@elgora/cli 8.0.0 → 9.1.0

package/README.md

@@ -27,10 +27,15 @@ answer.
 
 ## Commands
 
-- `poster:publish-fund` publishes approved `bounty_challenge.md` bytes and
-  funds the new bounty.
+- `poster:review` checks a bounty page and saves its readiness certificate
+  with `--signoff-out <file>`. Rejected pages print the full issue list and exit 2.
+- `poster:publish-fund` requires `--signoff <file>`, publishes those exact
+  approved `bounty_challenge.md` bytes, and funds the new bounty without another AI review.
 - `poster:open-winning-submission` retrieves the finalized winning Submission
   for the funding Poster and decrypts it locally.
+- `check-page <bounty_challenge_md_path|->` checks structural conformance offline,
+  returns an issue list and exits non-zero on failure. It needs no wallet or
+  network and does not replace hosted semantic readiness review.
 - `spec-commitment` reproduces the challenge's `spec_commitment` offline.
 - `solver:submit` encrypts a Submission for the bounty's pinned Guardian roster
   and prepares or sends the exact ElgoraHub transaction.

package/dist/cli.js

@@ -384,36 +384,107 @@ function isBountyChallengeFrontmatterKey(value) {
 }
 
 // ../../packages/core/src/bounty-publication-response.ts
-import { isHex as isHex2 } from "viem";
+import { isHex as isHex3 } from "viem";
+import { z as z3 } from "zod";
+
+// ../../packages/core/src/auth/readiness-signoff.ts
+import {
+  isAddressEqual,
+  isHex as isHex2,
+  recoverTypedDataAddress,
+  size as size2
+} from "viem";
 import { z as z2 } from "zod";
-var addressSchema = z2.string().refine(isHexAddress, "Must be a 20-byte EVM address").transform((value) => value);
-var bytes32Schema = z2.string().refine(isHexBytes32, "Must be a bytes32 hex string").transform((value) => value);
-var hexBytesSchema = z2.string().refine(isHex2, "Must be hex-encoded calldata").transform((value) => value);
-var bountyPublicationResponseSchema = z2.object({
-  content_record: z2.object({
-    content_kind: z2.literal("bounty_challenge_spec"),
-    spec_commitment: bytes32Schema,
-    byte_length: z2.number().int().positive(),
-    token_address: addressSchema,
-    created_at: z2.string().datetime({ offset: true })
-  }).strict(),
-  create_bounty_transaction: z2.object({
-    chain_id: z2.number().int().positive(),
+
+// ../../packages/core/src/auth/eip712.ts
+var API_REQUEST_APPROVAL_PRIMARY_TYPE = "ApiRequestApproval";
+var API_REQUEST_APPROVAL_TYPES = {
+  ApiRequestApproval: [
+    { name: "endpointId", type: "string" },
+    { name: "audience", type: "string" },
+    { name: "bodyHash", type: "bytes32" },
+    { name: "query", type: "string" },
+    { name: "blockNumber", type: "uint256" },
+    { name: "blockHash", type: "bytes32" }
+  ]
+};
+function buildElgoraEip712Domain(params) {
+  return {
+    name: "Elgora",
+    version: "1",
+    chainId: params.chainId,
+    verifyingContract: params.hubAddress
+  };
+}
+function buildApiRequestApprovalTypedData(params) {
+  return {
+    domain: buildElgoraEip712Domain({
+      chainId: params.chainId,
+      hubAddress: params.hubAddress
+    }),
+    types: API_REQUEST_APPROVAL_TYPES,
+    primaryType: API_REQUEST_APPROVAL_PRIMARY_TYPE,
+    message: params.message
+  };
+}
+function endpointIdFor(input) {
+  return `${input.method.toUpperCase()} ${input.path}`;
+}
+function audienceFor(host) {
+  return host.toLowerCase();
+}
+function queryFor(query) {
+  return new URLSearchParams(query).toString();
+}
+
+// ../../packages/core/src/auth/readiness-signoff.ts
+var READINESS_APPROVAL_VALIDITY_SECONDS = 7 * 24 * 60 * 60;
+var bytes32Schema = z2.string().refine(isHexBytes32).transform((value) => value);
+var timestampSchema = z2.number().int().nonnegative().max(9999999999);
+var readinessSignoffMessageSchema = z2.object({
+  audience: z2.string().min(1).max(512),
+  spec_commitment: bytes32Schema,
+  reviewer_hash: bytes32Schema,
+  model: z2.string().min(1).max(256),
+  issued_at: timestampSchema,
+  expires_at: timestampSchema
+}).strict();
+var signatureSchema = z2.string().refine((value) => isHex2(value) && size2(value) === 65).transform((value) => value);
+var readinessSignoffSchema = readinessSignoffMessageSchema.extend({ signature: signatureSchema }).refine((signoff) => signoff.expires_at > signoff.issued_at, {
+  path: ["expires_at"],
+  message: "Must expire after issuance"
+});
+
+// ../../packages/core/src/bounty-publication-response.ts
+var addressSchema = z3.string().refine(isHexAddress, "Must be a 20-byte EVM address").transform((value) => value);
+var bytes32Schema2 = z3.string().refine(isHexBytes32, "Must be a bytes32 hex string").transform((value) => value);
+var hexBytesSchema = z3.string().refine(isHex3, "Must be hex-encoded calldata").transform((value) => value);
+var bountyChallengeContentRecordSchema = z3.object({
+  content_kind: z3.literal("bounty_challenge_spec"),
+  spec_commitment: bytes32Schema2,
+  byte_length: z3.number().int().positive(),
+  token_address: addressSchema,
+  created_at: z3.string().datetime({ offset: true })
+}).strict();
+var bountyPublicationResponseSchema = z3.object({
+  content_record: bountyChallengeContentRecordSchema,
+  create_bounty_transaction: z3.object({
+    chain_id: z3.number().int().positive(),
     to: addressSchema,
-    value: z2.literal("0"),
+    value: z3.literal("0"),
     data: hexBytesSchema,
-    function_name: z2.literal("create_bounty"),
-    args: z2.object({
-      spec_commitment: bytes32Schema,
-      escrow_amount: z2.string().refine(isPositiveInteger),
-      submission_deadline: z2.number().int().positive()
+    function_name: z3.literal("create_bounty"),
+    args: z3.object({
+      spec_commitment: bytes32Schema2,
+      escrow_amount: z3.string().refine(isPositiveInteger),
+      submission_deadline: z3.number().int().positive()
     }).strict()
   }).strict(),
-  protocol_fee_policy: z2.object({
+  protocol_fee_policy: z3.object({
     treasury_recipient: addressSchema,
-    treasury_fee_bps: z2.number().int().min(0).max(1e4),
+    treasury_fee_bps: z3.number().int().min(0).max(1e4),
     guardian_fee_recipient: addressSchema,
-    guardian_fee_bps: z2.number().int().min(0).max(1e4)
+    guardian_fee_bps: z3.number().int().min(0).max(1e4)
   }).strict()
 }).strict().superRefine((response, context) => {
   if (response.content_record.spec_commitment !== response.create_bounty_transaction.args.spec_commitment) {
@@ -424,6 +495,47 @@ var bountyPublicationResponseSchema = z2.object({
     });
   }
 });
+var priorIssueSchema = z3.object({
+  issue_index: z3.number().int().nonnegative(),
+  message: z3.string().trim().min(1).max(1500)
+}).strict();
+var priorIssueStatusSchema = priorIssueSchema.extend({
+  status: z3.enum(["resolved", "open"])
+}).strict();
+var readinessFindingSchema = z3.object({
+  path: z3.string().trim().min(1).max(120),
+  message: z3.string().trim().min(1).max(1500),
+  code: z3.string().min(1).optional(),
+  anchor: z3.string().trim().min(1).max(120).optional(),
+  hazard: z3.boolean().optional()
+});
+var MAX_READINESS_FINDINGS = 20;
+var bountyReviewResponseSchema = z3.object({
+  content_record: bountyChallengeContentRecordSchema,
+  readiness: z3.object({
+    decision: z3.literal("ready"),
+    signoff: readinessSignoffSchema,
+    // The dissenting pass's findings on a ready check; never blocking.
+    // Optional because servers before three-pass review do not send it.
+    warnings: z3.array(readinessFindingSchema).max(MAX_READINESS_FINDINGS).optional(),
+    prior_issues_resolved: z3.array(priorIssueSchema),
+    prior_issues_open: z3.array(priorIssueSchema)
+  })
+}).superRefine((response, context) => {
+  if (response.readiness.signoff.spec_commitment.toLowerCase() !== response.content_record.spec_commitment.toLowerCase()) {
+    context.addIssue({
+      code: "custom",
+      path: ["readiness", "signoff", "spec_commitment"],
+      message: "Must match content_record.spec_commitment"
+    });
+  }
+});
+var readinessSignerResponseSchema = z3.object({
+  signer_address: addressSchema,
+  reviewer_hash: bytes32Schema2,
+  configured_model: z3.string().min(1),
+  audience: z3.string().min(1)
+}).strict();
 
