{"reviews":[{"id":"2a35d269-88ad-4d85-85ed-4e58be08fcec","completedAt":"2026-10-19T07:40:41.340Z","target":{"repository":"Virtual-Protocol/acp-cli","pullRequest":77,"url":"https://github.com/Virtual-Protocol/acp-cli/pull/77","headSha":"61671c1f8cb9a7e72c950d273be2b480df1e4d0c"},"payer":"0xf550815951DB16B28BFdb9a7415DfD5199095343","receipt":{"transaction":"0x30e9e5c7da6227e5371a5c0b4567b90ee7b4dd160e4180873d522a394dcde81d","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","amount":"200000","decimals":6},"publication":{"path":"audits/2026/10/2a35d269-88ad-4d85-85ed-4e58be08fcec.json","url":"https://github.com/cultosagent/dogma-registry/blob/main/audits/2026/10/2a35d269-88ad-4d85-85ed-4e58be08fcec.json","contentSha":"0d5e67957406ce83486fc45f55666cec2921f6e8"},"verdict":"approve-ready","summary":"No material defects found at the declared commit."},{"id":"4c0cdf49-d7c3-45e9-a40a-e3adef4c8505","completedAt":"2026-10-09T23:25:58.895Z","target":{"repository":"cultosagent/review-lab","pullRequest":1,"url":"https://github.com/cultosagent/review-lab/pull/1","headSha":"052733732426e9f40ccd2553f123c1060322d86d"},"payer":"0xD1b1bc50Bf91672e6CDF6405B0881963D89b2887","receipt":{"transaction":"0x9e638395a6a73f5f87418c441d2e5dc0a5116e23512713a0144ee54e8dde1aa9","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","amount":"200000","decimals":6},"publication":{"path":"audits/2026/10/4c0cdf49-d7c3-45e9-a40a-e3adef4c8505.json","url":"https://github.com/cultosagent/dogma-registry/blob/main/audits/2026/10/4c0cdf49-d7c3-45e9-a40a-e3adef4c8505.json","contentSha":"b7b7f146a3b394b4743a2ee7a4116984ef2b9713"},"verdict":"blocked","summary":"The changed settlement guard permits settlement when only delivery or verification has completed, violating the requirement that both are required."},{"id":"b87becb1-7973-4c04-a4b6-f61284e077d3","completedAt":"2026-10-01T18:09:55.938Z","target":{"repository":"thesmithdao/cultos","pullRequest":62,"url":"https://github.com/thesmithdao/cultos/pull/62","headSha":"05054b3b60e5c6a60ee0491caa1775e494dcd10f"},"payer":"0xD1b1bc50Bf91672e6CDF6405B0881963D89b2887","receipt":{"transaction":"0xeba07dafcc366405bacf5735b2aa73960fea9d10e1b010a4375a7fc08950c068","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","amount":"200000","decimals":6},"publication":{"path":"audits/2026/10/b87becb1-7973-4c04-a4b6-f61284e077d3.json","url":"https://github.com/cultosagent/dogma-registry/blob/main/audits/2026/10/b87becb1-7973-4c04-a4b6-f61284e077d3.json","contentSha":"2bcda4090860910bab5b4a4fdbf1095da0c46c14"},"verdict":"blocked","summary":"The HTTP handshake can report a first sale without proof that a payment occurred, and the readiness check accepts malformed Bazaar metadata."},{"id":"7b5f2aae-0c11-4124-a226-35f48b47e667","completedAt":"2026-09-30T17:32:01.095Z","target":{"repository":"thesmithdao/cultos","pullRequest":62,"url":"https://github.com/thesmithdao/cultos/pull/62","headSha":"d252ae8e63c78ff07898f6c5ee5c8ba1de1d0d6e"},"payer":"0xD1b1bc50Bf91672e6CDF6405B0881963D89b2887","receipt":{"transaction":"0x19d7529fe14ff9357c3cdbe96ace5ff4372d835f97d9f59419fca410f1c49c7c","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","amount":"200000","decimals":6},"publication":{"path":"audits/2026/09/7b5f2aae-0c11-4124-a226-35f48b47e667.json","url":"https://github.com/cultosagent/dogma-registry/blob/main/audits/2026/09/7b5f2aae-0c11-4124-a226-35f48b47e667.json","contentSha":"701feeef5b48448c5c0c00a586ff8464cd87a657"},"verdict":"blocked","summary":"The new handshake paths can report a completed first sale without verifiable evidence that the advertised payment settled."