feat(bounty): add video bug-report challenge

.github/workflows/ghcr-public.yml

@@ -29,6 +29,7 @@ jobs:
             "base/updater"
             "base/prism-challenge"
             "base/design-challenge"
+            "base/bounty-challenge"
             "base/design-egress-proxy"
             "base/design-runtime"
           )

.github/workflows/images.yml

@@ -57,6 +57,9 @@ jobs:
           - target: design-challenge
             image_suffix: design-challenge
             dockerfile: deploy/Dockerfile
+          - target: bounty-challenge
+            image_suffix: bounty-challenge
+            dockerfile: deploy/Dockerfile
           - target: design-egress-proxy
             image_suffix: design-egress-proxy
             dockerfile: deploy/Dockerfile
@@ -169,6 +172,7 @@ jobs:
               "updater",
               "prism-challenge",
               "design-challenge",
+              "bounty-challenge",
               "design-egress-proxy",
               "design-runtime",
               "design-review",
@@ -239,10 +243,10 @@ jobs:
           cp "$SRC" "deploy/digests/${SHA}.json"
           echo "Recorded digest manifest: deploy/digests/${SHA}.json"
           chmod +x deploy/scripts/promote.sh
-          # Pin services only (validator/gateway/updater/prism-challenge/design-challenge).
+          # Pin services only (validator/gateway/updater/prism/design/bounty).
           # --skip-backup: this job records CI digests; Spaces/PG backup runs at
           # prod promote (deploy-prod.yml, fail-closed).
-          for svc in validator gateway updater prism-challenge design-challenge; do
+          for svc in validator gateway updater prism-challenge design-challenge bounty-challenge; do
             IMAGE=$(python3 -c '
           import json, sys
           d = json.load(open(sys.argv[1]))
@@ -261,7 +265,7 @@ jobs:
           import json, sys
           p = json.load(open("deploy/pins/staging.json"))
           assert p["commit_sha"] == sys.argv[1], (p["commit_sha"], sys.argv[1])
-          for s in ("validator", "gateway", "updater", "prism-challenge", "design-challenge"):
+          for s in ("validator", "gateway", "updater", "prism-challenge", "design-challenge", "bounty-challenge"):
               assert s in p["services"], s
               assert p["services"][s]["digest"].startswith("sha256:")
           print("staging pins ok", p["commit_sha"])
@@ -310,6 +314,7 @@ jobs:
             "base/updater"
             "base/prism-challenge"
             "base/design-challenge"
+            "base/bounty-challenge"
             "base/design-egress-proxy"
             "base/design-runtime"
             "base/design-review"

AGENTS.md

@@ -28,7 +28,7 @@ Working branch: **`main`**. Prod ships from annotated tags `v*.*.*` cut on `main
 | Key | Who | Needed for |
 |-----|-----|------------|
 | `gateway_sk` | Gateway | Bundle **seal** signatures (`POST /v1/admin/seal`) |
-| `prism_sk` / `design_sk` | Challenge / smoke | Signed leaves (`POST /v1/weights/raw`); pubs must match trust root |
+| `prism_sk` / `design_sk` / `bounty_sk` | Challenge / smoke | Signed leaves (`POST /v1/weights/raw`); pubs must match trust root |
 | Gateway owner wallet + `BASE_GATEWAY_REQUIRE_OWNER` | Gateway | Master-only **identity** check (live/prod). **Not** required to seal or serve `/v1/weights/latest` |
 | Validator wallet | Validator | On-chain weight **submit** only — validators *fetch* sealed weights; they do not need a gateway wallet |
 
@@ -42,8 +42,9 @@ Each live challenge has a **separate public GitHub repo** for miners. Those repo
 |-----------|-------------|------|
 | Design | [`BaseIntelligence/design-challenge`](https://github.com/BaseIntelligence/design-challenge) | Miner docs + baseline harness |
 | Prism | [`BaseIntelligence/prism`](https://github.com/BaseIntelligence/prism) | Miner docs + recipe examples (publish / keep in sync; no control-plane code) |
+| Bounty | *(public repo follow-up)* | Miner docs mirror in [`docs/external-miner/bounty.md`](docs/external-miner/bounty.md) until published |
 
-Monorepo mirror for CI and operators: [`docs/external-miner/`](docs/external-miner/). Frozen contracts stay in this repo (`docs/DESIGN_CHALLENGE.md`, `docs/PRISM.md`, …).
+Monorepo mirror for CI and operators: [`docs/external-miner/`](docs/external-miner/). Frozen contracts stay in this repo (`docs/DESIGN_CHALLENGE.md`, `docs/PRISM.md`, `docs/BOUNTY_CHALLENGE.md`, …).
 
 **When a challenge product or public API changes**, agents **must** update:
 
@@ -90,7 +91,7 @@ Match CI (`.github/workflows/ci.yml`):
 | Doc authority vs evidence | [`docs/AGENTS.md`](docs/AGENTS.md) |
 | Component status | [`docs/COMPLETENESS.md`](docs/COMPLETENESS.md) |
 | Frozen contracts | [`docs/BUNDLE_SPEC.md`](docs/BUNDLE_SPEC.md), [`docs/DESIGN_CHALLENGE.md`](docs/DESIGN_CHALLENGE.md), [`docs/PRISM.md`](docs/PRISM.md) |
-| Miner HTTP submit | [`docs/external-miner/`](docs/external-miner/) · public: [design-challenge](https://github.com/BaseIntelligence/design-challenge), [prism](https://github.com/BaseIntelligence/prism) |
+| Miner HTTP submit | [`docs/external-miner/`](docs/external-miner/) · public: [design-challenge](https://github.com/BaseIntelligence/design-challenge), [prism](https://github.com/BaseIntelligence/prism) · bounty mirror: [`bounty.md`](docs/external-miner/bounty.md) |
 | Threat / operator checklist | [`docs/THREAT_MODEL.md`](docs/THREAT_MODEL.md), [`docs/OPERATOR_SECURITY.md`](docs/OPERATOR_SECURITY.md) |
 
 ## Do not commit

bins/bounty-challenge/Cargo.toml

@@ -0,0 +1,35 @@
+[package]
+name = "bounty-challenge-bin"
+description = "bounty-challenge operator binary (port 8095)"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+publish = false
+
+[[bin]]
+name = "bounty-challenge"
+path = "src/main.rs"
+
+[dependencies]
+axum = { version = "0.8", default-features = false, features = ["http1", "tokio", "json", "multipart"] }
+bounty-challenge = { path = "../../crates/bounty-challenge" }
+chain = { path = "../../crates/chain" }
+chain-live = { path = "../../crates/chain-live" }
+challenge-agentic = { path = "../../crates/challenge-agentic" }
+challenge-common = { path = "../../crates/challenge-common" }
+challenge-keys = { path = "../../crates/challenge-keys" }
+clap = { version = "4", features = ["derive", "env"] }
+crypto = { path = "../../crates/crypto" }
+db = { path = "../../crates/db" }
+hex = "0.4"
+sha2 = "0.10"
+submission-gating = { path = "../../crates/submission-gating" }
+telemetry = { path = "../../crates/telemetry" }
+tokio = { version = "1", features = ["macros", "rt-multi-thread", "net", "signal", "sync", "time"] }
+tracing = "0.1"
+trustroot = { path = "../../crates/trustroot" }
+
+[lints]
+workspace = true