submit: finfold-growth-mission

[joeymilano]

X-Agent MCP Hackathon submission

• Submission directory: submissions/mcp-hackathon/finfold-growth-mission/
• Live API: https://api.finfold.app
• OpenAPI: https://api.finfold.app/openapi.json
• Review commit: 65a4a545ca74b0e357973de433fd108c375531bc
• Source repository: https://github.com/joeymilano/finfold-growth-mission-api

What reviewers can verify

• One public business URL becomes one evidence-bound growth mission, one platform-native asset, one tracked CTA, and one measurable outcome loop.
• Live health and deployment-proof endpoints return the exact review commit above.
• The committed production benchmark covers LinkedIn, X, Reddit, Xiaohongshu, and WeChat: 20/20 successful calls, 100% first-attempt success, 22,548 ms p95, and 4/4 successes per platform.
• The package includes 56 passing Worker-runtime unit and integration tests, including full MCP create-read-outcome-read coverage.
• Exact claim-to-evidence validation, SSRF defenses, scoped hashed keys, idempotency, attribution, outcome-window checks, currency checks, retention, and log redaction are implemented and documented.
• Redacted live mission and authenticated MCP discovery artifacts are included under source/verification/.

Submitter confirmation

• This PR changes one submission directory only.
• source/ contains the complete review source and no secrets or private data.
• RIGHTS.md identifies the submitter, third-party licenses, and archive authorization.
• The public health check reports the exact review commit.
• /.well-known/xagent-verification.json reports the same slug and commit.
• I have the right to submit this code, service, dependencies, and data for review.
• I understand that passing X-Agent review does not promise OKX acceptance, listing, traffic, or revenue.
• I understand that closing an unmerged PR withdraws the entry, and that accepted or rewarded source remains in the official archive.

Validation status

• Source CI is green for the review commit.
• Official offline and online validators pass locally against the package and live deployment.
• The official receipt workflow is green.
• The official validation workflow currently shows action_required with no jobs and requires repository-side approval; the maintainer has confirmed the earlier workflow failure was not a project failure or rejection.
• Manual scorecard and award decision remain pending reviewer assessment.

[joeymilano]

The submission package passes both official validators locally, including the online GitHub commit, health binding, and same-origin deployment-proof checks.

The current CI failure occurs before the validator runs. The pull_request_target job fails while checking out the fork commit with:

Refusing to check out fork pull request code from a pull_request_target workflow ... set allow-unsafe-pr-checkout: true on the actions/checkout step.

Run: https://github.com/xagentAI/xagt-plugin/actions/runs/33610319553/job/100183662977

Because the trusted workflow comes from the base branch and this PR must change one submission directory only, the submission cannot safely patch that workflow. Please update the official workflow checkout/fetch pattern and rerun the checks. Review commit and live proof remain bound to 0c69c6e5f717c3fea41db3f30ee8f60ed7762da7.

[lessthanno]

Submission received: Finfold Growth Mission API

Thank you for submitting to the current X-Agent MCP Hackathon. We have received this PR and can see the source files included under submissions/mcp-hackathon/finfold-growth-mission/source/.

This confirms receipt only. It does not mean the entry has passed eligibility checks, technical review, judging, or been selected for an award. Passing automated checks or a future merge for archival purposes does not, by itself, mean any of those decisions have been made.

Source retention: As required by the submission instructions, the complete source for the submitted capability must be included in this repository, with the dependency files and instructions needed to reproduce it. An external repository link alone is not sufficient. This allows X-Agent to retain the submitted version even if the original repository later becomes unavailable. Please exclude secrets, credentials, and private user data, and clearly document any external or private services the project depends on.

Current check failure: We confirmed that the repository's workflow stops before the submission validator runs. This requires a workflow fix on our side; it is not a rejection of your entry or evidence that your project failed review. Official validation has not yet completed, and you do not need to change your project to resolve this particular workflow error.

[github-actions]

Submission received — #34

Thank you for submitting to the current X-Agent MCP Hackathon. We have received your pull request.

This is a receipt only. It does not confirm eligibility, completeness, technical approval, a judging result, or an award. Passing automated checks or merging code for archival purposes does not, by itself, mean the entry has passed review or won a prize.

Please include the complete source for the submitted capability in this repository under submissions/mcp-hackathon/<slug>/source/, with dependency files, configuration examples, and reproducible setup/build instructions. An external repository link alone is not sufficient. The official copy is intended to remain available if the original repository later becomes unavailable. Do not include secrets, credentials, or private user data; clearly disclose external and private-service dependencies.

The automated checks report technical checks separately. A workflow failure is not a judging decision. Keep updates in this PR while submissions remain open, and keep the documented source version and deployment evidence consistent.

See the submission instructions. Final review results and awards will be announced separately through the official event channels.

[joeymilano]

Submission update (2026-09-03): the review package now points to public commit 65a4a545ca74b0e357973de433fd108c375531bc, and both live proof endpoints return that exact SHA. The official offline and online validators pass locally. The updated source has 56 passing Worker-runtime tests and a committed five-platform production report: 20/20 successful calls, 100% first-attempt success, 22,548 ms p95, and every platform at 4/4. It also includes redacted live mission and authenticated MCP discovery evidence. The new pull_request validation run is currently marked action_required with no jobs; please approve it when the repository review path is ready, then rerun the official validation.