MRWK bounty: 40 MRWK - review open MergeWork PRs with evidence, round 18

[ramimbo]

This is a proposal-gated review bounty issue. It is not claimable yet. Do not submit /claim work from this issue until the treasury proposal executes, the public bounty page exists, and maintainers post Reserved on MergeWork.

Work needed

Review open MergeWork pull requests with concrete current-head evidence. This round is proposed early so review capacity is ready before the current review round empties.

Reward

40 MRWK per accepted review, up to 30 awards, if the treasury proposal executes.

Priority targets

• Maintainer infrastructure PRs that are clean, mergeable, and close to acceptance.
• PRs that affect treasury, bounty lifecycle, admin flow, deployment, documentation, or queue safety.
• Blocker reviews on stale-looking or dirty PRs where the review gives maintainers a clear close/fix/rebase decision.

Acceptance criteria

Accepted reviews must be by non-authors and must link a GitHub PR review or concise PR comment with concrete current-head evidence. Useful evidence includes files inspected, behavior checked, commands run, CI reviewed, mergeability checked, duplicate/overlap check, current-head SHA reviewed, or a specific actionable finding.

Out of scope

• rubber-stamp approvals
• vague comments
• stale-head reviews that do not account for current code
• duplicate reviews that add no new evidence
• self-reviews
• reviews that treat closed, exhausted, or pending-only bounty issues as live work
• reviews containing private secrets, private vulnerability details, or speculative MRWK price, exchange, bridge, liquidity, cash-out, or payout claims

Duplicate and stale review rules

Duplicate work is judged by the first useful, evidence-backed review. Stale reviews may be skipped if the PR head changes materially before acceptance. Reviews may identify blockers and still qualify if they give maintainers concrete action.

[ramimbo]

Treasury proposal: https://api.mrwk.online/api/v1/treasury/proposals/58

Status: not claimable yet. Do not submit /claim work from this issue until the proposal executes, the public bounty row exists, and maintainers post Reserved on MergeWork.

[ramimbo]

Reserved on MergeWork: https://mrwk.online/bounties/97

Claims are now open for accepted work that matches this bounty's criteria.

[attaboy11]

/claim #654

Review submitted for PR #703: #703 (review)

Evidence summary:

• Reviewed PR Expose active attempt summaries on bounty rows #703 current head 0071e117d5e3211be62c92f3c58069f56bffff48 as a non-author against current origin/main 05faf1f89932d59f2935e83b71fc42ffef363c7f.
• GitHub reports mergeStateStatus: DIRTY; main quality/readiness/docs check is successful.
• Local git merge-tree origin/main origin/pr-703 exits 1 with conflicts in app/bounty_attempts.py and tests/test_bounty_attempts.py, giving maintainers a clear rebase/fix path.
• Focused PR-head verification passed: python -m pytest tests/test_bounty_attempts.py tests/test_docs_public_urls.py -q -> 41 passed, 1 warning in 0.78s.
• Files reviewed: app/bounty_attempts.py, app/serializers.py, docs/api-examples.md, tests/test_bounty_attempts.py, tests/test_docs_public_urls.py.

[attaboy11]

/claim #729 (review)

Review submitted for Bounty #654 on PR #729: #729 (review)

Evidence:

• Reviewed current head db85ea3f72c6d76a3c568126e88685492421143c against current origin/main 05faf1f89932d59f2935e83b71fc42ffef363c7f as a non-author.
• Inspected scripts/bounty_refs.py, scripts/submission_quality_gate.py, .github/pull_request_template.md, docs/agent-guide.md, docs/bounty-rules.md, and tests/test_submission_quality_gate.py.
• Verified the shared _extract_issue_refs() path preserves MergeWork Bounty #N tracking while keeping Refs #N available for GitHub/bot linked-issue visibility.
• Confirmed mergeability with git merge-tree --write-tree origin/main HEAD exit 0.
• Validation passed on the PR head: .venv/bin/pytest tests/test_submission_quality_gate.py -q (35 passed), .venv/bin/python scripts/docs_smoke.py, targeted Ruff check/format, and git diff --check origin/main...HEAD.

No payout, wallet, treasury, private-data, exchange, bridge, or cash-out behavior reviewed or changed.

