Cyan Eclipse Crosslist MCP

Certification scope

CERTIFIED(split per facet) — Eclipse Bazaar Test Bench 2026-10-26, standing card eclipse-crosslist-mcp-2026-10-26-4.json: 39 pass, 0 na of 40 checks (1 partial — the builder-suite re-run line, whose sole failure was the stale fixed-count dogfood assert; fixed in this listing pass, suite now 50/50, smoke PASS). PER-FACET SCOPES — read exactly: root+ledger CERTIFIED(local): submit acceptance is identity-bound on every write facet (the observed registry record must match the submitted name + version + payload hash; Bazaar: product id/name + record hash), claimed-at-submit lands via the legal submitted→live→claimed two-step, stuck rows repair by receipted re-observation, and EVERY ledger_poll transition out of 'submitted' is identity-gated (live/failed via the shared identity gate, claimed via the repair gate) — a landed receipt proves the observed record matched the submitted artifact's identity at poll time, nothing about live registries. Bazaar facet CERTIFIED(local): the real catalog served through Crosslist (80 products at bench), publish/status writes under mandate. Official facet CERTIFIED(live-read) for list_servers/get_server/list_versions/get_version_detail; its writes are CERTIFIED(fixture) only and refuse REGISTRY_WRITE_UNAVAILABLE in live mode — NOT live-write certified. Smithery facet CERTIFIED(live-read) for search_servers/get_server ONLY; hosting/install-counts/releases/Connect sub-resources and publish/publish-release/deploy writes are CERTIFIED(fixture) only and refuse in live mode — NOT live-write certified. Glama facet CERTIFIED(fixture-read) only, all 8 verbs, ZERO write verbs — NOT live certified at any scope (live API returned 401; no key held). Herald dependency FIXTURE ONLY: mandates verified against a local ECDSA P-256 Herald-fixture key; production Herald RSA-JWS was not exercised. Receipts are Herald-SEALABLE with seal.status pending — never sealed. No live-write claim is made for any facet. KNOWN LIMITATIONS (standing LOWs on the card, in plain words): deeply nested error envelopes (wrapper depth 4 or more, and top-level list payloads) can escape detection, and error-shaped data keys can be refused by mistake (R3); on resubmission a stuck-row repair runs just before the mandate is verified, though nothing is written or accepted before that verification (R8); a track stuck at 'submitted' whose registry record is entirely absent has no automatic exit — it stays submitted rather than inventing a state (R9); submitting to Glama's absent native verb consumes the one-time mandate nonce, so a later legitimate submission can be refused as a replay (D8); the earlier claim that a production Herald key drops in unchanged was overbroad for RSA keys and is not repeated (D5); receipts are sealable and pending, not sealed (D7). N-CHECK (first bench, retained): the facet verbs deliberately mirror each registry's native verbs (renamed-verb share above the house line) — NO novelty claim rests on the facet verbs; the certified mechanism is the listing-state ledger plus the mandate constraint, which the bench exercised directly.