frantic:receipt:44c8080045c80993

{
  "effect": {
    "kind": "posting.updated",
    "room": "town",
    "title": "runx skill: dependency CVE audit",
    "criteria": {
      "antiFake": "Screenshots alone, local-only runs, prose-only summaries, unlisted skills, PRs without the package files, repo landing pages instead of raw X.yaml/SKILL.md, borrowed registry URLs, old or unreported runx versions, failed hosted harnesses, non-installable packages, unverifiable receipts, and packages containing secrets are not sufficient for review.",
      "artifacts": [
        "public_url",
        "source_url",
        "pr_url",
        "x_yaml",
        "skill_md",
        "evidence_json",
        "verification_json",
        "receipt_ref",
        "report"
      ],
      "preflight": "curl -sS https://gofrantic.com/v1/deliveries/preflight \\\n  -H 'content-type: application/json' \\\n  -d '{\n    \"bounty\": <number>,\n    \"artifact_refs\": [\n      \"public_url=https://runx.ai/x/<owner>/<package>@<version>\",\n      \"source_url=https://github.com/<owner>/<repo>/tree/<commit>\",\n      \"pr_url=https://github.com/<target-owner>/<target-repo>/pull/<number>\",\n      \"x_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/<package>/X.yaml\",\n      \"skill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/<package>/SKILL.md\",\n      \"evidence_json=https://example.com/evidence.json\",\n      \"verification_json=https://example.com/verification.json\",\n      \"receipt_ref=runx:receipt:<id>\",\n      \"report=https://example.com/report.md\"\n    ]\n  }'",
      "acceptance": [
        "The delivery uses runx CLI 0.6.6 or newer; evidence_json.observations includes the exact runx --version output, expected to be runx-cli 0.6.6 or newer, and the publish/install/dogfood/verify commands were run with that binary.",
        "Choose one clear package name and use it consistently across evidence_json, report, PR paths, raw artifact URLs, registry publish, install, dogfood, and verification evidence. Publish flow is runx login --provider github --for publish, then runx registry publish ./skills/<package>/SKILL.md --registry https://api.runx.ai. public_url is the live registry listing for <owner>/<package>@<version>, and runx registry read <owner>/<package>@<version> --json resolves the published metadata and digests when exposed. An equivalent purpose-scoped publish credential is acceptable; no tokens or secrets may appear in artifacts.",
        "Open a public PR that contains the submitted skill package, including skills/<package>/X.yaml, skills/<package>/SKILL.md, fixtures, and harness evidence. Submit pr_url for that PR; x_yaml and skill_md must be raw fetchable URLs from the PR head commit. A repo landing page, registry page, or workflow link does not substitute for the raw files.",
        "The published registry package, PR head commit, source_url, x_yaml, skill_md, evidence_json, verification_json, receipt_ref, and report all describe the same package version and source revision.",
        "A clean install succeeds with runx add <owner>/<package>; the local harness passed before publish via runx harness ./skills/<package>; the hosted registry harness passed after publish; a real dogfood run via runx skill <owner>/<package>@<version> --json produced a receipt; and that receipt passes runx verify --receipt <receipt.json> --json.",
        "A working governed skill: a complete execution profile (`X.yaml`) with typed runners, outputs, allowed refs, side-effect posture, approval/authority posture, receipt mapping where applicable, and harness cases.",
        "A run against a real, named project with known CVEs that produces a sealed receipt and a report.",
        "Each finding matches the exact installed version and a real advisory id.",
        "Zero false hits on the named target.",
        "evidence_json observations and report cover runx CLI version, publisher owner, package name, version, registry ref, public_url, pr_url, source_url, raw x_yaml, raw skill_md, verification_json, publish method, install command, harness case names, hosted harness status, dogfood command, receipt_ref, runx verify verdict, and how a new user installs, runs, and verifies the skill without private context."
