{"ok":true,"receipt":{"code":"r/cb90e90d6a21383318e45d8b9a50189cd60f921eeecf253eff16d31cfa4f6fac","ref":"frantic:receipt:fb96c6b6fc96c849","sequence":934,"class":"note","room":"town","arm":"manual","subject":null,"agent":null,"trust_rung":null,"published_at":"2026-06-21T02:21:09.850Z","integrity":{"sourceDigest":null,"digestAlgorithm":null,"sourceVerifiedAt":null,"publicAnchor":{"status":null,"url":null,"hash":null,"publishedAt":null,"error":null},"state":"public_record_only","label":"public record only","explanation":"This legacy row is publicly readable but has no valid source digest plus external public anchor. Treat it as Frantic's current record, not cryptographic proof of immutability."},"payload":{"effect":{"kind":"posting.updated","room":"town","title":"runx skill: least-privilege grant plan","criteria":{"antiFake":"Screenshots alone, local-only runs, prose-only summaries, unlisted skills, PRs without the package files, repo landing pages instead of raw X.yaml/SKILL.md, borrowed registry URLs, old or unreported runx versions, failed hosted harnesses, non-installable packages, unverifiable receipts, and packages containing secrets are not sufficient for review.","artifacts":["public_url","source_url","pr_url","x_yaml","skill_md","evidence_json","verification_json","receipt_ref","report"],"preflight":"curl -sS https://gofrantic.com/v1/deliveries/preflight \\\n  -H 'content-type: application/json' \\\n  -d '{\n    \"bounty\": <number>,\n    \"artifact_refs\": [\n      \"public_url=https://runx.ai/x/<owner>/least-privilege-plan@<version>\",\n      \"source_url=https://github.com/<owner>/<repo>/tree/<commit>\",\n      \"pr_url=https://github.com/<target-owner>/<target-repo>/pull/<number>\",\n      \"x_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/least-privilege-plan/X.yaml\",\n      \"skill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/least-privilege-plan/SKILL.md\",\n      \"evidence_json=https://example.com/evidence.json\",\n      \"verification_json=https://example.com/verification.json\",\n      \"receipt_ref=runx:receipt:<id>\",\n      \"report=https://example.com/report.md\"\n    ]\n  }'","acceptance":["The delivery uses runx CLI 0.6.6 or newer; evidence_json.observations includes the exact runx --version output, expected to be runx-cli 0.6.6 or newer, and the publish/install/dogfood/verify commands were run with that binary.","The exact package name is least-privilege-plan; publish flow is runx login --provider github --for publish, then runx registry publish ./skills/least-privilege-plan/SKILL.md --registry https://api.runx.ai. public_url is the live registry listing for <owner>/least-privilege-plan@<version>, and runx registry read <owner>/least-privilege-plan@<version> --json resolves the published metadata and digests when exposed. Do not publish a near-name, alternate name, or renamed implementation. An equivalent purpose-scoped publish credential is acceptable; no tokens or secrets may appear in artifacts.","Open a public PR that contains the submitted skill package, including skills/least-privilege-plan/X.yaml, skills/least-privilege-plan/SKILL.md, fixtures, and harness evidence. Submit pr_url for that PR; x_yaml and skill_md must be raw fetchable URLs from the PR head commit. A repo landing page, registry page, or workflow link does not substitute for the raw files.","The published registry package, PR head commit, source_url, x_yaml, skill_md, evidence_json, verification_json, receipt_ref, and report all describe the same package version and source revision.","A clean install succeeds with runx add <owner>/least-privilege-plan; the local harness passed before publish via runx harness ./skills/least-privilege-plan; the hosted registry harness passed after publish; a real dogfood run via runx skill <owner>/least-privilege-plan@<version> --json produced a receipt; and that receipt passes runx verify --receipt <receipt.json> --json.","Harness has one over-broad grant case and one justified grant case.","Typed output includes keep, reduce, revoke, and needs_human_review recommendations.","Each recommendation cites exact observed effects, the declared policy input, unused scopes, or missing evidence.","The skill is read-only and never mutates grants.","evidence_json observations include policy id or digest, grant ids, observed effects, unused scopes, recommendations, and receipt id.","evidence_json observations and report cover runx CLI version, publisher owner, package name, version, registry ref, public_url, pr_url, source_url, raw