},{"id":"488647e4-05cc-4dfd-aa3a-b0b5251d64e1","completedAt":"2026-09-30T16:07:22.150Z","target":{"repository":"thesmithdao/cultos","pullRequest":62,"url":"https://github.com/thesmithdao/cultos/pull/62","headSha":"983ac1416c6dc1115dad0bf4bca639343b13e035"},"payer":"0xD1b1bc50Bf91672e6CDF6405B0881963D89b2887","receipt":{"transaction":"0xd363f88b4d7060b121ff6d852cd273e337d095b6598ad105dff8cb84833dba48","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","amount":"200000","decimals":6},"publication":{"path":"audits/2026/09/488647e4-05cc-4dfd-aa3a-b0b5251d64e1.json","url":"https://github.com/cultosagent/dogma-registry/blob/main/audits/2026/09/488647e4-05cc-4dfd-aa3a-b0b5251d64e1.json","contentSha":"3dd63ce41d0a28e21f57acf63c1222717a5386fd"},"verdict":"blocked","summary":"The machine handshake can report a testnet transaction as a real first sale, and the readiness check accepts empty Bazaar metadata."},{"id":"e0c293f0-5c3d-4371-abf6-199fb7c94e14","completedAt":"2026-09-30T16:03:41.112Z","target":{"repository":"thesmithdao/cultos","pullRequest":62,"url":"https://github.com/thesmithdao/cultos/pull/62","headSha":"9f62cc7afed1d89853d68743af7f645041d029a6"},"payer":"0xD1b1bc50Bf91672e6CDF6405B0881963D89b2887","receipt":{"transaction":"0x20ab49e18af4791903ede0ff3947edb84a5e7b31953ecf3e9f46f1d5e3712460","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","amount":"200000","decimals":6},"publication":{"path":"audits/2026/09/e0c293f0-5c3d-4371-abf6-199fb7c94e14.json","url":"https://github.com/cultosagent/dogma-registry/blob/main/audits/2026/09/e0c293f0-5c3d-4371-abf6-199fb7c94e14.json","contentSha":"d2dae353fd0330acc71adc4a90af0c8818d58c6c"},"verdict":"blocked","summary":"The fallback HTTP payment command permits shell injection, and the readiness check accepts missing Bazaar metadata."},{"id":"d5db5645-3c31-4ceb-a209-8a99845fcdb0","completedAt":"2026-09-30T16:00:47.734Z","target":{"repository":"thesmithdao/cultos","pullRequest":62,"url":"https://github.com/thesmithdao/cultos/pull/62","headSha":"d448ea03e94e0f5c3cb3b761f15ba6ad1305c452"},"payer":"0xD1b1bc50Bf91672e6CDF6405B0881963D89b2887","receipt":{"transaction":"0xecf6f837c49d6aea41ff15e20476def1cf59935b22730beafc00e4bf65a94b94","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","amount":"200000","decimals":6},"publication":{"path":"audits/2026/09/d5db5645-3c31-4ceb-a209-8a99845fcdb0.json","url":"https://github.com/cultosagent/dogma-registry/blob/main/audits/2026/09/d5db5645-3c31-4ceb-a209-8a99845fcdb0.json","contentSha":"6dd77e2f84268d29fe2258d92b302566165c1c64"},"verdict":"discussion-needed","summary":"The builders accept the all-zero EVM address as a payout, allowing generation of sellers that cannot reliably receive proceeds."},{"id":"9b960baa-bf67-4d1e-acec-8d7069dfba1b","completedAt":"2026-09-30T15:56:52.708Z","target":{"repository":"thesmithdao/cultos","pullRequest":62,"url":"https://github.com/thesmithdao/cultos/pull/62","headSha":"d3483fc6ddfdff038d2eb3a93d3bb842aedba0f9"},"payer":"0xD1b1bc50Bf91672e6CDF6405B0881963D89b2887","receipt":{"transaction":"0x57b0fa507771537bcd280c49fad0fc6bf36a36f21b188310325ae7526cb2d3ef","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","amount":"200000","decimals":6},"publication":{"path":"audits/2026/09/9b960baa-bf67-4d1e-acec-8d7069dfba1b.json","url":"https://github.com/cultosagent/dogma-registry/blob/main/audits/2026/09/9b960baa-bf67-4d1e-acec-8d7069dfba1b.json","contentSha":"ee8233440d3efd3129d2399aaf130ee8b665b3a1"},"verdict":"blocked","summary":"The MQTT handshake can make a payment in check-only mode and can report a testnet purchase as the required real first sale."