Cyan Eclipse Archivist

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

What it does

• Novel mechanism (SPEC §2.1, verbatim) — page captures seal content, headers, and the TLS certificate together — the bundle proves what was served, by whom, and when, as one artifact.
• Decisive fixture F-A8 stands from the bench record — a fixture capture sealed, exported, and verified in a fresh process from the pack + pinned public keys alone: genuine pack BUNDLE_VALID with independent recompute (sha256(body)=content_hash, sha256(DER)=cert_hash); each single-part substitution from a second sealed capture fails by name (body → step1:content_hash, headers → step1:headers_hash, cert DER → step2:cert_identity).
• Cross-artifact integrity (v0.1.2, R1–R8 closed at re-bench 2) — a signed store head cross-commits the bundle-set head, every per-bundle chain head, the anomaly head, and the sealed metering head; a signed bundle-set anchor binds the full set, so subset deletion, delete-all, metering deletion/fabrication, record alias transplants, and pair-reverts are BUNDLE_DEFECT on every serve/mint surface, never clean serves or plain BUNDLE_NOT_FOUND; the pack face is exact (unknown top-level or capture keys fail by name) and whole-store garbage raises structured BUNDLE_DEFECT on every entry path.
• Condition 1 — Rollback residual (R1c): a full coordinated restore of all local artifacts to one consistent earlier snapshot is undetectable in the local file model — fenced verbatim on README + every pack (rollback_fence) + server.json. External anchor required before any live or multi-party use/claim.
• Condition 2 — §10 counsel-gated phases remain unbuilt and unclaimed; any claim at those scopes requires counsel clearance + scope edit + re-bench (§10.2).
• Rollback fence (README, verbatim): Honesty fence — rollback residual: within this local file model, a rollback that restores every local artifact (bundle records, verification chains and their anchors, the signed bundle-set anchor, the anomaly queue and its anchor, sealed metering and its anchor, and the signed store head) to one consistent earlier snapshot is undetectable; the cross-artifact anchors detect partial rollbacks and single-artifact tampering, not a complete coordinated snapshot restore. An external anchor — a head hash held outside this store — is required for live or multi-party use. No stronger claim is made.
• Residual limit (SPEC §11.2, on every bundle and export, verbatim in substance): This bundle proves what the capturing fetcher was served, at the witness time, under the certificate presented to it. A server may serve different content to other fetchers, at other times, or under other certificates — the bundle says nothing about what anyone else was served. The content-targeting case (a server detecting the fetcher and serving it special content) is the named example of this limit wherever it is explained at length.
• Downgrade law (SPEC §6.6) — a capture assembled after the fact receives no bundle, only a clearly labelled UNSEALED_SUMMARY (unsigned, sealed: false) which the §6.4 verifier rejects as an Archivist artifact; a pack with any part-hash failing downgrades whole to UNWITNESSED_EXPORT; an export without the content payload is a labelled HASH_ONLY_EXPORT, never an upgrade path.
• Format attribution is exact and minimal: metering records are emitted in Meter grammar, signing is Herald's pattern (fixture HMAC stand-in), and evidence packs are assembled to Docket's pattern — consumed, never redefined. Cyan Eclipse Verity Bench and Eclipse Cupel are internal tools, not products: this product has no dependency on them, no integration with them, and no buy path, price, licence, or checkout for them anywhere.

Tools

Problems it addresses

• Web evidence today is a screenshot, a saved HTML file, or a log line — each separable, alterable, and silent on who served it: a page capture without its certificate cannot prove which server (or which impersonator) supplied the content
• I need content, serving context, and server identity bound indivisibly at capture time — one hash-chained, signed bundle artifact — so recombining parts from different captures after the fact breaks verification by name
• I need the bundle's limit printed on its face: it proves what the capturing fetcher was served at the witness time under the presented certificate — never what anyone else was served, and never admissibility, notarization equivalence, or that the content was true

Not tested

• Live or multi-party use — CONDITION 1 (bench, verbatim): Rollback residual (R1c): a full coordinated restore of all local artifacts to one consistent earlier snapshot is undetectable in the local file model — fenced verbatim on README + every pack (rollback_fence) + server.json. External anchor required before any live or multi-party use/claim.
• Full coordinated restore of all artifacts to a consistent earlier snapshot — Honesty fence — rollback residual: within this local file model, a rollback that restores every local artifact (bundle records, verification chains and their anchors, the signed bundle-set anchor, the anomaly queue and its anchor, sealed metering and its anchor, and the signed store head) to one consistent earlier snapshot is undetectable; the cross-artifact anchors detect partial rollbacks and single-artifact tampering, not a complete coordinated snapshot restore. An external anchor — a head hash held outside this store — is required for live or multi-party use. No stronger claim is made.
• Counsel-gated phases (SPEC §10, named, unbuilt/unclaimed) — CONDITION 2 (bench, verbatim): §10 counsel-gated phases remain unbuilt and unclaimed; any claim at those scopes requires counsel clearance + scope edit + re-bench (§10.2). The gated phases are: (a) live web capture; (b) evidentiary use in proceedings (no admissibility or notarization-equivalence claim is made anywhere); (c) retention/handling of real captured content; (d) capture of authenticated or paywalled content. No dormant live path exists in v0.1.2 — the startup fence refuses fetch/endpoint configuration.
• Live captures and real servers — fixture captures only: fixture page content, fixture headers, and locally generated fixture TLS material; no real page, certificate, or server is touched, and the bundle identity on the face is the presented certificate's identity, not a verified identity of any operator (SPEC §11.3)
• Live Herald signing — v0.1.2 signing is a fixture HMAC stand-in for the Herald RS256 pattern, disclosed on the product's face; verification uses pinned fixture keys only, never keys presented inside a record or pack
• Production key custody — fixture keys are local-only in keys/ (gitignored, mode 600, never committed); a fresh clone must create its own fixture key file to run the full suite
• Hosted or live operation / charge path — local stdio only; metering point only per SPEC §9.1 (one Meter record per completed bundle_seal at the $0.10/capture price shape; verifications, gets, status, and exports emit no metering record), no charge path, payment call, or entitlement check is built and no live Meter ingest is claimed