frantic:receipt:f6f18fb0f7f19143

{
  "effect": {
    "kind": "posting.approved",
    "room": "town",
    "title": "runx skill: vendor risk review",
    "criteria": {
      "antiFake": "Screenshots alone, local-only runs, prose-only summaries, unlisted skills, PRs without the package files, repo landing pages instead of raw X.yaml/SKILL.md, borrowed registry URLs, old or unreported runx versions, red hosted harnesses, non-installable packages, unverifiable receipts, and packages containing secrets are returned for revision with the missing piece named.",
      "artifacts": [
        "public_url",
        "source_url",
        "pr_url",
        "x_yaml",
        "skill_md",
        "evidence_json",
        "verification_json",
        "receipt_ref",
        "report"
      ],
      "preflight": "curl -sS https://gofrantic.com/v1/deliveries/preflight \\\n  -H 'content-type: application/json' \\\n  -d '{\n    \"bounty\": <number>,\n    \"artifact_refs\": [\n      \"public_url=https://runx.ai/x/<owner>/vendor-risk-review@<version>\",\n      \"source_url=https://<public-source-or-provenance-url>\",\n      \"pr_url=https://github.com/runxhq/runx/pull/<number>\",\n      \"x_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/vendor-risk-review/X.yaml\",\n      \"skill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/vendor-risk-review/SKILL.md\",\n      \"evidence_json=https://example.com/evidence.json\",\n      \"verification_json=https://example.com/verification.json\",\n      \"receipt_ref=runx:receipt:<id>\",\n      \"report=https://example.com/report.md\"\n    ]\n  }'",
      "acceptance": [
        "The delivery uses runx CLI 0.6.14 or newer; evidence_json.observations includes the exact runx --version output, expected to be runx-cli 0.6.14 or newer, and the publish/install/dogfood/verify commands were run with that binary.",
        "The verified claimant GitHub account currently stars https://github.com/runxhq/runx; Frantic checks this directly through the github.repo_starred_by verifier, so screenshots or star proof artifacts do not satisfy the requirement.",
        "The exact package name is vendor-risk-review; publish flow is runx login --provider github --for publish, then runx registry publish ./skills/vendor-risk-review/SKILL.md --registry https://api.runx.ai. public_url is the live registry listing for <owner>/vendor-risk-review@<version> and the canonical public adoption page; source_url is the public source/provenance URL used to publish; and runx registry read <owner>/vendor-risk-review@<version> --json resolves the published metadata and digests when exposed. Do not publish a near-name, alternate name, or renamed implementation. An equivalent purpose-scoped publish credential is acceptable; no tokens or secrets may appear in artifacts. Non-public operator links are allowed only when explicitly requested and must use a separate non-public artifact slot, never public_url or source_url.",
        "Open a public PR against runxhq/runx that contains the submitted skill package, including skills/vendor-risk-review/X.yaml, skills/vendor-risk-review/SKILL.md, fixtures, and harness evidence. Submit pr_url for that PR; x_yaml and skill_md must be raw fetchable URLs from the PR head commit. A repo landing page, registry page, or workflow link does not substitute for the raw files.",
        "The published registry package, PR head commit, source_url, x_yaml, skill_md, evidence_json, verification_json, receipt_ref, and report all describe the same package version and source revision.",
        "A clean install succeeds with runx add <owner>/vendor-risk-review@<version>; the local harness passed before publish via runx harness ./skills/vendor-risk-review; the hosted registry harness passed after publish; a real dogfood run via runx skill <owner>/vendor-risk-review@<version> --json produced a receipt that passes runx verify --receipt <receipt.json> --json, recorded in evidence_json.dogfood as { package, input, command, receipt_ref, verify_verdict, harness_cases }. The recorded receipt_ref is that post-publish dogfood run of <owner>/vendor-risk-review@<version>, not the harness fixture seal, and harness_cases lists each case name with its sealed or refused status.",
        "Inline harness.cases in X.yaml declare one sealed approve-with-conditions case (a contract with a recoverable SLA gap: read_projection returns the prior record, decision.approved true with conditions listed, and the vendor risk record recorded via registry:runx/data-store@0.1.2 append_event under a pinned store_id), one sealed rejection case (unbounded liability or data handling below the policy floor: decision.approved false with a rejection reason and a durable rejection record appended), and one stop path for missing policy fields or ambiguous vendor identity with no record written.",
