Eclipse Ballotbox
Ballot evidence system for agent electorates over fixture electorates; local/simulator only. PASS-CONDITIONAL (local/simulator) — ballots sealed to mandate-eligibility proofs: only agents holding a valid governance mandate at vote time are counted, and the tally recomputes publicly. Recompute proves tally-vs-sealed-ballots, not electorate legitimacy. Counsel gate (C4, SPEC §10) named and unbuilt: any real binding election.
status: in-developmentclass: mcpIdentity & AttestationTrust & Receipts
Vendor: Cyan Eclipse Technologies
What it does
- Novel mechanism (the bench verifies exactly this) — ballots are sealed to mandate-eligibility proofs: only agents holding a valid governance mandate at vote time are counted, and the tally recomputes publicly. Eligibility is a vote-time fact: a mandate valid at cast and revoked afterwards does not retroactively void the ballot; a mandate revoked or expired before cast voids the cast.
- The legitimacy limit (verbatim, on every listing and receipt face): recompute proves tally-vs-sealed-ballots — that the published totals are exactly the function of the sealed ballots and their vote-time eligibility proofs. It does not prove electorate legitimacy: who chose the electorate, whether the mandate issuer was itself authorised, whether voters were coerced, or whether the question was fair are outside what this evidence shows, and Ballotbox claims none of them.
- Bench path: v0.1.0 bench (wave4/bench-ballotbox.md, defects D1–D6, conditions C1–C6) + v0.1.1 delta re-bench (wave4/rebench-ballotbox.md: D1–D6 all CLOSED on independent evidence, conditions C2 and C3 SATISFIED, builder suite 34/34 reproduced).
- Standing conditions (from the re-bench): C1 — HMAC cap (no public/third-party recompute, RS256, or JWS claim until real Herald signing replaces the HMAC stand-in). C4 — §10 counsel gate (named, unbuilt): any use for a real binding election — corporate (shareholder / board / member votes), union (certification, contract ratification, officer elections), or public (any government-administered or government-recognised vote) — and any use whose result any party will rely on to bind, seat, pay, or exclude any real person or organisation, is out of v0.1, hard; ballot-secrecy or coercion-resistance representations for real elections are also gated. C5 — metering-only pricing (one metering point per tallied election at the $50/election shape; no checkout, no buy-now, no payment verb). C6 — rollback fence (pure local file store caps the verdict at PASS-CONDITIONAL; external anchor required before live/multi-party reliance).
- Ballotbox is an evidence system, not an election authority: it does not choose the electorate, issue mandates (Herald's grammar, consumed by reference), decide the question, or bind anyone to a result. Herald (mandate grammar), Meter (metering grammar), and Docket (pack grammar) are consumed by reference only.
Tools
election_create · electorate_seal · election_open · ballot_cast · ballot_status · election_close · election_void · election_pack_get · tally_compute · tally_verify · tally_receipt_get · tally_receipt_counter_sign
Platforms
- MCP over stdio
Certification
Bench verdict: PASS-CONDITIONAL (local/simulator)
Certified scope: Eclipse Ballotbox — PASS-CONDITIONAL (local/simulator) — Verity bench of v0.1.0 (2026-10-27, argus101-program-20261027/wave4/bench-ballotbox.md) + delta re-bench of v0.1.1 (argus101-program-20261027/wave4/rebench-ballotbox.md: D1–D6 all CLOSED on independent evidence, conditions C2 and C3 SATISFIED, builder suite 34/34 reproduced). PASS-CONDITIONAL (local/simulator) is not CERTIFIED — certified is false, and nothing beyond that verdict at its exact scope is claimed. Scope is exactly: local stdio, fixture electorate + fixture governance mandates only, value_class "test"; no real person, company, union, public body, or live agent fleet votes in v0.1.1, no result binds anyone, and no real decision is taken here. The legitimacy limit binds verbatim: recompute proves tally-vs-sealed-ballots — that the published totals are exactly the function of the sealed ballots and their vote-time eligibility proofs; it does not prove electorate legitimacy (who chose the electorate, whether the mandate issuer was itself authorised, whether voters were coerced, or whether the question was fair), and Ballotbox claims none of them. Standing conditions: C1 (HMAC cap — no public/RS256/JWS claim until real Herald signing), C4 (§10 counsel gate, named and unbuilt — any real binding election), C5 (metering-only pricing), C6 (rollback fence) still bind.
