
  {
   "id": "U8",
   "name": "bench isolation",
   "verdict": "pass",
   "evidence": "workspace product state byte-identical before/after bench"
  }
 ],
 "notes": [
  "Real-env substitution vs 2026-10-24 simulator card: docroot = real on-disk directory served continuously by a separate real HTTP server process for the whole run; every deploy/rollback verified on disk byte-exact AND over live HTTP by an independent client; probe_channels additionally run against live public host cetech.ai (results recorded in H6 evidence). Same claim set, no expansion.",
  "Scope boundary (unchanged, load-bearing): the deploy TRANSPORT is still the product's 'simulate' transport -- v0.1.0 implements no SFTP/UAPI transport (H7: declared-not-live error). This CERTIFIED(local-real) covers the deploy pipeline, snapshot/rollback, smoke and probe claims against real local FS/HTTP/network only. It certifies NO remote-host deploy. Remote transport = product build gap for the Silas lane, not a bench-environment gap."
 ],
 "history": "append-only; prior runs retained in results/"
}