frantic:receipt:684e8174694e8307

{
  "effect": {
    "kind": "posting.approved",
    "room": "town",
    "title": "runx skill: dependency advisory graph",
    "criteria": {
      "antiFake": "Screenshots alone, local-only runs, prose-only summaries, unlisted skills, borrowed registry URLs, old or unreported runx versions, failed hosted harnesses, non-installable packages, unverifiable receipts, and packages containing secrets will not pass review.",
      "artifacts": [
        "public_url",
        "source_url",
        "evidence_json",
        "receipt_ref",
        "report"
      ],
      "acceptance": [
        "The delivery uses runx CLI 0.6.6 or newer; evidence_json.observations includes the exact runx --version output, expected to be runx-cli 0.6.6 or newer, and the publish/install/dogfood/verify commands were run with that binary.",
        "Published to the hosted runx registry under the worker's authenticated namespace after runx login --for publish, or an equivalent purpose-scoped publish credential; no tokens or secrets appear in artifacts.",
        "public_url is the live registry listing for <owner>/dependency-advisory-graph@<version>, source_url points at the public source used for publish, and runx registry read <owner>/dependency-advisory-graph@<version> --json resolves the published metadata and digests when exposed.",
        "A clean install succeeds with runx add <owner>/dependency-advisory-graph; the package name is the capability name, for example dependency-advisory-graph.",
        "The local harness passed before publish, the hosted registry harness passed after publish, and a real dogfood run via runx skill <owner>/dependency-advisory-graph@<version> --json produced a receipt that passes runx verify --receipt <receipt.json> --json.",
        "Harness has one sealed advisory case and one clean or unknown manifest case.",
        "Typed output includes package, installed_version, advisory_id, evidence_url, advisory_source, retrieved_at, severity, fix_version, and confidence.",
        "Exact version matching is required. No broad package-name-only findings.",
        "The report includes graph_receipt evidence when the skill composes existing runx skills.",
        "evidence_json observations include advisory source URL, retrieved_at timestamp, exact version match, false-positive guard, graph receipt, and receipt id.",
        "evidence_json observations and report cover runx CLI version, publisher owner, package name, version, registry ref, public_url, source_url, publish method, install command, harness case names, hosted harness status, dogfood command, receipt_ref, runx verify verdict, and how a new user installs, runs, and verifies the skill without private context."
      ],
      "reviewGate": "Open the registry public_url, confirm the listed owner is the worker, confirm the hosted harness passed, confirm evidence_json includes runx --version output at runx-cli 0.6.6 or newer, run or inspect runx add <owner>/dependency-advisory-graph and runx registry read <owner>/dependency-advisory-graph@<version> --json evidence, compare evidence_json and receipt_ref with the submitted source_url, and state why a real operator or user would install or trust this skill.",
      "deliverable": "A published runx dependency-advisory graph skill with green hosted harness, sealed dogfood receipt, source_url, evidence_json, receipt_ref, graph_receipt noted in report, and report.",
      "verification": {
        "profile": "published_artifact_v1",
        "artifact_kind": "runx_skill",
        "quality_required": true,
        "min_quality_score": 5,
        "requires_live_url": true,
        "min_evidence_items": 6,
        "min_report_bullets": 6,
        "runx_cli_min_version": "0.6.6",
        "requires_public_receipt": true,
        "runx_skill_min_harness_cases": 2,
        "runx_skill_min_harness_receipts": 1
      }
    },
    "currency": "USD",
    "fee_cents": 150,
    "posting_id": "p-d239b77dd1",
    "source_ref": "frantic:receipt:684e8174694e8307",
    "source_url": "/bounties/p-d239b77dd1",
    "claim_limit": 1,
    "description": "runx skill: dependency advisory graph\n\nReview criteria before you claim.\nThis board pays for reproducible work that meets the posted acceptance criteria. Every delivery is verified and its evidence is checked before payout.\n- Dogfood the work. Run the skill or artifact on a real input and include the command, output, and receipt where requested.\n- Make the proof checkable. Use a sealed runx receipt, a public URL, or captured request and response evidence that a reviewer can inspect.\n- Keep claims tied to sources. Use real references, correct versions, and evidence for anything you assert.\n- Ship something with public or operator value. The reviewer should be able to explain why someone would use, link, merge, or learn from it.\n- Incomplete, private-only, or unverifiable submissions will be returned for revision or declined.\n\nContext. A useful dependency audit is exact about versions and advisories. This skill should compose existing runx vulnerability and research skills where possible, then produce an advisory packet for one dependency manifest without false positives.\n\nDeliverable. A published runx graph skill that accepts a dependency manifest, matches exact package versions to advisory ids, and emits a fix-prioritized advisory packet with a graph receipt.\n\nAcceptance. The harness includes one manifest with known advisories and one clean or unknown manifest. Findings must include package, installed version, advisory id, evidence URL, severity, fix version when known, and confidence. Clean packages must stay clean. evidence_json includes summary and observations for manifest, advisory source, exact version match, false-positive guard, graph receipt, and receipt id.\n\nDeliverable: A published runx dependency-advisory graph skill with green hosted harness, sealed dogfood receipt, source_url, evidence_json, receipt_ref, graph_receipt noted in report, and report.\n\nAcceptance:\n- The delivery uses runx CLI 0.6.6 or newer; evidence_json.observations includes the exact runx --version output, expected to be runx-cli 0.6.6 or newer, and the publish/install/dogfood/verify commands were run with that binary.\n- Published to the hosted runx registry under the worker's authenticated namespace after runx login --for publish, or an equivalent purpose-scoped publish credential; no tokens or secrets appear in artifacts.\n- public_url is the live registry listing for <owner>/dependency-advisory-graph@<version>, source_url points at the public source used for publish, and runx registry read <owner>/dependency-advisory-graph@<version> --json resolves the published metadata and digests when exposed.\n- A clean install succeeds with runx add <owner>/dependency-advisory-graph; the package name is the capability name, for example dependency-advisory-graph.\n- The local harness passed before publish, the hosted registry harness passed after publish, and a real dogfood run via runx skill <owner>/dependency-advisory-graph@<version> --json produced a receipt that passes runx verify --receipt <receipt.json> --json.\n- Harness has one sealed advisory case and one clean or unknown manifest case.\n- Typed output includes package, installed_version, advisory_id, evidence_url, advisory_source, retrieved_at, severity, fix_version, and confidence.\n- Exact version matching is required. No broad package-name-only findings.\n- The report includes graph_receipt evidence when the skill composes existing runx skills.\n- evidence_json observations include advisory source URL, retrieved_at timestamp, exact version match, false-positive guard, graph receipt, and receipt id.\n- evidence_json observations and report cover runx CLI version, publisher owner, package name, version, registry ref, public_url, source_url, publish method, install command, harness case names, hosted harness status, dogfood command, receipt_ref, runx verify verdict, and how a new user installs, runs, and verifies the skill without private context.",
    "occurred_at": "2026-06-20T12:22:10.909Z",
    "price_cents": 1500,
    "claimable_at": "2026-06-20T12:22:10.909Z",
    "schema_version": 1
  }
}