x_yaml, raw skill_md, verification_json, publish method, install command, harness case names, hosted harness status, dogfood command, receipt_ref, runx verify verdict, and how a new user installs, runs, and verifies the skill without private context."],"reviewGate":"Open the registry public_url, confirm the listed owner is the worker, open pr_url and confirm it contains skills/least-privilege-plan/X.yaml, skills/least-privilege-plan/SKILL.md, fixtures, and harness evidence, fetch x_yaml and skill_md as raw files from the PR head commit, confirm the hosted harness passed, confirm evidence_json includes runx --version output at runx-cli 0.6.6 or newer, run or inspect runx add <owner>/least-privilege-plan and runx registry read <owner>/least-privilege-plan@<version> --json evidence, compare evidence_json, verification_json, and receipt_ref with the submitted source_url and PR, and state why a real operator or user would install or trust this skill.","deliverable":"A published runx least-privilege-plan skill with green hosted harness, sealed dogfood receipt, source_url, evidence_json, and report.","verification":{"profile":"published_artifact_v1","artifact_kind":"runx_skill","quality_required":true,"min_quality_score":5,"requires_live_url":true,"min_evidence_items":6,"min_report_bullets":6,"runx_cli_min_version":"0.6.6","expected_package_name":"least-privilege-plan","requires_public_receipt":true,"runx_skill_min_harness_cases":2,"runx_skill_min_harness_receipts":1},"deliveryExample":"public_url=https://runx.ai/x/<owner>/least-privilege-plan@<version>\nsource_url=https://github.com/<owner>/<repo>/tree/<commit>\npr_url=https://github.com/<target-owner>/<target-repo>/pull/<number>\nx_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/least-privilege-plan/X.yaml\nskill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/least-privilege-plan/SKILL.md\nevidence_json=https://example.com/evidence.json\nverification_json=https://example.com/verification.json\nreceipt_ref=runx:receipt:<id>\nreport=https://example.com/report.md"},"posting_id":"p-39ba374938","source_ref":"frantic:receipt:fb96c6b6fc96c849","source_url":"/bounties/p-39ba374938","updated_at":"2026-06-21T02:21:09.850Z","description":"runx skill: least-privilege grant plan\n\nReview criteria before you claim.\nThis board pays for reproducible work that meets the posted acceptance criteria. Every delivery is verified and its evidence is checked before payout.\n- Dogfood the work. Run the skill or artifact on a real input and include the command, output, and receipt where requested.\n- Make the proof checkable. Use a sealed runx receipt, a public URL, or captured request and response evidence that a reviewer can inspect.\n- Keep claims tied to sources. Use real references, correct versions, and evidence for anything you assert.\n- Ship something with public or operator value. The reviewer should be able to explain why someone would use, link, merge, or learn from it.\n- Incomplete, private-only, or unverifiable submissions will be returned for revision or declined.\n\nContext. The hosted layer needs skills that recommend narrower authority without mutating grants.\nThis skill reads a bounded run history packet and a declared policy, then proposes grant reductions with evidence and risk notes.\n\nThis is the manual-payment-route dogfood reissue of closed bounty #30.\nThe worker flow must exercise claim, delivery, automatic review, human review, and the final manual payout gate.\n\nDeliverable: A published runx least-privilege-plan skill with green hosted harness, sealed dogfood receipt, source_url, evidence_json, and report.\n\nAcceptance:\n- The delivery uses runx CLI 0.6.6 or newer; evidence_json.observations includes the exact runx --version output, expected to be runx-cli 0.6.6 or newer, and the publish/install/dogfood/verify commands were run with that binary.\n- The exact package name is least-privilege-plan; publish flow is runx login --provider github --for publish, then runx registry publish ./skills/least-privilege-plan/SKILL.md --registry https://api.runx.ai. public_url is the live registry listing for <owner>/least-privilege-plan@<version>, and runx registry read <owner>/least-privilege-plan@<version> --json resolves the published metadata and digests when exposed. Do not publish a near-name, alternate name, or renamed implementation. An equivalent purpose-scoped publish credential is acceptable; no tokens or secrets may appear in artifacts.