Cyan Eclipse Phantom

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

What it does

• Novel mechanism (SPEC §2.1, verbatim) — every charge is matched to a mandate record within seconds; unmatched charges generate an auto-assembled dispute pack and an issuer-freeze request before the statement closes.
• As-of mandate matching with a fixed evaluation order — existence → verifiability → fee/unit statability (build pin) → expiry/revocation → scope → cap; the first failing rule names the one non-match reason (9 reasons, incl. NO_MANDATE, SCOPE_MISS, CAP_EXCEEDED_AT_CHARGE, RECORD_UNVERIFIABLE). Every classification carries measured fixture-time latency on its face against the period's SLA bound; a miss is flagged sla_missed and counted, never edited away. Verification is fail-closed and recompute-only against keys pinned out-of-band; a pack proves a negative by recomputation in a fresh process from the period export + pinned keys alone.
• Decisive fixture F-P13 — bench re-derived from the bencher's own corpus (bencher keys throughout): 24 charges, 21 matched, 3 phantoms of 3 different classes (NO_MANDATE / SCOPE_MISS / CAP_EXCEEDED_AT_CHARGE), period SLA 45 (non-default); all 24 verdicts/reasons/mandate_refs reproduce the bencher's independent §4.3 recomputation exactly, latency 5s and sla_missed: false on every record. The SCOPE_MISS pack's hash recomputes, its freeze artifact cites the pack hash and carries the §6.3 label verbatim, and the freeze was assembled before period close (assembled_at 2027-03-02T22:00:15Z vs the fixture close). Fresh-process §6.4 verify (empty data dir, export + pinned keys alone): verified: true, non_match_reason: SCOPE_MISS, assembled_before_close: true.
• Honest scope — simulator only, local stdio, fixture charge stream + fixture mandate ledger ONLY, value_class "test": Phantom reconciles after a charge exists; it does not prevent, decline, or reverse charges, no verb transmits anything to any party, and no state implying FILED/SUBMITTED/FROZEN/DISPUTED_WITH_ISSUER exists. Closed surface of exactly 10 tools (7 operator + 3 reviewer, disjoint); 20 forbidden filing/transmission verbs bench-probed NO_SUCH_TOOL on both surfaces. Startup is fail-closed (CONFIG_FENCE_REFUSED:<class>) on any issuer/bank/network endpoint or key, real identifier source, non-fixture source, or value_class other than 'test'. Signing is an HMAC fixture stand-in for Herald RS256 (disclosed). Sole condition: full coordinated rollback = fenced condition — external anchor required before live/multi-party use.

Tools

Problems it addresses

• Agent payment programs accumulate charges — per-call fees, rail charges, tool subscriptions — each of which should trace to a mandate someone authorised; anything that traces to nothing is a phantom, and it is usually found weeks later, by a human, after the statement has closed
• Statement review and issuer fraud alerts cannot prove a negative: neither re-runs the mandate ledger as of the charge's timestamp to show that no mandate ever covered this charge, in a form a third party can recompute
• I need every charge matched to a mandate record within seconds — and for the unmatched ones, an auto-assembled dispute pack plus an issuer-freeze request artifact, assembled before the statement closes, that a fresh-process verifier can prove from the records alone

Not tested

• Live charge feeds — SPEC §10 counsel gate (named, unbuilt): live charge feeds from payment networks/banks are genuinely unbuilt. Ingesting any real charge stream or mandate ledger, transmitting a dispute pack or freeze request artifact to any issuer, network, bank, or processor, acting as dispute agent or authorised representative for a program, and any claim about dispute rights, chargeback windows, or freeze entitlements under card-network rules or Regulation E/Z are counsel-gated and unbuilt; there is no dormant live path, no issuer/network/bank code, stub, or endpoint in the tree (production imports are stdlib-only, bench-checked), and the startup config fence refuses issuer/bank/network configuration (CONFIG_FENCE_REFUSED:<class>)
• Sole condition (verbatim from the bench record): full coordinated rollback = fenced condition — external anchor required before live/multi-party use. No live or multi-party use until an external anchor exists
• A §6.5 downgrade pack evidences unverifiability (verify_pack names step3_ledger on such packs by design — spec-conformant, per re-bench ruling): a charge whose mandate field set is non-native downgrades to UNMATCHED/RECORD_UNVERIFIABLE with a pack evidencing unverifiability (excerpt carries the offending mandate exactly as presented, pack_hash recomputes, transcript states ledger_verified: false); fresh-process §6.4 verify of that pack's export returns PHANTOM_VERIFY_FAIL:step3_ledger — the correct named failure, not a verified verdict — while ordinary phantom packs over a native, recomputing ledger still verify verified: true
• Advisories F-1/F-2 (non-blocking, spec-conformant, from the bench record): F-1 — existence precedes verifiability in the fixed §4.3 order, so an unverifiable charge with no mandate candidate classifies NO_MANDATE, not RECORD_UNVERIFIABLE (a known reading of the spec's stated order, recorded so the behaviour is a known reading, not an accident); F-2 — no MCP verb exists for MATCHED-receipt verify: §6.4 receipt verification for a MATCHED charge is not reachable from either MCP surface (the reviewer surface exposes only pack_verify, per spec §5 as written); matched classifications were recomputed independently by the bencher instead
• Production signing — v0.1.0 signing is an HMAC fixture stand-in for Herald RS256 (HMAC Herald stand-in), disclosed on the product's face; verification uses keys pinned out-of-band in a local chmod-600 gitignored key file, never keys supplied by a record; a live phase requires real Herald signing and a re-bench
• Production key custody — fixture keys live in keys/fixture-keys.json (chmod 600, gitignored, never committed; GitHub contents/keys verified 404); a fresh clone must create its own fixture key file to run the full suite
• Hosted or live operation / charge path — local stdio only; metering points only per SPEC §9 (exactly 1x program_period_active per program per fixture period opened + 1x pack_assembled per dispute pack; 0 for ingestion, matching, receipts, verifications, request artifacts, reads, refusals, idempotent re-ingests, and the CHARGE_CONFLICT path; no charge path built, no payment taken, no live Meter ingest claimed)