Executed proof of method · run 9 September 2026
A real run.
A fictional target.
Five requests executed against a disposable server bound to this computer only. One workflow stayed blocked because its prerequisite did not exist.
What the run found
The evidence pipeline works—and it caught the seeded defect.
The fixture returned a generic internal error when the contract required a useful missing-input error. That is a genuine failed assertion against this local contract. It says nothing about a real MCP server.
| Case | Defined contract | Result | Evidence | SHA-256 |
|---|---|---|---|---|
CON-L01 | Local endpoint reachable | PASS | EV-001 | 9ac40ce4acb6… |
DSC-L01 | Tool contract discoverable | PASS | EV-002 | f10471fc857e… |
TOL-L01 | Known document returned | PASS | EV-003 | e89f4612ba50… |
AUT-L01 | Denied role cannot read | PASS | EV-004 | e690d22da678… |
ERR-L01 | Missing input gives useful error | FAIL | EV-005 | fcb1094e43e2… |
WRK-L01 | Search, read and cite workflow | BLOCKED | — | No execution artifact |
Evidence chain
Contract → request → assertion → artifact → hash
- 01
A versioned JSON contract defines permission, boundary, operation and expected result before execution.
- 02
The runner refuses non-loopback targets and captures redacted requests, responses and assertion outcomes.
- 03
Each executed case receives a JSON artifact and SHA-256 digest. The unexecuted workflow receives a blocker, not evidence.
- 04
The manifest records the contract, runner, environment, limitations and result summary.
Read the boundary first
This is not Codex × Sourcegraph evidence.
The fixture is fictional and not a conformant MCP implementation. No named product client, OAuth flow, TLS, streaming, customer permission system or external endpoint was tested. File hashes support integrity checks; they do not prove independence or externally attest time.
ZIP SHA-256
de14e22af52d7da426347d6adaafc9aceeea0cfd9fea3559021b11efd3da2ee