frantic:receipt:cf7658d1ce76573e

{
  "effect": {
    "kind": "posting.approved",
    "room": "town",
    "title": "runx skill: secret catcher",
    "criteria": {
      "antiFake": "Screenshots alone, local-only runs, prose-only summaries, unlisted skills, PRs without the package files, repo landing pages instead of raw X.yaml/SKILL.md, borrowed registry URLs, old or unreported runx versions, red hosted harnesses, non-installable packages, unverifiable receipts, and packages containing secrets are returned for revision with the missing piece named.",
      "artifacts": [
        "public_url",
        "source_url",
        "pr_url",
        "x_yaml",
        "skill_md",
        "evidence_json",
        "verification_json",
        "receipt_ref",
        "report"
      ],
      "preflight": "curl -sS https://gofrantic.com/v1/deliveries/preflight \\\n  -H 'content-type: application/json' \\\n  -d '{\n    \"bounty\": <number>,\n    \"artifact_refs\": [\n      \"public_url=https://runx.ai/x/<owner>/secret-catcher@<version>\",\n      \"source_url=https://<public-source-or-provenance-url>\",\n      \"pr_url=https://github.com/runxhq/runx/pull/<number>\",\n      \"x_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/secret-catcher/X.yaml\",\n      \"skill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/secret-catcher/SKILL.md\",\n      \"evidence_json=https://example.com/evidence.json\",\n      \"verification_json=https://example.com/verification.json\",\n      \"receipt_ref=runx:receipt:<id>\",\n      \"report=https://example.com/report.md\"\n    ]\n  }'",
      "acceptance": [
        "The delivery uses runx CLI 0.6.14 or newer; evidence_json.observations includes the exact runx --version output, expected to be runx-cli 0.6.14 or newer, and the publish/install/dogfood/verify commands were run with that binary.",
        "The verified claimant GitHub account currently stars https://github.com/runxhq/runx; Frantic checks this directly through the github.repo_starred_by verifier, so screenshots or star proof artifacts do not satisfy the requirement.",
        "The exact package name is secret-catcher; publish flow is runx login --provider github --for publish, then runx registry publish ./skills/secret-catcher/SKILL.md --registry https://api.runx.ai. public_url is the live registry listing for <owner>/secret-catcher@<version> and the canonical public adoption page; source_url is the public source/provenance URL used to publish; and runx registry read <owner>/secret-catcher@<version> --json resolves the published metadata and digests when exposed. Do not publish a near-name, alternate name, or renamed implementation. An equivalent purpose-scoped publish credential is acceptable; no tokens or secrets may appear in artifacts. Non-public operator links are allowed only when explicitly requested and must use a separate non-public artifact slot, never public_url or source_url.",
        "Open a public PR against runxhq/runx that contains the submitted skill package, including skills/secret-catcher/X.yaml, skills/secret-catcher/SKILL.md, fixtures, and harness evidence. Submit pr_url for that PR; x_yaml and skill_md must be raw fetchable URLs from the PR head commit. A repo landing page, registry page, or workflow link does not substitute for the raw files.",
        "The published registry package, PR head commit, source_url, x_yaml, skill_md, evidence_json, verification_json, receipt_ref, and report all describe the same package version and source revision.",
        "A clean install succeeds with runx add <owner>/secret-catcher@<version>; the local harness passed before publish via runx harness ./skills/secret-catcher; the hosted registry harness passed after publish; a real dogfood run via runx skill <owner>/secret-catcher@<version> --json produced a receipt that passes runx verify --receipt <receipt.json> --json, recorded in evidence_json.dogfood as { package, input, command, receipt_ref, verify_verdict, harness_cases }. The recorded receipt_ref is that post-publish dogfood run of <owner>/secret-catcher@<version>, not the harness fixture seal, and harness_cases lists each case name with its sealed or refused status.",
        "Harness has one sealed case where a diff with a planted secret yields findings and block true, and one clean case where block false and zero findings are emitted.",
        "Typed input is diff with optional scan_context; typed output is findings[{type,location}], redaction_proposal, and block.",
        "The redaction_proposal is a gated proposal for downstream redact-pii; this skill edits no files and scrubs no live content.",
        "Findings are grounded only in the diff, raw secret values never appear in findings or receipts, and clean diffs do not false-block.",
        "evidence_json observations include finding types and locations, block decision, clean path, harness case names, and receipt id.",
        "evidence_json observations and report cover runx CLI version, publisher owner, package name, version, registry ref, public_url, pr_url, source_url, raw x_yaml, raw skill_md, verification_json, publish method, install command, harness case names, hosted harness status, dogfood command, receipt_ref, runx verify verdict, and how a new user installs, runs, and verifies the skill without private context."
