Eclipse Loft MCP

Eclipse Loft

*governed design-to-print authority for agents — signed provenance from model to machine, safety envelopes at the bridge, evidence for every print.*

Status: CERTIFIED(simulator) — Eclipse Bazaar Test Bench 2026-10-25, scoped re-bench r3 (standing card `../test-bench/results/eclipse-strata-mcp-2026-10-25-r3.json`, 12/12 scoped checks). Bench history, all cards retained append-only: bench 1 FAILED (35 of 45), scoped re-bench r2 FAILED (25 of 26 — D2 signer-anchor defect open), r3 CERTIFIED(simulator) with D2 closed. Simulator scope only — no live printer was exercised; no claim broader than CERTIFIED(simulator) is made.

Spec: ../eclipse-strata-spec-20261025.md (Silas Forge W-002, 2026-10-25). Renamed Eclipse Loft — owner decision 2026-10-25: built and certified as Eclipse Strata; the Stratasys trademark-screen risk was rejected and fallback 2 (Loft) adopted over Sinter (D7). Test Bench scorecards retain the Strata name as history.

What it is

Fabrication authority exercised only inside a signed mandate pinning agent × printer serial × design pin × slicer build × profile hash × material × thermal/volume/duration/budget envelope × site class × window. The bridge re-slices the pinned inputs at dispatch and canonical-hash-matches (§4.3: comments + volatile header stripped, rest byte-exact) before any printer contact. Every print and every refusal seals into a Blackbox-form evidence pack (16+ fields, §12) verifiable offline by Loft Proof.

Surfaces

• MCP server (server.py, stdio JSON-RPC, stdlib only) — exactly 11 tools: design_register, design_inspect, design_pin_get, printers_discover, session_open, job_prepare, job_dispatch, job_status, job_abort, telemetry_read, session_close. No raw G-code, axis, heater, config-write, code-exec, or pin-activation tool exists on the surface; forbidden names refuse -32602 with the named refusal (§11).
• Bridge (strata_engine.py) — simulators only at P0: OctoPrint virtual printer + virtual Klipper/Moonraker (+ a virtual multi-function unit for non-print-head refusal). Slicer is a deterministic simulated PrusaSlicer/Orca behind the production interface (real CLI adapters slot in at P1+); re-derivation is real: identical pinned inputs re-derive the identical canonical hash, any content edit changes it.
• Bridge admin CLI (bridge_admin.py) — operator-only, bridge host, never MCP-reachable: toolchain registry, printer declaration, human-principal pin activation, pack export; admin acts receipted to data/bridge-admin.log.
• Loft Proof (proof.py, tools/strata_proof.py) — offline pack verifier: PRINT_VERIFIED | PRINT_UNVERIFIED, failing element named, toolpath re-derived from the pack's pinned inputs. Verification requires a trusted signer anchor supplied to the verifier (verify_pack(..., registry=… / expected_fingerprint=…); CLI --registry FILE / --expected-fingerprint FP): the pack's signer fingerprint + embedded key are cross-checked against that local registry (§7.1) — unknown signers, registry key mismatches, and no-anchor presentations refuse naming UNVERIFIED_SIGNER.
• Loft Gauge (gauge.py, tools/strata_gauge.py) — static mandate+profile conformance: ENVELOPE_SOUND | ENVELOPE_UNSOUND, violations named.

Safety law (§5, enforced in code)

CONFIG_DRIFT refusal on firmware attestation change; config writes = permanent refusal (no T3 verb exists); T2 raw G-code refused; dead-man = telemetry loss (mandate gap threshold, default 30 s, 10–300) → state UNKNOWN + pause, resume only after re-attestation; mandate expiry mid-print ≠ kill (completes under monitoring unless hard_stop_at_expiry signed); PENDING_PHYSICAL_CONFIRM is honest waiting, never a bypass; readiness facts are labeled machine-attested / human-declared / unchecked, never upgraded. Registration split (§4.4/S6): design_register only PROPOSES; activation requires a human-principal signed pin record — agent self-pin refuses AGENT_SELF_PIN_REFUSED.

Composition (§7, by port)

PinSigner port with local Ed25519 signer fallback (pure-stdlib; Herald upgrades verifiability, never behavior); Blackbox-form packs native; Tripwire-pattern ceilings native; Friction auto-file hook on adapter telemetry findings; Meter-shaped consumption records emitted read-side per print; Till = P3-gated port only (present, disabled, no active code paths); Span delegation slot present in the mandate grammar from P0 (inert); Census rejected (no port, no discovery targeting).

Tests

python3 -m unittest discover -s tests — 64 tests: happy-path full governed print on both simulators + pack verification, guards (coerce_int_param, parse_time, ref guard), canonical-hash volatile-invariance, and the §14 hostile-agent suite H1–H18 in bench shape (same fixtures, same expected refusal codes). Note: pure-Python Ed25519 makes the suite slow (~95 s); signing is the only non-trivial cost. python3 smoke.py — wire-level smoke (11 tools, discover, forbidden-name refusal).

Honest limits (P0)

Simulators only — no real printer was touched, no heat, no network calls, no vendor clouds, no Bambu path (Developer-Mode gate is P2+). A mandate layer never substitutes for a site's own risk assessment, fire precautions, or insurer terms (§6.6). On an open desktop, bridge custody is a discipline, not physics (§3). Geometry at P0 is declared geometry only (fix round D7): design_inspect returns the caller-declared bounding box from the parameter set plus arithmetic over it — no kernel/mesh inspection of the artifact is performed, and manifold / wall-thickness / triangle facts are reported unchecked (null), never echoed as verified. Packs are key-sealed (fix round D2): every pack carries an Ed25519 pack_signature; Loft Proof requires it — recomputing the pack's unkeyed hashes without the signer key does not verify. Proof is signer-anchored (fix round 2, D2X): the embedded key's self-consistency never suffices — Proof cross-checks signer fingerprint + embedded key against a verifier-supplied local registry / expected fingerprint (§7.1), and an attacker-minted self-consistent pack refuses UNVERIFIED_SIGNER.

Powered by Cyan Eclipse Technologies — https://cetech.ai