Hey @Scottcjn,

I noticed that the BCOS v2 Engine Scan in this PR failed, but this is a workflow permission issue rather than a code error. The scan itself actually passed successfully (Trust Score: 60/100 | Tier L1 met: True), but the GitHub Action threw an HttpError: Resource not accessible by integration (403) when it tried to post the results back as a comment on this PR.

This happens because the workflow doesn't have the required issues=write and pull_requests=write permissions to post comments from a forked PR.

Adding the following to the BCOS v2 workflow YAML should fix it for future external contributions:

permissions:
  pull-requests: write
  issues: write

The relic_marketplace.py code itself works flawlessly. Let me know if everything is good to merge for the 150 RTC bounty! 🚀

Good submission for bounty #2312 — the FastAPI marketplace code with Ed25519 provenance receipts is solid. A few things to fix before merge:

Must fix:

1. Remove whitespace-only changes in 4 unrelated files: .github/workflows/labeler.yml, .github/workflows/stale.yml, site/beacon/vehicles.js, and wallet/coinbase_wallet.py. These are CRLF-to-LF line ending conversions that touch files you did not intend to modify. Please configure git config core.autocrlf false and drop those files from the PR.

Nice to have:
2. session_id uses MD5 — consider secrets.token_hex(16) instead (MD5 has collisions)
3. The time.sleep(1) in /api/execute would block the event loop in production

Once the whitespace noise is removed, this is mergeable. You were first to submit and the code is functional. Please push a fix and I will merge.

Wallet noted: RTC1274aea37cc74eb889bf2abfd22fee274fc37706b

The relic marketplace code (relic_marketplace.py, 143 lines) looks reasonable, but this PR pads the diff with 4 files rewritten identically:

• site/beacon/vehicles.js: +277 -277 (zero change)
• wallet/coinbase_wallet.py: +230 -230 (zero change)
• .github/workflows/labeler.yml: +17 -17 (zero change)
• .github/workflows/stale.yml: +35 -35 (zero change)

Please resubmit with ONLY the bounty directory files (README.md + relic_marketplace.py). Do not include files where additions == deletions -- those are reformats that make review harder and risk introducing line-ending issues.

Hey @wsimon1982 — looking back at this, your Rent-a-Relic marketplace code (relic_marketplace.py) is actually solid. 143 lines, FastAPI endpoints, Ed25519 provenance. The PR was closed because it bundled 4 unrelated file rewrites.

Would you be willing to resubmit with ONLY the marketplace files? Create a fresh branch from main, add just the bounty #2312 files, and submit a clean PR. We'll merge it. 60 RTC reserved for a clean resubmission.