 // ../../packages/core/src/chain-registry.ts
 import { base, baseSepolia, foundry } from "viem/chains";
@@ -447,7 +559,7 @@ var FOUNDRY_CHAIN_ID = foundry.id;
 import { Aes256Gcm, CipherSuite, HkdfSha256 } from "@hpke/core";
 import { DhkemX25519HkdfSha256 } from "@hpke/dhkem-x25519";
 import { concatBytes, keccak256 as keccak2562, toBytes as toBytes2 } from "viem";
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 
 // ../../packages/core/src/base64.ts
 var BASE64_ENCODE_CHUNK_BYTES = 3 * 16384;
@@ -533,42 +645,42 @@ var BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
 var SOLVER_SUBMISSION_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 var MEDIA_TYPE_RE = /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/;
 var KEY_ID_RE = /^[A-Za-z0-9][ -~]*$/;
-var base64UrlSchema = z3.string().regex(BASE64URL_RE);
-var lowerAddressSchema = z3.string().refine(isLowercaseHexAddress);
-var bytes32Schema2 = z3.string().refine(isLowercaseBytes32);
-var sha256HexSchema = z3.string().refine(isSha256Hex);
-var keyIdSchema = z3.string().min(1).max(128).regex(KEY_ID_RE);
-var artifactNameSchema = z3.string().max(
+var base64UrlSchema = z4.string().regex(BASE64URL_RE);
+var lowerAddressSchema = z4.string().refine(isLowercaseHexAddress);
+var bytes32Schema3 = z4.string().refine(isLowercaseBytes32);
+var sha256HexSchema = z4.string().refine(isSha256Hex);
+var keyIdSchema = z4.string().min(1).max(128).regex(KEY_ID_RE);
+var artifactNameSchema = z4.string().max(
   MAX_SOLVER_SUBMISSION_NAME_CHARACTERS,
   `Artifact filename exceeds ${MAX_SOLVER_SUBMISSION_NAME_CHARACTERS} ASCII characters (including extension). Solvers may shorten it only if the published challenge permits, before the deadline.`
 ).regex(SOLVER_SUBMISSION_NAME_RE);
-var mediaTypeSchema = z3.string().regex(MEDIA_TYPE_RE);
-var bountyIdSchema = z3.string().refine(isBountyId);
-var chainIdSchema = z3.number().int().positive().lte(Number.MAX_SAFE_INTEGER);
-var privateArtifactContextSchema = z3.strictObject({
-  type: z3.literal("solver_submission"),
+var mediaTypeSchema = z4.string().regex(MEDIA_TYPE_RE);
+var bountyIdSchema = z4.string().refine(isBountyId);
+var chainIdSchema = z4.number().int().positive().lte(Number.MAX_SAFE_INTEGER);
+var privateArtifactContextSchema = z4.strictObject({
+  type: z4.literal("solver_submission"),
   chain_id: chainIdSchema,
   hub_address: lowerAddressSchema,
   bounty_id: bountyIdSchema,
   actor_address: lowerAddressSchema
 });
-var guardianRecipientSchema = z3.strictObject({
+var guardianRecipientSchema = z4.strictObject({
   key_id: keyIdSchema,
-  suite: z3.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
+  suite: z4.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
   public_key: base64UrlSchema.length(
     43,
     "public_key must encode a 32-byte X25519 public key"
   )
 });
-var guardianRecipientPrivateKeySchema = z3.strictObject({
+var guardianRecipientPrivateKeySchema = z4.strictObject({
   key_id: keyIdSchema,
-  suite: z3.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
+  suite: z4.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
   private_key: base64UrlSchema.length(
     43,
     "private_key must encode a 32-byte X25519 private key"
   )
 });
-var guardianRecipientsSchema = z3.array(guardianRecipientSchema).min(1).superRefine((recipients, ctx) => {
+var guardianRecipientsSchema = z4.array(guardianRecipientSchema).min(1).superRefine((recipients, ctx) => {
   const seen = /* @__PURE__ */ new Set();
   for (const recipient of recipients) {
     if (seen.has(recipient.key_id)) {
@@ -581,24 +693,24 @@ var guardianRecipientsSchema = z3.array(guardianRecipientSchema).min(1).superRef
     seen.add(recipient.key_id);
   }
 });
-var guardianRecipientPrivateKeysSchema = z3.array(guardianRecipientPrivateKeySchema).min(1);
-var artifactManifestEntrySchema = z3.strictObject({
+var guardianRecipientPrivateKeysSchema = z4.array(guardianRecipientPrivateKeySchema).min(1);
+var artifactManifestEntrySchema = z4.strictObject({
   name: artifactNameSchema,
   media_type: mediaTypeSchema,
-  size_bytes: z3.number().int().nonnegative().lte(Number.MAX_SAFE_INTEGER),
+  size_bytes: z4.number().int().nonnegative().lte(Number.MAX_SAFE_INTEGER),
   sha256: sha256HexSchema
 });
-var privateArtifactPublicManifestSchema = z3.strictObject({
-  kind: z3.literal(PRIVATE_ARTIFACT_PUBLIC_MANIFEST_KIND),
+var privateArtifactPublicManifestSchema = z4.strictObject({
+  kind: z4.literal(PRIVATE_ARTIFACT_PUBLIC_MANIFEST_KIND),
   context: privateArtifactContextSchema
 });
 var encryptedBundleArtifactSchema = artifactManifestEntrySchema.extend({
   bytes: base64UrlSchema
 });
-var privateArtifactEncryptedBundleSchema = z3.strictObject({
-  kind: z3.literal(PRIVATE_ARTIFACT_ENCRYPTED_BUNDLE_KIND),
+var privateArtifactEncryptedBundleSchema = z4.strictObject({
+  kind: z4.literal(PRIVATE_ARTIFACT_ENCRYPTED_BUNDLE_KIND),
   context: privateArtifactContextSchema,
-  artifacts: z3.array(encryptedBundleArtifactSchema).min(1).max(
+  artifacts: z4.array(encryptedBundleArtifactSchema).min(1).max(
     MAX_SOLVER_SUBMISSION_FILES,
     `Submission exceeds the maximum of ${MAX_SOLVER_SUBMISSION_FILES} files.`
   ).refine(
@@ -606,33 +718,33 @@ var privateArtifactEncryptedBundleSchema = z3.strictObject({
     "artifact names must be unique case-insensitively"
   )
 });
-var privateArtifactRevealPolicySchema = z3.strictObject({
-  kind: z3.literal(PRIVATE_ARTIFACT_REVEAL_POLICY_KIND),
-  network: z3.string().min(1),
-  chain_hash: z3.string().min(1),
-  round: z3.string().refine(isPositiveInteger),
-  not_before: z3.number().int().nonnegative().lte(Number.MAX_SAFE_INTEGER)
+var privateArtifactRevealPolicySchema = z4.strictObject({
+  kind: z4.literal(PRIVATE_ARTIFACT_REVEAL_POLICY_KIND),
+  network: z4.string().min(1),
+  chain_hash: z4.string().min(1),
+  round: z4.string().refine(isPositiveInteger),
+  not_before: z4.number().int().nonnegative().lte(Number.MAX_SAFE_INTEGER)
 });
-var wrappedRecipientKeySchema = z3.strictObject({
+var wrappedRecipientKeySchema = z4.strictObject({
   key_id: keyIdSchema,
-  suite: z3.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
+  suite: z4.literal(PRIVATE_ARTIFACT_HPKE_SUITE),
   enc: base64UrlSchema,
   ciphertext: base64UrlSchema
 });
-var wrappedKeyBagSchema = z3.strictObject({
-  kind: z3.literal(PRIVATE_ARTIFACT_WRAPPED_KEY_BAG_KIND),
-  keys: z3.array(wrappedRecipientKeySchema).min(1)
+var wrappedKeyBagSchema = z4.strictObject({
+  kind: z4.literal(PRIVATE_ARTIFACT_WRAPPED_KEY_BAG_KIND),
+  keys: z4.array(wrappedRecipientKeySchema).min(1)
 });
-var privateArtifactEnvelopeSchema = z3.strictObject({
-  kind: z3.literal(PRIVATE_ARTIFACT_ENVELOPE_KIND),
-  alg: z3.literal(SUBMISSION_ENCRYPTION_TYPE),
+var privateArtifactEnvelopeSchema = z4.strictObject({
+  kind: z4.literal(PRIVATE_ARTIFACT_ENVELOPE_KIND),
+  alg: z4.literal(SUBMISSION_ENCRYPTION_TYPE),
   context: privateArtifactContextSchema,
   public_manifest: privateArtifactPublicManifestSchema,
   public_manifest_sha256: sha256HexSchema,
   encrypted_bundle_sha256: sha256HexSchema,
   ciphertext_sha256: sha256HexSchema,
   guardian_recipients: guardianRecipientsSchema,
-  guardian_recipients_commitment: bytes32Schema2,
+  guardian_recipients_commitment: bytes32Schema3,
   reveal_policy: privateArtifactRevealPolicySchema,
   envelope_nonce: base64UrlSchema.length(
     22,
@@ -640,7 +752,7 @@ var privateArtifactEnvelopeSchema = z3.strictObject({
   ),
   iv: base64UrlSchema.length(16, "iv must encode 12 bytes"),
   wrapped_key_bag: base64UrlSchema,
-  ciphertext_locator: z3.string().min(1)
+  ciphertext_locator: z4.string().min(1)
 });
 function parsePrivateArtifactEnvelope(input) {
   return privateArtifactEnvelopeSchema.parse(input);
@@ -698,11 +810,11 @@ var x25519PrivateKeySchema = base64UrlSchema.length(
   43,
   "must encode a 32-byte X25519 private key"
 );
-var winningSolutionDeliveryContextSchema = z3.strictObject({
+var winningSolutionDeliveryContextSchema = z4.strictObject({
   chain_id: chainIdSchema,
   hub_address: lowerAddressSchema,
   bounty_id: bountyIdSchema,
-  submission_commitment: bytes32Schema2
+  submission_commitment: bytes32Schema3
 });
 async function generateX25519KeyPair(input) {
   const suite = createHpkeSuite();
@@ -779,7 +891,7 @@ function buildWinningSolutionDeliveryInfo(contextCommitment) {
 var GUARDIAN_ROSTER_KEY_PROOF_INFO = "elgora/guardian-roster-key-proof/hpke-fixture/v0";
 var GUARDIAN_ROSTER_KEY_PROOF_MESSAGE_TYPE = "elgora_guardian_roster_key_proof_v0";
 var GUARDIAN_ROSTER_KEY_PROOF_FIXTURE_BYTES = 32;
-var guardianRosterKeyProofContextSchema = z3.strictObject({
+var guardianRosterKeyProofContextSchema = z4.strictObject({
   chain_id: chainIdSchema,
   hub_address: lowerAddressSchema,
   proposed_account: lowerAddressSchema,
@@ -1107,7 +1219,7 @@ async function wrapAesKeyForRecipients(input) {
 }
 async function openAesKeyForRecipient(input) {
   const suite = createHpkeSuite();
-  const wrappedKeys = z3.array(wrappedRecipientKeySchema).parse(input.wrappedKeys);
+  const wrappedKeys = z4.array(wrappedRecipientKeySchema).parse(input.wrappedKeys);
   const privateKeys = guardianRecipientPrivateKeysSchema.parse(
     input.privateKeys
   );
@@ -3818,7 +3930,7 @@ function settlementAmounts(escrowAmount, treasuryFeeBps, guardianFeeBps) {
 import { zeroAddress } from "viem";
 
