Cyan Eclipse Exportcheck

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

What it does

• Novel mechanism (the bench verifies exactly this) — screening verdicts seal the list vintage used, so a clearance remains provable after the sanctions lists themselves change. Matching is deterministic only: screening is a pure function of (party record, snapshot, match rule-set version) — integer field scores (name / variant / identifier), sealed bands, no model inference, no per-run discretion — and the score breakdown recomputes field by field in the §6.3 verifier. Loading a newer list never edits an earlier sealed verdict; re-screening creates a new, linked verdict, and both stand and both verify against their own vintages. Any two sealed snapshots diff exactly: entries added, removed, and changed, by entry id.
• Bench path: v0.1.0 bench (wave4/bench-exportcheck.md — PASS-CONDITIONAL (local/fixture), defects D1 (name_variants not screened) + D2 (partial punctuation strip), conditions C1-C3; 77 independent probes) -> collision-screen fix rounds v0.1.1-v0.1.7 -> spot re-benches rounds 1-6 (D1 evolved into defect D3; rounds 1-4 FAILs on extension classes) -> round 6 (wave4/spot-exportcheck-022.md, v0.1.7 @5b0ab96): exhaustive sweep 2,749 glyphs / 9,836 candidate forms, survivors-in-claim 0 forms / 0 glyphs, determinism 55/55 fresh processes one digest, invariance 29/29 verdict records + 29/29 receipts byte-identical vs v0.1.2, near-miss 45/45, transmitted-only entry forms 40/40 refused, identity leak none. D3 CLOSED, C4 DISCHARGED, final product verdict PASS-CONDITIONAL (local/fixture) (spot-022 verdict: PASS, scoped to the D3/C4 condition only; the C3 rollback fence is undischarged and caps the product verdict at PASS-CONDITIONAL (local/fixture) until an external anchor exists). Builder suite 74/74 at the shipped commit.
• Collision screening (local/fixture scope): fixture sets loaded into Cyan Eclipse Exportcheck are collision-screened against symbol-, format- and homoglyph-decorated forms of listed names under SPEC Q-E3 as amended at v0.1.7 — assignment, identity and transmitted readings as there defined (bench: spot-exportcheck-022, survivors-in-claim 0). Standing disclosure: fixture sets are invented test data; a fixture CLEAR states only that this invented party record did not match this invented snapshot under this sealed rule-set version, as recomputed by spec 6.3 — it authorises no shipment, transaction, or filing. No live claim is made; no certification is claimed beyond the stated local/fixture bench scope.
• Standing conditions (from the original bench, NOT discharged by the spot rounds): C2 (from bench deviation 2): party_screen never links (prior_verdict_id: null) — a repeat party_screen under a newer snapshot produces an unlinked but immutable, vintage-sealed verdict; chain claims rest on verdict_rescreen + pack chain receipts only, and no listing or doc may imply party_screen chains. C3 (rollback fence, builder-stated, bencher-confirmed): verdict caps at PASS-CONDITIONAL(local/fixture) until an external anchor exists; pure local file store + signed head/SET anchors only.
• Export-control counsel gate (SPEC §10) — named, unbuilt: any use beyond fixture screening — loading any real list (licensed or public), screening any real party, relying on a verdict for any transaction, shipment, onboarding, or filing, or redistributing list-derived data — is out of v0.1, hard, until export-control counsel clears it in writing AND live list-licensing terms are separately cleared. v0.1 contains no dormant live path (no list fetcher, no vendor connector, no real-party ingest exists to flip); a post-gate live form is a new, re-benched build, not a configuration change. Trademark screen on "Exportcheck" still pending per spec.
• Downgrade law: a verdict-like record without a sealed vintage citation exports only as UNVINTAGED_EXPORT (vintage_sealed: false) and is rejected as a verdict; an external screening result exports only as IMPORTED_SCREEN_EXPORT (sealed: false) and enters no pack as a verdict; a pack failing any §6.3 step is a DOWNGRADED_PACK naming the step. No tool path upgrades any of these into a sealed verdict. Operator and auditor surfaces are disjoint (6 operator / 4 auditor tools); forbidden verbs (edit, delete, clear, fetch, authorise, backdate, ship) exist on neither surface. Herald (signing mechanism), Meter (metering grammar), and Docket (pack shape) are consumed by grammar/reference only.

Tools

Problems it addresses

• Screening verdicts are computed against lists that change constantly — once the list moves on, there is no way to prove what a past clearance was actually computed against
• I need every screening verdict to seal the exact list vintage (snapshot id, vintage label, content hash) and the sealed rule-set version on its face, with a field-by-field recomputable score breakdown, so a clearance remains provable long after the lists themselves change
• I need the representation fence stated on the face of the evidence: a fixture CLEAR states only that this invented party record did not match this invented snapshot under this sealed rule-set version — it authorises no shipment, transaction, or filing

Not tested

• Any real list, real party, reliance, or redistribution — loading any real sanctions/export list (licensed or public), screening any real party, relying on a verdict for any transaction, shipment, onboarding, or filing, or redistributing list-derived data is SPEC §10 counsel-gated (export-control counsel + live list-licensing clearance) and UNBUILT; no dormant live path exists (no fetcher/connector/ingest code, grep-verified at bench)
• Live or production screening of any kind — v0.1.7 screens fixture parties against invented fixture snapshots only (value_class "test" on every artifact); no real list is loaded, fetched, or reproduced and no verdict is relied on for anything
• Production signatures — v0.1.7 signing is an HMAC fixture stand-in for Herald RS256 (operator + witness counter-signatures, fixture keys in keys/, gitignored, mode 600), disclosed on every artifact face as signature_scheme; no RS256/JWS production claim is made
• External anchoring / live use — the pure local file store + signed head/SET anchors are the only anchors in v0.1.7 (standing condition C3, rollback fence); an external anchor is required before any live use
• Trademark clearance of the name "Exportcheck" — the house trademark screen on the name is still pending per spec; the name is a working name