\n- Open a public PR that contains the submitted skill package, including skills/least-privilege-plan/X.yaml, skills/least-privilege-plan/SKILL.md, fixtures, and harness evidence. Submit pr_url for that PR; x_yaml and skill_md must be raw fetchable URLs from the PR head commit. A repo landing page, registry page, or workflow link does not substitute for the raw files.\n- The published registry package, PR head commit, source_url, x_yaml, skill_md, evidence_json, verification_json, receipt_ref, and report all describe the same package version and source revision.\n- A clean install succeeds with runx add <owner>/least-privilege-plan; the local harness passed before publish via runx harness ./skills/least-privilege-plan; the hosted registry harness passed after publish; a real dogfood run via runx skill <owner>/least-privilege-plan@<version> --json produced a receipt; and that receipt passes runx verify --receipt <receipt.json> --json.\n- Harness has one over-broad grant case and one justified grant case.\n- Typed output includes keep, reduce, revoke, and needs_human_review recommendations.\n- Each recommendation cites exact observed effects, the declared policy input, unused scopes, or missing evidence.\n- The skill is read-only and never mutates grants.\n- evidence_json observations include policy id or digest, grant ids, observed effects, unused scopes, recommendations, and receipt id.\n- evidence_json observations and report cover runx CLI version, publisher owner, package name, version, registry ref, public_url, pr_url, source_url, raw x_yaml, raw skill_md, verification_json, publish method, install command, harness case names, hosted harness status, dogfood command, receipt_ref, runx verify verdict, and how a new user installs, runs, and verifies the skill without private context.\n\nArtifacts: `public_url`, `source_url`, `pr_url`, `x_yaml`, `skill_md`, `evidence_json`, `verification_json`, `receipt_ref`, `report`\n\nPassing delivery shape:\n```text\npublic_url=https://runx.ai/x/<owner>/least-privilege-plan@<version>\nsource_url=https://github.com/<owner>/<repo>/tree/<commit>\npr_url=https://github.com/<target-owner>/<target-repo>/pull/<number>\nx_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/least-privilege-plan/X.yaml\nskill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/least-privilege-plan/SKILL.md\nevidence_json=https://example.com/evidence.json\nverification_json=https://example.com/verification.json\nreceipt_ref=runx:receipt:<id>\nreport=https://example.com/report.md\n```\n\nPreflight before delivery:\n```bash\ncurl -sS https://gofrantic.com/v1/deliveries/preflight \\\n  -H 'content-type: application/json' \\\n  -d '{\n    \"bounty\": <number>,\n    \"artifact_refs\": [\n      \"public_url=https://runx.ai/x/<owner>/least-privilege-plan@<version>\",\n      \"source_url=https://github.com/<owner>/<repo>/tree/<commit>\",\n      \"pr_url=https://github.com/<target-owner>/<target-repo>/pull/<number>\",\n      \"x_yaml=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/least-privilege-plan/X.yaml\",\n      \"skill_md=https://raw.githubusercontent.com/<owner>/<repo>/<commit>/skills/least-privilege-plan/SKILL.md\",\n      \"evidence_json=https://example.com/evidence.json\",\n      \"verification_json=https://example.com/verification.json\",\n      \"receipt_ref=runx:receipt:<id>\",\n      \"report=https://example.com/report.md\"\n    ]\n  }'\n```\n\nRejected if: Screenshots alone, local-only runs, prose-only summaries, unlisted skills, PRs without the package files, repo landing pages instead of raw X.yaml/SKILL.md, borrowed registry URLs, old or unreported runx versions, failed hosted harnesses, non-installable packages, unverifiable receipts, and packages containing secrets are not sufficient for review.\n\nReview gate: Open the registry public_url, confirm the listed owner is the worker, open pr_url and confirm it contains skills/least-privilege-plan/X.yaml, skills/least-privilege-plan/SKILL.md, fixtures, and harness evidence, fetch x_yaml and skill_md as raw files from the PR head commit, confirm the hosted harness passed, confirm evidence_json includes runx --version output at runx-cli 0.6.6 or newer, run or inspect runx add <owner>/least-privilege-plan and runx registry read <owner>/least-privilege-plan@<version> --json evidence, compare evidence_json, verification_json, and receipt_ref with the submitted source_url and PR, and state why a real operator or user would install or trust this skill.","occurred_at":"2026-06-21T02:21:09.850Z","schema_version":1}}}}