Cyan Eclipse Shelfprice — Cyan Eclipse Bazaar

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

Certification scope

CERTIFIED(local, fixture listing/checkout pairs) — Verity bench of v0.1.0 (2026-10-27, argus101-program-20261027/wave2/bench-shelfprice.md) PASS-CONDITIONAL(local, fixture listing/checkout pairs) with conditions C1–C4 and a stored-path carve-out, plus delta re-bench of v0.1.1 in the same record (stored paths only): C1 CLOSED, C2 CLOSED, C3 CLOSED at scope — the carve-out is LIFTED and no new findings were raised. Builder suite 33/33 at v0.1.0 and 43/43 at v0.1.1 (33 prior + 10 new TestStoredPathIntegrity) re-run clean-state by the bencher both times; decisive fixture F-SP8 independently reproduced in a fresh process at both benches — seal at fixture T=2026-10-27T01:00:00Z (listing v3), checkout drifting exactly price + one fee + returns terms, pack re-verified in a verifier-only subprocess from pack + pinned fixture keys alone (fresh empty data dir, no state files written): verified True, verdict DRIFT re-derived, drifted exactly [unit_price, fees_as_stated, total_all_in, returns_terms_hash]. Delta probes 26/26 PASS: stored term_hashes rewritten to the drifted checkout's hashes and Herald signature zeroed both meet SEAL_DEFECT with no verdict issued and no record appended (the DRIFT-to-signed-MATCH laundering is dead); tampered stored verdict, backdated stored seal, forged seal_hash/2030 expiry, and tampered drift receipt all refuse SEAL_DEFECT and are never served, while intact controls serve normally on every path. Scope is exactly: local stdio MCP, fixture listing/checkout pairs only, value_class 'test' throughout — now including the online stored-read paths (checkout_verify fresh + idempotent, view_seal idempotent return, seal_status, drift_receipt_get), which recompute and signature-verify stored seals, verdicts, and receipts before serving; no live marketplace, listing page, storefront, cart, or seller system is touched, scraped, or judged, and Shelfprice never blocks or alters a checkout; no counsel-gate (SPEC §10) live phase built or claimed. Novel mechanism (SPEC §2.1, with the §11.2 substitution applied): the price + terms an agent saw are sealed at view time, so view-to-checkout drift is recomputable from the buyer-held pack by the buyer. Accepted limitation F6 (on the face of the bench): a pack truncated to a prefix of the record chain verifies over the presented records only — the format has no completeness anchor; nothing presented can be forged or upgraded. C4 (standing scope condition): scope stays local/fixture until signing is real Herald RS256; no surface may describe v0.1 verification as public-key verification — 'pinned fixture keys' wording only. Verification uses pinned fixture keys only (fixture HMAC stand-in; not public-key verification); the pinned key file holds a shared HMAC secret, not a public key, any holder can forge seals, and no public-key or third-party verifiability is claimed.

What it does

Novel mechanism (SPEC §2.1, with the §11.2 substitution applied) — the price + terms an agent saw are sealed at view time, so view-to-checkout drift is recomputable from the buyer-held pack by the buyer. (Spec §11.2 fence: in v0.1 surfaces the product claims only drift — 'the checkout differed from the sealed view in these named terms'; drift proves difference, not intent, and admissibility is never claimed.)
Seal at view time + term-by-term diff — seal_hash = sha256(canonical(view_terms_object)) over the full §4.1 view terms object (price, fees, shipping, taxes as stated, quantity/availability terms, returns terms, subscription terms, and the listing version itself), each field also hashed individually (term_hashes) so drift is located, not just detected; there is no price-only mode — a checkout matching the headline price but drifting any other sealed term is DRIFT. Verification recomputes each sealed term's per-term hash from the presented checkout and returns MATCH, or on any mismatch a signed drift receipt naming each drifted term with its sealed vs presented per-term hashes (hashes only, except unit_price/total_all_in/shipping_as_stated amounts when those terms drift, SPEC §6.3). Verdicts: MATCH · DRIFT · LISTING_SUPERSEDED · EXPIRED_VIEW · SEAL_NOT_FOUND. A listing view never presented at view time can never be sealed retrospectively — a reconstructed view receives only an unsigned UNSEALED_SUMMARY, which the verifier rejects; downgrade law: unverifiable packs downgrade whole to UNWITNESSED_EXPORT, never upgraded.
Offline verification (SPEC §6.4) — a pure function of the buyer-held pack + pinned fixture keys alone: seal_hash and every term_hash recomputed from the pack's view terms, Herald signature and buyer counter-signature verified against keys pinned out-of-band (never keys carried inside the pack; counter-signature presence/absence must match the seal's face label), record chain walked gapless, drifted_terms + verdict re-derived per verification record including the expiry and superseded-version conditions, value_class 'test' required throughout; any step failing downgrades the whole pack with no partial verdict. Stored paths enforce the same discipline (v0.1.1, delta-bench C1–C3 closures): checkout_verify (fresh + idempotent), view_seal's idempotent return, seal_status, and drift_receipt_get recompute stored seal hashes/term hashes and verify record hashes, Herald signatures, counter-signatures, and receipt hashes before issuing any verdict or serving any stored record — any mismatch is a SEAL_DEFECT refusal, no verdict issued, no record appended, nothing tampered served.
Decisive fixture F-SP8 — bench-reproduced at v0.1.0 and as a delta regression at v0.1.1: listing view sealed at fixture T=2026-10-27T01:00:00Z (listing v3); checkout drifting in exactly 3 named terms (unit_price, one fee in fees_as_stated, returns_terms_hash); pack exported to a buyer-side holder only and re-verified in a fresh verifier-only subprocess from pack + pinned fixture keys alone (fresh empty data dir): verified True, seal ts == T, version bound = 3, drift re-derived as exactly [unit_price, fees_as_stated, total_all_in, returns_terms_hash] (the 3 named terms + consequential total), and the fresh process wrote no state files.
Honest scope — LOCAL stdio, fixture listing/checkout pairs ONLY: no live marketplace, listing page, storefront, cart, or seller system is touched, scraped, or judged, no real listing or checkout is sealed or judged, and every emitted artifact carries value_class 'test'. Shelfprice never blocks a checkout, alters a price, contacts a seller or marketplace, or executes or refunds any payment. Closed surface of exactly 7 tools (5 caller + 2 operator, disjoint); no retrospective-seal, seal-edit, verification-delete, checkout-block/alter, seller/marketplace-contact, scrape, or unsealed-view-receipt verb exists on either surface. Startup is fail-closed (CONFIG_FENCE_REFUSED:<class>) on a live-key string, a marketplace/listing endpoint or scraping or network-client config, a caller-supplied-witness-timestamp mode flag, or value_class other than 'test'. Signing is an HMAC-SHA256 fixture stand-in for the Herald pattern (disclosed on every record's face); C4 (standing scope condition): scope stays local/fixture until signing is real Herald RS256; no surface may describe v0.1 verification as public-key verification — 'pinned fixture keys' wording only. Verification uses pinned fixture keys only (fixture HMAC stand-in; not public-key verification); the pinned key file holds a shared HMAC secret, not a public key, any holder can forge seals, and no public-key or third-party verifiability is claimed.

