Cyan Eclipse Skillseal

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

What it does

• Novel mechanism (SPEC §2.1, verbatim) — a skill claim is a pointer to a bench-verdict receipt; a claim with no receipt renders as UNVERIFIED in a standard format counterparties and routers can filter on. The claim is a pointer, not a proof by assertion: a claim carries no grade, score, or verdict of its own (a claim carrying one is malformed and refused), and every verdict string in a rendering is copied mechanically from the receipt's face at verification time.
• Verification recomputes everything from the presented artifacts + pinned keys alone — claim hash + publisher fixture signature; receipt hash recomputed and required to equal the claim's pointer; receipt bench signature verified against the bench key pinned out-of-band by receipt format (never a key taken from, or selected by, the record); subject, skill ref, scope (token-set containment over the pinned fixture vocabulary), pass-class verdict (pinned: PASS only), expiry, and revocation re-derived from the receipt's face; render hash recomputed and the Herald counter-signature verified. Two fixture receipt formats are consumed (benchkit-scorecard and assay-service-receipt) with identical rendered shape. Any parseable-but-failing receipt renders UNVERIFIED with a machine-readable reason (NO_RECEIPT, RECEIPT_HASH_MISMATCH, RECEIPT_SIGNATURE_INVALID, RECEIPT_SUBJECT_MISMATCH, RECEIPT_SKILL_MISMATCH, RECEIPT_SCOPE_NARROWER, RECEIPT_NON_PASS, RECEIPT_EXPIRED, RECEIPT_REVOKED, WITHDRAWN); unparseable artifacts and malformed claims refuse. Downgrade law: any export that cannot be recompute-verified is labelled UNVERIFIED_EXPORT on its face, with no path back to a VERIFIED rendering over the same export. Re-verifying identical material is idempotent (identical render_hash, no second metering point).
• Stored-read verification (v0.1.1, delta-bench C1 closure) — skillseal_claim_get and skillseal_claim_list verify before serving: claim hash + publisher signature, the hash-chained record stream link by link, stored receipt hashes + pinned bench signatures, and the latest rendering's Herald signature + claim binding + receipt-face binding are all recomputed; on any failure claim_get serves only the downgraded form (verified:false, export_label UNVERIFIED_EXPORT, render_status UNVERIFIED, named step_failed, no stored claim/receipt/rendering values) and claim_list computes status and filter fields from verified state only (failed entries list as UNVERIFIED with agent_ref/skill_ref withheld and a downgraded marker, and never match a VERIFIED or skill filter they cannot authenticate).
• Decisive fixture F-S9 — bench-reproduced at v0.1.0 and as a delta regression at v0.1.1: a three-claim fixture set authored by parties other than Skillseal (claim A pointing to a valid pass receipt for A, claim B pointing to nothing, claim C pointing to A's receipt) verified in a fresh process, socket-denied, from the artifacts + pinned keys alone renders exactly VERIFIED / UNVERIFIED (NO_RECEIPT) / UNVERIFIED (RECEIPT_SUBJECT_MISMATCH), all in the identical standard format with render_status as the sole filter field; offline verify_export on A verifies (verified=True, VERIFIED_EXPORT).
• Honest scope — LOCAL stdio, fixture claims + fixture verdict receipts ONLY: no live marketplace, router, registry, or bench system is read, polled, or written, and every emitted artifact carries value_class 'test'. Skillseal benches nothing, certifies no skill, and issues no verdicts. Closed surface of exactly 7 tools (5 caller + 2 operator, disjoint); no verb benches or scores a skill, issues or alters a verdict receipt, edits a claim's receipt_ref, renders a claim verified without a verification run, removes an UNVERIFIED rendering, or fetches a live receipt. Startup is fail-closed (CONFIG_FENCE_REFUSED:<class>) on a live-key string, a non-local endpoint, value_class other than 'test', or any bench-execution/scoring/receipt-issuance/live-ingest module in the tree. Signing is a fixture HMAC-SHA256 stand-in for the Herald / bench signature patterns, disclosed in README + code; verification uses pinned fixture keys only (not public-key verification); the pinned key file holds shared HMAC secrets, not public keys, and no public-key or third-party verifiability is claimed.

Tools

Problems it addresses

• Skill claims in agent cards and marketplace listings are free text: self-asserted, unscoped, and unfilterable — a router cannot distinguish 'benched PASS on scope X by a named bench, recomputable from a receipt' from 'the publisher typed the same words'
• I need a claim to be a pointer to a bench-verdict receipt, rendered in one standard format every counterparty produces identically — VERIFIED with the receipt's own verdict + scope on its face, or UNVERIFIED — so routing and filtering are mechanical, not a fresh trust decision per listing
• I need the rendering kept honest on its face: a claim carries no self-asserted grade, stored readings are never served without recompute-and-verify, unverifiable material downgrades and is never upgraded post-hoc, and UNVERIFIED asserts nothing negative about an agent — only that no verifiable receipt was presented

Not tested

• Live receipt ingestion, live routers/marketplaces, or any real agent, skill, or bench outcome — fixture claims + fixture verdict receipts only; the SPEC §10 counsel gate is unbuilt by design, named, with no dormant live mode: ingesting receipts from a live bench pipeline, serving renderings to live routers or marketplaces, or any public claim that a named third party's skills are verified — each is a separate, counsel-cleared, re-benched build reviewed under the house claim/counsel review for marketplace-facing trust claims
• Any benching, scoring, or verdict issuance by Skillseal itself — Skillseal benches nothing, certifies no skill, and issues no verdicts (SPEC §11.2); it defines the claim pointer, the render rule, and the verification procedure only, and consumes verdict receipts as artifacts owned by the house bench ecosystem. The SPEC §11.4 forbidden claim strings are never claimed for v0.1.1 (they are listed in SPEC §11.4 only and are not reproduced on this surface); UNVERIFIED means only that no verifiable receipt was presented — it is never a negative finding about an agent (SPEC §11.3) — and a VERIFIED rendering is never presented detached from the receipt's own verdict + scope strings; no wording implies a verdict can be bought (SPEC §9.2: no price attaches to any bench verdict or receipt itself)
• Production signing / public-key verification — v0.1.1 signing is a fixture HMAC-SHA256 stand-in for the Herald / bench signature patterns (local fixture keys, keys/ gitignored, mode 600, never committed); the live RS256 Herald signing form is unbuilt. Verification uses pinned fixture keys only, selected by the pinned in-source mapping by receipt format — a key is never taken from, or selected by, the record under verification; the pinned key file holds shared HMAC secrets, not public keys, and no public-key or third-party verifiability is claimed. A fresh clone generates its own fixture keys to run the full suite
• Hosted or live operation — local stdio only; metering points only per SPEC §9.1 (exactly one Meter record per completed skillseal_verify run that produces a rendered record; refusals, cache re-renders, and idempotent re-verifications emit none; VERIFIED and UNVERIFIED outcomes meter identically), the FREE publication + $0.02/verification shape is a book reference with no charge path built and no live Meter ingest