Cyan Eclipse Brake

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

What it does

• Novel mechanism — runtimes poll a local policy endpoint; a BRAKE verdict halts the fleet within the poll interval, and the runtime returns a signed halt receipt proving it actually stopped (SPEC §2.1, the mechanism the bench verified verbatim via F-B14). Brake has no push channel, no remote kill, and no verb inside any runtime — a runtime that never polls cannot be halted by Brake, and Brake never claims otherwise.
• HALTED only on proof — a fleet is HALTED only when every enrolled runtime has a valid, in-window, counter-signed halt receipt bound to the verdict's hash. Absence of a receipt is never evidence of a halt: the complementary terminal state is UNPROVEN-HALT, stated on the episode pack's face and never softened. Late receipts are recorded as defects and never amend a closed episode; a stale verdict closes its episode STALE-UNDELIVERED.
• Offline-recomputable episode pack — the pack (fleet record, verdict token, poll records, receipts, defects, close statement, hash chain) recomputes via receipt_verify executing the full §6.4 procedure: fleet-record hash recomputed from the full record in the pack and bound to the signed chain, chain and poll-record signatures verified, receipts bound to recorded poll deliveries, post-halt attestations recomputed against the Brake-side fixture task log exported in the pack, and the close state derived mechanically from the enrolled roster — a partial fleet's pack cannot be re-hashed into HALTED (re-bench D1 forgery now fails at verifier step 1 with no key).
• Named refusals + configuration fence — duplicate receipts, receipts from non-enrolled runtimes, no-poll receipts, poll-time mismatches, excess latency, and malformed inputs are all refused by name (RECEIPT_DUPLICATE, RECEIPT_RUNTIME_NOT_ENROLLED, RECEIPT_NO_POLL_RECORD, RECEIPT_POLL_TIME_MISMATCH, RECEIPT_LATENCY_INVALID, RECEIPT_MALFORMED, and the §5.4 set); startup hard-refuses fenced configurations (CONFIG_FENCE_REFUSED:<class>, §7.3 — non-local endpoints, real credentials, production identifiers, non-test value_class, non-mock relay modes all hard-exit code 2). Disjoint surfaces: operator = exactly 5 tools, runtime = exactly 3; cross-surface calls return the identical unknown-tool refusal as a nonsense name.
• Honest scope — LOCAL/simulator ONLY: local stdio MCP server (Python stdlib only) + fixture fleet runtime on an integer fixture clock; signing is a fixture HMAC stand-in for the Herald pattern (fixture keys are derivable from the published source — the labelled §7.4 fixture discipline, scope-inherent and disclosed by the bench). No real fleet is halted, polled, or contacted; no live-fleet path exists in the tree (no socket/urllib.request/requests/http.client imports). Halting real fleets is behind a named counsel gate — v0.1.2 contains no dormant live path.

Tools

Problems it addresses

• My fleet's kill switch is self-operated and self-attested — I need a halt ordered through a neutral third-party authority, executed by the runtime, and proved by a signed receipt bound to the verdict that ordered it
• A runtime never responded to a halt order and I need that failure named on the record — UNPROVEN-HALT — not smoothed into a claim that the fleet stopped
• I insure or regulate agent fleets and need halt evidence a third party can recompute offline from the episode pack alone — verdict token, poll log, and halt receipts — without trusting the operator or the halt authority

Not tested

• Live fleets — not tested and not claimed: v0.1.2 runs a local policy endpoint + fixture runtime only; no real fleet is halted, polled, or contacted, and no live-fleet path exists in the tree
• Production signing custody — signing is a fixture HMAC stand-in for the Herald pattern; fixture keys are derivable from the published source (labelled §7.4 fixture discipline), so a presenter holding the fixture keys can mint indistinguishable artifacts — scope-inherent, disclosed by the bench
• Hosted fleet shape — waits Gate B1; the local package is the reference implementation and no hosted endpoint exists or is claimed