Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio
Certification scope
local stdio, fixture sessions + mock relay, Moderato testnet SHAPES, no chain interaction, no live clearing, no live Meter ingest, K6 claims only
What it does
- Novel mechanism — a session mandate (Herald-shape RS256 JWS) is verified at open in a fixed order (authenticity → cap → allowlist → expiry/revocation → approval threshold) and its hash is sealed into the session_open record; every draw is counter-signed at draw time by the caller key and a witness sidecar key, hash-chained, citing the mandate hash and a running all-in total.
- Named refusals + witness receipts — cap-breaching draws are refused by name before they happen (spec §5.4 named refusals, incl. the R-W1 trigger partition); refusals are logged unsigned and never move the total. At close, a witness receipt binds mandate-hash ↔ voucher-chain head ↔ settlement reference from the mock relay, with three signatures (witness, buyer, seller); the §6.4 offline verifier recomputes the whole pack from the artifact + public keys alone, and dispute_pack_get assembles a Docket-grade dispute pack.
- Honest scope — local stdio, Python stdlib only, fixture sessions + mock relay, Tempo Moderato testnet SHAPES (chainId 42431, hard-pinned in code): no chain interaction, no RPC, no Stripe API, no live clearing, no deposit custody, no live Meter ingest (draw records are emitted in Meter's record grammar for later ingest). Every artifact carries value_class: "test" and network: "tempo-moderato-42431". Startup hard-refuses any mainnet marker, any Stripe key, any RPC/non-local endpoint, relay_mode other than mock, or value_class other than "test".
- Disjoint surfaces, no money verbs — buyer and operator tool tables are disjoint, selected by ECLIPSE_TILL_MPP_WITNESS_SURFACE; no tool moves money, holds or releases a deposit, raises a cap, alters a mandate, counter-signs for a party, or issues a receipt for an unwitnessed session. The enabling MPP rail profile earned its own PASS (sandbox/fixture) but is never listed standalone (rail spec §1.4) — listings attach to the Witness only.
Tools
session_opensession_drawsession_closesession_statusreceipt_getreceipt_verifybuyer_counter_signsession_open_acceptsession_close_acceptsession_listdispute_pack_getrevocation_presentanomaly_queue_read
Problems it addresses
- My agent runs MPP sessions — I need session evidence a neutral witness sealed at draw time, not a log either party can rewrite afterwards
- A session dispute needs a pack a third party can recompute offline from the artifact + public keys alone: the sealed mandate, the counter-signed draw chain, and the close receipt bound together
- I need cap-breaching draws refused by name before they happen, with the refusal itself on record and the running total unmoved
Not tested
- Live clearing — not tested and not claimed: v0.1 runs fixture sessions against a local mock relay only; no chain interaction of any kind
- Mainnet — not tested and refused by design: startup hard-refuses any mainnet marker; Moderato testnet shapes only (chainId 42431)
- Live Meter ingest — not tested and not claimed: draw records are emitted in Meter's record grammar for later ingest only
- Live protocol operation, Stripe API, deposit custody — absent at v0.1 by design; none exists in the package
Evaluation-intake listing
This listing records the tool's place in the Bazaar's evaluation
and monitoring pipeline, with the evidence gathered so far printed above — verdict, scope,
and not-tested items included. It is not sold on this site, and its presence in the catalog
is not a claim beyond that evidence. The service behind every verdict is the bench:
what a bench run buys →