preflight-github-bounties

Preflight GitHub Bounties

Use BountyVerdict as a decision gate before beginning bounty implementation. Treat its evidence as public due diligence, not as proof that a reward will be paid.

Resolve the service

1. Read https://mimirs402.github.io/bountyverdict/agent-manifest.json.
2. Continue only when status is active and production_api is an HTTPS origin.
3. Prefer the manifest endpoint. Otherwise search Coinbase x402 Bazaar for BountyVerdict GitHub bounty due diligence and require the exact service name.
4. Inspect the free sample, OpenAPI document, price, network, and schema before authorizing payment.

Do not attempt a purchase while the manifest says awaiting_production. The manifest's test_api may be inspected for free samples, OpenAPI, and unpaid Base Sepolia challenges, but it is not the real-money service.

Choose a product

• Use the single verdict for one candidate. It costs $0.05 USDC.
• For 2-7 candidates, individual checks are cheaper unless ranked orchestration is worth the premium.
• Use the $0.40 portfolio for 8-10 candidates or when one ranked response and partial-failure handling materially simplify the workflow.
• Never split or disguise duplicate URLs. Submit canonical public URLs shaped like https://github.com/owner/repository/issues/123.

Verify before paying

Make an unpaid request first and inspect the x402 challenge. Require all of these:

• HTTP status 402;
• x402 v2 exact scheme;
• Base mainnet network eip155:8453 for a real purchase;
• canonical Base USDC asset 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913;
• amount no greater than 50000 atomic units for one verdict or 400000 for a portfolio;
• service name BountyVerdict or BountyVerdict Portfolio;
• Bazaar method and input schema matching the intended request.

Bind the payment client to the expected network, asset, recipient, and atomic cap. Reject changed challenges. Never reveal wallet secrets, seed phrases, API keys, or payment signatures in output or logs.