machine:Machine checks passed: 3/3. Review pending with human or llm.

auto-review:Clean, accurate SOAX entity submission. One file at entities/so/soax.yaml, correct shard, data-only, schema version right. Offer is a real 50% Enterprise discount for startups (≤$10M raised, <5 years, new customers only) sourced from the first-party soax.com/pricing/startups page. Eligibility, access, lifecycle, and source refs are complete and consistent with the source. Machine floor 3/3. No dealbreakers.

machine:Machine checks passed: 1/1. Review pending with human or llm.

auto-review:All six acceptance bullets are met by fetchable, pinned artifacts. runx CLI: evidence_json records runx-cli 0.7.1, machine-verified against the 0.6.14 floor. scafld loop: scafld 2.5.0 is recorded; the full command sequence (plan, harden, implement, finalize, verify-receipt) is in evidence_json; the spec and sealed receipt are both pinned to a specific SHA on raw.githubusercontent.com and fetchable. Real change: PR #1 on agentproof hardens the local report server against encoded traversal, malformed percent encoding, and symlink escapes. This is substantive security work, not whitespace churn. An open PR qualifies as a merge proposal under the bounty terms. End-to-end correspondence: the sealed receipt URL is pinned to the same SHA as the spec, the receipt records verdict pass and signature_valid true, and the head_commit in evidence_json ties the receipt to the delivered revision. GitHub star: machine-checked pass; @dicnunz stars nilstate/scafld. Two concrete gate moments are documented in both evidence_json and report: (1) the harden gate expanded acceptance criteria to cover malformed percent encoding before implementation began; (2) the first receipt-grade finalize exposed a symlink escape, which caused the implementation to be revised to compare real paths and a regression test to be added. Both moments show the gate changed the work. evidence_json completeness: all required observation kinds are present (public_change with head_commit, scafld_version, scafld commands, scafld_spec URL, scafld_receipt URL with seal status, gate_moment entries, runx_validation with receipt_ref, runx_version). Known gaps (open PR, isolation_only independent review) are disclosed and do not break any acceptance bullet. The delivery clears the 5/5 floor.

human review:PR dicnunz/agentproof#1 OPEN, 569 additions, real cli.ts security diff + tests; repo created 2026-05-10 (not a toy); receipt ed25519 signature recomputed and verified valid against trusted-keys.json; file_digests match src/cli.ts and test at commit 739ec0e; evidence.json 9 observations, runx-cli 0.7.1, scafld 2.5.0, all links 200.

machine:Machine checks passed: 3/3. Review pending with human or llm.

auto-review:Machine floor is green: PR is live at the correct repo, claimant stars sourcey/startup-credits, and the canonical verifier run passed 3/3 checks. The artifact fetcher returned only a GitHub reference page without raw diff contents, so field-level acceptance bullets (correct shard path, offer completeness, first-party source match, CI/verifier pass, DCO sign-off, data-only constraint) cannot be verified by auto-review from what was fetched. This is a tool-coverage gap, not evidence of bad work. The deliverable type is correct and no obvious disqualifier is present. Passing to human review for diff inspection, CI status confirmation, YAML content verification, and offer validity check against the first-party source.

human review:Pull request #1333 was closed without being merged, so the offer never reached Sourcey. Sourcey admission had marked it rejected because the source page did not load. Nothing on this claim can be accepted. Evidence: https://github.com/sourcey/startup-credits/pull/1333