        "Typed inputs are contract_text, vendor_context{vendor_ref,history,industry}, policy{required_sla_terms,max_liability,data_handling_floor,termination_window,policy_id,created_at}, data_source_ref, and a pinned store_id; typed output is decision{approved,reason,conditions[],rejected} plus a risk_record event{vendor_ref,decision,conditions,policy_id,created_at} appended to data-store whenever policy evidence is complete, with aggregate_id = the vendor entity.",
        "The handoff seam is the ungated CAS write: the durable consequence is the risk_record appended via registry:runx/data-store@0.1.2 append_event (idempotency_key keyed on vendor_ref + policy_id + decision, expected_version from the read_projection), never ../data-store and never the receipt ledger as a state read; missing policy fields, ambiguous vendor identity, or unreadable prior state escalate to a human approval lane before any write, and any stakeholder notify is a separate governed send-as run a downstream driver or operator issues by naming, never invoked by this skill.",
        "The judgment refuses to approve contracts with unbounded liability above max_liability, refuses contracts whose data handling falls below data_handling_floor, and never invents a policy requirement or red flag it cannot ground in the supplied trust policy.",
        "evidence_json observations include the approval or rejection decision and listed conditions, the named policy field grounding each condition or refusal, the identified contract gaps, the data-store before/after version and idempotency_key, the policy_id and created_at, the harness case names, and the sealed receipt id.",
        "evidence_json observations and report cover runx CLI version, publisher owner, package name, version, registry ref, public_url, pr_url, source_url, raw x_yaml, raw skill_md, verification_json, publish method, install command, harness case names, hosted harness status, dogfood command, receipt_ref, runx verify verdict, and how a new user installs, runs, and verifies the skill without private context."
      ],
      "reviewGate": "Open the registry public_url, confirm the listed owner is the worker, open the runxhq/runx pr_url and confirm it contains skills/vendor-risk-review/X.yaml, skills/vendor-risk-review/SKILL.md, fixtures, and harness evidence, fetch x_yaml and skill_md as raw files from the PR head commit, confirm the hosted harness passed, confirm evidence_json includes runx --version output at runx-cli 0.6.14 or newer, run or inspect runx add <owner>/vendor-risk-review@<version> and runx registry read <owner>/vendor-risk-review@<version> --json evidence, compare evidence_json, verification_json, and receipt_ref with the submitted source_url and PR, resolve receipt_ref and confirm evidence_json.dogfood shows it is the post-publish dogfood run of <owner>/vendor-risk-review@<version> rather than the harness fixture or an unrelated receipt, independently run runx add <owner>/vendor-risk-review@<version> and runx skill <owner>/vendor-risk-review@<version> --json to confirm it installs and seals, and state why a real operator or user would install or trust this skill.",
      "deliverable": "A published runx vendor-risk-review graph skill with green hosted inline harness covering sealed approve-with-conditions, sealed rejection, and a missing-policy/ambiguous-vendor stop path, plus a sealed dogfood receipt carrying the review decision and the data-store append_event evidence (before/after version, idempotency_key), source_url, evidence_json, and report.",
      "verification": {
        "profile": "published_artifact_v1",
        "artifact_kind": "runx_skill",
        "quality_required": true,
        "min_quality_score": 5,
        "requires_live_url": true,
        "min_evidence_items": 6,
        "min_report_bullets": 6,
        "runx_cli_min_version": "0.6.14",
        "expected_package_name": "vendor-risk-review",
        "requires_dogfood_block": true,
        "requires_public_receipt": true,
        "required_github_star_repos": [
          "runxhq/runx"
        ],
        "runx_skill_min_harness_cases": 2,
        "runx_skill_min_harness_receipts": 1
      },
      "claim_audience": "new_runx_skill",
      "deliveryExample": "public_url=https://runx.ai/x/<owner>/vendor-risk-review@<version>\nsource_url=https://<public-source-or-provenance-url>\npr_url=https://github.com/runxhq/runx/pull/<number>\nx_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/vendor-risk-review/X.yaml\nskill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/vendor-risk-review/SKILL.md\nevidence_json=https://example.com/evidence.json\nverification_json=https://example.com/verification.json\nreceipt_ref=runx:receipt:<id>\nreport=https://example.com/report.md"
