Cyan Eclipse Understudy — Cyan Eclipse Bazaar

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

Certification scope

PASS-CONDITIONAL(local, subset proof over Till-grammar fixture mandates) — Verity bench of v0.1.0 (2026-10-27, argus101-program-20261027/wave3/bench-understudy.md): builder suite 34/34 re-run clean by bencher; decisive fixture F-U9 independently reproduced (bencher corpus, bencher keys, black-box stdio) — STRICT_ATTENUATION with face vector and subset_proof equal to bencher recomputation, full chain recomputed from the §6.2 export alone, and fresh-process empty-data-dir verify → VERIFIED_EXPORT / STRICT_ATTENUATION re-derived; all 8 F-U5 single-dimension widenings NOT_SUBSET with named codes and fresh-process recompute; 9-field absence totality, §5.3 refusal partition, verify/tamper/downgrade battery, metering exactness, and malformed battery all pass (bencher battery 99 checks). PASS-CONDITIONAL is not CERTIFIED — certified is false. Scope is exactly: local stdio, fixture mandate pairs only, value_class 'test'; Understudy issues no mandates, grants no authority, registers no agents, and executes no delegated action. Sole condition (verbatim): Cross-artifact cross-commitment note: full coordinated rollback across separately held artifacts is a fenced condition — external anchor required before live/multi-party use. Advisory F-2/F-3 (non-blocking, v0.2 hardening notes): chain-hop hash continuity (chain_verify binds hops by mandate_id, not hash/citation) and offline verify temporal re-check (verify step 2 does not re-run write-time predates/expiry-at-issuance checks; prove, the sole mint path, refuses both).

What it does

Novel mechanism (SPEC §2.1, verbatim) — a cryptographic subset proof that the sub-agent's mandate is a strict attenuation of the delegator's — delegation can narrow authority, provably never widen it.
Dimension-by-dimension subset proof — the delegate mandate is checked against the delegator mandate over the complete Till mandate dimension set (SPEC §2.3, fixed order: amount/cap, single-action max, scope, counterparty, expiry, approval threshold, velocity/count limits, delegability) under a total absence rule (a constraint present on the delegator and absent on the delegate is WIDER, never EQUAL). subset_proof = sha256(canonical(delegator_hash ‖ delegate_hash ‖ dimension_vector)); every vector entry is on the proof record's face so a verifier re-derives the vector itself. Attenuation requires subset-or-equal on every dimension and strictly narrower on at least one; an identical mandate proves SUBSET_EQUAL, a distinct verdict, never labelled attenuation.
Offline verification (SPEC §6.4) — a pure function of the §6.2 export (proof + binding records + both mandates + chain) + pinned keys alone: both mandate hashes, the full dimension vector, the proof hash, and the Herald signature are recomputed on every verify. Any export that cannot be recompute-verified is labelled UNVERIFIED_EXPORT with no verdict claim in either direction; downgraded labels are never removed or upgraded and there is no path from a downgraded export back to a sealed proof.
Decisive fixture F-U9 — bench-reproduced in fresh processes from bencher corpus + bencher keys (signers the product does not operate): understudy_prove → STRICT_ATTENUATION with the face vector and subset_proof equal to the bencher's own §2.3/§2.2 recomputation, and all 8 single-dimension widenings (amount, single-action, scope, counterparty, expiry, approval threshold, omitted velocity amount, depth) each recompute to NOT_SUBSET with the named §5.3 code; a fresh process with an empty data dir, from the export + pinned keys alone, re-derives the vector and verifies VERIFIED_EXPORT / STRICT_ATTENUATION.
Honest scope — LOCAL stdio, fixture mandate pairs ONLY: Understudy evaluates fixture mandate pairs and issues proofs about the two presented mandates; it issues no mandates, grants no authority, registers no agents, and executes no delegated action, and every artifact carries value_class "test". Closed surface of exactly 6 tools (4 caller + 2 operator, disjoint); no issuance/grant/execute/register/revoke/waive verb exists on either surface. Startup is fail-closed (CONFIG_FENCE_REFUSED:<class>) on a live-key string, a non-local endpoint, value_class other than 'test', or any mandate-issuance/wallet/execution module in the tree. Grammar is Till §5 consumed verbatim (GRAMMAR_PIN disclosed). Signing is an HMAC fixture stand-in for Herald RS256 (disclosed). Sole condition: Cross-artifact cross-commitment note: full coordinated rollback across separately held artifacts is a fenced condition — external anchor required before live/multi-party use.

