MRWK bounty: review open MergeWork PRs with evidence, round 13

[ramimbo]

MRWK Bounty

Reward: 40 MRWK per accepted award
Max awards: 30

Round 12 is #447. This round covers distinct useful PR reviews after #447 fills.

Work Needed

Review open MergeWork PRs with specific evidence. Focus on duplicates, overlap, mergeability, failing checks, stale bounty references, security/public-copy risks, and whether the change is actually useful.

Accepted review claims must:

• Be by someone other than the PR author.
• Link a GitHub PR review or concise PR comment.
• Include concrete evidence: files inspected, behavior checked, commands run, CI status reviewed, or an actionable finding.
• Be distinct from already paid review claims.

Duplicate, vague, self-review, rubber-stamp, misleading, or superseded duplicate reviews do not qualify.

How To Submit

Comment here with /claim and the PR review or PR-comment URL. Keep the claim short and evidence-backed.

[ramimbo]

Reserved on MergeWork: https://mrwk.ltclab.site/bounties/78

[eliasx45]

/claim #550 (review)

Reviewed PR #550 current head 69078f19fdf5b3a4d4c8cb38d4ebfd2cb14aa053 as non-author @eliasx45 after the retarget to governance-mvp-proposals. Verdict: no blocker found in the treasury proposal execution/revalidation slice.

Evidence: inspected the changed treasury execution/error-mapping surfaces, verified prior 409 conflict semantics fixes, ran focused treasury/migration tests (23 passed), exact prior failing tests (2 passed), ruff check/format, docs smoke, git diff --check, and confirmed hosted CodeRabbit + Quality/readiness checks are green. Scope note included in review.

[eliasx45]

/claim #558 (review)

Reviewed PR #558 current head 88f94f80e9a1706536ca568fd2504f236dc2d7f2 as non-author @eliasx45. Verdict: no blocker found after the docs-smoke required-field follow-up.

Evidence: inspected the issue template, bounty rules/admin runbook docs, docs-smoke helper, and focused regression. Verified evidence, out_of_scope, and duplicate_stale_rules are individually required; ran docs smoke, focused docs/check-agent tests (26 passed), ruff check/format, git diff --check, and confirmed hosted CodeRabbit + Quality/readiness checks pass. Scope note included in review.

[eliasx45]

/claim #555 (review)

Reviewed PR #555 current head 582ebde3be56b6511005b3d48b8a0a362b2e1a10 as non-author @eliasx45 after the shared bounty-reference parser and direct-entrypoint follow-ups. Verdict: no blocker found.

Evidence: confirmed the earlier direct-script ModuleNotFoundError blocker is fixed for both scripts/pr_queue_health.py --help and scripts/submission_quality_gate.py --help; checked accepted GitHub linking verbs and malformed suffix boundaries; ran focused parser/entrypoint regressions (10 passed), script suites (42 passed), full pytest (424 passed), ruff check/format, mypy, docs smoke, git diff --check, and confirmed hosted Quality/readiness + CodeRabbit are green.

[eliasx45]

/claim #551 (review)

Reviewed PR #551 current head c0e893726fa917b70768f40b593eb19ada50aa83 as non-author @eliasx45 after the recursive/self-referential metadata follow-up. Verdict: no blocker found.

Evidence: inspected app/ledger/service.py and tests/test_security.py; confirmed nested verifier-result strings, list elements, and object keys with control characters are rejected before proof/submission persistence; confirmed the new recursive/self-reference follow-up converts recursion into a bounded LedgerError; confirmed safe nested metadata remains preserved. Ran focused metadata tests (5 passed), security+ledger suites (75 passed), full pytest (419 passed), ruff check/format, mypy, docs smoke, git diff --check, and confirmed hosted Quality/readiness + CodeRabbit are green.

[eliasx45]

/claim #561 (review)

Reviewed current head 55f35ee9eaf4634879ee221919e1dd5faae6c819 for the browser/server wallet JSON canonicalization change.

Validation summary:

• Focused wallet canonicalization/API tests: 3 passed
• Full tests/test_wallet_api.py: 33 passed
• Wallet + ledger slice: 55 passed
• Full suite: 415 passed
• node --check app\static\wallet.js
• ruff check / ruff format --check on Python test changes
• mypy app\wallets.py app\ledger\service.py
• docs smoke ok

[akmhatey-ai]

/claim #566 (comment)

Reviewed PR #566 current head 16e68b00332249fbda6b159c798b24c64775feea as non-author after the previous held syntax-error head was updated.

Verdict: current branch is not useful/mergeable as a bounty fix because it is now an empty diff while the PR body still says Closes #406.

