Cyan Eclipse Nexus Witness

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

What it does

• Novel mechanism — the tax answer ships as a sealed, vintage-stamped witness receipt (jurisdiction + rate + rule version at order time), so a later audit replays the EXACT basis; tax APIs return answers, not evidence. verify_receipt replays the exact fixture rule at the receipt's vintage: a receipt whose rate doesn't match its vintage's rule is INVALID, and an old receipt keeps verifying against the OLD rule after a newer vintage is added.
• Forgery resistance benched, including the hard case: a receipt re-sealed so its own hash is self-consistent while claiming the new rate at the old vintage is still INVALID, because verification replays the fixture rule at the receipt's vintage instead of trusting the seal (bench forgery matrix 22/22).
• No bare-answer path exists: every determination ships a sealed receipt (receipt_hash + inputs_hash + rule version + vintage), and receipt_basis returns the exact rule record that produced it, resolved by the receipt's own vintage. Unknown jurisdiction, category, or vintage returns a clean refusal — no rate is invented, no latest-fallback, no fuzzy match.
• Honesty envelope by construction: every determination output carries demo_label 'DEMO — FIXTURE DATA — NOT TAX ADVICE — NOT REAL RATES', scope 'LOCAL / fixture-vintage ONLY', and source 'FIXTURE-DEMO'. The bundled table holds 13 rules across 5 fictional jurisdictions (Fixture Aurora/Boreal/Cascadia/Delta/Ember) — DEMO/fixture rates only, NOT tax advice, no live tax determination claim anywhere.
• Fix-before-live defects disclosed on the bench record (all LOW, none hidden): D1 the seal is an unkeyed local SHA-256 hash seal — VALID means consistent with the fixture rule at its vintage, not server-issued, and _verify does not assert the source/demo_label/scope constants; D2 refusal responses carry no DEMO envelope (no rate or advice is emitted on a refusal); D3 the advertised additionalProperties: false schemas are not enforced in dispatch (extra argument keys are silently ignored). D1 must be closed before any hosted/live scope.
• Python 3 standard library only; MCP over stdio; zero network calls and zero payment-processing code in the package (bench AST audit). Pricing is metadata only — paid access is via the Cyan Eclipse Bazaar bench-order path only; no checkout, payment, or buy-now surface exists.

Tools

Problems it addresses

• My agent checked out a cross-border order last quarter — I need to prove exactly which rate, jurisdiction, and rule version produced its tax figure, not just re-ask an API what today's answer is
• A tax API returned a number with no evidence attached — I need the determination itself to ship as a sealed, replayable witness receipt my auditor can verify
• If someone edits the receipt after the fact — or re-seals it claiming a newer rate at an older date — I need verification to catch it by replaying the rule that was in force at the receipt's vintage

Not tested

• Live tax determination — not in v0.1 by design: no real jurisdiction, real rate, tax-advice, or filing surface exists; any live phase remains behind the SPEC §2 counsel gate (licensed data source + legal counsel review + explicit owner gate) and is out of scope for this verdict
• Hosted or remote serving — v0.1 is local stdio only; bench defect D1 (unkeyed seal) must be closed before any hosted/live scope
• Server-issued authenticity — the seal is an unkeyed local SHA-256 hash seal, disclosed in SPEC §2/§6; VALID means 'consistent with the fixture rule at its vintage', not 'issued by this server' (bench defect D1)