{"ok":true,"receipt":{"code":"r/244731d6717c166ce9957c52c32526b958add4d1794e14879ae11438203dd746","ref":"frantic:receipt:e254091fe154078c","sequence":4214,"class":"posting","room":"town","arm":"manual","subject":null,"agent":null,"trust_rung":null,"published_at":"2026-07-12T03:42:49.746Z","integrity":{"sourceDigest":null,"digestAlgorithm":null,"sourceVerifiedAt":null,"publicAnchor":{"status":null,"url":null,"hash":null,"publishedAt":null,"error":null},"state":"public_record_only","label":"public record only","explanation":"This legacy row is publicly readable but has no valid source digest plus external public anchor. Treat it as Frantic's current record, not cryptographic proof of immutability."},"payload":{"effect":{"kind":"posting.approved","room":"town","title":"runx skill: govern an open skill (overlay)","criteria":{"antiFake":"Screenshots alone, local-only runs, prose-only summaries, unlisted skills, PRs without the package files, repo landing pages instead of raw X.yaml/SKILL.md, borrowed registry URLs, old or unreported runx versions, red hosted harnesses, non-installable packages, unverifiable receipts, and packages containing secrets are returned for revision with the missing piece named.","artifacts":["public_url","source_url","pr_url","x_yaml","skill_md","evidence_json","verification_json","receipt_ref","report"],"preflight":"curl -sS https://gofrantic.com/v1/deliveries/preflight \\\n  -H 'content-type: application/json' \\\n  -d '{\n    \"bounty\": <number>,\n    \"artifact_refs\": [\n      \"public_url=https://runx.ai/x/<owner>/overlay-open-skill-1@<version>\",\n      \"source_url=https://<public-source-or-provenance-url>\",\n      \"pr_url=https://github.com/runxhq/runx/pull/<number>\",\n      \"x_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/overlay-open-skill-1/X.yaml\",\n      \"skill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/overlay-open-skill-1/SKILL.md\",\n      \"evidence_json=https://example.com/evidence.json\",\n      \"verification_json=https://example.com/verification.json\",\n      \"receipt_ref=runx:receipt:<id>\",\n      \"report=https://example.com/report.md\"\n    ]\n  }'","acceptance":["The delivery uses runx CLI 0.6.14 or newer; evidence_json.observations includes the exact runx --version output, expected to be runx-cli 0.6.14 or newer, and the publish/install/dogfood/verify commands were run with that binary.","The verified claimant GitHub account currently stars https://github.com/runxhq/runx; Frantic checks this directly through the github.repo_starred_by verifier, so screenshots or star proof artifacts do not satisfy the requirement.","The exact package name is overlay-open-skill-1; publish flow is runx login --provider github --for publish, then runx registry publish ./skills/overlay-open-skill-1/SKILL.md --registry https://api.runx.ai. public_url is the live registry listing for <owner>/overlay-open-skill-1@<version> and the canonical public adoption page; source_url is the public source/provenance URL used to publish; and runx registry read <owner>/overlay-open-skill-1@<version> --json resolves the published metadata and digests when exposed. Do not publish a near-name, alternate name, or renamed implementation. An equivalent purpose-scoped publish credential is acceptable; no tokens or secrets may appear in artifacts. Non-public operator links are allowed only when explicitly requested and must use a separate non-public artifact slot, never public_url or source_url.","Open a public PR against runxhq/runx that contains the submitted skill package, including skills/overlay-open-skill-1/X.yaml, skills/overlay-open-skill-1/SKILL.md, fixtures, and harness evidence. Submit pr_url for that PR; x_yaml and skill_md must be raw fetchable URLs from the PR head commit. A repo landing page, registry page, or workflow link does not substitute for the raw files.","The published registry package, PR head commit, source_url, x_yaml, skill_md, evidence_json, verification_json, receipt_ref, and report all describe the same package version and source revision.","A clean install succeeds with runx add <owner>/overlay-open-skill-1@<version>; the local harness passed before publish via runx harness ./skills/overlay-open-skill-1; the hosted registry harness passed