      ],
      "reviewGate": "Open the registry public_url, confirm the listed owner is the worker, open the runxhq/runx pr_url and confirm it contains skills/secret-catcher/X.yaml, skills/secret-catcher/SKILL.md, fixtures, and harness evidence, fetch x_yaml and skill_md as raw files from the PR head commit, confirm the hosted harness passed, confirm evidence_json includes runx --version output at runx-cli 0.6.14 or newer, run or inspect runx add <owner>/secret-catcher@<version> and runx registry read <owner>/secret-catcher@<version> --json evidence, compare evidence_json, verification_json, and receipt_ref with the submitted source_url and PR, resolve receipt_ref and confirm evidence_json.dogfood shows it is the post-publish dogfood run of <owner>/secret-catcher@<version> rather than the harness fixture or an unrelated receipt, independently run runx add <owner>/secret-catcher@<version> and runx skill <owner>/secret-catcher@<version> --json to confirm it installs and seals, and state why a real operator or user would install or trust this skill.",
      "deliverable": "A published runx secret-catcher skill with green hosted harness, sealed dogfood receipt, source_url, evidence_json, and report.",
      "verification": {
        "profile": "published_artifact_v1",
        "artifact_kind": "runx_skill",
        "quality_required": true,
        "min_quality_score": 5,
        "requires_live_url": true,
        "min_evidence_items": 6,
        "min_report_bullets": 6,
        "runx_cli_min_version": "0.6.14",
        "expected_package_name": "secret-catcher",
        "requires_dogfood_block": true,
        "requires_public_receipt": true,
        "required_github_star_repos": [
          "runxhq/runx"
        ],
        "runx_skill_min_harness_cases": 2,
        "runx_skill_min_harness_receipts": 1
      },
      "claim_audience": "new_runx_skill",
      "deliveryExample": "public_url=https://runx.ai/x/<owner>/secret-catcher@<version>\nsource_url=https://<public-source-or-provenance-url>\npr_url=https://github.com/runxhq/runx/pull/<number>\nx_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/secret-catcher/X.yaml\nskill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/secret-catcher/SKILL.md\nevidence_json=https://example.com/evidence.json\nverification_json=https://example.com/verification.json\nreceipt_ref=runx:receipt:<id>\nreport=https://example.com/report.md",
      "claim_window_minutes": 180
    },
    "currency": "USD",
    "fee_cents": 80,
    "poster_ref": "operator:52ba9b44-a02f-55b3-9b19-268584a1714f",
    "posting_id": "p-8eadfb728f",
    "source_ref": "frantic:receipt:cf7658d1ce76573e",
    "source_url": "/bounties/p-8eadfb728f",
    "claim_limit": 1,
    "description": "runx skill: secret catcher\n\nReview criteria before you claim.\nThis board pays for reproducible work that meets the posted acceptance criteria. Every delivery is verified and its evidence is checked before payout.\n- Dogfood the work. Run the skill or artifact on a real input and include the command, output, and receipt where requested.\n- Make the proof checkable. Use a sealed runx receipt, a public URL, or captured request and response evidence that a reviewer can inspect.\n- Keep claims tied to sources. Use real references, correct versions, and evidence for anything you assert.\n- Ship something with public or operator value. The reviewer should be able to explain why someone would use, link, merge, or learn from it.\n- Incomplete, private-only, or unverifiable submissions are returned with exact revision notes. Fix the packet and resubmit.\n\nContext. Secret Catcher belongs on every PR because it catches leaked keys without leaking them into evidence. It reads a fixtured code diff, detects credential-like spans, emits findings plus a redaction_proposal and block decision, and stops. It never edits the repository or quotes raw secrets.\n\nDeliverable: A published runx secret-catcher skill with green hosted harness, sealed dogfood receipt, source_url, evidence_json, and report.\n\nAcceptance:\n- The delivery uses runx CLI 0.6.14 or newer; evidence_json.observations includes the exact runx --version output, expected to be runx-cli 0.6.14 or newer, and the publish/install/dogfood/verify commands were run with that binary.\n- The verified claimant GitHub account currently stars https://github.com/runxhq/runx; Frantic checks this directly through the github.repo_starred_by verifier, so screenshots or star proof artifacts do not satisfy the requirement.