Evidence:

• gh pr view 566 --repo ramimbo/mergework --json files returned an empty files array.
• gh pr diff 566 --repo ramimbo/mergework --name-only returned no output.
• Hosted Quality/readiness and CodeRabbit are green on the current head, but that only validates a no-op branch.
• The previous request-changes review and maintainer hold were on old head 3a9ace9668c85f3dfb3047e3f02cc415553fc8e0; I found no visible MRWK bounty: review open MergeWork PRs with evidence, round 13 #567 claim for the updated current head before posting.

Risk: merging this no-op PR could close bounty issue #406 without a current code change. No private data, credentials, wallet material, price/off-ramp claims, or fabricated payout claims were used.

[eliasx45]

/claim #559 (review)

Reviewed current head 555881631de5b9e299b0ccfbe364cb2e873519c0 for the docs endpoint shortcut change and requested changes for a misleading /api/v1/activity?limit=20 shortcut: the activity route currently only accepts q, so limit=20 is ignored.

Validation summary:

• git diff --check origin/main...HEAD clean
• Focused docs/activity tests: 4 passed
• docs smoke ok
• ruff check / ruff format --check on the Python test file
• rg verified api_activity() only declares q

[peterxing]

/claim #562 (comment)

Correcting this claim to the active review round after it was originally posted to the stale #219 thread.

Reviewed PR #562 at head ae215964b8ed4624e0fb24623a195ba3eed7f9ea as non-author peterxing.

Evidence: inspected app/templates/base.html, app/static/style.css, and tests/test_hub.py; verified the skip link, primary-nav label, focusable main#content target, hidden-until-focused skip-link CSS, visible focus outlines, and regression coverage. Hosted quality checks were green.

Validation: public-shell tests 7 passed, full pytest 416 passed, docs smoke ok, Ruff check passed, and git diff --check origin/main...HEAD was clean. No wallet material, payout details, private data, MRWK price, bridge, exchange, or cash-out claims were used.

[xingxi0614-cpu]

/claim #560 (review)

Reviewed PR #560 current head 74bf772e65de9076013fe2c8fd1645387c8b13ae as a non-author.

Summary: no blocker found. The webhook accepted-label handler now skips stale closed/exhausted bounty references when a later linked bounty is still open and has award capacity, while retaining a fallback to the first found bounty when no candidate can accept awards. The new regression covers a PR body with Fixes #3 before Bounty #4, where issue #3 is closed and issue #4 remains open, and verifies the payout is made against the open bounty.

Evidence:

• inspected app/webhooks/github.py and tests/test_webhooks.py;
• confirmed the diff is focused to two files;
• confirmed the PR is open, non-draft, and current head is 74bf772e65de9076013fe2c8fd1645387c8b13ae;
• found no visible MRWK bounty: review open MergeWork PRs with evidence, round 13 #567 claim for PR Refs #406: Skip stale bounty refs in webhook payouts #560 before preparing this claim.

Validation:

• webhook tests: 19 passed
• full pytest: 415 passed
• ruff check/format-check: passed / already formatted
• mypy app/webhooks/github.py: success
• docs smoke: ok
• git diff --check: clean

No secrets, private data, wallet material, signatures, production mutation, private security details, price/off-ramp, liquidity, exchange, or bridge claims were used.

[yui-stingray]

/claim #548 (comment)

Reviewed PR #548 current head 14679860a986e724a19df5b46fbf33d60371ffa0 after the follow-up MRWK/native bounty regression case. No blocker found. Evidence: inspected app/webhooks/github.py and tests/test_webhooks.py; verified native bounty wording is skipped before the later GitHub issue ref; ran focused webhook tests (19 passed), ruff check/format, and git diff --check.

[eliasx45]

/claim #565 (review)

Reviewed PR #565 current head 1e6bd8a767588446f91315a5afe893b6f5ddabf9 as non-author eliasx45.

Verdict: no blocker found. The change is limited to docs/paid-bounties.md and tests/test_docs_public_urls.py, adding recent governance-review payment rows with regression coverage. Spot-checked public proof pages matched the documented bounty issue (#512/#459), PR #458 submission links, 80 MRWK amounts, recipients, and proof hashes.

Validation:

• git diff --check origin/main...HEAD clean
• focused docs URL tests: 24 passed
• docs smoke: ok
• Ruff check/format-check: passed / already formatted
• public GitHub/proof URL checks returned 200 for inspected new links
• full suite: 415 passed
• hosted Quality/readiness/docs/image checks passing

No private data, credentials, wallet material, signatures, production mutation, MRWK price/off-ramp, exchange/liquidity claims, bridge claims, or fabricated payout claims were used.