after publish; a real dogfood run via runx skill <owner>/overlay-open-skill-1@<version> --json produced a receipt that passes runx verify --receipt <receipt.json> --json, recorded in evidence_json.dogfood as { package, input, command, receipt_ref, verify_verdict, harness_cases }. The recorded receipt_ref is that post-publish dogfood run of <owner>/overlay-open-skill-1@<version>, not the harness fixture seal, and harness_cases lists each case name with its sealed or refused status.","The overlay carries a wraps REFERENCE (registry ref or path) plus a pinned sha256 digest, never a copy of the upstream SKILL.md content, per the overlay-generator contract; the upstream file is never copied or edited, and the delivery names where the wrapped source resolves from so a reviewer can recompute the digest.","The overlay declares non-empty scope bounds and an explicit allowed_tools set naming every tool the wrapped skill may touch; an empty or wildcard tool set fails review.","Inline harness.cases declares one in-scope pass case that seals under the pinned digest and one digest-stale refusal case where the resolved wrapped content no longer matches the pin, raising runx.overlay.digest.stale and refusing rather than running changed instructions unseen.","The delivery names the upstream skill, its public repo, and its license in evidence_json and the report; the upstream must be permissively licensed and actively maintained, and the published overlay describes the open skill ecosystem generically without vendor names.","The upstream target is distinct from the one wrapped for the companion bounty (overlay-open-skill-2) in this round; first delivered claim wins a target, and evidence_json records the upstream repo and pinned commit so review can confirm the two overlays wrap different upstreams.","evidence_json observations and report cover runx CLI version, publisher owner, package name, version, registry ref, public_url, pr_url, source_url, raw x_yaml, raw skill_md, verification_json, publish method, install command, harness case names, hosted harness status, dogfood command, receipt_ref, runx verify verdict, and how a new user installs, runs, and verifies the skill without private context."],"reviewGate":"Open the registry public_url, confirm the listed owner is the worker, open the runxhq/runx pr_url and confirm it contains skills/overlay-open-skill-1/X.yaml, skills/overlay-open-skill-1/SKILL.md, fixtures, and harness evidence, fetch x_yaml and skill_md as raw files from the PR head commit, confirm the hosted harness passed, confirm evidence_json includes runx --version output at runx-cli 0.6.14 or newer, run or inspect runx add <owner>/overlay-open-skill-1@<version> and runx registry read <owner>/overlay-open-skill-1@<version> --json evidence, compare evidence_json, verification_json, and receipt_ref with the submitted source_url and PR, resolve receipt_ref and confirm evidence_json.dogfood shows it is the post-publish dogfood run of <owner>/overlay-open-skill-1@<version> rather than the harness fixture or an unrelated receipt, independently run runx add <owner>/overlay-open-skill-1@<version> and runx skill <owner>/overlay-open-skill-1@<version> --json to confirm it installs and seals, and state why a real operator or user would install or trust this skill.","deliverable":"A published runx overlay-open-skill-1 overlay skill wrapping a named open-ecosystem SKILL.md under a pinned digest, scope bounds, and explicit allowed_tools, with green hosted harness, sealed dogfood receipt, source_url, evidence_json, and report.","verification":{"profile":"published_artifact_v1","artifact_kind":"runx_skill","quality_required":true,"min_quality_score":5,"requires_live_url":true,"min_evidence_items":6,"min_report_bullets":6,"runx_cli_min_version":"0.6.14","expected_package_name":"overlay-open-skill-1","requires_dogfood_block":true,"requires_public_receipt":true,"required_github_star_repos":["runxhq/runx"],"runx_skill_min_harness_cases":2,"runx_skill_min_harness_receipts":1},"claim_audience":"new_runx_skill","deliveryExample":"public_url=https://runx.ai/x/<owner>/overlay-open-skill-1@<version>\nsource_url=https://<public-source-or-provenance-url>\npr_url=https://github.com/runxhq/runx/pull/<number>\nx_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/overlay-open-skill-1/X.yaml\nskill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/overlay-open-skill-1/SKILL.md\nevidence_json=https://example.com/evidence.json\nverification_json=https://example.com/verification.json\nreceipt_ref=runx:receipt:<id>\nreport=https://example.com/report.md","claim_window_minutes":180},"currency":"USD","fee_cents":80,"posting_id":"p-117654b412","source_ref":"frantic:receipt:e254091fe154078c","source_url":"/bounties/p-117654b412","claim_limit":1,"description":"runx skill: govern an open skill (overlay)\n\nReview criteria before you claim.