Cyan Eclipse Recall Witness

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

What it does

• Sealed campaign vintages, recomputable by anyone: NHTSA serves current state only — amended filings replace records in place and the API has no vintage parameter — so this product seals the recalls flat file nightly into a hash-chained anchor (recall-anchor/1.0); every campaign's full payload seals as an immutable vintage under recall-canon/1.0, and a campaign that disappears seals as a tombstone vintage, never a silent drop. CERTIFIED SCOPE IS FIXTURE: at P0 the nightly spine is proven over fixture flat files — no live nightly seal exists yet (capability 4 states exactly what is and is not live).
• Drift between consecutive vintages seals as events across the closed recall-events/1.1 grammar — POPULATION_EXPANSION, REMEDY_CHANGE, ESCALATION_DO_NOT_DRIVE, ESCALATION_PARK_OUTSIDE, CORRECTION, CLOSURE, each with closed subtypes; an escalation is never absorbed into an expansion. Advisory detection is normalized token-pattern matching harvested from the live escalation stock (BMW/Mazda/Ford/Ferrari 'advised not to drive', Porsche 24V809 'should not drive', GM/Kia park-outside) and cross-checked against the API's own parkIt/parkOutSide flags — 15/15 live campaigns agree at re-bench. Per printed condition RW-D9, NO escalation-completeness claim is made beyond the live-stock-proven phrase families: the drive/park families are proven; operate/use paraphrase families are a known coverage boundary.
• Posture-at-date derives exclusively from sealed vintages — before the first vintage (or after the last sealed night) the answer is NOT_SEALED, printed with its reason and the campaign's own first-vintage date. Mandate-bound check receipts run one live CAMPAIGN-LEVEL check and seal what it returned: every receipt prints scope_class: CAMPAIGN-LEVEL and the three standing sentences byte-exact — “This record states what NHTSA served at the stated time. It is not a safety determination about any vehicle.” / “This receipt proves a check was made and what it returned. It is not a legal determination of compliance with any law.” / “Per-VIN unrepaired status is NOT determined by this check.” A specific VIN is never called “open”: per-VIN unrepaired status lives behind NHTSA's consumer VIN lookup, whose posture bars automated submission, so no such determination exists in this product and no consumer-VIN-lookup code path exists anywhere in the tree; no VIN-decode tool surface exists either (decode is an internal step of check issuance only). Safety-verdict, owner, repair-advice, and per-VIN ask shapes refuse by name.
• LIVE-PROVEN at cross-check + check-issuance scope (proof/live-api-20261026.md in the tree, independently re-verified first-hand on card -2): the API transport points at the spec-named host api.nhtsa.gov; a live cross-check seals campaign 24V809 with cross_check OK and its DO_NOT_DRIVE tag agreeing with the API's parkIt: true; an altered-summary hold-out sealed NOTHING (FAILED + named); one live check receipt (rcpt-00001, Porsche 911 MY2024) carries exactly the 4 campaigns the live API returns today and recomputes MATCH, phrase tags vs API flags 4/4. What is NOT live: the nightly flat-file spine — www-odi.nhtsa.dot.gov remains unreachable from the build egress (re-probed 2026-10-26, empty reply) and the spine was NOT re-routed to the API, because the flat file is the canon source. LIVE scope is gated on (a) the first real nightly ingest and (b) live-key cutover: all P0 seals are under FIXTURE ECDSA keys, labelled seal_key_class: FIXTURE on every artifact (owner's call, spec O3).
• Churn measurement (recall-churn/1.0): nightly counters seal inside every anchor from night one; get_churn_series returns the methodology and MEASURING — no rates — until a day-90 segment bearing rates seals, and series_state derives from the segments (a methodology-only segment never flips the series to PUBLISHED; no churn rate appears in any copy before day 90). Three NEW LOW conditions stand printed on card -2 (none blocks CERTIFIED(local, FIXTURE scope); all ride the next grammar/seal touch): RW-D7 — the park-outside matcher can tag narrative “parked outside” rollaway text as a false PARK_OUTSIDE (constructed shape; no live-stock instance found; fix at recall-events/1.2 with an owner-directed-voice requirement); RW-D8 — the chain walk does not yet assert the genesis links, so first-vintage/first-anchor prev-hash tampers verify MATCH (content integrity unaffected — record hashes and seals still verify; one-line assert at the next seal-store touch); RW-D9 — operate/use paraphrase families (“should not be operated”, “never operate”, “do not use”) tag nothing (the coverage boundary in capability 2; 1.2 candidates). Nothing in this product speaks to any vehicle's safety, any specific VIN's repair state, or compliance with any law.

Tools

Problems it addresses

• NHTSA serves only what a recall campaign says now — amended filings replace records in place. I need what the campaign said on a past date, sealed, so a posture answer recomputes offline instead of trusting today's screenshot
• When a recall population grows or a remedy escalates to do-not-drive, I need that change sealed as dated drift — an escalation never quietly absorbed into an expansion
• At sale time I need a check receipt that prints exactly what was actually checked — campaign-level, as served — and never dresses itself up as a per-VIN “open/clear” verdict or a safety determination

Not tested

• Live nightly ingest — no live nightly seal exists: the flat-file spine host (www-odi.nhtsa.dot.gov) is unreachable from the build egress (re-probed 2026-10-26) and the spine was NOT re-routed to the API; LIVE scope requires the first real nightly ingest
• Production Herald custody — all seals are under FIXTURE ECDSA keys, labelled on every artifact (spec O3); live-key cutover is the owner's call and has not been exercised
• Escalation completeness beyond the live-stock-proven phrase families — RW-D9: operate/use paraphrase families (“should not be operated”, “never operate”, “do not use”) tag nothing; no as-served instance found in the live stock sampled; bound to the recall-events/1.2 bump
• Narrative park-outside text — RW-D7: a constructed rollaway-narrative shape (“parked outside the owner's home”) tags a false PARK_OUTSIDE; no live-stock instance; fix at recall-events/1.2 (owner-directed-voice requirement)
• Genesis-link assertion — RW-D8: first-vintage prev_vintage_hash and first-anchor prev_anchor_hash tampers verify MATCH (content integrity unaffected); the assert lands at the next seal-store touch
• Per-VIN unrepaired status — never determined by construction (gate C5): the consumer VIN lookup is not automated, no per-VIN code path exists, and receipts print scope_class CAMPAIGN-LEVEL only
• Hosted or remote serving — v0.1 is local stdio only
• The trademark screen for the Recall Witness name (owner-side, spec O1) — still open; it gates public surfaces under the name, not this local certification

Bench scorecard: test-bench/results/eclipse-recall-witness-mcp-2026-10-26-2.json