Cyan Eclipse Kitseal

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

What it does

• Novel mechanism (SPEC §2.1, verbatim) — an agent's full tool/permission configuration is sealed and streamed; every change emits a delta receipt to subscribers (employers, insurers, auditors). Mandatory gloss (SPEC §11.3): sealed = an operator declared this configuration, in this order, at these times — recompute it yourself.
• Genesis seal + hash-chained delta stream — the full configuration is canonicalised, hashed, and sealed at config_seq 0, signed by the operator and counter-signed by Kitseal; every change is a delta record citing the exact head config_hash it applies to and the resulting config_hash, chained on dual spines (prev_hash record spine + base→result config spine). A delta citing anything but the current head is refused (DELTA_BASE_MISMATCH); the chain is append-only and fork-refusing, retirement is itself a delta, and sealed records are never edited or deleted. Every delta receipt carries the attestation verbatim: 'operator-declared configuration change; Kitseal attests presentation, sequence, and hashes — not runtime state.'
• Offline recompute (SPEC §6.4) — a subscriber holding only the exported pack + pinned fixture keys recomputes the current configuration in a fresh process without asking Kitseal anything: config hashes, record hashes, both spines, the op digest, and both signatures (operator + Kitseal counter-signature) are recomputed against keys pinned out-of-band, never keys presented inside a record. A withheld receipt is detectable by sequence gap: the recompute stops at KITSEAL_VERIFY_FAIL:gap@<seq>, asserts no current configuration, and the export is labelled STALE_OR_PARTIAL. Verify-before-serve (v0.1.1, delta-bench C1/C2 closures): loadout_status, feed_read, and the pack face run the full chain verification over the records they serve before asserting any head hash, state, receipt, or chain_complete_through, and receipt_verify walks the presented chain from genesis to the receipt's record — an isolated record without chain context does not verify.
• Decisive fixture F-K11 — bench-reproduced at v0.1.0 and as a delta regression at v0.1.1, both branches PASS in fresh subprocesses (pack + pinned key file only): genesis + 6 deltas recompute verified:true with config_hash == the reported head hash @ seq 6 (final tools [tool-alpha, tool-beta, tool-delta], the unset setting gone); with seq-3 withheld the recompute fails KITSEAL_VERIFY_FAIL:gap@3, current_config:null, verified_through:2, export labelled STALE_OR_PARTIAL — no current config asserted.
• Honest scope — LOCAL stdio, fixture loadouts ONLY: configurations are operator-supplied fixture data, no real agent is sealed or streamed, Kitseal connects to no runtime, captures no configuration from any system, grants/revokes no permission, and is not a config-management tool, runtime monitor, or policy engine. Closed surface of exactly 9 dispatch entries (5 operator + 4 subscriber, disjoint; loadout_pack_export appears on both surfaces); no verb edits or deletes a sealed record, re-bases a delta onto a non-head hash, asserts a current configuration without recompute, captures a config from a runtime, or suppresses a delta from a subscriber feed. Startup is fail-closed (CONFIG_FENCE_REFUSED:<class>) on a live-key string, a non-local endpoint, a config source other than operator presentation, a runtime credential, or value_class other than 'test'. Signing is an HMAC-SHA256 fixture stand-in for the Herald pattern (bench observation F4); symmetric fixture keys mean the operator/Kitseal key holder set is a local trust domain, consistent with (local) scope.

Tools

Problems it addresses

• Agent configurations drift silently and matter enormously: a permission widened on Tuesday is the difference between the agent an insurer priced and the agent that ran on Friday — and today the evidence is an editable config file in a repo, a screenshot in a compliance folder, or the operator's assertion at renewal time
• I need a sealed starting point plus an unbroken signed chain of every change, with one signed delta receipt per change streamed to subscribers, so the current configuration is an arithmetic consequence of the chain — recomputable offline from the pack + pinned keys alone — rather than a claim about it
• I need the stream kept honest on its face: silence is never rendered as 'no changes' (a withheld receipt surfaces as a named sequence gap and no current config is asserted), stored values are never served as assertions without chain verification, and a seal is never presented as evidence of running state

Not tested

• Real agents, real subscribers, or any live use — fixture loadouts only; the SPEC §10 counsel gate is unbuilt by design, named, with no dormant live mode: seals presented as compliance/insurance evidence for real agents (reliance language, misrepresentation exposure when an operator seals a configuration the agent does not run, employee-monitoring / workplace-surveillance rules, trade-secret handling of sealed configs, and the runtime-attested capture integration as a separate later clearance) — each requires counsel clearance, a scope edit in code, and a Verity re-bench at the new scope
• Any runtime state — Kitseal seals what it is given: a seal binds the operator's declaration (presentation, sequence, hashes) and is never evidence that an agent runs the sealed configuration; never claimed for v0.1.1 are 'verified configuration', 'attested loadout', 'the agent's actual tools', 'compliance-ready', or any implication that a seal describes running state (SPEC §11.3 strings are named here only as never claimed); every displayed configuration carries its config_seq + config_hash per SPEC §11.4
• Production signing — v0.1.1 signing is an HMAC-SHA256 fixture stand-in for the Herald pattern (local fixture keys, keys/ gitignored, mode 600, never committed); symmetric fixture keys mean the operator/Kitseal key holder set is a local trust domain (bench observation F4), to be revisited at any post-counsel gate; a fresh clone generates its own fixture keys to run the full suite
• Hosted or live operation — local stdio only; metering records only per SPEC §9.1 (genesis_sealed, delta_receipted, subscription_period, pack_exported), the $49/mo shape is a book reference with no charge path built and no live Meter ingest