Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio
Certification scope
CERTIFIED(local) — Eclipse Bazaar Test Bench 2026-10-25: 25 pass, 0 na of 27 checks (1 partial, 1 fail — LOW defects D-COR-1/D-COR-2, no verdict impact, retained on the card). CEILING — read exactly: CERTIFIED(local) for the local verifier only, at the P0 ceiling, and nothing broader. Proven: the 5-tool MCP surface + Gate CLI + Sheet CLI as shipped; staged-class sealed packs over the §14 fixture corpus (bench-built, bench-signed); served-class dogfood pack verification for cetech.ai (builder-sealed, bench-recomputed); the gate contract including WARN/ENFORCE claim asymmetry; the house profile on a bench house-shaped fixture. Render-proof packs are bound to deployed artifact hashes: a pack proves identity and mechanical soundness of the pinned bytes under named measured facts — it does NOT prove an asset is semantically the right asset; semantic approval is the separate human act of approving the pack's contact sheet once per version. Claim-gate wording (spec §8.2): a deploy may be reported 'verified live' only while a PASS served pack exists whose input hashes equal the currently deployed manifest; any served-byte change invalidates the proof automatically; the gate blocks the word 'verified', never the publish. No hosted or live scope is certified: the hosted matrix is a P2 seam only (HOSTED_MATRIX_NOT_AVAILABLE). N-CHECK: NOVELTY_PROVEN — shipped surface 7/7 novel core (5 MCP tools + Gate CLI + Sheet CLI), substrate verbs 0/7 = 0% (R3 kill line 80% not triggered). NAME CONDITIONAL pending trademark screen (Chaos Corona / Corona beer screen outstanding, D1); fallbacks on record: Eclipse Transit, Eclipse Behold, Eclipse Lantern.
What it does
- Sealed render-proof: renders the served artifact across a pinned matrix (Chromium/Firefox/WebKit x 1440x900, 768x1024, 390x844), runs a closed vocabulary of mechanical probes at each cell (served Content-Type per asset class, stylesheet application, media boxes, overflow, viewport meta, alt presence, console errors, transport), hashes every screenshot, and seals measurements + hashes + matrix into a signed, hash-chained pack any third party can recompute offline
- Proof bound to the deployed artifact: the pack pins the deploy manifest (version + per-file content hashes) as the approved build — any served-byte change invalidates the proof automatically (gate reads STALE, never VERIFIED_LIVE)
- Claim-gate only (spec §8.2): the publish pipeline may say 'verified live' only while a PASS served pack's input hashes equal the deployed manifest; gate failure blocks the word 'verified', never the publish — WARN and ENFORCE compute identical states
- Honest limits by construction: a PASS means exactly 'no probe failed and no probe errored'; the pack proves identity and mechanical soundness of the pinned bytes, never that an asset is semantically the right asset — semantic approval is the separate human act of approving the contact sheet; verify_page is an unsealed diagnostic and says so verbatim in every response
- No driver surface: Playwright is an internal adapter only — there is no screenshot/click/navigate tool and no code-exec tool; substrate-shaped names refuse -32602; unknown probes refuse PROBE_UNKNOWN on every surface; evidence classes (served/staged/hosted) are never blended
Tools
verify_deployverify_pagepack_inspectpack_recomputeprobe_registry
Problems it addresses
- My deploy shipped, but I need proof the live site is byte-identical to the build I approved — not a screenshot someone eyeballed
- A stylesheet served as text/html left my site unstyled while every text check passed — I need render-proof bound to the deployed artifact
- When a byte changes after approval, the 'verified live' claim should invalidate itself — no revocation process, no stale badge
Not tested
- Real-device / hosted evidence class: P2 seam only (HOSTED_MATRIX_NOT_AVAILABLE verified); no hosted pack exists or was certified.
- Semantic correctness of any asset — never claimed: a pack proves identity and mechanical soundness of the pinned bytes; semantic approval is the separate human act on the contact sheet.
- Served-class rendering of Chromium/Firefox cells on GoDaddy-hosted dogfood sites from the bench VM: transport-blocked by the host, sealed honestly as PAGE_UNREACHABLE; served certification rests on the rendered cells plus loopback shapes.
- Full §14 B9 determinism as written (each dogfood site + full corpus x5): bench ran 5x on one stable fixture plus builder-suite shapes.
- ENFORCE posture as a flipped production state: mechanics benched in both modes; the flip is an owner config act (D2) and has not occurred.
- Herald-signed packs: bench and dogfood packs are local-signer packs (signer_type=local) verified through the PinSigner port grammar; no Herald custody exercised.
- Trademark screen for the name 'Eclipse Corona' (D1): still CONDITIONAL — Chaos Corona / Corona beer screen outstanding before any public surface; certification covers function, not the name.
- Third-party subjects, Bazaar listing mechanics, scheduled re-verification, public proof pages, CI adapters: P1/P2, not built, not certified.
Bench scorecard: test-bench/results/eclipse-corona-mcp-2026-10-25.json
Evaluation-intake listing
This listing records the tool's place in the Bazaar's evaluation
and monitoring pipeline, with the evidence gathered so far printed above — verdict, scope,
and not-tested items included. It is not sold on this site, and its presence in the catalog
is not a claim beyond that evidence. The service behind every verdict is the bench:
what a bench run buys →