 // ../../packages/core/src/api/bounty-preparation.ts
-import { ZodError, z as z4 } from "zod";
+import { ZodError, z as z5 } from "zod";
 
 // ../../packages/core/src/submission-timelock.ts
 import {
@@ -4079,7 +4191,7 @@ import {
   getAbiItem as getAbiItem2,
   parseAbi,
   parseSignature,
-  recoverTypedDataAddress
+  recoverTypedDataAddress as recoverTypedDataAddress2
 } from "viem";
 var ELGORA_HUB_ERRORS = ELGORA_HUB_ABI.filter(
   (item) => item.type === "error"
@@ -4236,7 +4348,7 @@ async function prepareAuthorizedCreateBountyTransaction(input) {
     if (unsupported) return null;
     throw error;
   }
-  if ((await recoverTypedDataAddress({ ...authorization, signature })).toLowerCase() !== poster.toLowerCase()) {
+  if ((await recoverTypedDataAddress2({ ...authorization, signature })).toLowerCase() !== poster.toLowerCase()) {
     throw new Error("USDC authorization was not signed by the funding Poster.");
   }
   const { r, s, yParity } = parseSignature(signature);
@@ -4312,14 +4424,14 @@ var BoundaryValidationError = class extends Error {
     this.issues = issues;
   }
 };
-var artifactUploadUrlRequestSchema = z4.object({
-  ciphertext_sha256: z4.string().refine(isSha256Hex),
-  ciphertext_byte_length: z4.number().int().positive().max(MAX_SOLVER_SUBMISSION_CIPHERTEXT_BYTES)
+var artifactUploadUrlRequestSchema = z5.object({
+  ciphertext_sha256: z5.string().refine(isSha256Hex),
+  ciphertext_byte_length: z5.number().int().positive().max(MAX_SOLVER_SUBMISSION_CIPHERTEXT_BYTES)
 }).strict();
 