Not tested:
- Any real binding election — corporate (shareholder / board / member votes), union (certification, contract ratification, officer elections), or public (any government-administered or government-recognised vote) use, and any result relied on to bind, seat, pay, or exclude any real person or organisation, is SPEC §10 counsel-gated (condition C4) and UNBUILT; ballot-secrecy or coercion-resistance representations for real elections are also gated
- Electorate legitimacy — recompute proves tally-vs-sealed-ballots only; who chose the electorate, whether the mandate issuer was itself authorised, whether voters were coerced, or whether the question was fair are outside what this evidence shows, and Ballotbox claims none of them
- Public/third-party recompute under production signatures — v0.1.1 signing is an HMAC fixture stand-in (condition C1: no public/RS256/JWS claim until real Herald signing + re-bench; fixture keys in keys/, gitignored, mode 600)
- External anchoring / multi-party reliance — the pure local file store caps any verdict at PASS-CONDITIONAL (local/simulator) (condition C6); an external anchor is required before live or multi-party reliance
- Live agent-fleet governance — fixture electorate + fixture governance mandates only; no live fleet votes in v0.1.1 and no result binds anyone
Live state note: Bench evidence: argus101-program-20261027/wave4/bench-ballotbox.md (Verity bench of v0.1.0, PASS-CONDITIONAL (local/simulator), defects D1–D6, conditions C1–C6) + argus101-program-20261027/wave4/rebench-ballotbox.md (Verity delta re-bench of v0.1.1 fix commit 3475d7f: D1–D6 all CLOSED, C2 + C3 SATISFIED, builder suite 34/34 reproduced). No test-bench scorecard was issued for this verdict and none is claimed (scorecard_ref/card_url null).
Pricing
PRICED — $50/election, via the Eclipse Bazaar bench-order/intake path only. No checkout, payment, or buy-now link exists for this product, and no Stripe object exists for it in this pass: intake orders are reviewed and confirmed by the operator before any payment link is sent. Metering shape per SPEC §9 and standing condition C5 (metering-only pricing in v0.1.1, no charge path built): one Meter-grammar metering point per tallied election keyed to election_id + receipt hash at the $50/election price shape; refusals emit no metering event. No charge path is built, no payment is taken, and no live Meter ingest is claimed. The local package is the reference implementation. Repository is PRIVATE.
Install / verify
No install command is published for this product in the catalog or its registry record.
Official MCP Registry name: io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-ballotbox-mcp
Registry listing: https://registry.modelcontextprotocol.io/v0.1/servers/io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC%2Feclipse-ballotbox-mcp/versions/0.1.1
Repository: https://github.com/CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-ballotbox-mcp
Verify any MCP server in your client configs against this catalog with bazaar check (Eclipse Bazaar MCP / CLI — see llms.txt).
Verification
Issued by Verity (Cyan Eclipse Technologies) — a role-separated internal desk of the same company that publishes this catalog. Issuer relationship: first-party. The bench is not an external third-party evaluator.
Availability
Catalog status: in-development
Distribution: MCP over stdio
Live-state note (from the catalog record): Bench evidence: argus101-program-20261027/wave4/bench-ballotbox.md (Verity bench of v0.1.0, PASS-CONDITIONAL (local/simulator), defects D1–D6, conditions C1–C6) + argus101-program-20261027/wave4/rebench-ballotbox.md (Verity delta re-bench of v0.1.1 fix commit 3475d7f: D1–D6 all CLOSED, C2 + C3 SATISFIED, builder suite 34/34 reproduced). No test-bench scorecard was issued for this verdict and none is claimed (scorecard_ref/card_url null).
Test verdict
Bench verdict: PASS-CONDITIONAL (local/simulator)
Certified scope: Eclipse Ballotbox — PASS-CONDITIONAL (local/simulator) — Verity bench of v0.1.0 (2026-10-27, argus101-program-20261027/wave4/bench-ballotbox.md) + delta re-bench of v0.1.1 (argus101-program-20261027/wave4/rebench-ballotbox.md: D1–D6 all CLOSED on independent evidence, conditions C2 and C3 SATISFIED, builder suite 34/34 reproduced). PASS-CONDITIONAL (local/simulator) is not CERTIFIED — certified is false, and nothing beyond that verdict at its exact scope is claimed. Scope is exactly: local stdio, fixture electorate + fixture governance mandates only, value_class "test"; no real person, company, union, public body, or live agent fleet votes in v0.1.1, no result binds anyone, and no real decision is taken here. The legitimacy limit binds verbatim: recompute proves tally-vs-sealed-ballots — that the published totals are exactly the function of the sealed ballots and their vote-time eligibility proofs; it does not prove electorate legitimacy (who chose the electorate, whether the mandate issuer was itself authorised, whether voters were coerced, or whether the question was fair), and Ballotbox claims none of them. Standing conditions: C1 (HMAC cap — no public/RS256/JWS claim until real Herald signing), C4 (§10 counsel gate, named and unbuilt — any real binding election), C5 (metering-only pricing), C6 (rollback fence) still bind.
Publication integrity
Receipt hash: none published — no receipt is linked to this record in the current records
Anchor state: NOT_ANCHORED No receipt hash is linked to this record in the published records; verdict anchoring ships with Phase-1 D2 of the Eclipse Anchor program.
Full verification view — integrity result, digests, and evidence for this listing.
Operational status
Trust state: UNVERIFIED · Drift: UNKNOWN
Benched version: — · Latest seen: 0.1.1
Verify it yourself
- Cross-check the verdict and scope against this product's record in the append-only verdict feed (/verdicts.json) — corrections arrive only as superseding records.
- On-chain: not yet available for this verdict — no receipt is linked to it in the published records (per-verdict anchoring arrives with Phase-1 D2). The scorecard and the verdict feed are the complete published record until then.