# list-hygiene-judge delivery report

ArgonautWorks built and published `argonautworks/list-hygiene-judge@0.1.0` for Frantic bounty 68. The exact public source revision is `a92103ee690beb068a4cb4b0af0d919f439ba06c`, under review in [runxhq/runx#383](https://github.com/runxhq/runx/pull/383).

## Result

- The live adoption page is https://runx.ai/x/argonautworks/list-hygiene-judge@0.1.0.
- The hosted registry lists ArgonautWorks as publisher and resolves digest `sha256:535eacd9b775a820ae2fe4b51872cb473f58e837a4f463bbcc47752bfa67c598`.
- A clean, digest-pinned install into a fresh directory succeeded and inspected as ready with runners `decide`, `finalize`, and `judge`.
- The local Runx 0.8.2 harness passed all eight cases with zero assertion errors, including the three exact required case names.
- The hosted registry publish gate passed and published the same package as version `0.1.0`.
- The post-publish dogfood run executed the registry ref, not the working tree, and sealed receipt `runx:receipt:sha256:1010ba48683038cb815b8efc0b8a74d2a86dfa0e1988c717743e1f6126d5e475`.
- That real input contained one verified hard bounce; the skill selected `suppress`, appended one compare-and-set consent event at version 0, and read version 1 back.
- The complete six-receipt graph tree is checked into `receipts/`; both the root and full tree verify with production-mode Ed25519 signatures and zero findings.
- No secret is required for independent verification: the verifier uses Runx's documented public `runx-demo-key` from the source revision's public JWKS.
- The skill never sends, never mints a grant, and leaves `downstream_send.status` as `not_run`; `send-as` remains a separate governed run that must read the durable consent state.

## Behavior and safety

- Engagement older than `bounce_policy.decay_threshold_days`, with fresh evidence and no unsubscribe marker, records `re_permission`.
- Verified `hard_bounces > 0` with a suppress policy records `suppress` and takes priority over recency.
- Missing, unreadable, ambiguous, or stale evidence returns `human_review` without appending.
- An active unsubscribe marker returns `human_review` without appending and can never be re-permissioned automatically.
- Negative or invented engagement metrics are refused before a data write.
- `expected_version` and `idempotency_key` are carried into `data.append_event`; the graph then uses `data.read_projection` to bind the reported result to durable readback.

## Install and run

```bash
runx add argonautworks/list-hygiene-judge@0.1.0 \
  --registry https://api.runx.ai \
  --digest 535eacd9b775a820ae2fe4b51872cb473f58e837a4f463bbcc47752bfa67c598

runx skill argonautworks/list-hygiene-judge@0.1.0 judge \
  --registry https://api.runx.ai \
  -i data_source_ref=local://example/list-hygiene \
  -i resource=contact_consent_events \
  -i aggregate_id=contact:example \
  -i expected_version=0 \
  -i idempotency_key=contact:example:consent:v1 \
  --input-json engagement_history='{"opens_count":2,"clicks_count":1,"hard_bounces":1,"recency_days":12}' \
  --input-json bounce_policy='{"hard_bounce_action":"suppress","decay_threshold_days":90}' \
  --input-json current_consent_state='{"state":"subscribed","active_unsubscribe_marker":false,"evidence_status":"read","evidence_version":0}' \
  --json
```

## Verify this dogfood receipt

Clone this evidence repository, then use the documented public verification key:

```bash
export RUNX_RECEIPT_VERIFY_KID=runx-demo-key
export RUNX_RECEIPT_VERIFY_ED25519_PUBLIC_KEY_BASE64='IVL40Zt5HSRFMkLhXy6rbLfP+ntqXtMAl5YOBpiB2xI='

runx verify \
  --receipt receipts/sha256-1010ba48683038cb815b8efc0b8a74d2a86dfa0e1988c717743e1f6126d5e475.json \
  --json

runx verify \
  sha256:1010ba48683038cb815b8efc0b8a74d2a86dfa0e1988c717743e1f6126d5e475 \
  --receipt-dir receipts \
  --json
```

Expected root verdict: `valid: true`, digest and content address valid, signature mode `production`, signature status valid, and no findings. Expected tree verdict: six receipts, no missing parent, `valid: true`, and no findings.