Eclipse Crosspay

Bench verdict: PASS-CONDITIONAL(local/simulator, fixture FX records)

Certified scope: PASS-CONDITIONAL(local/simulator, fixture FX records) — Verity bench of v0.1.0 (2026-10-27, argus101-program-20261027/wave3/bench-crosspay.md) + delta re-bench (argus101-program-20261027/wave3/rebench-crosspay.md, D1/D2/D3 CLOSED, C2/C3/C4 discharged): builder suite 39/39 re-run clean by bencher (34 baseline + 5 fix regressions); decisive fixture F-X9 independently re-derived from the bencher's own corpus (GBP/USD pair the builder never used) — under-cap CLEAR at spread 40 bps vs cap 100 with fx_seal == bencher-recomputed seal, over-cap twin REFUSED / SPREAD_CAP_EXCEEDED at 101 bps, both exports fresh-verify in a fresh process from export + pinned keys alone. PASS-CONDITIONAL is not CERTIFIED — certified is false, and nothing beyond this scope is claimed. Scope is exactly: local stdio, fixture FX records only, pre-flight verdicts only, value_class 'test'; Crosspay never converts, settles, or moves currency and fetches no live rates. Sole remaining condition (verbatim): cross-artifact cross-commitment is fenced — external anchor required before live/multi-party use. Novel mechanism (SPEC §2.1, verbatim): rate source, rate, and spread are sealed at execution, and settlement is refused pre-flight when the spread exceeds the mandate's cap — enforcement before money moves, not evidence after.

Not tested:

• Live FX — SPEC §10 counsel gate (named, unbuilt): live FX — fetching live rates for real payments, quoting or executing conversion, or any cross-border settlement — is counsel-gated (joined to the existing FinTech Law packet (Till/x402)) and unbuilt; no live FX source/rails exist in v0.1.0 (fixture records only), no live rate is fetched, no currency is converted or settled, and any live phase is a separate, counsel-cleared, re-benched build, not a configuration change
• Sole condition (verbatim): cross-artifact cross-commitment is fenced — external anchor required before live/multi-party use. Cross-artifact cross-commitment (seal ↔ verdict ↔ export) provides full coordinated rollback only as a fenced condition: external anchor required before live/multi-party use. No live or multi-party use is licensed until that anchor exists and the build is re-benched
• D2 lineage exports — CHECK_REPLAY sealed verdicts are offline-verifiable from export + pinned keys alone via lineage: prior_export is carried in verdict_get bundles, and replay verdicts verify from export + pinned keys alone (re-bench D2 CLOSED, condition C3 discharged); a replay bundle is never served unlabelled/unverifiable
• Non-blocking observation (re-bench): with ≥2 priors a second replay's prior_export may point to the earliest prior rather than the immediate predecessor (spec predicate unaffected) — §5.3's replay predicate requires only the existence of a prior distinct-triple same-intent sealed check, which the shipped prior satisfies and the verifier re-derives; soundness is unaffected
• Real FX rates, quotes, mandates, payments, or settlement — local/simulator, fixture FX records only, value_class "test": no live FX source/rails (fixture records only); Crosspay never converts, settles, or moves currency, fetches no live rates, and holds no funds; a CLEAR speaks only to the sealed fixture quote against the presented mandate's cap
• Production signing — v0.1.0 signing is an HMAC fixture stand-in for Herald RS256 (HMAC Herald stand-in), disclosed on the product's face; verification uses keys pinned out-of-band in a local chmod-600 gitignored key file, never keys supplied by a record; a live phase requires real Herald signing and a re-bench
• Production key custody — fixture keys live in keys/fixture-keys.json (chmod 600, gitignored, never committed; GitHub contents/keys verified 404); a fresh clone must create its own fixture key file to run the full suite
• Hosted or live operation / charge path — local stdio only; metering points only per SPEC §9 (exactly +1 per sealed verdict, CLEAR or REFUSED alike; 0 for no-seal refusals, verifies, verdict-gets, handoff marks, and idempotent re-presentations; no charge path built, no payment taken, no live Meter ingest claimed)

Live state note: Bench evidence: argus101-program-20261027/wave3/bench-crosspay.md + rebench-crosspay.md (Verity bench + delta re-bench of v0.1.0, 2026-10-27; builder suite re-run clean 39/39 on re-bench, decisive F-X9 re-derived incl. fresh-process verify from export + pinned keys alone, bencher battery 144 probes at bench and 33 probes at re-bench, D1/D2/D3 closed and C2/C3/C4 discharged, sole remaining condition C1 as stated). No test-bench scorecard was issued for this verdict and none is claimed (scorecard_ref/card_url null).