Eclipse Timecapsule

Bench verdict: CERTIFIED (local/simulator, public seal registry over fixture commitments, value_class "test")

Certified scope: CERTIFIED (local/simulator, public seal registry over fixture commitments, value_class "test") — CERTIFIED — Eclipse Timecapsule v0.1.4, local/simulator scope only: public seal registry over fixture commitments, value_class "test". No certification claimed beyond this scope. Verity bench of v0.1.0 (2026-10-27, argus101-program-20261027/wave2/bench-timecapsule.md) PASS-CONDITIONAL (local/simulator, public seal registry over fixture commitments) with conditions C1–C8; fix rounds v0.1.1–v0.1.3 closed C1–C8, D1–D5 and N1–N3; delta re-bench round 4 of v0.1.4 (rebench4-timecapsule.md): R1 (aux anchor signature-null bypass) CLOSED, remaining conditions NONE, builder suite 69/69 re-run by the bencher, independent harness 72/72 checks PASS, regression spot probes confirm C/D classes stay closed — CERTIFIED at exactly this scope. Decisive fixture F-T10 independently reproduced at the bench: from the registry export + pinned public keys alone, an author's complete track record recomputes (8 seals, gapless author_seq, head counts exact, tallies identical) and a cherry-picked presentation of only the winners fails step 5, naming the missing author_seq values. Scope is exactly: local/simulator, public seal registry over fixture commitments, value_class "test"; fixture cryptography only (1024-bit fixture RSA, fixture keys, fixture clock); no live prediction, real SLA, real outcome feed, or public registry deployment exists in v0.1.4. Gates remain unbuilt by design and are OUT of certified scope: no public hosting, no outcome feed, no SLA enforcement, no charge path, no network. Score ≠ merit (SPEC §10.3): a track record establishes only that stated commitments were sealed before their windows and scored under their pinned rules over presented outcomes — whether the commitments were hard, the outcomes true, or the author skilled is outside what the recomputation shows. Novel mechanism (SPEC §2.1, verbatim): predictions and SLA commitments are sealed publicly before the outcome window and scored at maturity — a track record that cannot be backdated or cherry-picked. Stored serves are verify-before-serve / downgrade-labelled (C5), aux stores (metering + anomalies) are Herald-anchored with entry-by-entry validation (C6 + R1), and every anchor-consulting surface fails closed as STORE_DEFECT / AUX_ANCHOR_DEFECT on a signature-defective aux anchor with zero writes.

Not tested:

• Live public track records relied on by third parties (SPEC §10 counsel gate) — a track record marketed to sell agent services or forecasts, cited in investment or procurement decisions, or attached to an enforceable SLA with penalties is OUT of v0.1.4, hard, UNBUILT by design: this tree contains no public-registry hosting, no outcome-feed integration, no public anchoring, and no SLA-enforcement code whose later activation the gate could be misread to authorize; a live phase, if counsel clears it, is a separate, re-benched build
• Public hosting / network operation — local stdio only, no network imports tree-wide; the gates (hosting, outcome feed, SLA enforcement, charge path, network) are unbuilt and out of certified scope by design
• Real outcomes / oracle claims — outcome records are fixture records presented with a source ref; Timecapsule does not originate outcomes and no fixture source is styled as an oracle or anything more than a fixture source in any artifact (Q-T1); the track record's honesty extends exactly as far as those presented sources (§10.3 disclaimer)
• Enforcement / collection / reputation rating — Timecapsule scores commitments; it does not collect on them, enforce them, or move money, and a track record is never a single blended reputation rating or a claim that a HIT rate establishes skill (SPEC §11.3 forbidden claims are bench-grepped absent tree-wide)
• Production signing / Herald authority — fixture cryptography only (1024-bit fixture RSA, locally generated fixture keys in keys/, chmod 600, gitignored, never committed); verification reads pinned keys/public-keys.json only and never keys embedded in a record or export; no key in this product can move money or enforce an SLA. A fresh clone generates its own fixture keys on first run to run the full suite
• Author identity continuity (SPEC Q-T3, accepted, stated not solved) — author_ref is a fixture key hash; an author who rotates keys forks their track record into two authors under this spec; author_counter_sign uses server-held fixture author keys (house fixture custody pattern) with no caller-identity proof — in-scope for simulator, must not survive a live phase
• Hosted or live operation / charge path — metering points only per SPEC §9 (exactly one Meter-grammar metering point per accepted seal at the FREE + $0.10/seal price shape; scoring, outcome presentation, reads, verifies, refusals, voids and idempotent re-seals emit none), no charge, checkout, or collection path is built and no live Meter ingest is claimed

Live state note: Bench evidence: argus101-program-20261027/wave2/bench-timecapsule.md (Verity bench of v0.1.0, PASS-CONDITIONAL (local/simulator, public seal registry over fixture commitments), conditions C1–C8, suite 27/27 re-run x2, F-T10 decisive independent) + fix/rebench rounds v0.1.1–v0.1.3 (C1–C8, D1–D5, N1–N3 closed) + fix4-timecapsule.md / rebench4-timecapsule.md (v0.1.4: R1 CLOSED, conditions NONE, suite 69/69, independent harness 72/72 — CERTIFIED). Shipper suite re-run fresh pre-ship: 69/69 OK (pre- and post-ship-prep). No test-bench scorecard was issued for this verdict and none is claimed (scorecard_ref/card_url null).