 // ../../packages/core/src/api/config.ts
 import { createHash } from "crypto";
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 function withDeploymentEnvDefaults(env) {
   const merged = { ...env };
   const setIfBlank = (key, value) => {
@@ -4340,11 +4452,11 @@ function withDeploymentEnvDefaults(env) {
   setIfBlank("ELGORA_SUBGRAPH_ENDPOINT", deployment?.ELGORA_SUBGRAPH_ENDPOINT);
   return merged;
 }
-var chainIdField = z5.coerce.number().int().positive().refine((chainId) => SUPPORTED_CHAINS[chainId] !== void 0, {
+var chainIdField = z6.coerce.number().int().positive().refine((chainId) => SUPPORTED_CHAINS[chainId] !== void 0, {
   message: `ELGORA_CHAIN_ID must be a supported chain: ${Object.keys(SUPPORTED_CHAINS).join(", ")}`
 });
-var hubAddressField = z5.string().refine(isHexAddress, "ELGORA_HUB_ADDRESS must be a 20-byte EVM address").transform((value) => value.toLowerCase());
-var publicDeploymentEnvSchema = z5.object({
+var hubAddressField = z6.string().refine(isHexAddress, "ELGORA_HUB_ADDRESS must be a 20-byte EVM address").transform((value) => value.toLowerCase());
+var publicDeploymentEnvSchema = z6.object({
   ELGORA_CHAIN_ID: chainIdField,
   ELGORA_HUB_ADDRESS: hubAddressField
 });
@@ -4360,40 +4472,50 @@ function loadPublicDeploymentConfig(env = process.env) {
 var envShape = {
   ELGORA_CHAIN_ID: chainIdField,
   ELGORA_HUB_ADDRESS: hubAddressField,
-  ELGORA_ESCROW_TOKEN_ADDRESS: z5.string().refine(
+  ELGORA_ESCROW_TOKEN_ADDRESS: z6.string().refine(
     isHexAddress,
     "ELGORA_ESCROW_TOKEN_ADDRESS must be a 20-byte EVM address"
   ).transform((value) => value.toLowerCase()),
-  ELGORA_TIMELOCK_REVEAL_DELAY_SECONDS: z5.coerce.number().int().nonnegative().default(DEFAULT_TIMELOCK_REVEAL_DELAY_SECONDS),
-  ELGORA_RPC_URL: z5.string().min(1, "ELGORA_RPC_URL is required"),
+  ELGORA_TIMELOCK_REVEAL_DELAY_SECONDS: z6.coerce.number().int().nonnegative().default(DEFAULT_TIMELOCK_REVEAL_DELAY_SECONDS),
+  ELGORA_RPC_URL: z6.string().min(1, "ELGORA_RPC_URL is required"),
   /**
    * Only consulted for a chain with no recorded deployment — a local anvil
    * stack, whose addresses change on every deploy. A recorded deployment's
    * scheme always wins, because settlement validation compares against it.
    */
-  ELGORA_PAYOUT_SCHEME_ADDRESS: z5.string().refine(
+  ELGORA_PAYOUT_SCHEME_ADDRESS: z6.string().refine(
     isHexAddress,
     "ELGORA_PAYOUT_SCHEME_ADDRESS must be a 20-byte EVM address"
   ).transform((value) => value.toLowerCase()).optional(),
-  ELGORA_DATABASE_URL: z5.string().min(1, "ELGORA_DATABASE_URL is required"),
-  ELGORA_SUBGRAPH_ENDPOINT: z5.string().min(1, "ELGORA_SUBGRAPH_ENDPOINT is required"),
-  ELGORA_ARTIFACT_STORAGE_ENDPOINT: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_ENDPOINT is required"),
-  ELGORA_ARTIFACT_STORAGE_REGION: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_REGION is required"),
-  ELGORA_ARTIFACT_STORAGE_BUCKET: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_BUCKET is required"),
-  ELGORA_ARTIFACT_STORAGE_ACCESS_KEY_ID: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_ACCESS_KEY_ID is required"),
-  ELGORA_ARTIFACT_STORAGE_SECRET_ACCESS_KEY: z5.string().min(1, "ELGORA_ARTIFACT_STORAGE_SECRET_ACCESS_KEY is required"),
-  ELGORA_DELIVERY_PUBLIC_KEY: z5.string().min(1, "ELGORA_DELIVERY_PUBLIC_KEY is required"),
-  ELGORA_DELIVERY_PRIVATE_KEY: z5.string().min(1, "ELGORA_DELIVERY_PRIVATE_KEY is required")
+  ELGORA_DATABASE_URL: z6.string().min(1, "ELGORA_DATABASE_URL is required"),
+  ELGORA_SUBGRAPH_ENDPOINT: z6.string().min(1, "ELGORA_SUBGRAPH_ENDPOINT is required"),
+  ELGORA_ARTIFACT_STORAGE_ENDPOINT: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_ENDPOINT is required"),
+  ELGORA_ARTIFACT_STORAGE_REGION: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_REGION is required"),
+  ELGORA_ARTIFACT_STORAGE_BUCKET: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_BUCKET is required"),
+  ELGORA_ARTIFACT_STORAGE_ACCESS_KEY_ID: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_ACCESS_KEY_ID is required"),
+  ELGORA_ARTIFACT_STORAGE_SECRET_ACCESS_KEY: z6.string().min(1, "ELGORA_ARTIFACT_STORAGE_SECRET_ACCESS_KEY is required"),
+  ELGORA_DELIVERY_PUBLIC_KEY: z6.string().min(1, "ELGORA_DELIVERY_PUBLIC_KEY is required"),
+  ELGORA_DELIVERY_PRIVATE_KEY: z6.string().min(1, "ELGORA_DELIVERY_PRIVATE_KEY is required")
 };
+var readinessAudienceSchema = z6.string().trim().toLowerCase().min(1).max(512).refine((host) => {
+  try {
+    const url = new URL(`https://${host}`);
+    return url.host === host && url.pathname === "/" && !url.username && !url.password && !url.search && !url.hash;
+  } catch {
+    return false;
+  }
+}, "Must be a canonical hostname with optional port, without a URL path");
 var publicationEnvShape = {
   ELGORA_CHAIN_ID: envShape.ELGORA_CHAIN_ID,
   ELGORA_HUB_ADDRESS: envShape.ELGORA_HUB_ADDRESS,
   ELGORA_ESCROW_TOKEN_ADDRESS: envShape.ELGORA_ESCROW_TOKEN_ADDRESS,
   ELGORA_DATABASE_URL: envShape.ELGORA_DATABASE_URL,
-  ELGORA_SUBGRAPH_ENDPOINT: envShape.ELGORA_SUBGRAPH_ENDPOINT
+  ELGORA_SUBGRAPH_ENDPOINT: envShape.ELGORA_SUBGRAPH_ENDPOINT,
+  ELGORA_PUBLICATION_REVIEW_ENABLED: z6.string().trim().toLowerCase().pipe(z6.enum(["true", "false"])).default("true").transform((value) => value === "true"),
+  ELGORA_READINESS_TIMEOUT_MS: z6.coerce.number().int().min(1).max(12e4).default(12e4)
 };
-var envSchema = z5.object(envShape);
-var bountyPublicationEnvSchema = z5.object(publicationEnvShape);
+var envSchema = z6.object(envShape);
+var bountyPublicationEnvSchema = z6.object(publicationEnvShape);
 
 // ../../packages/core/src/api/elgora-hub-error-catalog.ts
 import { decodeErrorResult } from "viem";
@@ -4407,55 +4529,12 @@ var ELGORA_HUB_FEE_POLICY_ABI = [
   getAbiItem3({ abi: ELGORA_HUB_ABI, name: "guardianFeeBps" })
 ];
 
-// ../../packages/core/src/api/orchestrator-readiness.ts
-import { z as z6 } from "zod";
-var MAX_ORCHESTRATOR_ISSUES = 20;
-var readinessIssueSchema = z6.object({
-  path: z6.string().trim().min(1).max(120),
-  message: z6.string().trim().min(1).max(1500),
-  code: z6.enum([
-    "acceptance_undecidable",
-    "winner_unresolved",
-    "source_unidentified",
-    "domain_underspecified",
-    "platform_conflict",
-    "operative_instruction",
-    "placeholder_unreplaced",
-    "unsafe_content"
-  ]),
-  anchor: z6.string().trim().min(1).max(120),
-  hazard: z6.boolean()
-}).strict();
-var readinessResponseSchema = z6.object({
-  issues: z6.array(readinessIssueSchema).max(MAX_ORCHESTRATOR_ISSUES),
-  judgeable: z6.boolean()
-}).strict();
-var READINESS_OUTPUT_JSON_SCHEMA = z6.toJSONSchema(readinessResponseSchema, {
-  override: ({ jsonSchema }) => {
-    delete jsonSchema.minLength;
-    delete jsonSchema.maxLength;
-    delete jsonSchema.maxItems;
-  }
-});
-delete READINESS_OUTPUT_JSON_SCHEMA.$schema;
-var providerMessageSchema = z6.object({
-  id: z6.string().optional(),
-  choices: z6.array(
-    z6.object({
-      message: z6.object({
-        content: z6.string().nullable().optional()
-      }).passthrough(),
-      finish_reason: z6.string().nullable().optional()
-    }).passthrough()
-  ).min(1)
-}).passthrough();
-
 // ../../packages/core/src/api/solver-submission-responses.ts
-import { isHex as isHex3 } from "viem";
+import { isHex as isHex4 } from "viem";
 import { z as z7 } from "zod";
 var hexAddressSchema = z7.string().refine(isHexAddress, "Must be a hex-encoded address");
 var hexBytes32Schema = z7.string().refine(isHexBytes32, "Must be 32-byte hex");
-var hexDataSchema = z7.string().refine((value) => isHex3(value), "Must be hex-encoded calldata");
+var hexDataSchema = z7.string().refine((value) => isHex4(value), "Must be hex-encoded calldata");
 var artifactUploadUrlResponseSchema = z7.object({
   locator: z7.string().min(1),
   upload_url: z7.string().min(1),
@@ -4609,7 +4688,7 @@ var FRONTMATTER_DELIMITER2 = "---";
 var decimalSchema = z10.string().regex(/^[1-9][0-9]*$/, "Must be a positive integer").transform(Number).refine(Number.isSafeInteger, "Must be a safe integer");
 var bountyIdSchema2 = z10.string().regex(/^(0|[1-9][0-9]*)$/, "Must be a non-negative integer");
 var addressSchema2 = z10.string().refine(isHexAddress, "Must be a hex-encoded address").refine((value) => value === value.toLowerCase(), "Must use lowercase hex").transform((value) => value);
-var bytes32Schema3 = z10.string().refine(isHexBytes32, "Must be 32-byte hex").refine((value) => value === value.toLowerCase(), "Must use lowercase hex").transform((value) => value);
+var bytes32Schema4 = z10.string().refine(isHexBytes32, "Must be 32-byte hex").refine((value) => value === value.toLowerCase(), "Must use lowercase hex").transform((value) => value);
 var commonFields = {
   format_version: z10.literal(WRITTEN_VERDICT_FORMAT_VERSION.toString()).transform(() => WRITTEN_VERDICT_FORMAT_VERSION),
   chain_id: decimalSchema,
@@ -4625,7 +4704,7 @@ var writtenVerdictSchema = z10.discriminatedUnion("outcome", [
       (value) => value !== zeroAddress2,
       "Must not be the zero address"
     ),
-    awarded_submission_commitment: bytes32Schema3.refine(
+    awarded_submission_commitment: bytes32Schema4.refine(
       (value) => value !== ZERO_BYTES32,
       "Must not be zero bytes"
     )
@@ -5115,6 +5194,9 @@ function defaultApiBaseUrl(env) {
 