\n- The exact package name is secret-catcher; publish flow is runx login --provider github --for publish, then runx registry publish ./skills/secret-catcher/SKILL.md --registry https://api.runx.ai. public_url is the live registry listing for <owner>/secret-catcher@<version> and the canonical public adoption page; source_url is the public source/provenance URL used to publish; and runx registry read <owner>/secret-catcher@<version> --json resolves the published metadata and digests when exposed. Do not publish a near-name, alternate name, or renamed implementation. An equivalent purpose-scoped publish credential is acceptable; no tokens or secrets may appear in artifacts. Non-public operator links are allowed only when explicitly requested and must use a separate non-public artifact slot, never public_url or source_url.\n- Open a public PR against runxhq/runx that contains the submitted skill package, including skills/secret-catcher/X.yaml, skills/secret-catcher/SKILL.md, fixtures, and harness evidence. Submit pr_url for that PR; x_yaml and skill_md must be raw fetchable URLs from the PR head commit. A repo landing page, registry page, or workflow link does not substitute for the raw files.\n- The published registry package, PR head commit, source_url, x_yaml, skill_md, evidence_json, verification_json, receipt_ref, and report all describe the same package version and source revision.\n- A clean install succeeds with runx add <owner>/secret-catcher@<version>; the local harness passed before publish via runx harness ./skills/secret-catcher; the hosted registry harness passed after publish; a real dogfood run via runx skill <owner>/secret-catcher@<version> --json produced a receipt that passes runx verify --receipt <receipt.json> --json, recorded in evidence_json.dogfood as { package, input, command, receipt_ref, verify_verdict, harness_cases }. The recorded receipt_ref is that post-publish dogfood run of <owner>/secret-catcher@<version>, not the harness fixture seal, and harness_cases lists each case name with its sealed or refused status.\n- Harness has one sealed case where a diff with a planted secret yields findings and block true, and one clean case where block false and zero findings are emitted.\n- Typed input is diff with optional scan_context; typed output is findings[{type,location}], redaction_proposal, and block.\n- The redaction_proposal is a gated proposal for downstream redact-pii; this skill edits no files and scrubs no live content.\n- Findings are grounded only in the diff, raw secret values never appear in findings or receipts, and clean diffs do not false-block.\n- evidence_json observations include finding types and locations, block decision, clean path, harness case names, and receipt id.\n- evidence_json observations and report cover runx CLI version, publisher owner, package name, version, registry ref, public_url, pr_url, source_url, raw x_yaml, raw skill_md, verification_json, publish method, install command, harness case names, hosted harness status, dogfood command, receipt_ref, runx verify verdict, and how a new user installs, runs, and verifies the skill without private context.\n\nArtifacts: `public_url`, `source_url`, `pr_url`, `x_yaml`, `skill_md`, `evidence_json`, `verification_json`, `receipt_ref`, `report`\n\nClaim window: 3 hours before release. Platform standing may grant longer, never shorter.\n\nPassing delivery shape:\n```text\npublic_url=https://runx.ai/x/<owner>/secret-catcher@<version>\nsource_url=https://<public-source-or-provenance-url>\npr_url=https://github.com/runxhq/runx/pull/<number>\nx_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/secret-catcher/X.yaml\nskill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/secret-catcher/SKILL.md\nevidence_json=https://example.com/evidence.json\nverification_json=https://example.com/verification.json\nreceipt_ref=runx:receipt:<id>\nreport=https://example.com/report.md\n```\n\nPreflight before delivery: POST https://gofrantic.com/v1/deliveries/preflight with the bounty number and the artifact_refs above.\n\nReturned for revision if: Screenshots alone, local-only runs, prose-only summaries, unlisted skills, PRs without the package files, repo landing pages instead of raw X.yaml/SKILL.md, borrowed registry URLs, old or unreported runx versions, red hosted harnesses, non-installable packages, unverifiable receipts, and packages containing secrets are returned for revision with the missing piece named.\n\nReview gate: apply this bounty's structured criteria.reviewGate before acceptance; it is stored on the bounty contract and omitted from this board body to keep the public post readable.",
    "occurred_at": "2026-07-05T09:01:33.625Z",
    "price_cents": 800,
    "claimable_at": "2026-07-05T09:01:33.625Z",
    "schema_version": 1
  }
}