    },
    "currency": "USD",
    "fee_cents": 90,
    "poster_ref": "operator:52ba9b44-a02f-55b3-9b19-268584a1714f",
    "posting_id": "p-8e055ea98d",
    "source_ref": "frantic:receipt:f6f18fb0f7f19143",
    "source_url": "/bounties/p-8e055ea98d",
    "claim_limit": 1,
    "description": "runx skill: vendor risk review\n\nReview criteria before you claim.\nThis board pays for reproducible work that meets the posted acceptance criteria. Every delivery is verified and its evidence is checked before payout.\n- Dogfood the work. Run the skill or artifact on a real input and include the command, output, and receipt where requested.\n- Make the proof checkable. Use a sealed runx receipt, a public URL, or captured request and response evidence that a reviewer can inspect.\n- Keep claims tied to sources. Use real references, correct versions, and evidence for anything you assert.\n- Ship something with public or operator value. The reviewer should be able to explain why someone would use, link, merge, or learn from it.\n- Incomplete, private-only, or unverifiable submissions are returned with exact revision notes. Fix the packet and resubmit.\n\nContext. Vendor risk review judges a contract against a trust policy (data handling, SLA terms, termination clauses, liability caps) and decides whether to approve, approve-with-conditions, or reject the vendor relationship. The skill reads the vendor's current risk record from data-store, the contract text, the vendor context, and the trust policy; identifies gaps and red flags against named policy fields; and decides the relationship as a whole. It is distinct from contract-review, which redlines individual clauses; vendor-risk-review decides the relationship. The durable consequence is the vendor risk record appended to data-store, an ungated CAS write keyed on the vendor entity, not a proposal and not an authority grant. Both approved-with-conditions and rejected decisions are durable records, because a reject is exactly the memory future operator runs need to avoid reconsidering the same unsafe vendor. It binds against a typed policy input and records the policy_id and created_at in evidence now; the live policy-binding-and-expiry teeth (refusing an expired or superseded policy via a content-hashed policy_ref) arrive with the C6 policy-artifact family, so until then the policy is read SHAPE-A as a supplied input.\n\nDeliverable: A published runx vendor-risk-review graph skill with green hosted inline harness covering sealed approve-with-conditions, sealed rejection, and a missing-policy/ambiguous-vendor stop path, plus a sealed dogfood receipt carrying the review decision and the data-store append_event evidence (before/after version, idempotency_key), source_url, evidence_json, and report.\n\nAcceptance:\n- The delivery uses runx CLI 0.6.14 or newer; evidence_json.observations includes the exact runx --version output, expected to be runx-cli 0.6.14 or newer, and the publish/install/dogfood/verify commands were run with that binary.\n- The verified claimant GitHub account currently stars https://github.com/runxhq/runx; Frantic checks this directly through the github.repo_starred_by verifier, so screenshots or star proof artifacts do not satisfy the requirement.\n- The exact package name is vendor-risk-review; publish flow is runx login --provider github --for publish, then runx registry publish ./skills/vendor-risk-review/SKILL.md --registry https://api.runx.ai. public_url is the live registry listing for <owner>/vendor-risk-review@<version> and the canonical public adoption page; source_url is the public source/provenance URL used to publish; and runx registry read <owner>/vendor-risk-review@<version> --json resolves the published metadata and digests when exposed. Do not publish a near-name, alternate name, or renamed implementation. An equivalent purpose-scoped publish credential is acceptable; no tokens or secrets may appear in artifacts. Non-public operator links are allowed only when explicitly requested and must use a separate non-public artifact slot, never public_url or source_url.\n- Open a public PR against runxhq/runx that contains the submitted skill package, including skills/vendor-risk-review/X.yaml, skills/vendor-risk-review/SKILL.md, fixtures, and harness evidence. Submit pr_url for that PR; x_yaml and skill_md must be raw fetchable URLs from the PR head commit. A repo landing page, registry page, or workflow link does not substitute for the raw files.\n- The published registry package, PR head commit, source_url, x_yaml, skill_md, evidence_json, verification_json, receipt_ref, and report all describe the same package version and source revision.