Eclipse Holdfast
Simulated escrow-release witness over a fixture escrow ledger — release is triggered by a counter-signed acceptance proof generated by executing the buyer's own acceptance tests — the test-run receipt, not a human click, unlocks funds. PASS-CONDITIONAL(simulator, fixture escrow ledger) — fixture escrow ledger only; no real funds are held, moved, or owed. Condition C-1: external anchor required before live/multi-party use — coordinated rollback across artifacts is not claimed by this local build. Condition C-2: SETTLEMENT_BPS = 50 requires price-book/owner ratification before priced reliance (SPEC states no numeric figure — §9.1 shape only, §9.2 defers to price book; the 50 bps component is disclosed and NEVER collected in this scope, collected:false on every metering record).
status: in-developmentclass: mcpAgent PaymentsTrust & Receipts
Vendor: Cyan Eclipse Technologies
What it does
- Novel mechanism (SPEC §2.1, verbatim) — release is triggered by a counter-signed acceptance proof generated by executing the buyer's own acceptance tests — the test-run receipt, not a human click, unlocks funds.
- Decisive fixture F-H9 — bench-reproduced independently (bencher corpus, bencher keys, amount 77700): Run 1 — a genuine passing, counter-signed proof over the sealed bundle releases (RELEASED_SIM, release entry = terms amount, simulated: true), the receipt's proof_hash equals the release entry's and the bencher-recomputed proof hash, metering exactly 1 record, idempotent re-presentation mints nothing new, and in a fresh process with an empty data dir the §6 export + pinned keys alone verify (verified: true, release claim RELEASED_SIM). Run 2 (decisive) — a run whose test_bundle_hash is an alien, never-sealed bundle hash, with all tests passing, results/proof hashes recomputed over the alien hash, and both counter-signatures valid over the proof as presented, is refused BUNDLE_HASH_MISMATCH; the escrow stays ACCEPTANCE_PENDING, chain and ledger unchanged, metering 0. A bench that only checked 'tests passed' would have released Run 2; this one did not.
- Recompute-only, fail-closed release — the §2.3 checks run in the spec's fixed order (terms binding, bundle identity, results recompute, pass criterion, counter-signatures, freshness/state) and any doubt refuses release by name with no ledger movement; there is no human approval verb, override verb, manual-release path, or partial release on any surface (13 forbidden verbs bench-probed absent). State is derived from the signed chain on every read; no stored state field exists.
- Offline verification (SPEC §6.3) — a pure function of the terms + chain + proof + receipt export + pinned keys alone: terms hash and both party signatures recomputed, chain recomputed head-to-tail against its signed anchors (terms hash, signed head hash, record count), §2.3 checks re-run, and the release entry bound to the verified proof. Any step failing names its step (HOLDFAST_VERIFY_FAIL:<step>); an unverifiable export is labelled UNVERIFIED_EXPORT on its face, carries no release claim, and can never be upgraded.
- Condition C-1: external anchor required before live/multi-party use — coordinated rollback across artifacts is not claimed by this local build.
- Condition C-2: SETTLEMENT_BPS = 50 requires price-book/owner ratification before priced reliance (SPEC states no numeric figure — §9.1 shape only, §9.2 defers to price book; the 50 bps component is disclosed and NEVER collected in this scope, collected:false on every metering record).
- Honest scope — SIMULATOR, fixture escrow ledger only: local stdio, fixture terms/funding/delivery/run artifacts only, value_class "test" on every artifact and simulated: true on every ledger entry; no real funds are held, moved, or owed and no custody, payment rail, bank, wallet, or processor is touched. Closed surface of exactly 10 tools (8 party + 2 operator, disjoint; a cross-surface verb returns the identical NO_SUCH_TOOL as a nonsense name). Startup is fail-closed (CONFIG_FENCE_REFUSED:<class>) on a live-key string, a non-local endpoint, value_class other than "test", or any custody/wallet/rail/bank/processor module or configuration. Signing is an HMAC fixture stand-in for Herald RS256 (disclosed).
- Grammar attribution is exact and minimal: mandates are Till's, metering records are Meter's grammar, signing follows Herald's pattern, dispute packs go to Docket, party refs come from Agent Wallet — consumed by grammar or reference only, none redefined and none depended on in code. Eclipse Assay and Eclipse Cupel are internal tools, not products: this product has no dependency on them, no integration with them, and no buy path, price, licence, or checkout for them anywhere.
Tools
holdfast_terms_propose · holdfast_terms_sign · holdfast_fund_sim · holdfast_delivery_present · holdfast_proof_present · holdfast_status · holdfast_verify · holdfast_dispute_handoff · holdfast_escrow_list · holdfast_anomaly_queue_read
Platforms
- MCP over stdio
Certification
Bench verdict: PASS-CONDITIONAL(simulator, fixture escrow ledger)
Certified scope: PASS-CONDITIONAL(simulator, fixture escrow ledger) — Verity bench of v0.1.0, 2026-10-27 (argus101-program-20261027/wave3/bench-holdfast.md): builder suite 34/34 re-run clean by bencher; decisive fixture F-H9 independently re-derived in both runs from bencher corpus + bencher keys; bencher adversarial battery 60/60 (recompute-in-verify, signed head + SET anchors, signed-records-only derived state, exact face/field sets, whole-store validation pre-write, consume-or-refuse partition with byte-identical store on every refusal, counter-signatures on every path, fail-closed verify on missing key, temporal monotonicity, crash-proof envelopes, F-H2/F-H5/F-H6 state battery, F-H3 expiry return, amount discipline, no-click law with 13 forbidden verbs absent, dispute handoff, labels on 100% of artifacts). Defects: none. PASS-CONDITIONAL is not CERTIFIED — certified is false, and nothing beyond the conditional verdict at its exact scope is claimed. Scope is exactly: local stdio MCP, fixture escrow ledger only, value_class "test" on every artifact and simulated: true on every ledger artifact; no real funds are held, moved, released, or owed, and no custody in any form exists in v0.1.0. Condition C-1: external anchor required before live/multi-party use — coordinated rollback across artifacts is not claimed by this local build. Condition C-2: SETTLEMENT_BPS = 50 requires price-book/owner ratification before priced reliance (SPEC states no numeric figure — §9.1 shape only, §9.2 defers to price book; the 50 bps component is disclosed and NEVER collected in this scope, collected:false on every metering record).
