Cyan Eclipse Ward

Vendor: Cyan Eclipse Technologies · Platforms: MCP over stdio

What it does

• Novel mechanism (SPEC §2.1, verbatim) — a designated human guardian holds veto rights over sealed action classes, and every veto (or veto-window lapse) is receipted into the agent's own record.
• Decisive fixture F-W13 stands from the bench record — in a fresh subprocess with no Ward state, pack_verify recomputes the verdict from the exported pack and pinned keys alone (branches (a)–(d)); every outcome — veto, approval, lapse — is a signed receipt in the agent's own hash-chained record.
• Delta re-bench of v0.1.1 (wave4/rebench-ward.md): defects D1–D10 all CLOSED on independent re-probe (57/57 bencher checks, builder suite 37/37 re-run by the bencher) — the guardian-change subsystem (replacement/revocation outcomes), carved out of the v0.1.0 pass under condition C1, is now INSIDE the PASS-CONDITIONAL (local/simulator) scope; the carve-out is LIFTED and no condition from the first bench remains open.
• Enforcement fence (verbatim, on every surface): Ward issues verdicts and receipts; it does not enforce them. Enforcement is the consuming runtime's mandate layer (§12): a runtime that does not check Ward, or that proceeds despite a VETOED verdict, is outside Ward's control, and Ward claims nothing about such a runtime's actions.
• The lapse deal, stated wherever the veto is described: a window that expires with no guardian act produces a lapse receipt stating the window opened, when it expired, and that no veto or approval was recorded; only with that receipt chained is the action proceed-eligible to the mandate layer. A lapse is never an approval. An open window is never proceed-eligible; a VETOED action is terminal — no appeal verb, no revival.
• Rollback fence (verbatim): the v0.1 store is a pure local file store anchored only by its signed store head and hash chains; verdicts are capped at PASS-CONDITIONAL(local/simulator) — an external anchor is required before any live or multi-party reliance.
• Counsel gate (SPEC §10) — named, unbuilt: connecting Ward verdicts to a real agent runtime such that real actions are barred or cleared in reliance on them, and any use of Ward for a legally recognised ward/guardian relationship, requires counsel clearance first (guardian authority and liability, lapse-based auto-proceed defensibility per class, the legal meaning of "guardian"/"ward" in naming and copy). There is no dormant live path in v0.1.1 to flip: the startup fence refuses non-local endpoints, live keys, runtime credentials, production agent sources, and value_class ≠ "test" by name.
• Signing in v0.1.1 is a fixture HMAC stand-in for Herald RS256, disclosed on every artifact face as signature_scheme; verification keys are pinned out-of-band by fixed key ref and never accepted from the record under verification. Till (mandate layer), Herald (counter-signing pattern), Meter (metering grammar), and Docket (evidence-pack shape) are consumed by grammar/reference only.

Tools

Problems it addresses

• "Human in the loop" for agents today usually means a dashboard a human might look at, an approval buried in a log the agent's operator wrote, or nothing — there is no portable, third-party-recomputable record that a named guardian held the right to stop a sensitive action class, and what they did or did not do with it
• I need a designated human guardian to hold veto rights over enumerated sealed action classes for my agent — veto inside the window bars the action, approval clears it early, and every outcome is receipted into the agent's own hash-chained record
• I need a veto-window lapse to be its own receipted fact — the window expired unused — never silently treated as an approval, and the whole record recomputable offline from the exported pack alone

Not tested

• Live runtime reliance — connecting Ward verdicts to a real agent runtime such that real actions are barred or cleared in reliance on them is SPEC §10 counsel-gated and UNBUILT; there is no dormant live path in v0.1.1 and the startup fence refuses non-local endpoints, live keys, runtime credentials, and production agent sources by name
• Legally recognised ward/guardian use — requires counsel clearance first (guardian authority and liability, lapse-based auto-proceed defensibility per class, the legal meaning of "guardian"/"ward" in naming and copy); pre-counsel language is "guardian veto verdicts + receipts (local/simulator)" only — never "guardian protection", "human oversight guaranteed", or "actions are stopped"
• External anchoring / multi-party reliance — the pure local file store caps any verdict at PASS-CONDITIONAL(local/simulator); an external anchor is required before any live or multi-party reliance
• Production key custody — signing is an HMAC fixture stand-in for Herald RS256 (fixture keys in keys/, gitignored, mode 600); a live phase would need real Herald signing and a re-bench