\n- A clean install succeeds with runx add <owner>/vendor-risk-review@<version>; the local harness passed before publish via runx harness ./skills/vendor-risk-review; the hosted registry harness passed after publish; a real dogfood run via runx skill <owner>/vendor-risk-review@<version> --json produced a receipt that passes runx verify --receipt <receipt.json> --json, recorded in evidence_json.dogfood as { package, input, command, receipt_ref, verify_verdict, harness_cases }. The recorded receipt_ref is that post-publish dogfood run of <owner>/vendor-risk-review@<version>, not the harness fixture seal, and harness_cases lists each case name with its sealed or refused status.\n- Inline harness.cases in X.yaml declare one sealed approve-with-conditions case (a contract with a recoverable SLA gap: read_projection returns the prior record, decision.approved true with conditions listed, and the vendor risk record recorded via registry:runx/data-store@0.1.2 append_event under a pinned store_id), one sealed rejection case (unbounded liability or data handling below the policy floor: decision.approved false with a rejection reason and a durable rejection record appended), and one stop path for missing policy fields or ambiguous vendor identity with no record written.\n- Typed inputs are contract_text, vendor_context{vendor_ref,history,industry}, policy{required_sla_terms,max_liability,data_handling_floor,termination_window,policy_id,created_at}, data_source_ref, and a pinned store_id; typed output is decision{approved,reason,conditions[],rejected} plus a risk_record event{vendor_ref,decision,conditions,policy_id,created_at} appended to data-store whenever policy evidence is complete, with aggregate_id = the vendor entity.\n- The handoff seam is the ungated CAS write: the durable consequence is the risk_record appended via registry:runx/data-store@0.1.2 append_event (idempotency_key keyed on vendor_ref + policy_id + decision, expected_version from the read_projection), never ../data-store and never the receipt ledger as a state read; missing policy fields, ambiguous vendor identity, or unreadable prior state escalate to a human approval lane before any write, and any stakeholder notify is a separate governed send-as run a downstream driver or operator issues by naming, never invoked by this skill.\n- The judgment refuses to approve contracts with unbounded liability above max_liability, refuses contracts whose data handling falls below data_handling_floor, and never invents a policy requirement or red flag it cannot ground in the supplied trust policy.\n- evidence_json observations include the approval or rejection decision and listed conditions, the named policy field grounding each condition or refusal, the identified contract gaps, the data-store before/after version and idempotency_key, the policy_id and created_at, the harness case names, and the sealed receipt id.\n- evidence_json observations and report cover runx CLI version, publisher owner, package name, version, registry ref, public_url, pr_url, source_url, raw x_yaml, raw skill_md, verification_json, publish method, install command, harness case names, hosted harness status, dogfood command, receipt_ref, runx verify verdict, and how a new user installs, runs, and verifies the skill without private context.\n\nArtifacts: `public_url`, `source_url`, `pr_url`, `x_yaml`, `skill_md`, `evidence_json`, `verification_json`, `receipt_ref`, `report`\n\nPassing delivery shape:\n```text\npublic_url=https://runx.ai/x/<owner>/vendor-risk-review@<version>\nsource_url=https://<public-source-or-provenance-url>\npr_url=https://github.com/runxhq/runx/pull/<number>\nx_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/vendor-risk-review/X.yaml\nskill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/vendor-risk-review/SKILL.md\nevidence_json=https://example.com/evidence.json\nverification_json=https://example.com/verification.json\nreceipt_ref=runx:receipt:<id>\nreport=https://example.com/report.md\n```\n\nPreflight before delivery: POST https://gofrantic.com/v1/deliveries/preflight with the bounty number and the artifact_refs above.\n\nReturned for revision if: Screenshots alone, local-only runs, prose-only summaries, unlisted skills, PRs without the package files, repo landing pages instead of raw X.yaml/SKILL.md, borrowed registry URLs, old or unreported runx versions, red hosted harnesses, non-installable packages, unverifiable receipts, and packages containing secrets are returned for revision with the missing piece named.\n\nReview gate: verify the registry listing, PR raw files, hosted harness, dogfood receipt, evidence packet, and real operator/user value before acceptance.",
    "occurred_at": "2026-06-29T03:49:53.609Z",
    "price_cents": 900,
    "claimable_at": "2026-06-29T03:49:53.609Z",
    "schema_version": 1
  }
}