 // ../../packages/core/src/api-client.ts
 var ApiRequestError = class extends Error {
+  issues;
+  priorIssuesResolved;
+  priorIssuesOpen;
   status;
   code;
   retryAfterMs;
@@ -5123,15 +5205,20 @@ var ApiRequestError = class extends Error {
       `Request to ${input.url} failed with ${input.status}: ${formatApiError(input.body)}`
     );
     this.name = "ApiRequestError";
+    this.issues = readApiErrorIssues(input.body);
+    const error = input.body && typeof input.body === "object" && "error" in input.body ? input.body.error : void 0;
+    const fields = error && typeof error === "object" ? error : {};
+    this.priorIssuesResolved = priorIssueSchema.array().safeParse(fields.prior_issues_resolved).data ?? [];
+    this.priorIssuesOpen = priorIssueSchema.array().safeParse(fields.prior_issues_open).data ?? [];
     this.status = input.status;
     this.code = readApiErrorCode(input.body);
     this.retryAfterMs = input.retryAfterMs;
   }
 };
-async function postText(url, body, contentType, authorization) {
+async function postText(url, body, contentType, authorization, headers = {}) {
   const response = await fetch(url, {
     method: "POST",
-    headers: { "content-type": contentType, authorization },
+    headers: { ...headers, "content-type": contentType, authorization },
     body
   });
   return parseJsonResponse(url, response);
@@ -5236,12 +5323,11 @@ function formatApiError(body) {
   if (body && typeof body === "object" && "error" in body && body.error && typeof body.error === "object" && "message" in body.error) {
     const apiError = body.error;
     const parts = [String(apiError.message)];
-    if (Array.isArray(apiError.issues) && apiError.issues.length > 0) {
-      for (const issue of apiError.issues) {
-        if (!issue || typeof issue !== "object" || typeof issue.message !== "string")
-          continue;
-        parts.push(`${issue.path || "request"}: ${issue.message}`);
-      }
+    for (const issue of readApiErrorIssues(body)) {
+      let line = `${issue.anchor || issue.path || "request"}: ${issue.message}`;
+      if (issue.code) line += ` [${issue.code}]`;
+      if (issue.hazard !== void 0) line += ` (hazard: ${issue.hazard})`;
+      parts.push(line);
     }
     if (apiError.next_action !== void 0 && apiError.next_action !== null) {
       parts.push(`next action: ${String(apiError.next_action)}`);
@@ -5264,6 +5350,13 @@ async function assertResponseOk(url, response) {
     retryAfterMs: readRetryAfterMs(response)
   });
 }
+function readApiErrorIssues(body) {
+  if (!body || typeof body !== "object" || !("error" in body) || !body.error || typeof body.error !== "object" || !("issues" in body.error) || !Array.isArray(body.error.issues))
+    return [];
+  return body.error.issues.filter(
+    (issue) => issue && typeof issue === "object" && typeof issue.path === "string" && typeof issue.message === "string" && (issue.code === void 0 || typeof issue.code === "string") && (issue.anchor === void 0 || typeof issue.anchor === "string") && (issue.hazard === void 0 || typeof issue.hazard === "boolean")
+  );
+}
 function readApiErrorCode(body) {
   if (!body || typeof body !== "object" || !("error" in body) || !body.error || typeof body.error !== "object" || !("code" in body.error) || typeof body.error.code !== "string") {
     return void 0;
@@ -5285,7 +5378,7 @@ function toArrayBuffer(bytes) {
 import { privateKeyToAccount as privateKeyToAccount2 } from "viem/accounts";
 
 // ../../packages/core/src/auth/authorization-header.ts
-import { isAddress as isAddress3, isHex as isHex4 } from "viem";
+import { isAddress as isAddress3, isHex as isHex5 } from "viem";
 var ELGORA_APPROVAL_AUTH_SCHEME = "Elgora-Approval";
 var FIELD_SEPARATOR = "~";
 function encodeApiRequestApprovalHeader(fields) {
@@ -5298,59 +5391,27 @@ function encodeApiRequestApprovalHeader(fields) {
   return `${ELGORA_APPROVAL_AUTH_SCHEME} ${btoa(payload)}`;
 }
 
-// ../../packages/core/src/auth/eip712.ts
-var API_REQUEST_APPROVAL_PRIMARY_TYPE = "ApiRequestApproval";
-var API_REQUEST_APPROVAL_TYPES = {
-  ApiRequestApproval: [
-    { name: "endpointId", type: "string" },
-    { name: "audience", type: "string" },
-    { name: "bodyHash", type: "bytes32" },
-    { name: "query", type: "string" },
-    { name: "blockNumber", type: "uint256" },
-    { name: "blockHash", type: "bytes32" }
-  ]
-};
-function buildElgoraEip712Domain(params) {
-  return {
-    name: "Elgora",
-    version: "1",
-    chainId: params.chainId,
-    verifyingContract: params.hubAddress
-  };
-}
-function buildApiRequestApprovalTypedData(params) {
-  return {
-    domain: buildElgoraEip712Domain({
-      chainId: params.chainId,
-      hubAddress: params.hubAddress
-    }),
-    types: API_REQUEST_APPROVAL_TYPES,
-    primaryType: API_REQUEST_APPROVAL_PRIMARY_TYPE,
-    message: params.message
-  };
-}
-function endpointIdFor(input) {
-  return `${input.method.toUpperCase()} ${input.path}`;
-}
-function audienceFor(host) {
-  return host.toLowerCase();
-}
-function queryFor(query) {
-  return new URLSearchParams(query).toString();
+// ../../packages/core/src/auth/readiness-signoff-header.ts
+var ELGORA_READINESS_SIGNOFF_HEADER = "Elgora-Readiness-Signoff";
+function encodeReadinessSignoffHeader(signoff) {
+  const bytes = new TextEncoder().encode(
+    JSON.stringify(readinessSignoffSchema.parse(signoff))
+  );
+  return btoa(String.fromCharCode(...bytes));
 }
 
 // ../../packages/core/src/auth/request-approval.ts
 import {
   hashTypedData,
-  isAddressEqual as isAddressEqual2,
+  isAddressEqual as isAddressEqual3,
   keccak256 as keccak2565,
   toBytes as toBytes4
 } from "viem";
 
 // ../../packages/core/src/auth/signature.ts
 import {
-  isAddressEqual,
-  recoverTypedDataAddress as recoverTypedDataAddress2
+  isAddressEqual as isAddressEqual2,
+  recoverTypedDataAddress as recoverTypedDataAddress3
 } from "viem";
 
 // ../../packages/core/src/auth/request-approval-header.ts
@@ -6011,9 +6072,10 @@ function createElgoraSubgraphClient(options) {
       );
       raw = await response.text();
     } catch (cause) {
+      const code = transportErrorCode(cause);
       throw new SubgraphReadError(
         "transport_failed",
-        "Subgraph request did not complete",
+        `Subgraph request did not complete${code ? ` (${code})` : ""}`,
         { cause }
       );
     }
@@ -6166,6 +6228,17 @@ function createElgoraSubgraphClient(options) {
     }
   };
 }
+function transportErrorCode(error, depth = 0) {
+  if (depth > 4 || typeof error !== "object" || error === null)
+    return void 0;
+  const { code, cause, errors } = error;
+  if (typeof code === "string" && /^[A-Z][A-Z0-9_]*$/.test(code)) return code;
+  for (const inner of [cause, ...Array.isArray(errors) ? errors : []]) {
+    const found = transportErrorCode(inner, depth + 1);
+    if (found) return found;
+  }
+  return void 0;
+}
 var defaultFetch = (endpoint, body) => fetch(endpoint, {
   method: "POST",
   headers: { "content-type": "application/json" },
@@ -7100,7 +7173,7 @@ function resolveChainId(selector) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "8.0.0" : "0.0.0-dev";
+var CLI_VERSION = true ? "9.1.0" : "0.0.0-dev";
 var CLI_NODE_ENGINES = true ? ">=24 <25" : ">=24 <25";
 