Tools

view_sealcheckout_verifyseal_statusdrift_receipt_getseal_verifyseal_pack_exportanomaly_queue_read

Problems it addresses

View-to-checkout drift is ordinarily unprovable by the buyer: the listing the agent saw is gone or edited by checkout time, the seller's records are the seller's, and a screenshot is contestable — the party with the grievance holds the weakest evidence
I need the price plus the full terms as displayed sealed by a neutral witness at view time — headline price alone is not enough, because a checkout can match the price while drifting a fee, shipping, returns, or renewal term — so drift can be located term by term and recomputed from the buyer-held pack, with no marketplace or seller cooperation
I need the witness kept evidence-only and honest on its face: it blocks nothing and alters nothing, a view never sealed at view time can never be sealed after the fact, stored records are never served without recompute-and-verify, and unverifiable material downgrades instead of being upgraded post-hoc

Not tested

Real listings, real checkouts, or any live marketplace use — fixture listing/checkout pairs only; the SPEC §10 counsel gate is unbuilt by design, named, with no dormant live mode: (a) sealing real listing views / verifying real checkouts on live marketplaces (integration, scraping, and platform-terms review), (b) any characterization language beyond 'drift' in a live listing, pack, or sales material, (c) any integration that blocks or alters a live checkout on a DRIFT verdict, (d) retention/handling of real buyers' view/checkout data (privacy review), (e) any claim that a drift receipt is admissible or binding — each requires counsel clearance, a scope edit in code, and a Verity re-bench at the new scope
Any checkout blocked or altered, price altered, seller or marketplace contacted, or payment executed or refunded — Shelfprice is evidence-only: a DRIFT verdict is information for the buyer and evidence for a later dispute, nothing more; drift proves difference, not intent. Never claimed for v0.1.1 are price accuracy, best-price, seller/marketplace endorsement or partnership, live monitoring of any marketplace, or that a MATCH means the price was fair (SPEC §11.3 strings are named here only as never claimed); a MATCH means only that the presented checkout matched the sealed view in every term; no wording implies a verdict can be bought or a drift finding suppressed (SPEC §11.4 — metering attaches to the seal, identical regardless of later verdicts)
Production signing / public-key verification — v0.1.1 signing is an HMAC-SHA256 fixture stand-in for the Herald pattern (local fixture keys, keys/ gitignored, mode 600, never committed; signer face: herald-fixture (fixture HMAC stand-in)); C4 (standing scope condition): scope stays local/fixture until signing is real Herald RS256; no surface may describe v0.1 verification as public-key verification — 'pinned fixture keys' wording only. Verification uses pinned fixture keys only (fixture HMAC stand-in; not public-key verification); the pinned key file holds a shared HMAC secret, not a public key, any holder can forge seals, and no public-key or third-party verifiability is claimed. A fresh clone generates its own fixture keys to run the full suite
Hosted or live operation — local stdio only; metering point only per SPEC §9.1 (exactly one Meter record per completed view_seal; verifications, drift receipts, status, and exports never meter), the $0.001/seal or $99/mo shape is a book reference with no charge path built and no live Meter ingest

Evaluation-intake listing

This listing records the tool's place in the Bazaar's evaluation and monitoring pipeline, with the evidence gathered so far printed above — verdict, scope, and not-tested items included. It is not sold on this site, and its presence in the catalog is not a claim beyond that evidence. The service behind every verdict is the bench: what a bench run buys →