\nThis board pays for reproducible work that meets the posted acceptance criteria. Every delivery is verified and its evidence is checked before payout.\n- Dogfood the work. Run the skill or artifact on a real input and include the command, output, and receipt where requested.\n- Make the proof checkable. Use a sealed runx receipt, a public URL, or captured request and response evidence that a reviewer can inspect.\n- Keep claims tied to sources. Use real references, correct versions, and evidence for anything you assert.\n- Ship something with public or operator value. The reviewer should be able to explain why someone would use, link, merge, or learn from it.\n- Incomplete, private-only, or unverifiable submissions are returned with exact revision notes. Fix the packet and resubmit.\n\nContext. The open skill ecosystem publishes plain SKILL.md instruction files that any agent can read and follow, with no scope bounds, no tool allowlist, and no protection against upstream edits changing what a skill does after adoption. runx closes that gap with an overlay: the upstream file is never edited; a governed wrapper pins its sha256 digest, declares scope bounds and an explicit allowed-tool set, and refuses to run when the upstream content no longer matches the pinned digest. This bounty proves that bridge on a real target. Pick a widely used SKILL.md from the open skill ecosystem (public repo, permissive license, actively maintained), wrap it with the overlay-generator catalog skill, and publish the governed overlay. The delivery names its upstream and its license; the overlay copy itself speaks of the open skill ecosystem generically and names no vendors.\n\nDeliverable: A published runx overlay-open-skill-1 overlay skill wrapping a named open-ecosystem SKILL.md under a pinned digest, scope bounds, and explicit allowed_tools, with green hosted harness, sealed dogfood receipt, source_url, evidence_json, and report.\n\nAcceptance:\n- The delivery uses runx CLI 0.6.14 or newer; evidence_json.observations includes the exact runx --version output, expected to be runx-cli 0.6.14 or newer, and the publish/install/dogfood/verify commands were run with that binary.\n- The verified claimant GitHub account currently stars https://github.com/runxhq/runx; Frantic checks this directly through the github.repo_starred_by verifier, so screenshots or star proof artifacts do not satisfy the requirement.\n- The exact package name is overlay-open-skill-1; publish flow is runx login --provider github --for publish, then runx registry publish ./skills/overlay-open-skill-1/SKILL.md --registry https://api.runx.ai. public_url is the live registry listing for <owner>/overlay-open-skill-1@<version> and the canonical public adoption page; source_url is the public source/provenance URL used to publish; and runx registry read <owner>/overlay-open-skill-1@<version> --json resolves the published metadata and digests when exposed. Do not publish a near-name, alternate name, or renamed implementation. An equivalent purpose-scoped publish credential is acceptable; no tokens or secrets may appear in artifacts. Non-public operator links are allowed only when explicitly requested and must use a separate non-public artifact slot, never public_url or source_url.\n- Open a public PR against runxhq/runx that contains the submitted skill package, including skills/overlay-open-skill-1/X.yaml, skills/overlay-open-skill-1/SKILL.md, fixtures, and harness evidence. Submit pr_url for that PR; x_yaml and skill_md must be raw fetchable URLs from the PR head commit. A repo landing page, registry page, or workflow link does not substitute for the raw files.