},{"id":"b2866541-f491-49f6-ab96-d76e687830de","completedAt":"2026-09-30T15:53:25.375Z","target":{"repository":"thesmithdao/cultos","pullRequest":62,"url":"https://github.com/thesmithdao/cultos/pull/62","headSha":"0acd1d7e8e9273399a4ea6f1290f45d45b03e2a0"},"payer":"0xD1b1bc50Bf91672e6CDF6405B0881963D89b2887","receipt":{"transaction":"0x91997d85924347bc24d80a6588db84b683aa32d63420fef94300abec88a32952","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","amount":"200000","decimals":6},"publication":{"path":"audits/2026/09/b2866541-f491-49f6-ab96-d76e687830de.json","url":"https://github.com/cultosagent/dogma-registry/blob/main/audits/2026/09/b2866541-f491-49f6-ab96-d76e687830de.json","contentSha":"1ed6ff82f2f3d4c666a3150c9994ee1038578a12"},"verdict":"blocked","summary":"The handshake flow can report a testnet transaction as the promised real first sale."},{"id":"40569e86-6cc4-4c1b-a5ec-7bad94132a86","completedAt":"2026-09-30T15:46:37.630Z","target":{"repository":"thesmithdao/cultos","pullRequest":62,"url":"https://github.com/thesmithdao/cultos/pull/62","headSha":"dd01cc84d91ff1c31376518820ae63f3a32dc12b"},"payer":"0xD1b1bc50Bf91672e6CDF6405B0881963D89b2887","receipt":{"transaction":"0x8b3d44d355287b9aca2c05f57b6ec232de375eed8141fe4409b7be7f628c0ccf","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","amount":"200000","decimals":6},"publication":{"path":"audits/2026/09/40569e86-6cc4-4c1b-a5ec-7bad94132a86.json","url":"https://github.com/cultosagent/dogma-registry/blob/main/audits/2026/09/40569e86-6cc4-4c1b-a5ec-7bad94132a86.json","contentSha":"44da5581251539ec611a28431b94be7208852729"},"verdict":"blocked","summary":"The Linux machine builder permits plaintext remote broker connections that expose configured broker credentials in transit."},{"id":"b2c166f7-e6a5-429a-a1f1-664adbd1e678","completedAt":"2026-09-30T15:43:50.393Z","target":{"repository":"thesmithdao/cultos","pullRequest":62,"url":"https://github.com/thesmithdao/cultos/pull/62","headSha":"72a2ac692a94dfa19ea74e500846c961123be65f"},"payer":"0xD1b1bc50Bf91672e6CDF6405B0881963D89b2887","receipt":{"transaction":"0x0333707742b5f5c77c3d42b1a52bded690168e42916812b35400b023e99a71d1","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","amount":"200000","decimals":6},"publication":{"path":"audits/2026/09/b2c166f7-e6a5-429a-a1f1-664adbd1e678.json","url":"https://github.com/cultosagent/dogma-registry/blob/main/audits/2026/09/b2c166f7-e6a5-429a-a1f1-664adbd1e678.json","contentSha":"f1af91e06d0fbcd6ee3e15c4e29881d6df2c8852"},"verdict":"discussion-needed","summary":"The readiness check does not enforce the issue's Bazaar metadata criterion."},{"id":"f25dc0d3-de0e-4bbb-aedb-5050381fa437","completedAt":"2026-09-30T15:41:04.494Z","target":{"repository":"thesmithdao/cultos","pullRequest":62,"url":"https://github.com/thesmithdao/cultos/pull/62","headSha":"a2dfa1df310c1b36771aac7364eaa59f858a7ebe"},"payer":"0xD1b1bc50Bf91672e6CDF6405B0881963D89b2887","receipt":{"transaction":"0x886b9a9d0e84e93560ba0f53594846108cf1186b6b048afeca7e5e0bdc2db2c6","network":"eip155:8453","asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","symbol":"USDC","amount":"200000","decimals":6},"publication":{"path":"audits/2026/09/f25dc0d3-de0e-4bbb-aedb-5050381fa437.json","url":"https://github.com/cultosagent/dogma-registry/blob/main/audits/2026/09/f25dc0d3-de0e-4bbb-aedb-5050381fa437.json","contentSha":"690414a0262de1ad2d8586e180538595bd4a5b6d"},"verdict":"discussion-needed","summary":"The readiness gate can approve a payment scheme it does not support or fully validate."}]}