Eclipse MPP Session Witness MCP
MPP session evidence / witness: mandate-sealed sessions, counter-signed draws, and witness receipts over fixture sessions and a local mock relay — Moderato testnet shapes only; no chain interaction, no live clearing, no live Meter ingest.
status: in-developmentclass: mcpAgent Commerce & DisputesTrust & Receipts
Vendor: Cyan Eclipse Technologies
What it does
- Novel mechanism — a session mandate (Herald-shape RS256 JWS) is verified at open in a fixed order (authenticity → cap → allowlist → expiry/revocation → approval threshold) and its hash is sealed into the session_open record; every draw is counter-signed at draw time by the caller key and a witness sidecar key, hash-chained, citing the mandate hash and a running all-in total.
- Named refusals + witness receipts — cap-breaching draws are refused by name before they happen (spec §5.4 named refusals, incl. the R-W1 trigger partition); refusals are logged unsigned and never move the total. At close, a witness receipt binds mandate-hash ↔ voucher-chain head ↔ settlement reference from the mock relay, with three signatures (witness, buyer, seller); the §6.4 offline verifier recomputes the whole pack from the artifact + public keys alone, and dispute_pack_get assembles a Docket-grade dispute pack.
- Honest scope — local stdio, Python stdlib only, fixture sessions + mock relay, Tempo Moderato testnet SHAPES (chainId 42431, hard-pinned in code): no chain interaction, no RPC, no Stripe API, no live clearing, no deposit custody, no live Meter ingest (draw records are emitted in Meter's record grammar for later ingest). Every artifact carries value_class: "test" and network: "tempo-moderato-42431". Startup hard-refuses any mainnet marker, any Stripe key, any RPC/non-local endpoint, relay_mode other than mock, or value_class other than "test".
- Disjoint surfaces, no money verbs — buyer and operator tool tables are disjoint, selected by ECLIPSE_TILL_MPP_WITNESS_SURFACE; no tool moves money, holds or releases a deposit, raises a cap, alters a mandate, counter-signs for a party, or issues a receipt for an unwitnessed session. The enabling MPP rail profile earned its own PASS (sandbox/fixture) but is never listed standalone (rail spec §1.4) — listings attach to the Witness only.
Tools
session_open · session_draw · session_close · session_status · receipt_get · receipt_verify · buyer_counter_sign · session_open_accept · session_close_accept · session_list · dispute_pack_get · revocation_present · anomaly_queue_read
Platforms
- MCP over stdio
Certification
Bench verdict: PASS-CONDITIONAL (sandbox/fixture)
Certified scope: local stdio, fixture sessions + mock relay, Moderato testnet SHAPES, no chain interaction, no live clearing, no live Meter ingest, K6 claims only
Not tested:
- Live clearing — not tested and not claimed: v0.1 runs fixture sessions against a local mock relay only; no chain interaction of any kind
- Mainnet — not tested and refused by design: startup hard-refuses any mainnet marker; Moderato testnet shapes only (chainId 42431)
- Live Meter ingest — not tested and not claimed: draw records are emitted in Meter's record grammar for later ingest only
- Live protocol operation, Stripe API, deposit custody — absent at v0.1 by design; none exists in the package
Live state note: Label on record: MPP Session Witness — PASS-CONDITIONAL (sandbox/fixture), Verity re-bench of v0.1 @ 70cc818; the sole condition R-W1 was doc-only and is discharged by coordinator edits to the witness spec §5.4, verified on disk 2026-10-27. PASS-CONDITIONAL is not CERTIFIED — certified is false, and nothing beyond the conditional verdict at its exact scope is claimed. No test-bench scorecard is claimed for this listing; scorecard_ref is null.
Pricing
PRICED — witness receipts priced at the witness-receipt pattern and dispute-pack assembly at the Docket pattern in the house price book, via the Eclipse Bazaar bench-order path (order intake) only. No checkout, payment, or buy-now link exists for this product, and no dollar figures are stated in this listing — figures live in the price book. Repository is PRIVATE (priced-product policy).
Install / verify
No install command is published for this product in the catalog or its registry record.
Verify any MCP server in your client configs against this catalog with bazaar check (Eclipse Bazaar MCP / CLI — see llms.txt).