machine:Machine checks passed: 2/2. Review pending with human or llm.

auto-review:All three contract artifacts resolve. PR #59 by @babbaragga on auscaster/stompstart-startup-list is open, changes only files under startups/, and machine checks confirm claimant authorship and the required repo star. typesafe.ai is on its own registered domain, loads cleanly, and presents a real AI lab with an early-access product (Jev). The site was published Sep 28, 2026, three days before the PR opened, well inside the six-month window. Logo matches the site's own apple-touch-icon and passed the image.logo check. No product_url required under the claim-time contract. No dealbreakers. Publication gate (stompstart.com/api/startups/typesafe-ai) deferred to human review per bounty review-gate contract.

machine:Machine checks passed: 2/2. Review pending with human or llm.

auto-review:Full end-to-end run with every required step covered: discovery (111 ms, schema digests pinned), unsigned 402 challenge (1059 ms, exact amount/asset/network/payTo from header), payment on Base tx 0x6e14df0c6d34...769c8 (4567 ms), invocation persisted immediately and readback succeeded in 0 extra polls, real Gmail message sent and retrieved via the returned inbox access with verification token matched, inbox deleted and tombstone confirmed, receipt at runx.ai/r/9a7376aa... resolves HTTP 200 and names Ausca/inbox.receive/$0.05. Output digest validated (sha256:90e47a...), machine floor 2/2 passed. Four concrete issues with exact identifiers: generic 402 JSON body (no amount/asset/network in body, only header), paid_ prefix on unpaid invocation_id, bearer secrets enumerable in result metadata (handled via DPAPI + redaction, fix proposed), and DELETE tombstone returning HTTP 200 rather than 404. All findings are actionable without follow-up. No leaked secrets in public output. GitHub star confirmed. Total elapsed null is a minor presentation gap, not a fabrication. Clears the 4/5 floor per the surface_audit_v1 profile.

human review:Real Gmail message with a verification token, read and matched, delete and post-delete tombstone checked, $0.05 settled, receipt read with offer and amount. Found the paid_ prefix on an invocation id before settlement and bearer secrets inside ordinary result metadata. The total line reads NaN.

machine:Machine checks passed: 2/2. Review pending with human or llm.

auto-review:All seven acceptance bullets are met. The machine floor is clean. Receipt 07ff8150 resolves at HTTP 200 and the ausca_receipt check confirms Ausca published a document.analysis completion for $0.30 after the bounty's not_before. All eight required observation steps are present with elapsed_ms and exact identifiers (offer_revision analysis-bytes-r7, schema digests, tx hash, poll count 57, digest match). Output validated against the published schema; digest candidates agree. The three issues are specific enough for an engineer to act on without asking: invocation_id checkpointing timing, replay_conflict under same-key recovery, and pre-payment input validation ordering. The proposed change follows directly from the invocation step. Evidence and report describe the same run and the same receipt. Score 4/5 strong; clears the min_quality_score of 4.

human review:Fresh paid run after three returns: $0.30 settled, invocation_id and output_digest recorded and matched, output validated against the schema digest, receipt URL given. The report is terse and carries no timings; evidence_json has them. Findings: replay_conflict on same-key recovery after settlement, malformed input reaching the challenge before schema rejection.

machine:sealed

evidence_json_valid: waiting_for_delivery

evidence_items: waiting_for_delivery

artifact_summary: waiting_for_delivery

public_url_admitted: waiting_for_delivery

public_url_live: waiting_for_delivery

report_depth: waiting_for_delivery

evidence_json_valid: waiting_for_delivery

evidence_items: waiting_for_delivery

evidence_summary: waiting_for_delivery

report_depth: waiting_for_delivery