Eclipse Promptseal

Bench verdict: PASS (local/fixture)

Certified scope: PASS (local/fixture) — Verity bench of v0.1.0 (2026-10-27, argus101-program-20261027/wave2/bench-promptseal.md) PASS-CONDITIONAL (local/fixture) with condition C1 (minor, stored-read: incident_link idempotent path echoed stored link before chain check); delta re-bench of v0.1.1 (rebench-promptseal.md): C1 CLOSED, new C2 (lineage binding) + C3 (incident_link idempotent pairing); delta re-bench round 2 of v0.1.2 (rebench2-promptseal.md): C2+C3 CLOSED, new C4 (serve canonicalization) + C5 (pack duplicates unbound) + C6 (whole-store validation); delta re-bench round 3 of v0.1.3 (rebench3-promptseal.md): C4+C5+C6 CLOSED, C1–C6 all CLOSED, no new conditions — CONDITIONS CLOSED, Promptseal — PASS (local/fixture). Builder suite re-run by bencher at every bench: 27/27 at v0.1.0, 30/30 at v0.1.1, 36/36 at v0.1.2, 49/49 at v0.1.3; R3 independent probes: 102/102 checks + 31/31 C6 probes PASS. Decisive fixture F-PS13 independently reproduced: pack written to file, trace_verify in fresh subprocess with empty data dir verified:true, prompt_hash + approver_ref + version_record_hash equal receipt face values, prompt_hash=sha256(body) recomputed. PASS (local/fixture) is not CERTIFIED — certified is false, and nothing beyond the PASS verdict at its exact scope is claimed. Scope is exactly: seal chain + Herald approval binding + incident traceability over fixture prompts/deployments/incidents ONLY; NOT production prompts, real deployments, or runtime attestation (SPEC §11.2 — the chain proves which prompt version was sealed and who approved it, and that a fixture deployment's binding named it; it does not prove the sealed prompt is what actually ran in any live process); dispute use is SPEC §10.1 counsel-gated and UNBUILT — no production ingest, deployment connector, or runtime hook exists. Novel mechanism (SPEC §2.1, verbatim): production system prompts are sealed and versioned; every runtime incident can be traced to the exact prompt version and its approver. Stored serves in v0.1.3 are canonical (exact per-type field sets, injected counter_signature/unknown fields are chain defects), pack duplicates are bound exactly to chain copies, and the whole store is validated at load on every path. Non-blocking observations O1 (lineage_status lists state:APPROVED under chain_ok:false, disclosed in-band, not an export/receipt) and O2/R3 observations remain observations, no conditions. Fixture Herald key is a test double (pinned herald-fixture, keys/ gitignored mode 600); Promptseal consumes Herald-signed approval records, issues none, redefines none; value_class:"test" throughout.

Not tested:

• Production prompts, real deployments, or runtime attestation — SPEC §11.2 fence: the chain proves which prompt version was sealed and who approved it, and that a fixture deployment's binding named it; it does not prove the sealed prompt is what actually ran in any live process. Runtime attestation is an integration claim, never a v0.1 claim, and no runtime integration exists in v0.1.3
• Sealing real production prompts (prompt bodies may carry trade-secret/confidential material), binding to real deployments, any runtime-attestation integration, or use of a trace receipt in an employment, contractual, or regulatory dispute — the SPEC §10.1 counsel gate is UNBUILT by design, named, with no dormant live mode: each live phase is a separate, counsel-cleared, re-benched build. v0.1.3 has no production-prompt ingest path, no deployment connector, and no runtime hook
• Production signing / Herald authority — fixture Herald key is a test double (pinned herald-fixture, local fixture key in keys/, gitignored, mode 600, never committed) and confers no Herald authority; Promptseal verifies and cites Herald-signed approval records, issues none, and holds no real Herald key. A fresh clone generates its own fixture keys to run the full suite
• Hosted or live operation — local stdio only; metering points only per SPEC §9 (exactly 1 promptseal_lineage_month_active event per lineage; seals, approvals, binds, links, traces and refusals add none; no charge path built, no live Meter ingest), the $49/mo shape is a book reference with no charge path built

Live state note: Bench evidence: argus101-program-20261027/wave2/bench-promptseal.md (Verity bench of v0.1.0, PASS-CONDITIONAL (local/fixture), condition C1, builder suite 27/27 re-run twice, F-PS13 decisive fixture independent, stored-read + adversarial + malformed batteries) + rebench-promptseal.md (v0.1.1: C1 CLOSED, suite 30/30, new C2+C3) + rebench2-promptseal.md (v0.1.2: C2+C3 CLOSED, suite 36/36, new C4+C5+C6) + rebench3-promptseal.md (v0.1.3: C4+C5+C6 CLOSED, C1–C6 all CLOSED, suite 49/49, 102/102 checks + 31/31 probes PASS, F-PS13 re-confirmed, no new conditions). No test-bench scorecard was issued for this verdict and none is claimed (scorecard_ref/card_url null).