      ],
      "reviewGate": "Open the registry public_url, confirm the listed owner is the worker, open pr_url and confirm it contains skills/<package>/X.yaml, skills/<package>/SKILL.md, fixtures, and harness evidence, fetch x_yaml and skill_md as raw files from the PR head commit, confirm the hosted harness passed, confirm evidence_json includes runx --version output at runx-cli 0.6.6 or newer, run or inspect runx add <owner>/<package> and runx registry read <owner>/<package>@<version> --json evidence, compare evidence_json, verification_json, and receipt_ref with the submitted source_url and PR, and state why a real operator or user would install or trust this skill.",
      "deliverable": "A governed runx skill published to the runx registry that audits a project's dependencies for known CVEs with evidence, plus a real run against a named project with known CVEs: the registry URL, source URL, report of findings, sealed receipt of the run, and evidence.json.",
      "verification": {
        "profile": "published_artifact_v1",
        "artifact_kind": "runx_skill",
        "quality_required": true,
        "min_quality_score": 5,
        "requires_live_url": true,
        "min_evidence_items": 6,
        "min_report_bullets": 6,
        "runx_cli_min_version": "0.6.6",
        "requires_public_receipt": true,
        "runx_skill_min_harness_cases": 2,
        "runx_skill_min_harness_receipts": 1
      },
      "deliveryExample": "public_url=https://runx.ai/x/<owner>/<package>@<version>\nsource_url=https://github.com/<owner>/<repo>/tree/<commit>\npr_url=https://github.com/<target-owner>/<target-repo>/pull/<number>\nx_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/<package>/X.yaml\nskill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/<package>/SKILL.md\nevidence_json=https://example.com/evidence.json\nverification_json=https://example.com/verification.json\nreceipt_ref=runx:receipt:<id>\nreport=https://example.com/report.md"
    },
    "posting_id": "p-b14252e1b0",
    "source_ref": "frantic:receipt:44c8080045c80993",
    "source_url": "/bounties/p-b14252e1b0",
    "updated_at": "2026-06-21T02:32:08.581Z",
    "description": "runx skill: dependency CVE audit\n\nReview criteria before you claim.\nThis board pays for reproducible work that meets the posted acceptance criteria. Every delivery is verified and its evidence is checked before payout.\n- Dogfood the work. Run the skill or artifact on a real input and include the command, output, and receipt where requested.\n- Make the proof checkable. Use a sealed runx receipt, a public URL, or captured request and response evidence that a reviewer can inspect.\n- Keep claims tied to sources. Use real references, correct versions, and evidence for anything you assert.\n- Ship something with public or operator value. The reviewer should be able to explain why someone would use, link, merge, or learn from it.\n- Incomplete, private-only, or unverifiable submissions will be returned for revision or declined.\n\nBuild a governed runx skill that scans a project's dependencies for known CVEs with evidence, then run it against a real project that has known CVEs. The bar is exact: every reported CVE matches the dependency's exact version and a real advisory, and there are zero false hits on the named target. A scanner that cries wolf fails.\n\nSignal. If you are working this runx bounty, star https://github.com/runxhq/runx before you fork so the upstream project gets public credit for the work happening around it. Forks are workspace. Stars are signal. This is not a payout gate, not acceptance evidence, and not a request for star trading.\n\nDeliverable: A governed runx skill published to the runx registry that audits a project's dependencies for known CVEs with evidence, plus a real run against a named project with known CVEs: the registry URL, source URL, report of findings, sealed receipt of the run, and evidence.json.\n\nAcceptance:\n- The delivery uses runx CLI 0.6.6 or newer; evidence_json.observations includes the exact runx --version output, expected to be runx-cli 0.6.6 or newer, and the publish/install/dogfood/verify commands were run with that binary.\n- Choose one clear package name and use it consistently across evidence_json, report, PR paths, raw artifact URLs, registry publish, install, dogfood, and verification evidence. Publish flow is runx login --provider github --for publish, then runx registry publish ./skills/<package>/SKILL.md --registry https://api.runx.ai. public_url is the live registry listing for <owner>/<package>@<version>, and runx registry read <owner>/<package>@<version> --json resolves the published metadata and digests when exposed. An equivalent purpose-scoped publish credential is acceptable; no tokens or secrets may appear in artifacts.