[bitdamii]

/claim #654

Review submitted for PR #745: #745 (review)

Evidence summary:

• Reviewed PR Make public treasury timestamps UTC-explicit #745 current head 8e436ff71178744be76be52704fb6022f38bc502 as a non-author.
• Inspected public_utc_timestamp() and all touched public treasury/account/activity timestamp surfaces: proposal summaries, pending payout rows, proposal/challenge serialization, capacity projections, and reserve windows.
• Verified the fix converts stored naive UTC datetimes and aware datetimes into explicit UTC Z strings, matching the live ambiguity identified in MRWK bounty: 75 MRWK - live verification and bug reports, round 1 #656.
• Local validation: targeted pytest coverage for the affected account/activity/treasury timestamp paths passed (7 passed); ruff check passed; ruff format --check passed; python -m compileall -q app passed; git diff --check passed; git merge-tree --write-tree origin/main HEAD produced clean tree b6d4196b9880126dcea645faec6b95f5c67f263b.
• GitHub status at submission time: PR Make public treasury timestamps UTC-explicit #745 is CLEAN, Quality/readiness/docs/image checks successful, CodeRabbit successful.

No blocking issue found in the current head.

[attaboy11]

Follow-up for my earlier #654 review claim on PR #703: the author updated/rebased the branch after my blocker review, so I reviewed the new current head and submitted an approval with fresh evidence.

Updated review: #703 (review)

Evidence summary:

• Reviewed current head 2a99032fe8e3a21ac00f0803a532e9ef7c196390 as a non-author against current origin/main 05faf1f89932d59f2935e83b71fc42ffef363c7f.
• GitHub now reports mergeStateStatus: CLEAN; hosted Quality/readiness/docs/image check is successful.
• git merge-tree --write-tree origin/main origin/pr-703 succeeds with tree 24b9ab473bd6ad454fee97369dd17a3a282ea421.
• Focused verification passed: pytest tests/test_bounty_attempts.py tests/test_docs_public_urls.py -q -> 45 passed, 1 warning in 0.80s; targeted Ruff check/format and git diff --check passed.
• Files reviewed: app/bounty_attempts.py, app/serializers.py, docs/api-examples.md, tests/test_bounty_attempts.py, tests/test_docs_public_urls.py.

This keeps the claim evidence current after the PR head changed; no private payout, wallet, exchange, bridge, or cash-out behavior reviewed or changed.

[attaboy11]

/claim #654

Review submitted for PR #705: #705 (review)

Evidence summary:

• Reviewed current head d1bba0bc430533554c8f5bd0e65a96cecf67cb9a as a non-author against current origin/main 05faf1f89932d59f2935e83b71fc42ffef363c7f.
• Inspected app/serializers.py, docs/agent-guide.md, docs/api-examples.md, tests/test_serializers.py, tests/test_bounty_api_routes.py, tests/test_bounty_pages.py, and tests/test_public_routes.py.
• Confirmed bounty_list_summary() preserves existing raw/effective capacity fields while adding aggregate availability-state counts, pending payout awards, reduced-capacity bounty count, and effectively-unavailable bounty count.
• GitHub reports mergeStateStatus: CLEAN; hosted Quality/readiness/docs/image check is successful.
• git merge-tree --write-tree origin/main origin/pr-705 succeeds with tree ea555d90269ba10f0647b52734f4c2688b972d1e.
• Focused verification passed: pytest tests/test_serializers.py tests/test_bounty_api_routes.py tests/test_bounty_pages.py tests/test_public_routes.py tests/test_docs_public_urls.py -q -> 74 passed, 1 warning in 1.67s; scripts/docs_smoke.py, targeted Ruff check/format, and git diff --check passed.

No payout, wallet, treasury execution, private account, exchange, bridge, or cash-out behavior reviewed or changed.

