Eclipse Faircharge

Bench verdict: PASS (local, fixture charge streams + sealed authorizations)

Certified scope: PASS (local, fixture charge streams + sealed authorizations) — Verity bench of v0.1.0 (2026-10-27, argus101-program-20261027/wave2/bench-faircharge.md) PASS-CONDITIONAL (local, fixture charge streams + sealed authorizations) with conditions C1–C7 plus spec-hygiene condition C0 (spec §2.2.2 formula sentence contradicted fixtures F-FC4/F-FC8; Verity ruled the fixture/defining-test reading governs and the shipped behaviour IS the fixture's; §2.2.2 + §6.4 step-3 amended to it); fix round v0.1.1 closed C0–C7; delta re-bench of v0.1.1 (rebench-faircharge.md) and round 2 of v0.1.2 (rebench2-faircharge.md) raised D1–D6 and E1–E4; delta re-bench round 3 of v0.1.3 (rebench3-faircharge.md): E1 (pack face binding) + E2 (anomaly gate coverage) + E3 (envelope) + E4 (whole-store validation) CLOSED, C0–C7 and D1–D6 hold under serialized re-runs and full-strength frontier sweeps — CONDITIONS CLOSED, Faircharge — PASS (local, fixture charge streams + sealed authorizations). Builder suite re-run by the bencher at every bench: 18/18 at v0.1.0, 44/44 at v0.1.3 (38 prior + 6 round-3 fixes); R3 independent probes: 213 PASS / 1 probe-bug FAIL, standalone re-run PASS = 214/214 effective serialized checks. Decisive fixture F-FC8 independently reproduced at every bench: counter-signed seal (both thresholds pinned minor-only, scheduled step 1050@idx4), charges [1000,1030,1090,1050,1090,1095,1200] → exact sequence WITHIN, WITHIN, CREEP_PER_CHARGE, WITHIN, WITHIN, CREEP_CUMULATIVE, CREEP_BOTH; serialized pack verifies in a fresh process from pack + pinned public keys alone. PASS (local, fixture charge streams + sealed authorizations) is not CERTIFIED — certified is false, and nothing beyond the PASS verdict at its exact scope is claimed. Scope is exactly: local, fixture charge streams + sealed authorizations only; no live merchant, card network, bank feed, billing system, or real charge is touched; no real consumer financial data enters any fixture; value_class:"test" throughout. SPEC §11.2 measurement-not-breach fence: Faircharge measures drift against the sealed original authorization. Whether a measured increase breaches the merchant's terms or any law is a contract/legal question for Docket/counsel — Faircharge makes no breach, overcharge, or misconduct finding. A CREEP verdict is a measurement, not an accusation and not a breach finding; WITHIN_TERMS means only that the stream measured within its own sealed thresholds (or that a dimension was unpinned, labelled on the face — §6.3 no-verdict-laundering). The SPEC §10.1 counsel gates are UNBUILT, named in not_tested. Novel mechanism (SPEC §2.1, verbatim): creep is detected against the sealed price history from the original authorization, so a merchant's gradual increases are measured against proof, not memory. Stored serves in v0.1.3 are verify-before-serve (receipts hash/signature-gated, C3), the canonical measurement pack binds all 15 face fields exactly (E1, verifier_transcript dropped), the anomaly queue gates every store-consuming surface (E2), the stdio envelope survives non-object requests (E3), and mutators whole-store-validate before any write (E4). Non-blocking hygiene note F1 stands, verbatim class: container-level foreign keys undetected + re-persisted (never served, no verdict impact) (full text in not_tested).