 // src/node-engines.ts
@@ -7307,26 +7380,99 @@ function required3(env, name) {
 }
 
 // src/publish-fund.ts
-import { readFile as readFile4 } from "fs/promises";
-import { text as readStdinText3 } from "stream/consumers";
+import { readFile as readFile5 } from "fs/promises";
 import {
   decodeFunctionData,
   parseAbi as parseAbi2,
   parseEventLogs
 } from "viem";
 import { privateKeyToAccount as privateKeyToAccount8 } from "viem/accounts";
-var PUBLISH_FUND_USAGE = "Usage: elgora-cli poster:publish-fund <bounty_challenge_md_path>\n   or: elgora-cli poster:publish-fund -";
+
+// src/poster-request.ts
+import { readFile as readFile4 } from "fs/promises";
+import { text as readStdinText3 } from "stream/consumers";
+function loadPosterConfig(env, apiBaseUrlOverride) {
+  const defaults = withDeploymentDefaults(env);
+  const clientConfig = loadClientDeploymentConfig(defaults, apiBaseUrlOverride);
+  const rpcUrl = defaults.ELGORA_RPC_URL?.trim();
+  if (!rpcUrl) throw new Error("ELGORA_RPC_URL is required");
+  const privateKey = env.ELGORA_POSTER_PRIVATE_KEY?.trim();
+  if (!privateKey || !isHexBytes32(privateKey)) {
+    throw new Error(
+      "ELGORA_POSTER_PRIVATE_KEY must be a 32-byte hex private key"
+    );
+  }
+  return {
+    ...clientConfig,
+    rpcUrl,
+    posterPrivateKey: privateKey
+  };
+}
+function takeFlag(argv, flag, usage) {
+  const uses = argv.filter(
+    (arg) => arg === flag || arg.startsWith(`${flag}=`)
+  ).length;
+  const extracted = extractFlagValue(argv, flag);
+  if (uses > 1 || uses === 1 && (!extracted.value || extracted.value.startsWith("--")))
+    throw new Error(usage);
+  return extracted;
+}
+async function readBountyChallengeMarkdown2(path5) {
+  return path5 === "-" ? readStdinText3(process.stdin) : readFile4(path5, "utf8");
+}
+async function signPosterRequest(input) {
+  return buildAuthorizationHeader({
+    requestUrl: input.requestUrl.toString(),
+    method: "POST",
+    body: input.markdown,
+    chainId: input.config.chainId,
+    hubAddress: input.config.hubAddress,
+    address: input.account.address,
+    block: await fetchSignableBlock(input.publicClient),
+    sign: (typedData) => input.account.signTypedData(typedData)
+  });
+}
+
+// src/publish-fund.ts
+var PUBLISH_FUND_USAGE = "Usage: elgora-cli poster:publish-fund <bounty_challenge_md_path|-> --signoff <file>";
 var usdcAbi = parseAbi2([
   "function approve(address spender,uint256 value) returns (bool)",
   "function balanceOf(address account) view returns (uint256)"
 ]);
 async function main9(env = process.env, argv = process.argv.slice(2)) {
-  const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
-  const config = loadPublishFundConfig(
-    withDeploymentDefaults(env),
-    apiBaseUrlOverride
+  const { apiBaseUrl: apiBaseUrlOverride, argv: afterApiBaseUrl } = extractApiBaseUrlFlag(argv);
+  const { value: signoffPath, argv: remainingArgv } = takeFlag(
+    afterApiBaseUrl,
+    "--signoff",
+    PUBLISH_FUND_USAGE
   );
-  const bountyChallengeMarkdown = await readBountyChallengeMarkdown2(remainingArgv);
+  if (!signoffPath || remainingArgv.length !== 1 || !remainingArgv[0])
+    throw new Error(PUBLISH_FUND_USAGE);
+  const config = loadPosterConfig(env, apiBaseUrlOverride);
+  const escrowTokenAddress = withDeploymentDefaults(env).ELGORA_ESCROW_TOKEN_ADDRESS?.trim();
+  if (!escrowTokenAddress || !isHexAddress(escrowTokenAddress)) {
+    throw new Error(
+      "ELGORA_ESCROW_TOKEN_ADDRESS must be a 20-byte EVM address"
+    );
+  }
+  const tokenAddress = escrowTokenAddress.toLowerCase();
+  const bountyChallengeMarkdown = await readBountyChallengeMarkdown2(
+    remainingArgv[0]
+  );
+  const localSpecCommitment = deriveBountyChallengeContentCommitment(
+    bountyChallengeMarkdown
+  );
+  const signoff = readinessSignoffSchema.parse(
+    JSON.parse(await readFile5(signoffPath, "utf8"))
+  );
+  if (signoff.spec_commitment.toLowerCase() !== localSpecCommitment) {
+    throw new Error(
+      "Readiness sign-off does not match the exact bounty_challenge.md bytes. Run poster:review again."
+    );
+  }
+  if (signoff.expires_at <= Math.floor(Date.now() / 1e3)) {
+    throw new Error("Readiness sign-off has expired. Run poster:review again.");
+  }
   const account = privateKeyToAccount8(config.posterPrivateKey);
   const publicClient = createChainPublicClient(config.chainId, config.rpcUrl);
   const walletClient = createChainWalletClient(
@@ -7340,31 +7486,25 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
     config.apiBaseUrl
   );
   requestUrl.searchParams.set("poster_address", account.address);
-  const block = await fetchSignableBlock(publicClient);
-  const authorization = await buildAuthorizationHeader({
-    requestUrl: requestUrl.toString(),
-    method: "POST",
-    body: bountyChallengeMarkdown,
-    chainId: config.chainId,
-    hubAddress: config.hubAddress,
-    address: account.address,
-    block,
-    sign: (typedData) => account.signTypedData(typedData)
+  const authorization = await signPosterRequest({
+    requestUrl,
+    markdown: bountyChallengeMarkdown,
+    config,
+    account,
+    publicClient
   });
   const prepared = await requestPreparePublication({
     requestUrl: requestUrl.toString(),
     markdown: bountyChallengeMarkdown,
-    authorization
+    authorization,
+    signoff: encodeReadinessSignoffHeader(signoff)
   });
-  const localSpecCommitment = deriveBountyChallengeContentCommitment(
-    bountyChallengeMarkdown
-  );
   if (prepared.content_record.spec_commitment !== localSpecCommitment) {
     throw new Error(
       "Elgora API returned a spec_commitment that does not match the locally submitted bounty_challenge.md"
     );
   }
-  if (prepared.create_bounty_transaction.chain_id !== config.chainId || prepared.create_bounty_transaction.to !== config.hubAddress || prepared.content_record.token_address !== config.escrowTokenAddress) {
+  if (prepared.create_bounty_transaction.chain_id !== config.chainId || prepared.create_bounty_transaction.to !== config.hubAddress || prepared.content_record.token_address !== tokenAddress) {
     throw new Error(
       "Elgora API returned a create_bounty_transaction that does not match the locally configured deployment (chain id, hub address, or escrow token)"
     );
@@ -7386,7 +7526,7 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
   const [ethBalance, usdcBalance] = await Promise.all([
     publicClient.getBalance({ address: account.address }),
     publicClient.readContract({
-      address: config.escrowTokenAddress,
+      address: tokenAddress,
       abi: usdcAbi,
       functionName: "balanceOf",
       args: [account.address]
@@ -7402,7 +7542,7 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
   }
   const authorized = await prepareAuthorizedCreateBountyTransaction({
     transaction: prepared.create_bounty_transaction,
-    tokenAddress: config.escrowTokenAddress,
+    tokenAddress,
     poster: account.address,
     publicClient,
     sign: (typedData) => account.signTypedData(typedData)
@@ -7423,7 +7563,7 @@ async function main9(env = process.env, argv = process.argv.slice(2)) {
     });
   } else {
     const approveHash = await walletClient.writeContract({
-      address: config.escrowTokenAddress,
+      address: tokenAddress,
       abi: usdcAbi,
       functionName: "approve",
       args: [config.hubAddress, escrowAmount]
@@ -7497,60 +7637,115 @@ async function requestPreparePublication(input) {
     new URL(input.requestUrl),
     input.markdown,
     "text/markdown",
-    input.authorization
+    input.authorization,
+    { [ELGORA_READINESS_SIGNOFF_HEADER]: input.signoff }
   );
   return bountyPublicationResponseSchema.parse(body);
 }
-async function readBountyChallengeMarkdown2(argv) {
-  const path5 = argv[0];
-  if (!path5) {
-    throw new Error(PUBLISH_FUND_USAGE);
-  }
-  if (path5 === "-") {
-    return readStdinText3(process.stdin);
-  }
-  return readFile4(path5, "utf8");
+
+// src/required-env.ts
+function missingRequiredEnv(required4, env) {
+  return required4.filter((envName) => !env[envName]?.trim());
 }
-function loadPublishFundConfig(env, apiBaseUrlOverride) {
-  const clientConfig = loadClientDeploymentConfig(env, apiBaseUrlOverride);
-  const rpcUrl = env.ELGORA_RPC_URL?.trim();
-  if (!rpcUrl) {
-    throw new Error("ELGORA_RPC_URL is required");
-  }
-  const posterPrivateKey = env.ELGORA_POSTER_PRIVATE_KEY?.trim();
-  if (!posterPrivateKey || !isHexBytes32(posterPrivateKey)) {
-    throw new Error(
-      "ELGORA_POSTER_PRIVATE_KEY must be a 32-byte hex private key"
+
+// src/review.ts
+import { writeFile as writeFile3 } from "fs/promises";
+import { resolve } from "path";
+import { privateKeyToAccount as privateKeyToAccount9 } from "viem/accounts";
+var USAGE2 = "Usage: elgora-cli poster:review <path|-> [--previous <commitment>] [--signoff-out <file>]";
+async function main10(env = process.env, argv = process.argv.slice(2)) {
+  const { apiBaseUrl, argv: args } = extractApiBaseUrlFlag(argv);
+  const { value: previous, argv: afterPrevious } = takeFlag(
+    args,
+    "--previous",
+    "--previous must be one bytes32 page commitment"
+  );
+  if (previous && !isHexBytes32(previous))
+    throw new Error("--previous must be one bytes32 page commitment");
+  const { value: signoffOut, argv: paths } = takeFlag(
+    afterPrevious,
+    "--signoff-out",
+    USAGE2
+  );
+  if (paths.length !== 1 || !paths[0] || paths[0].startsWith("--"))
+    throw new Error(USAGE2);
+  if (signoffOut && paths[0] !== "-" && resolve(signoffOut) === resolve(paths[0]))
+    throw new Error("--signoff-out must not overwrite the bounty draft");
+  const config = loadPosterConfig(env, apiBaseUrl);
+  const markdown = await readBountyChallengeMarkdown2(paths[0]);
+  const commitment = deriveBountyChallengeContentCommitment(markdown);
+  const account = privateKeyToAccount9(config.posterPrivateKey);
+  const publicClient = createChainPublicClient(config.chainId, config.rpcUrl);
+  await assertHubDeployment(publicClient, config.chainId, config.hubAddress);
+  const requestUrl = new URL(
+    "/api/bounty-challenge-specs/review",
+    config.apiBaseUrl
+  );
+  requestUrl.searchParams.set("poster_address", account.address);
+  if (previous)
+    requestUrl.searchParams.set(
+      "previous_spec_commitment",
+      previous.toLowerCase()
     );
+  const authorization = await signPosterRequest({
+    requestUrl,
+    markdown,
+    config,
+    account,
+    publicClient
+  });
+  let response;
+  try {
+    response = bountyReviewResponseSchema.parse(
+      await postText(requestUrl, markdown, "text/markdown", authorization)
+    );
+  } catch (error) {
+    if (error instanceof ApiRequestError && error.code === "bounty_challenge_not_ready") {
+      console.log(
+        JSON.stringify({
+          event: "review.not_ready",
+          issues: error.issues,
+          prior_issues_resolved: error.priorIssuesResolved,
+          prior_issues_open: error.priorIssuesOpen
+        })
+      );
+      process.exitCode = 2;
+      return;
+    }
+    throw error;
   }
-  const escrowTokenAddress = env.ELGORA_ESCROW_TOKEN_ADDRESS?.trim();
-  if (!escrowTokenAddress || !isHexAddress(escrowTokenAddress)) {
+  if (response.content_record.spec_commitment !== commitment) {
     throw new Error(
-      "ELGORA_ESCROW_TOKEN_ADDRESS must be a 20-byte EVM address"
+      "Elgora API returned a review for different bounty_challenge.md bytes"
     );
   }
-  return {
-    ...clientConfig,
-    rpcUrl,
-    posterPrivateKey: posterPrivateKey.toLowerCase(),
-    escrowTokenAddress: escrowTokenAddress.toLowerCase()
-  };
-}
-
-// src/required-env.ts
-function missingRequiredEnv(required4, env) {
-  return required4.filter((envName) => !env[envName]?.trim());
+  if (signoffOut)
+    await writeFile3(
+      signoffOut,
+      `${JSON.stringify(response.readiness.signoff, null, 2)}
+`
+    );
+  console.log(
+    JSON.stringify({
+      event: "review.ready",
+      spec_commitment: commitment,
+      signoff: response.readiness.signoff,
+      warnings: response.readiness.warnings ?? [],
+      prior_issues_resolved: response.readiness.prior_issues_resolved,
+      prior_issues_open: response.readiness.prior_issues_open
+    })
+  );
 }
 
