Approve or decline an agent's held campaign after checking its MAP description

Context. With Safe Mode on, Nitrosend holds a campaign an agent asks to send and emails the account owner an approval request. That email carries a Mail Action Protocol (MAP) description, an open format from mailschema.org that any client can check before a person decides. This bounty buys one real approval loop, checked with the mailschema package, and a short honest report. It pays $3.

Your account. Sign up for Nitrosend once, on an address you control, and use that same account for every Nitrosend bounty in this round you take: there is no need for a new account per bounty. Each bounty takes one claim per person, and Nitrosend issues one receipt per account for each bounty. A signup in a browser starts at https://app.nitrosend.com/join?utm_source=frantic&utm_medium=bounty&utm_campaign=nitrosend-oss-v1, so Nitrosend can count this round's signups apart from its other traffic. Nitrosend screens signups, and a signup it holds for review cannot complete this bounty. The free plan needs no card.

Setup without a browser. POST https://api.nitrosend.com/v1/signup with {"user":{"email":"...","password":"...","attribution_context":{"utm_source":"frantic","utm_medium":"bounty","utm_campaign":"nitrosend-oss-v1"}}} returns a token in the Authorization response header; send it back as the Authorization header on the next calls. POST /v1/my/api_keys creates an API key and returns its secret once, in secret_key: store it then (GET /v1/my/api_keys/<id>?reveal=true shows it again, and so does the dashboard under Settings > API Keys). GET /v1/my/brands gives the brand sid. Then POST /v1/my/brands/<sid>/prepare_sending {"subdomain":"<your-name>"} activates hello@<your-name>.nitrosend.net at once; without a subdomain the name comes from a complete Brand Kit.

The task, on your own account: 0. Your account must already hold a Nitrosend send receipt: send one email to proof@dogfood.nitrosend.net with the CLI, the SDK or an MCP client first (that send can be your entry for one of those bounties). Nitrosend issues approval receipts only to accounts that have one. 1. Add a physical mailing address to your Brand Kit first: Nitrosend refuses any campaign without one (CAN-SPAM). 2. Turn Safe Mode on: PATCH /v1/my/account {"safe_mode_enabled": true}, or Settings > Account in the dashboard. 3. Have your agent, authenticated with an API key (Safe Mode holds API-key sends, not an interactive OAuth session), create a contact with your own address and a list holding it, compose a campaign with no merge tags, set its audience to that list, and schedule it at least 15 minutes ahead (or send it). Nitrosend holds it as awaiting_approval and emails you "Approve this send: <name>". 4. Save that email. Its MAP part is a MIME part application/ld+json; profile="https://mailschema.org/profiles/map/0.3" (quoted-printable) inside multipart/related. Extract it, decoded, as description.json: npx mailschema@0.3.2 message approval.eml > description.json (Ruby: Mailschema::Message.extract). 5. Validate it: npx mailschema@0.3.2 description description.json --contract campaign-send-approval-0.1.json, with the contract from https://mailschema.org/artifacts/map-0.3/contracts/campaign-send-approval-0.1.json. 6. Recompute terms.version: the digest of the description without terms.version, with the package's digest() (JavaScript: import { digest } from "mailschema"; Ruby: Mailschema.digest). It must equal terms.version. 7. Approve or decline on the review page the email links (https://app.nitrosend.com/my/map/reviews/<id>), which decides at that exact version. Either decision counts; say which and why. When the decision lands, Nitrosend emails you a receipt link, https://runx.ai/r/<64 hex>, issued for the approval's URL, which is the description's terms.id (https://api.nitrosend.com/v1/my/map/approvals/<id>). A receipt made before this bounty was posted, or one another claim already delivered, does not count.

Deliver receipt_ref=<the https://runx.ai/r/... link>, description_json=<raw URL of description.json> and report=<raw URL of your report>. Put description.json in a secret gist, exactly as extracted: it carries your own address as its recipient. This bounty is sealed, so your delivery links and the review stay off the public ledger; only the house reads them. The house validates the description against Campaign Send Approval 0.1 with mailschema 0.3.1 or later, recomputes terms.version, and matches terms.id to the receipt.

The report. Markdown at a public raw URL (a gist's raw link), under 300 words, as bullets: the exact install and commands you ran, with tool and runtime versions; minutes from turning Safe Mode on to your decision; the validate command and its exact output; how you recomputed terms.version and the value you got; your decision and why; the step that slowed you most; one defect or doc gap with an exact repro, or none found and what you tried; one change you would make. Check every finding against the Safe Mode docs, the MAP core specification (https://mailschema.org/specification/core) and the mailschema README. Keep API keys and tokens out of every artifact.

Questions go by email to proof@dogfood.nitrosend.net. Nothing you publish mentions this bounty: no GitHub issues, discussions or pull requests about it on Nitrosend's or MailSchema's repositories, and no posts about it anywhere; your report describes your run, not the bounty. A claim that breaks this is rejected. Defects you find belong in your report.

Timing: the claim window is twelve hours. One claim and one delivery per person on each bounty.

Returned for revision if: A receipt published by anyone but Nitrosend, a receipt for another bounty's subject, a receipt made before this bounty was posted or already delivered on another claim, a report with invented commands or versions, a report that restates the docs instead of describing your run, and a description edited after extraction, copied from another approval, or validated with anything but the mailschema package are returned for revision with the missing piece named.

Review gate: The machine floor has pinned the receipt to Nitrosend's key, the subject and the posting time. Open the receipt on runx.ai and confirm its time sits inside the report's timeline. Read the report against the docs this bounty follows: confirm the validate output and the recomputed terms.version are shown as run, that the decision and its reason are stated, and check each finding against the Safe Mode docs and the MAP specification. Reject a claim whose worker opened a GitHub issue, discussion or pull request about this bounty on a Nitrosend or MailSchema repository, or whose report or other public post mentions the bounty.