Tools

understudy_proveunderstudy_proof_getunderstudy_verifyunderstudy_chain_verifyunderstudy_evaluation_listunderstudy_anomaly_queue_read

Problems it addresses

Delegation is where agent authority silently grows: a sub-agent commissioned for one task ends up holding the delegator's full cap, a longer expiry than the delegator itself, or a counterparty the delegator could never pay — assembled from mandate fields nobody compared as a set
Each mandate verifies fine on its own under Till's grammar; the widening only exists between the two mandates, where no single-mandate verifier looks — platforms currently trust the orchestrator's assertion that it delegated narrowly
I need narrowness as a proof, not an assertion: a Herald-signed, dimension-by-dimension subset proof over two Till-grammar mandates I present, recomputable offline by a third party from the mandates + pinned keys alone — and the same machinery failing a delegation widened on any single dimension

Not tested

Live delegated-authority reliance — SPEC §10 counsel gate (named, unbuilt): a production platform admitting, limiting, or acting on sub-agents in reliance on Understudy proofs over live mandates, or any marketing of the proof as establishing legal agency, authority, or liability allocation — is out of v0.1, hard, gated on counsel clearance; no issuance, registration, or enforcement code exists, and a subset proof establishes a mathematical relation between two mandates only — whether that relation creates, evidences, or limits legal authority is a counsel question this product never answers on its own face
Condition (bench, verbatim): Cross-artifact cross-commitment note: full coordinated rollback across separately held artifacts is a fenced condition — external anchor required before live/multi-party use. v0.1 anchors are local to the evaluation (binding prev_hash = pair-hash anchor); no coordinated rollback across separately held artifacts is possible or claimed until an external anchor exists
Advisory F-2 (bench, v0.2 hardening note, non-blocking): chain_verify binds hops by mandate_id equality and does not check that hop i+1's delegator mandate is hash-identical to hop i's delegate mandate, nor that hop i+1's proof cites hop i's subset_proof in prior_hop_proof — the direct root-vs-final recompute still prevents any chain-verified final delegate from exceeding the root mandate, and each hop proof is individually genuine; hash + citation continuity in chain_verify is recorded for v0.2 hardening
Advisory F-3 (bench, v0.2 hardening note, non-blocking): offline understudy_verify re-runs structure, pinned-key signatures, binding, and delegability at SPEC §6.4 step 2, but does not re-run the write-time temporal checks (DELEGATE_PREDATES_DELEGATOR, delegator expiry at evaluation) — reachable only by the Herald-key holder, since prove, the sole mint path, refuses both
Production signing — v0.1.0 signing is an HMAC fixture stand-in for Herald RS256 (signer face: herald-fixture (fixture HMAC stand-in for Herald RS256)), disclosed on every signed face; verification uses keys pinned out-of-band in a local chmod-600 gitignored key file, never key material from the record under verification; a live phase requires real Herald signing and a re-bench
Production key custody — fixture keys live in keys/fixture-keys.json (chmod 600, gitignored, never committed); a fresh clone generates its own fixture key file to run the full suite
Hosted or live operation / charge path — local stdio only; metering points only per SPEC §9 (exactly 1 point per sealed proof, any verdict; 0 for refusals, verifies, chain reads, and idempotent resubmissions), no charge path is built, no payment is taken, and no live Meter ingest is claimed
Grammar pin — mandate fields, canonical form, hash construction, and verification order are Till §5's, consumed verbatim (GRAMMAR_PIN: Till section 5 mandate grammar (eclipse-till-mcp README section 5 + MPP Session Witness spec 4.1), dimension set per Understudy spec 2.3, pinned 2026-10-27); the B0 checkout-profile spellings are the purchase profile of the same grammar, mapped semantically and disclosed per SPEC §14 Q-U1 — if a future Till grammar revision renames fields, a spec amendment (not builder discretion) is required

Evaluation-intake listing

This listing records the tool's place in the Bazaar's evaluation and monitoring pipeline, with the evidence gathered so far printed above — verdict, scope, and not-tested items included. It is not sold on this site, and its presence in the catalog is not a claim beyond that evidence. The service behind every verdict is the bench: what a bench run buys →