[attaboy11]

/claim #654

Review submitted for PR #699: #699 (review)

Evidence summary:

• Reviewed current head 4fbf1eea1ec47108bb1e0098d2f01ee69e1ba9d3 as a non-author against current origin/main 05faf1f89932d59f2935e83b71fc42ffef363c7f.
• GitHub reports mergeStateStatus: DIRTY; hosted Quality/readiness/docs/image check is successful.
• Merge-base is 6cd957c0f0a9dd29da03a03ec75eac46fc402b2e.
• git merge-tree origin/main origin/pr-699 exits 1 with content conflicts in app/bounty_api.py and app/treasury_routes.py, giving maintainers a clear rebase/fix path.
• Focused PR-head verification passed: pytest tests/test_openapi_public_schemas.py tests/test_bounty_api_routes.py -q -> 11 passed, 1 warning in 0.71s; targeted Ruff check/format and git diff --check passed.
• Files inspected: app/accounts.py, app/activity.py, app/api_schemas.py, app/bounty_api.py, app/main.py, app/treasury_routes.py, tests/test_bounty_api_routes.py, and tests/test_openapi_public_schemas.py.

No payout, wallet, treasury execution, private account, exchange, bridge, or cash-out behavior reviewed or changed.

[Jorel97]

/claim #654

Review submitted for PR #746: #746 (review)

Evidence summary:

• Reviewed current head 5d4afd91b532bc4a63296408b5e3bfef3ee288c4 as a non-author against current origin/main 05faf1f89932d59f2935e83b71fc42ffef363c7f.
• Inspected app/treasury_routes.py and tests/test_treasury_proposals.py.
• Confirmed action and status query values still reject raw control characters, normalize uppercase callers to stored lowercase proposal values, and now reject unknown values with bounded HTTP 400 guidance instead of returning misleading empty 200 lists.
• Confirmed allowed actions come from TREASURY_ACTIONS, and status values match the proposal lifecycle states used by treasury execution/challenge handling.
• GitHub reports mergeStateStatus: CLEAN; hosted Quality/readiness/docs/image check and CodeRabbit are successful.
• Local validation passed: pytest tests/test_treasury_proposals.py -q -> 45 passed, 1 warning; targeted Ruff check/format; mypy app/treasury_routes.py; git diff --check origin/main...HEAD; and git merge-tree --write-tree origin/main HEAD -> clean tree 6ad75aca8d85c1c694f88cd2e891c3585db9fe37.

No private data, wallet material, payout execution, ledger mutation, exchange, bridge, cash-out, or price behavior reviewed or changed.

[Jorel97]

/claim #654

Review submitted for PR #747: #747 (review)

Evidence summary:

• Reviewed current head f190a42e5425f3a2a9653a4d0a1035a73510e177 as a non-author against current origin/main e00dc75550bcbb91446d1805b53e50c3db9aed3b.
• Inspected scripts/pr_queue_health.py and tests/test_pr_queue_health.py.
• Local tests pass: pytest tests/test_pr_queue_health.py -q -> 16 passed.
• Ruff found three E501 line-length failures in the touched files, and ruff format --check says both touched files would be reformatted.
• git diff --check origin/main...HEAD is clean.
• Mergeability is blocked: git merge-tree origin/main HEAD exits non-zero with a content conflict in tests/test_pr_queue_health.py; GitHub reports mergeStateStatus: DIRTY.
• CodeRabbit status is successful but posted actionable review comments; the standard quality check is not present in the PR status rollup.

Review requested a rebase/conflict resolution plus Ruff formatting/check cleanup before merge. No private data, wallet material, payout execution, ledger mutation, exchange, bridge, cash-out, or price behavior reviewed or changed.

[attaboy11]

/claim #654

Review submitted for PR #749: #749 (review)

Evidence summary:

• Reviewed current head 91061d2bf61c4f972797f13399d57b1fc686d923 as a non-author against current origin/main 05faf1f89932d59f2935e83b71fc42ffef363c7f.
• Inspected app/github_issue_finalization.py, app/treasury_executor.py, app/db.py, app/models.py, docs/admin-runbook.md, tests/test_github_issue_finalization.py, and tests/test_treasury_executor.py.
• Found a concrete blocker: if paid-issue label creation succeeds but the filled-and-paid comment fails, the retry path sees mrwk:paid and closes the issue without retrying the missing comment.
• Reproduced the partial-write retry path locally with a fake GitHub opener: first run returned failed after GET, label POST, comment POST; retry against open issue with mrwk:paid returned closed with only GET and PATCH, no comment retry.
• Local validation on the PR head passed: targeted pytest tests/test_github_issue_finalization.py tests/test_treasury_executor.py -> 14 passed in 0.47s; targeted Ruff check/format passed; mypy app/github_issue_finalization.py app/treasury_executor.py passed; git diff --check origin/main...HEAD passed; git merge-tree --write-tree origin/main HEAD produced clean tree 365da4973525261b9f63d1ac86225c14d38256b3.

