Cyan Eclipse Shelfspace

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

What it does

• Novel mechanism (SPEC §2.1, verbatim) — paid placements carry a sealed sponsorship receipt that buying agents are required to surface, so paid ranking can't masquerade as merit ranking.
• Sealed at placement time — the sponsorship receipt is issued when the placement is created, over the placement record's hash, counter-signed by advertiser + Herald (fixture HMAC stand-in); a receipt attempted after the first render is refused (RECEIPT_AFTER_SURFACING), and every render cites the receipt hash.
• UNMARKED-PAID defect derivation (SPEC §3.3) — a paid placement with no valid receipt, a mismatched/expired/revoked receipt, or a render citing no receipt derives the named defect UNMARKED-PAID on every status, export, and pack; absence of a receipt is never rendered as, upgraded to, or omitted into a merit presentation.
• Surfacing proofs + offline verification (SPEC §4.5 / §6.4) — a proof binds receipt hash ↔ render hash ↔ disclosure-render hash ↔ buying-agent ref; receipt_verify recomputes placement hashes, both receipt signatures, the hash chain, mechanical status derivation, and every proof from the exported pack + pinned fixture keys alone, in a fresh process; any failure returns SHELFSPACE_VERIFY_FAIL:<step> with no partial verdict, and imported sponsorship claims receive at most UNVERIFIED_IMPORT.
• Stored-chain integrity (v0.1.1, hardened v0.1.2) — every append refreshes a signed head anchor kept in two copies (store mirror + head-anchor.json) and extends an append-only anchor journal; both anchor copies must be present and agree, the journal and metering side records are cross-checked against the chain head/count, an emptied or tampered store derives SEAL_DEFECT, duplicate revocation is refused (RECEIPT_ALREADY_REVOKED, earliest-wins), a missing signing key suspends all minting (SIGNING_KEY_UNAVAILABLE, zero writes, no null signature ever persisted), verify_pack binds the full pack face, and a malformed store yields a structured SEAL_DEFECT refusal from every core tool.
• Rollback-residual honesty fence (on the product face) — Honesty fence — rollback residual: within this local file model, a rollback that restores every local artifact (store, both anchors, journal, metering) to one consistent earlier snapshot is undetectable; the journal/metering cross-checks detect partial rollbacks and single-artifact tampering, not a complete coordinated snapshot restore. No stronger claim is made.
• Compulsion fence (SPEC §11.2, verbatim) — Shelfspace issues sponsorship receipts and a surfacing-proof format and verifies proofs presented to it. It does not compel any router, marketplace, or agent to surface a disclosure. A 'required to surface' duty exists only where a router/marketplace adopts it (§12); Shelfspace evidences surfacing, it does not enforce it.

Tools

Problems it addresses

• Paid ranking routinely masquerades as merit ranking on agent-facing marketplaces: a listing is first because it paid, while the surface presents the order as earned — the payment, the placement, and the disclosure (if any) live in three different parties' logs, none binding the others
• I need the paid placement, the payment-as-stated, and the disclosure actually rendered bound in one recomputable chain — a sponsorship receipt sealed at placement time that travels with the placement, plus a surfacing proof a third party can verify offline from the pack alone
• I need a paid placement with no valid receipt to be a named defect (UNMARKED-PAID) on every surface — never silently presented as unmarked or merit — and I need the witness itself kept honest: it evidences surfacing, it does not compel or enforce it

Not tested

• Live, multi-party, shared-filesystem, or adversarial-operator use — CONDITION 1 (bench, verbatim): Scope/fence condition (from F2' residual): certification holds only at scope local, fixture placement records under the local single-operator file model. The README rollback-residual honesty fence and scope label must remain on the product face. Any live, multi-party, shared-filesystem, or adversarial-operator use requires an anchor outside the data-dir trust model + fresh bench (the existing counsel gate for live use stands separately).
• Complete coordinated snapshot rollback — Honesty fence — rollback residual: within this local file model, a rollback that restores every local artifact (store, both anchors, journal, metering) to one consistent earlier snapshot is undetectable; the journal/metering cross-checks detect partial rollbacks and single-artifact tampering, not a complete coordinated snapshot restore. No stronger claim is made.
• Live marketplaces, ranking systems, advertisers, routers, ad networks, or buying agents — fixture placement records only; no live system is contacted, integrated, or compelled, and Shelfspace does not rank, sell, render, or endorse any placement
• Legal effect / disclosure-duty compliance (SPEC §10 counsel gate, named, unbuilt) — any claim that a Shelfspace receipt/proof satisfies a legal sponsorship-disclosure duty, advertising law, or anti-deception / unfair-practice rule, or that surfacing is legally required of any party, is out of v0.1.2, hard; the gate packet (disclosure law for agent-facing surfaces; defamation/false-statement review of a public UNMARKED-PAID derivation about a real party; contract terms by which a marketplace/router could require surfacing; real advertiser-terms retention) is unbuilt by design and no dormant live path exists to flip
• Live Herald RS256 signing — v0.1.2 signing is a fixture HMAC stand-in for the Herald pattern, disclosed on every record's face; verification uses pinned fixture keys only, never keys presented inside a record or pack
• Production key custody — fixture keys are local-only in keys/ (gitignored, mode 600, never committed); a fresh clone must create its own fixture key file to run the full suite
• Hosted or live operation / charge path — local stdio only; metering points only per SPEC §9.1 (sponsorship_receipt_issued, surfacing_proof_verified, shelfspace_pack_exported, active_placement_month), no charge path, subscription, or invoice is built and no live Meter ingest is claimed ($99/mo is a book reference)