{
  "schema": "neomorphic.n-bty-003.offer.v1",
  "id": "N-BTY-003",
  "state": "open",
  "acceptsSubmissions": true,
  "title": "One accepted semantic defect in lockfile-pin-delta",
  "reward": {
    "amount": "0.10",
    "asset": "USDC",
    "network": "base",
    "totalOneReward": "0.10",
    "entryFee": "0",
    "walletRequiredToSubmit": false,
    "automated": false,
    "escrowed": false,
    "customerRevenue": false,
    "payout": "Neomorphic-sponsored, maintainer-reviewed, manual",
    "budget": "internal commitment, not escrow"
  },
  "engine": {
    "repo": "epistemedeus/x402-url-extractor",
    "commit": "ca38205279f0d543515b81b7261909e55ea2600f",
    "merchantVersion": "1.23.47",
    "path": "vendor/lockfile-pin-delta",
    "sourceUrl": "https://github.com/epistemedeus/x402-url-extractor/tree/ca38205279f0d543515b81b7261909e55ea2600f/vendor/lockfile-pin-delta",
    "localCommandCwd": "Working directory that already contains before.json and after.json (npm lockfile v2/v3). The clone is created as a subdirectory of that directory.",
    "localCommand": "git clone https://github.com/epistemedeus/x402-url-extractor && git -C x402-url-extractor checkout ca38205279f0d543515b81b7261909e55ea2600f && node x402-url-extractor/vendor/lockfile-pin-delta/bin/lockfile-delta.mjs --before before.json --after after.json --out-dir pin-delta-out",
    "hostedServiceRequired": false
  },
  "kit": {
    "version": "0.1.0",
    "publicDir": "/downloads/n-bty-003/",
    "archivePath": "/downloads/n-bty-003/n-bty-003-kit-0.1.0.tar.gz",
    "archiveUrl": "https://neomorphic.io/downloads/n-bty-003/n-bty-003-kit-0.1.0.tar.gz",
    "sha256sumsPath": "/downloads/n-bty-003/SHA256SUMS",
    "sha256sumsUrl": "https://neomorphic.io/downloads/n-bty-003/SHA256SUMS",
    "provenancePath": "/downloads/n-bty-003/provenance.json",
    "guidePath": "/downloads/n-bty-003/",
    "fetchCommand": "curl -fsSL https://neomorphic.io/downloads/n-bty-003/n-bty-003-kit-0.1.0.tar.gz -o n-bty-003-kit-0.1.0.tar.gz && curl -fsSL https://neomorphic.io/downloads/n-bty-003/SHA256SUMS -o SHA256SUMS && sha256sum -c SHA256SUMS && tar -xzf n-bty-003-kit-0.1.0.tar.gz && node n-bty-003-kit-0.1.0/reproduce.mjs n-bty-003-kit-0.1.0/fixtures/owner-fixture.json",
    "ownerFixturePath": "n-bty-003-kit-0.1.0/fixtures/owner-fixture.json",
    "reproduceEntry": "n-bty-003-kit-0.1.0/reproduce.mjs"
  },
  "issuesUrl": "https://github.com/epistemedeus/x402-url-extractor/issues",
  "contact": {
    "afterAcceptance": "/contact/",
    "email": "contact@neomorphic.io",
    "destination": "Base USDC address only after acceptance. Never a seed phrase."
  },
  "inScope": [
    "npm package-lock.json lockfileVersion 2 or 3 JSON pairs",
    "Claimed incorrect pin-delta vs expected pin-delta grounded in lock semantics",
    "Reproduction with the genuine local engine at the pin"
  ],
  "outOfScope": [
    "CVE or security-exploit rewards",
    "Private data or secrets",
    "Unbounded fuzz or load",
    "Executing submitted code",
    "Known supported refusals (HTML, package.json-only, unsupported lockfileVersion)",
    "Mere feature requests",
    "Existing tracked duplicates"
  ],
  "trialUrl": "/trials/n-bty-003/",
  "envelopeSchema": "neomorphic.n-bty-003.reproduction-claim.v1",
  "boundary": "Open for submissions. Validator well-formed is not acceptance. Owner fixture is not a paid claim. No automated payout. Budget is an internal commitment, not escrow."
}