Result: requested changes with a suggested regression test for label-success/comment-failure retry behavior. No private data, wallet material, payout execution, ledger mutation, exchange, bridge, cash-out, or price behavior was used or changed.

[attaboy11]

/claim #654

Review submitted for PR #748: #748 (review)

Evidence summary:

• Reviewed current head 96cc34a6d92a87c7e688e7fd3e740a0792487fda as a non-author against current origin/main 05faf1f89932d59f2935e83b71fc42ffef363c7f.
• Inspected docs/admin-runbook.md and scripts/docs_smoke.py.
• Confirmed the branch diff is only two files / 13 insertions, so CodeRabbit’s broad 86-file Bounty Pr Focus warning appears to be stale/integration-derived rather than actual current-head scope creep.
• Verified the intended Proposed work: Add bounty-focus false-positive triage guidance #691 runbook guidance: compare GitHub current-head file list with gh pr diff <number> --name-only, treat broad scope as real only when both agree, and post a scope-sanity note when they disagree.
• Branch-local validation passed: python scripts/docs_smoke.py -> docs smoke ok; targeted Ruff check passed; targeted Ruff format check -> 1 file already formatted; git diff --check origin/main...HEAD passed.
• Mergeability is blocked: git merge-tree --write-tree origin/main HEAD exits non-zero with content conflicts in both docs/admin-runbook.md and scripts/docs_smoke.py; GitHub reports mergeStateStatus: DIRTY.
• Status rollup showed CodeRabbit successful but no standard Quality/readiness/docs/image check context for this PR at review time.

Result: requested changes for current-main rebase/conflict resolution while preserving the #691 triage wording and docs-smoke phrases. No private data, wallet material, payout execution, ledger mutation, exchange, bridge, cash-out, or price behavior was used or changed.

[attaboy11]

/claim #654

Review submitted for PR #732:

Evidence summary:

• current head reviewed: 5b5363553bedbb7c2b567586829816343c0967af
• base/current main checked: 05faf1f89932d59f2935e83b71fc42ffef363c7f
• files inspected: app/mcp.py, app/mcp_tools.py, tests/test_api_mcp.py, docs/agent-guide.md, docs/api-examples.md
• verified shared issue-number/repo selector behavior for get_bounty and list_bounty_attempts, mixed selector rejection, and ambiguous issue-number rejection
• merge check: git merge-tree --write-tree origin/main HEAD exited 0
• validation: .venv/bin/python -m pytest tests/test_api_mcp.py -q -> 86 passed, 1 existing Starlette/httpx deprecation warning
• validation: .venv/bin/python -m ruff check app/mcp.py app/mcp_tools.py tests/test_api_mcp.py -> passed
• validation: .venv/bin/python -m ruff format --check app/mcp.py app/mcp_tools.py tests/test_api_mcp.py -> passed
• validation: git diff --check origin/main...HEAD -> passed

[bitdamii]

Follow-up for my #654 PR #745 review claim after the author pushed updated head aeb6160e138566515fa944ef79f708a5eeddabbf:

Updated review: #745 (review)

Additional evidence:

• Inspected the follow-up diff from 8e436ff71178744be76be52704fb6022f38bc502 to aeb6160e138566515fa944ef79f708a5eeddabbf; it extends public_utc_timestamp() to direct bounty row created_at and bounty award history created_at surfaces.
• Confirmed the new serializer/MCP assertions cover explicit UTC Z timestamps for bounty rows and accepted award history.
• Re-ran validation on updated head: targeted pytest selection 10 passed; ruff check passed; ruff format --check passed; python -m compileall -q app passed; git diff --check clean; git merge-tree --write-tree origin/main HEAD clean tree 6532678dd02a606f0a29ed49f15cdb5e9832592e.
• GitHub still reports PR Make public treasury timestamps UTC-explicit #745 CLEAN with Quality/readiness/docs/image checks successful and CodeRabbit successful.

This is a current-head follow-up to the existing PR #745 review claim, not a duplicate new PR claim.