Not tested:
- Live custody / escrow licensing — SPEC §10 counsel gate (named, unbuilt): real fund custody or movement in an escrow form — holding buyer funds, acting as escrow agent, releasing real funds, or marketing a live escrow offering — is counsel-gated under the FinTech Law packet, additionally implicating escrow-agent / money-transmission licensing analysis counsel must scope before any live design exists; no custody, rail, wallet, bank, or processor code exists in this tree, there is no dormant live mode to activate, and a live phase is a separate, counsel-cleared, re-benched build, not a configuration change
- Condition C-1: external anchor required before live/multi-party use — coordinated rollback across artifacts is not claimed by this local build.
- Condition C-2: SETTLEMENT_BPS = 50 requires price-book/owner ratification before priced reliance (SPEC states no numeric figure — §9.1 shape only, §9.2 defers to price book; the 50 bps component is disclosed and NEVER collected in this scope, collected:false on every metering record).
- Production signing — v0.1.0 signing is an HMAC fixture stand-in for Herald RS256, disclosed on the product's face and on the signer face of receipts/evaluations; keys are pinned out-of-band in a local chmod-600 gitignored key file — a record-supplied key field is an unknown field, refused by name with its value never echoed, and a missing pinned key verifies nothing (fail-closed); a live phase requires real Herald RS256 signing and a re-bench
- Proof honesty (SPEC §11.4) — a release receipt proves a counter-signed run of the sealed bundle met the sealed criterion over the presented run record; it does not prove the delivered goods are good in any broader sense, that the tests were well-chosen, or that the runner's environment was honest; under NO_CRITICAL_FAIL, per-test criticality is taken from the counter-signed proof's outcomes (the bundle itself is never presented, only its sealed hash — bench advisory F-2)
- Multi-deliverable or staged escrows and a mutual-cancel verb — out of v0.1 (one deliverable, one amount, all-or-nothing release; §5 defines no cancel verb; the v0.1 return path is expiry-only); an ACCEPTANCE_PENDING escrow read past expiry does not auto-return (bench advisory F-3) and a post-expiry proof is refused ESCROW_EXPIRED
- Production key custody / fresh clone — fixture keys live in keys/fixture-keys.json (chmod 600, gitignored, never committed); a fresh clone generates its own fixture key file to run the full suite
- Hosted or live operation / charge path — local stdio only; metering points only per SPEC §9 (exactly one Meter-grammar record per escrow reaching a terminal settlement state, RELEASED_SIM or RETURNED_SIM, at the $1/settlement + bps shape; refusals, failed runs, and idempotent re-presentations emit 0; the bps component is disclosed and never collected — collected: false on every metering record), no charge, checkout, invoice, or payment-collection path is built and no live Meter ingest is claimed
Live state note: Bench evidence: argus101-program-20261027/wave3/bench-holdfast.md (Verity bench of v0.1.0, 2026-10-27; builder suite 34/34 re-run clean by bencher, decisive F-H9 reproduced independently in both runs, bencher adversarial battery 60/60, scope audit confirming the §10 counsel gate genuinely unbuilt; defects none; conditions C-1/C-2 binding, advisories F-2–F-4 non-blocking). No test-bench scorecard was issued for this verdict and none is claimed (scorecard_ref/card_url null).
Pricing
PRICED — $1/settlement + bps, via the Eclipse Bazaar bench-order/intake path only. No checkout, payment, or buy-now link exists for this product, and no Stripe object exists for it in this pass: intake orders are reviewed and confirmed by the operator before any payment link is sent. Condition C-2: SETTLEMENT_BPS = 50 requires price-book/owner ratification before priced reliance (SPEC states no numeric figure — §9.1 shape only, §9.2 defers to price book; the 50 bps component is disclosed and NEVER collected in this scope, collected:false on every metering record). Metering shape per SPEC §9 (metering point only in v0.1.0, no charge path built): exactly one Meter-grammar record per escrow reaching a terminal settlement state (RELEASED_SIM or RETURNED_SIM), carrying price_shape "$1/settlement + bps" — a $1 base (settlement_base_minor 100) plus the bps component against the fixture amount (bps: 50, disclosed on every record); the bps component is disclosed and NEVER collected in this scope — collected: false on every metering record; refusals, failed runs, and idempotent re-presentations emit 0 metering points and no escrow meters twice. The local package is the reference implementation. Repository is PRIVATE (priced-product policy).
Install / verify
No install command is published for this product in the catalog or its registry record.
Official MCP Registry name: io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-holdfast-mcp
Registry listing: https://registry.modelcontextprotocol.io/v0.1/servers/io.github.CYAN-ECLIPSE-TECHNOLOGIES-LLC%2Feclipse-holdfast-mcp/versions/0.1.0
Repository: https://github.com/CYAN-ECLIPSE-TECHNOLOGIES-LLC/eclipse-holdfast-mcp
Verify any MCP server in your client configs against this catalog with bazaar check (Eclipse Bazaar MCP / CLI — see llms.txt).