Cyan Eclipse Scamshield

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

What it does

• Novel mechanism (SPEC §2.1, verbatim) — a first payment to any new payee triggers a witnessed risk briefing (fraud reports, payee-continuity, lookalike domains) the user must acknowledge — the acknowledgment is receipted.
• Decisive fixture F-SS9 stands from the bench record — for a first payment to a fixture payee Scamshield did not originate, in a fresh process from the export + public keys alone, scamshield_verify recomputes the trigger fact from the presented history, re-verifies every source seal/hash, and confirms the ack covers exactly that briefing_hash with ack-before-expiry ordering; the control (one fraud-report excerpt removed from the briefing, hashes recomputed) fails verification at step sources — the ack is bound to the content shown, not to the payee or the act of clicking (regression spot, delta re-bench 2).
• Integrity (v0.1.2, RB-F1–RB-F8 closed at delta re-bench 2) — verify requires the signed export anchor + record count; every mint path preflights its pinned keys before any write (KEY_MISSING refusal, byte-identical disk, no null seal persisted); the stdio envelope and every entry shape fail structured with zero raw exceptions; nested field sets are exact; check/ack timestamps must not precede their causal predecessors (TEMPORAL_ORDER); duplicate source records are refused (DUPLICATE_SOURCE); the store carries a retained cross-artifact head commitment (store_head.json) so subset restores, tail truncation, fabricated anomaly/metering entries, and raw disk edits surface as SEAL_DEFECT.
• Condition 1 — RB-F7 coordinated-restore residual stays fenced verbatim on README + all named faces — full coordinated restore of all artifacts (incl. store_head.json) is undetectable in the pure local model; an external anchor is required for detection.
• Condition 2 — scope-only certification — the live phase remains behind the §10 counsel gate + separate re-bench.
• Rollback fence (README, verbatim): ROLLBACK FENCE: a full coordinated restore of every local artifact (store.json, store_head.json, and any backups) to an earlier snapshot is undetectable in the pure local model and is NOT claimed to be detected; detecting it requires an external anchor outside this local store. Restoring or deleting only some artifacts contradicts the retained cross-artifact head commitment and surfaces as SEAL_DEFECT.
• Key-fact label (SPEC §11.2, verbatim in substance): Scamshield assembles a briefing from witnessed sources and receipts the user's acknowledgment of that briefing; it does not certify a payee safe, trustworthy, legitimate, or fraudulent, and it issues no risk score or verdict on any payee. A briefing with no adverse excerpts renders NO_ADVERSE_RECORDS_FOUND — a statement about the fixture records presented, meaning only that none of the three source classes presented an adverse record — and never SAFE, VERIFIED PAYEE, LOW RISK, or any equivalent. An acknowledgment receipt proves the user acknowledged this briefing; it does not prove the payment was wise, safe, or fraud-free, and it transfers no risk.
• Downgrade law (SPEC §6.4) — any export that cannot be recompute-verified is labelled UNVERIFIED_EXPORT on its face (verified: false) and rendered ACKNOWLEDGMENT NOT VERIFIED, never as an acknowledgment claim; there is no path from a downgraded export, or from a UI click log, back to an ack receipt except a fresh run.
• Format attribution is exact and minimal: payee-continuity is Morphguard's (consumed by reference as witnessed excerpts, never redefined), signing is Herald's pattern (fixture HMAC stand-in), payments and mandates are Till's (Scamshield never calls Till and neither outcome executes, blocks, or releases anything), and metering points are emitted in Meter grammar — consumed, never redefined. Cyan Eclipse Verity Bench and Eclipse Cupel are internal tools, not products: this product has no dependency on them, no integration with them, and no buy path, price, licence, or checkout for them anywhere.

Tools

Problems it addresses

• First payments to new payees are the classic consumer-fraud surface (invoice redirection, impersonation, lookalike domains) — and the moment today's flows handle worst: a generic "are you sure?" dialog the user clicks through, leaving no evidence of what risk information was shown or whether the specific warnings about this payee were ever seen
• I need the first payment to a new payee to trigger a witnessed briefing — fraud reports, payee-continuity, lookalike domains, each excerpt hash-bound with its pointer and witness seal, every source class recorded including its gaps — not a risk score or a safe/unsafe verdict
• I need the user's acknowledgment bound to that exact sealed briefing hash and receipted counter-signed, so "the user was told" becomes a fact a third party can recompute offline from the export + public keys alone — and any export that cannot be recomputed labelled UNVERIFIED_EXPORT with no acknowledgment claim

Not tested

• Full coordinated restore of every local artifact — CONDITION 1 (bench, verbatim): RB-F7 residual (fenced): a full coordinated restore of every local artifact (store.json, store_head.json, and any backups) is undetectable in the pure local model and is NOT claimed detected; detection requires an external anchor outside this local store. The fence must remain verbatim on README + status/list/anomaly/verify/briefing_get/check faces in any future version claiming this certification. The fence stands verbatim in the README and on the status/list/anomaly/verify/briefing_get/check faces in v0.1.2: ROLLBACK FENCE: a full coordinated restore of every local artifact (store.json, store_head.json, and any backups) to an earlier snapshot is undetectable in the pure local model and is NOT claimed to be detected; detecting it requires an external anchor outside this local store. Restoring or deleting only some artifacts contradicts the retained cross-artifact head commitment and surfaces as SEAL_DEFECT.
• Live phase — CONDITION 2 (bench, verbatim): Certification extends only to the scope above; any live phase remains behind the §10 counsel gate and requires a separate re-benched build.
• Counsel-gated phase (SPEC §10, named, unbuilt/unclaimed): (a) presenting briefings to real consumers as fraud-risk information, incl. the NO_ADVERSE_RECORDS_FOUND rendering's consumer meaning; (b) relying on live fraud-report sources, live Morphguard chains, or live lookalike-domain data (accuracy/defamation exposure for named payees is counsel's question); (c) any composition in which a Till flow requires an ack receipt before proceeding (the acknowledgment becoming a payment condition) — all out of v0.1, hard. A live phase is a separate, re-benched build after §10 clearance; v0.1.2 builds nothing around, against, or in anticipation of this gate and there is no dormant live path to activate — the startup fence refuses live-key strings, non-local endpoints, value_class other than "test", payment-execution/blocking modules, scoring/rating modules, and live-source clients.
• Live payments and live payees — fixtures only: fixture payment intents against a fixture payee history and fixture risk sources under a deterministic seed; payee refs name no real payee, and every artifact carries value_class "test"
• Live Herald signing — v0.1.2 signing is a fixture HMAC stand-in for the Herald pattern, disclosed on the product's face; verification keys are pinned out-of-band per role/class in code — a record under verification can never select its own verification key, and key material inside a presented record is refused/downgraded
• Production key custody — fixture keys live in keys/fixture-keys.json (chmod 600, gitignored, never committed); a fresh clone must create its own fixture key file to run the full suite
• Hosted or live operation / charge path — local stdio only; metering points only per SPEC §9.1 (one metered check event per check that completes the trigger evaluation with a sealed briefing, at the $0.05/check shape; NOT_FIRST_PAYMENT verdicts, refusals, verifications, duplicate re-presentations, and ack/decline acts emit no additional metering point), no charge path is built, no payment is taken, and no live Meter ingest is claimed