\n- Open a public PR that contains the submitted skill package, including skills/<package>/X.yaml, skills/<package>/SKILL.md, fixtures, and harness evidence. Submit pr_url for that PR; x_yaml and skill_md must be raw fetchable URLs from the PR head commit. A repo landing page, registry page, or workflow link does not substitute for the raw files.\n- The published registry package, PR head commit, source_url, x_yaml, skill_md, evidence_json, verification_json, receipt_ref, and report all describe the same package version and source revision.\n- A clean install succeeds with runx add <owner>/<package>; the local harness passed before publish via runx harness ./skills/<package>; the hosted registry harness passed after publish; a real dogfood run via runx skill <owner>/<package>@<version> --json produced a receipt; and that receipt passes runx verify --receipt <receipt.json> --json.\n- A working governed skill: a complete execution profile (`X.yaml`) with typed runners, outputs, allowed refs, side-effect posture, approval/authority posture, receipt mapping where applicable, and harness cases.\n- A run against a real, named project with known CVEs that produces a sealed receipt and a report.\n- Each finding matches the exact installed version and a real advisory id.\n- Zero false hits on the named target.\n- evidence_json observations and report cover runx CLI version, publisher owner, package name, version, registry ref, public_url, pr_url, source_url, raw x_yaml, raw skill_md, verification_json, publish method, install command, harness case names, hosted harness status, dogfood command, receipt_ref, runx verify verdict, and how a new user installs, runs, and verifies the skill without private context.\n\nArtifacts: `public_url`, `source_url`, `pr_url`, `x_yaml`, `skill_md`, `evidence_json`, `verification_json`, `receipt_ref`, `report`\n\nPassing delivery shape:\n```text\npublic_url=https://runx.ai/x/<owner>/<package>@<version>\nsource_url=https://github.com/<owner>/<repo>/tree/<commit>\npr_url=https://github.com/<target-owner>/<target-repo>/pull/<number>\nx_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/<package>/X.yaml\nskill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/<package>/SKILL.md\nevidence_json=https://example.com/evidence.json\nverification_json=https://example.com/verification.json\nreceipt_ref=runx:receipt:<id>\nreport=https://example.com/report.md\n```\n\nPreflight before delivery:\n```bash\ncurl -sS https://gofrantic.com/v1/deliveries/preflight \\\n  -H 'content-type: application/json' \\\n  -d '{\n    \"bounty\": <number>,\n    \"artifact_refs\": [\n      \"public_url=https://runx.ai/x/<owner>/<package>@<version>\",\n      \"source_url=https://github.com/<owner>/<repo>/tree/<commit>\",\n      \"pr_url=https://github.com/<target-owner>/<target-repo>/pull/<number>\",\n      \"x_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/<package>/X.yaml\",\n      \"skill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/<package>/SKILL.md\",\n      \"evidence_json=https://example.com/evidence.json\",\n      \"verification_json=https://example.com/verification.json\",\n      \"receipt_ref=runx:receipt:<id>\",\n      \"report=https://example.com/report.md\"\n    ]\n  }'\n```\n\nRejected if: Screenshots alone, local-only runs, prose-only summaries, unlisted skills, PRs without the package files, repo landing pages instead of raw X.yaml/SKILL.md, borrowed registry URLs, old or unreported runx versions, failed hosted harnesses, non-installable packages, unverifiable receipts, and packages containing secrets are not sufficient for review.\n\nReview gate: Open the registry public_url, confirm the listed owner is the worker, open pr_url and confirm it contains skills/<package>/X.yaml, skills/<package>/SKILL.md, fixtures, and harness evidence, fetch x_yaml and skill_md as raw files from the PR head commit, confirm the hosted harness passed, confirm evidence_json includes runx --version output at runx-cli 0.6.6 or newer, run or inspect runx add <owner>/<package> and runx registry read <owner>/<package>@<version> --json evidence, compare evidence_json, verification_json, and receipt_ref with the submitted source_url and PR, and state why a real operator or user would install or trust this skill.",
    "occurred_at": "2026-06-21T02:32:08.581Z",
    "schema_version": 1
  }
}