 // src/roster-add-guardian.ts
 import { isAddress as isAddress4 } from "viem";
-import { privateKeyToAccount as privateKeyToAccount9 } from "viem/accounts";
+import { privateKeyToAccount as privateKeyToAccount10 } from "viem/accounts";
 var ROSTER_ADMIN_ADDRESS_FLAG = "--roster-admin-address";
 var ENCRYPTION_PUBLIC_KEY_RE = /^[A-Za-z0-9_-]{43}$/;
-async function main10(env = process.env, argv = process.argv.slice(2)) {
+async function main11(env = process.env, argv = process.argv.slice(2)) {
   const args = parseRosterAddGuardianArgs(argv);
   const config = loadRosterAddGuardianConfig(env, args.rosterAdminAddress);
-  const account = config.rosterAdminPrivateKey ? privateKeyToAccount9(config.rosterAdminPrivateKey) : null;
+  const account = config.rosterAdminPrivateKey ? privateKeyToAccount10(config.rosterAdminPrivateKey) : null;
   const rosterAdmin = account?.address ?? args.rosterAdminAddress;
   if (!rosterAdmin) throw new Error("Roster admin address is required");
   const normalizedRosterAdmin = rosterAdmin.toLowerCase();
@@ -7718,7 +7913,7 @@ function usageError2() {
 // src/roster-prepare-guardian-proof.ts
 import { isAddress as isAddress5 } from "viem";
 var ENCRYPTION_PUBLIC_KEY_RE2 = /^[A-Za-z0-9_-]{43}$/;
-async function main11(env = process.env, argv = process.argv.slice(2)) {
+async function main12(env = process.env, argv = process.argv.slice(2)) {
   const args = parseArgs(argv);
   const envWithDefaults = withDeploymentDefaults(env);
   const { chainId, hubAddress } = loadPublicDeploymentConfig(envWithDefaults);
@@ -7765,17 +7960,17 @@ function usageError3() {
 }
 
 // src/roster-verify-guardian-proof.ts
-import { readFile as readFile5 } from "fs/promises";
-import { isAddress as isAddress6, isHex as isHex5, recoverMessageAddress } from "viem";
-async function main12(_env = process.env, argv = process.argv.slice(2)) {
+import { readFile as readFile6 } from "fs/promises";
+import { isAddress as isAddress6, isHex as isHex6, recoverMessageAddress } from "viem";
+async function main13(_env = process.env, argv = process.argv.slice(2)) {
   const [preparedPath, responsePath] = argv;
   if (!preparedPath || !responsePath) {
     throw new Error(
       "Usage: elgora-cli roster:verify-guardian-proof <prepared_json_path> <response_json_path>"
     );
   }
-  const prepared = parsePrepared(await readFile5(preparedPath, "utf8"));
-  const response = parseResponse(await readFile5(responsePath, "utf8"));
+  const prepared = parsePrepared(await readFile6(preparedPath, "utf8"));
+  const response = parseResponse(await readFile6(responsePath, "utf8"));
   const fixture = base64UrlToBytes(prepared.fixture);
   const signedPayload = buildGuardianRosterKeyProofSignedPayload(
     prepared.message,
@@ -7839,7 +8034,7 @@ function parseResponse(text) {
   }
   const guardianAccount = get(parsed, "guardian_account");
   const signature = get(parsed, "signature");
-  if (typeof guardianAccount !== "string" || !isAddress6(guardianAccount) || typeof signature !== "string" || !isHex5(signature) || signature.length !== 132) {
+  if (typeof guardianAccount !== "string" || !isAddress6(guardianAccount) || typeof signature !== "string" || !isHex6(signature) || signature.length !== 132) {
     throw new Error(
       "Guardian response JSON must be the unmodified stdout of guardian:prove-roster-key"
     );
@@ -7857,10 +8052,10 @@ function get(value, key) {
 }
 