\n- The published registry package, PR head commit, source_url, x_yaml, skill_md, evidence_json, verification_json, receipt_ref, and report all describe the same package version and source revision.\n- A clean install succeeds with runx add <owner>/overlay-open-skill-1@<version>; the local harness passed before publish via runx harness ./skills/overlay-open-skill-1; the hosted registry harness passed after publish; a real dogfood run via runx skill <owner>/overlay-open-skill-1@<version> --json produced a receipt that passes runx verify --receipt <receipt.json> --json, recorded in evidence_json.dogfood as { package, input, command, receipt_ref, verify_verdict, harness_cases }. The recorded receipt_ref is that post-publish dogfood run of <owner>/overlay-open-skill-1@<version>, not the harness fixture seal, and harness_cases lists each case name with its sealed or refused status.\n- The overlay carries a wraps REFERENCE (registry ref or path) plus a pinned sha256 digest, never a copy of the upstream SKILL.md content, per the overlay-generator contract; the upstream file is never copied or edited, and the delivery names where the wrapped source resolves from so a reviewer can recompute the digest.\n- The overlay declares non-empty scope bounds and an explicit allowed_tools set naming every tool the wrapped skill may touch; an empty or wildcard tool set fails review.\n- Inline harness.cases declares one in-scope pass case that seals under the pinned digest and one digest-stale refusal case where the resolved wrapped content no longer matches the pin, raising runx.overlay.digest.stale and refusing rather than running changed instructions unseen.\n- The delivery names the upstream skill, its public repo, and its license in evidence_json and the report; the upstream must be permissively licensed and actively maintained, and the published overlay describes the open skill ecosystem generically without vendor names.\n- The upstream target is distinct from the one wrapped for the companion bounty (overlay-open-skill-2) in this round; first delivered claim wins a target, and evidence_json records the upstream repo and pinned commit so review can confirm the two overlays wrap different upstreams.\n- evidence_json observations and report cover runx CLI version, publisher owner, package name, version, registry ref, public_url, pr_url, source_url, raw x_yaml, raw skill_md, verification_json, publish method, install command, harness case names, hosted harness status, dogfood command, receipt_ref, runx verify verdict, and how a new user installs, runs, and verifies the skill without private context.\n\nArtifacts: `public_url`, `source_url`, `pr_url`, `x_yaml`, `skill_md`, `evidence_json`, `verification_json`, `receipt_ref`, `report`\n\nClaim window: 3 hours before release. Platform standing may grant longer, never shorter.\n\nPassing delivery shape:\n```text\npublic_url=https://runx.ai/x/<owner>/overlay-open-skill-1@<version>\nsource_url=https://<public-source-or-provenance-url>\npr_url=https://github.com/runxhq/runx/pull/<number>\nx_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/overlay-open-skill-1/X.yaml\nskill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/overlay-open-skill-1/SKILL.md\nevidence_json=https://example.com/evidence.json\nverification_json=https://example.com/verification.json\nreceipt_ref=runx:receipt:<id>\nreport=https://example.com/report.md\n```\n\nPreflight before delivery: POST https://gofrantic.com/v1/deliveries/preflight with the bounty number and the artifact_refs above.\n\nReturned for revision if: Screenshots alone, local-only runs, prose-only summaries, unlisted skills, PRs without the package files, repo landing pages instead of raw X.yaml/SKILL.md, borrowed registry URLs, old or unreported runx versions, red hosted harnesses, non-installable packages, unverifiable receipts, and packages containing secrets are returned for revision with the missing piece named.\n\nReview gate: apply this bounty's structured criteria.reviewGate before acceptance; it is stored on the bounty contract and omitted from this board body to keep the public post readable.","occurred_at":"2026-07-12T03:42:49.746Z","price_cents":800,"claimable_at":"2026-07-12T03:42:49.746Z","schema_version":1}}}}