Eclipse Understudy

Bench verdict: PASS-CONDITIONAL(local, subset proof over Till-grammar fixture mandates)

Certified scope: PASS-CONDITIONAL(local, subset proof over Till-grammar fixture mandates) — Verity bench of v0.1.0 (2026-10-27, argus101-program-20261027/wave3/bench-understudy.md): builder suite 34/34 re-run clean by bencher; decisive fixture F-U9 independently reproduced (bencher corpus, bencher keys, black-box stdio) — STRICT_ATTENUATION with face vector and subset_proof equal to bencher recomputation, full chain recomputed from the §6.2 export alone, and fresh-process empty-data-dir verify → VERIFIED_EXPORT / STRICT_ATTENUATION re-derived; all 8 F-U5 single-dimension widenings NOT_SUBSET with named codes and fresh-process recompute; 9-field absence totality, §5.3 refusal partition, verify/tamper/downgrade battery, metering exactness, and malformed battery all pass (bencher battery 99 checks). PASS-CONDITIONAL is not CERTIFIED — certified is false. Scope is exactly: local stdio, fixture mandate pairs only, value_class 'test'; Understudy issues no mandates, grants no authority, registers no agents, and executes no delegated action. Sole condition (verbatim): Cross-artifact cross-commitment note: full coordinated rollback across separately held artifacts is a fenced condition — external anchor required before live/multi-party use. Advisory F-2/F-3 (non-blocking, v0.2 hardening notes): chain-hop hash continuity (chain_verify binds hops by mandate_id, not hash/citation) and offline verify temporal re-check (verify step 2 does not re-run write-time predates/expiry-at-issuance checks; prove, the sole mint path, refuses both).

Not tested:

• Live delegated-authority reliance — SPEC §10 counsel gate (named, unbuilt): a production platform admitting, limiting, or acting on sub-agents in reliance on Understudy proofs over live mandates, or any marketing of the proof as establishing legal agency, authority, or liability allocation — is out of v0.1, hard, gated on counsel clearance; no issuance, registration, or enforcement code exists, and a subset proof establishes a mathematical relation between two mandates only — whether that relation creates, evidences, or limits legal authority is a counsel question this product never answers on its own face
• Condition (bench, verbatim): Cross-artifact cross-commitment note: full coordinated rollback across separately held artifacts is a fenced condition — external anchor required before live/multi-party use. v0.1 anchors are local to the evaluation (binding prev_hash = pair-hash anchor); no coordinated rollback across separately held artifacts is possible or claimed until an external anchor exists
• Advisory F-2 (bench, v0.2 hardening note, non-blocking): chain_verify binds hops by mandate_id equality and does not check that hop i+1's delegator mandate is hash-identical to hop i's delegate mandate, nor that hop i+1's proof cites hop i's subset_proof in prior_hop_proof — the direct root-vs-final recompute still prevents any chain-verified final delegate from exceeding the root mandate, and each hop proof is individually genuine; hash + citation continuity in chain_verify is recorded for v0.2 hardening
• Advisory F-3 (bench, v0.2 hardening note, non-blocking): offline understudy_verify re-runs structure, pinned-key signatures, binding, and delegability at SPEC §6.4 step 2, but does not re-run the write-time temporal checks (DELEGATE_PREDATES_DELEGATOR, delegator expiry at evaluation) — reachable only by the Herald-key holder, since prove, the sole mint path, refuses both
• Production signing — v0.1.0 signing is an HMAC fixture stand-in for Herald RS256 (signer face: herald-fixture (fixture HMAC stand-in for Herald RS256)), disclosed on every signed face; verification uses keys pinned out-of-band in a local chmod-600 gitignored key file, never key material from the record under verification; a live phase requires real Herald signing and a re-bench
• Production key custody — fixture keys live in keys/fixture-keys.json (chmod 600, gitignored, never committed); a fresh clone generates its own fixture key file to run the full suite
• Hosted or live operation / charge path — local stdio only; metering points only per SPEC §9 (exactly 1 point per sealed proof, any verdict; 0 for refusals, verifies, chain reads, and idempotent resubmissions), no charge path is built, no payment is taken, and no live Meter ingest is claimed
• Grammar pin — mandate fields, canonical form, hash construction, and verification order are Till §5's, consumed verbatim (GRAMMAR_PIN: Till section 5 mandate grammar (eclipse-till-mcp README section 5 + MPP Session Witness spec 4.1), dimension set per Understudy spec 2.3, pinned 2026-10-27); the B0 checkout-profile spellings are the purchase profile of the same grammar, mapped semantically and disclosed per SPEC §14 Q-U1 — if a future Till grammar revision renames fields, a spec amendment (not builder discretion) is required

Live state note: Bench evidence: argus101-program-20261027/wave3/bench-understudy.md (Verity bench of v0.1.0, 2026-10-27; builder suite re-run clean-state 34/34, decisive F-U9 reproduced independently incl. fresh-process re-derivation, bencher battery 99 checks, scope + claim-surface audit confirming the §10 counsel gate genuinely unbuilt; single condition as stated, F-2/F-3 advisory only). No test-bench scorecard was issued for this verdict and none is claimed (scorecard_ref/card_url null).