 // src/spec-commitment.ts
-import { readFile as readFile6 } from "fs/promises";
+import { readFile as readFile7 } from "fs/promises";
 import { text as readStdinText4 } from "stream/consumers";
 var SPEC_COMMITMENT_USAGE = "Usage: elgora-cli spec-commitment <bounty_challenge_md_path>\n   or: elgora-cli spec-commitment -";
-async function main13(_env = process.env, argv = process.argv.slice(2)) {
+async function main14(_env = process.env, argv = process.argv.slice(2)) {
   const markdown = await readBountyChallengeMarkdown3(argv);
   const specCommitment = deriveBountyChallengeContentCommitment(markdown);
   console.log(
@@ -7879,23 +8074,23 @@ async function readBountyChallengeMarkdown3(argv) {
   if (path5 === "-") {
     return readStdinText4(process.stdin);
   }
-  return readFile6(path5, "utf8");
+  return readFile7(path5, "utf8");
 }
 
 // src/submit.ts
-import { readdir, readFile as readFile7, stat } from "fs/promises";
+import { readdir, readFile as readFile8, stat } from "fs/promises";
 import path3 from "path";
 import { createInterface } from "readline";
 import { isAddress as isAddress7 } from "viem";
-import { privateKeyToAccount as privateKeyToAccount10 } from "viem/accounts";
+import { privateKeyToAccount as privateKeyToAccount11 } from "viem/accounts";
 
 // src/external-api-approval-signer.ts
-import { isHex as isHex6 } from "viem";
+import { isHex as isHex7 } from "viem";
 function createExternalApiApprovalSigner(input) {
   return async (typedData) => {
     input.writePrompt(input.renderPrompt(typedData));
     const signature = (await input.readSignature())?.trim();
-    if (!signature || signature === "0x" || !isHex6(signature)) {
+    if (!signature || signature === "0x" || !isHex7(signature)) {
       throw new Error(
         "External signer must return one non-empty 0x-prefixed hex signature line on stdin"
       );
@@ -7937,13 +8132,13 @@ var MEDIA_TYPE_BY_EXTENSION = {
   diff: "text/x-diff"
 };
 var DEFAULT_MEDIA_TYPE = "application/octet-stream";
-async function main14(env = process.env, argv = process.argv.slice(2)) {
+async function main15(env = process.env, argv = process.argv.slice(2)) {
   const { solverAddress, argv: argvWithoutSolverAddress } = extractSolverAddressFlag(argv);
   const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argvWithoutSolverAddress);
   const config = loadSubmitConfig(env, apiBaseUrlOverride, solverAddress);
   const args = readSubmitArgs(remainingArgv);
   const bountyIdText = args.bountyId.toString();
-  const account = config.solverPrivateKey ? privateKeyToAccount10(config.solverPrivateKey) : null;
+  const account = config.solverPrivateKey ? privateKeyToAccount11(config.solverPrivateKey) : null;
   const solverAddressFromConfig = account?.address ?? config.solverAddress;
   if (!solverAddressFromConfig) throw new Error("Solver address is required");
   const solver = solverAddressFromConfig.toLowerCase();
@@ -8335,7 +8530,7 @@ async function readArtifactDirectory(artifactDir) {
   }
   return Promise.all(
     entries.map(async (entry) => {
-      const bytes = await readFile7(path3.join(artifactDir, entry.name));
+      const bytes = await readFile8(path3.join(artifactDir, entry.name));
       return {
         name: entry.name,
         media_type: guessMediaType(entry.name),
@@ -8404,7 +8599,7 @@ async function requestPrepareSubmission(input) {
           })
         );
       }
-      await new Promise((resolve) => setTimeout(resolve, retryDelay));
+      await new Promise((resolve2) => setTimeout(resolve2, retryDelay));
     }
   }
 }
@@ -8448,7 +8643,7 @@ function readTimelockRevealDelaySeconds(env) {
 
 // src/verification-record.ts
 var VERIFICATION_RECORD_USAGE = "Usage: elgora-cli verification-record <bounty_id>";
-async function main15(env = process.env, argv = process.argv.slice(2)) {
+async function main16(env = process.env, argv = process.argv.slice(2)) {
   const { apiBaseUrl: apiBaseUrlOverride, argv: remainingArgv } = extractApiBaseUrlFlag(argv);
   const args = readVerificationRecordArgs(remainingArgv);
   const envWithDefaults = withDeploymentDefaults(env);
@@ -8533,15 +8728,16 @@ var COMMANDS = {
   "guardian:verdict": main7,
   "guardian:deliver-key": main4,
   "poster:open-winning-submission": main8,
+  "poster:review": main10,
   "poster:publish-fund": main9,
-  "roster:add-guardian": main10,
-  "roster:prepare-guardian-proof": main11,
-  "roster:verify-guardian-proof": main12,
-  "solver:submit": main14,
+  "roster:add-guardian": main11,
+  "roster:prepare-guardian-proof": main12,
+  "roster:verify-guardian-proof": main13,
+  "solver:submit": main15,
   claim: main2,
   "check-page": main,
-  "spec-commitment": main13,
-  "verification-record": main15
+  "spec-commitment": main14,
+  "verification-record": main16
 };
 var COMMAND_HELP = {
   "guardian:judgeable": {
@@ -8610,10 +8806,23 @@ var COMMAND_HELP = {
     ],
     apiBaseUrlFlag: true
   },
+  "poster:review": {
+    usage: "elgora-cli poster:review <path|-> [--previous <commitment>] [--signoff-out <file>]",
+    title: "Review a bounty page and save its readiness certificate.",
+    description: "Send the exact Markdown for a signed readiness review. Ready prints\n  review.ready; --signoff-out saves the certificate for publication.\n  Not-ready prints all issues and exits 2; other failures exit 1.\n  --previous sends the previous page commitment with the signed request.",
+    required: ["ELGORA_POSTER_PRIVATE_KEY"],
+    defaulted: [
+      "ELGORA_CHAIN_ID",
+      "ELGORA_HUB_ADDRESS",
+      "ELGORA_RPC_URL",
+      "ELGORA_API_BASE_URL"
+    ],
+    apiBaseUrlFlag: true
+  },
   "poster:publish-fund": {
-    usage: "elgora-cli poster:publish-fund <bounty_challenge_md_path|->",
+    usage: "elgora-cli poster:publish-fund <bounty_challenge_md_path|-> --signoff <file>",
     title: "Publish an approved challenge and fund its bounty.",
-    description: "Read the exact approved bounty_challenge.md bytes and publish them through\n  Elgora's API. Eligible wallets sign a USDC authorization, then send\n  one funding transaction and pay gas. No new allowance is required;\n  this authorization path does not revoke existing allowances.\n  Unsupported accounts use approval then creation. Pass '-' to read stdin.",
+    description: "Read the exact approved bounty_challenge.md bytes and its saved certificate.\n  Publishing checks the certificate and never runs another AI review.\n  Eligible wallets sign a USDC authorization, then send\n  one funding transaction and pay gas. No new allowance is required;\n  this authorization path does not revoke existing allowances.\n  Unsupported accounts use approval then creation. Pass '-' to read stdin.",
     required: ["ELGORA_POSTER_PRIVATE_KEY"],
     defaulted: [
       "ELGORA_CHAIN_ID",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elgora/cli",
-  "version": "8.0.0",
+  "version": "9.1.0",
   "description": "Command-line client for Elgora, a decentralized bounty marketplace for science. Lets Posters, Solvers, and Guardians interact with Elgora's public API and on-chain contracts.",
   "type": "module",
   "license": "MIT",