Not tested:

• Hygiene note F1 (Verity delta re-bench round 3, MINOR, class-c hygiene, E4-adjacent, NON-BLOCKING): container-level foreign keys undetected + re-persisted (never served, no verdict impact). A foreign key on a relationship OBJECT (relationships.<ref>.certified=true) or at store ROOT (certification:"Cyan Eclipse Certified"), serialized, is never checked by _store_shape_ok / _chain_defect / _whole_store_defect (container key sets are not allowlisted) — status serves clean and a mutator on that relationship mints and re-persists the foreign key verbatim. No false serve resulted: status/export/receipt outputs are constructed explicitly (the key never appears in any output; the export pack is the canonical 15 fields, key absent from export JSON — verified), no verdict/anchor/receipt is affected, and the same key inside a PACK fails pack_face. The store is internal state, never the Docket deliverable. Hygiene fix for a later pass: exact key-set allowlists for store root + relationship objects in _store_shape_ok / _whole_store_defect. F1 is recorded as hygiene debt; it does not gate the deliverable and did not affect the verdict.
• Live charge streams or real consumers' authorizations — sealing real consumers' real subscription authorizations or measuring live charge streams from any real account/card/bank source (privacy + financial-data review) is SPEC §10.1 counsel gate (a), UNBUILT by design: v0.1.3 has no network imports tree-wide, the fail-closed fence refuses merchant/bank/card endpoints, live keys, real-format financial identifiers, and value_class other than "test"; no live merchant, card network, bank feed, billing system, or real charge is touched and no real consumer financial data enters any fixture
• Use of a measurement pack in a live chargeback, regulator complaint, or legal proceeding (SPEC §10.1 gate (b), evidence-language review, Docket-coordinated) and any integration that acts on a verdict automatically against a live charge — blocking/cancelling (gate (c), interference review) — are UNBUILT: no such verb exists on either surface, Faircharge never blocks, reverses, disputes, or alters any charge, contacts any merchant, or cancels anything; the measurement pack is Docket's deliverable and breach is Docket/counsel's question (§11.2 fence on every creep receipt + pack face)
• Marketing language asserting breach, overcharging as a legal conclusion, or merchant misconduct (SPEC §10.1 gate (d)) — fenced pre-counsel in README/manifest/receipts; never "catches merchants cheating", "proves overcharging", or "unauthorized charge detector"; also never claimed: live monitoring of any account, charge blocking/reversal, savings amounts, or that WITHIN_TERMS means a price is fair
• Production signing / Herald authority — Herald signing in v0.1.3 uses locally generated fixture keys (keys/, chmod 600, gitignored, never committed); verification reads keys/pinned-public.json only ({n,e} per role, Herald + caller publics) and key material in tool args or inside a pack is refused pre-verification. The fixture signing key holds no funds and authorizes no charge. A fresh clone generates its own fixture keys on first run to run the full suite
• Hosted or live operation — local stdio only; metering points only per SPEC §9 (exactly one Meter-grammar relationship-month record per sealed relationship non-terminal in that period, fixture clock in v0.1; measurements, creep receipts, status and exports emit no further metering, a creep finding is never a per-event charge per §11.4, CLOSED/BASELINE_DEFECT relationships emit none), the $5/mo shape is a book reference with no payment verb, invoice, collection mechanism, or charge path built and no live Meter ingest

Live state note: Bench evidence: argus101-program-20261027/wave2/bench-faircharge.md (Verity bench of v0.1.0, PASS-CONDITIONAL (local, fixture charge streams + sealed authorizations), conditions C0–C7, suite 18/18 re-run x2, F-FC8 decisive independent, spec-contradiction ruling on §2.2.2) + fix-faircharge.md / rebench-faircharge.md (v0.1.1) + fix2-faircharge.md / rebench2-faircharge.md (v0.1.2, D1–D6) + fix3-faircharge.md / rebench3-faircharge.md (v0.1.3: E1–E4 CLOSED, C0–C7 + D1–D6 hold, suite 44/44, 214/214 effective serialized checks, one new minor F1 hygiene note, non-blocking). Shipper suite re-run fresh pre-ship: 44/44 OK (x2, pre- and post-ship-prep). No test-bench scorecard was issued for this verdict and none is claimed (scorecard_ref/card_url null).