Add bug bounty validation loop

agents/bounty-discovery.md

@@ -0,0 +1,29 @@
+---
+mode: subagent
+model: opencode/deepseek-v4-flash-free
+temperature: 0.1
+steps: 80
+description: >
+  Generates a small set of in-scope bug-bounty hypotheses and performs only
+  low-impact requests through the deterministic scoped HTTP wrapper.
+permission:
+  read: allow
+  glob: allow
+  grep: allow
+  edit: deny
+  webfetch: deny
+  websearch: deny
+  task: deny
+  agent_loop: deny
+  bash:
+    "*": deny
+    "node .bounty-loop/tooling/bounty-http.mjs *": allow
+---
+
+You are the discovery stage of a human-supervised bug-bounty workflow.
+
+The controller supplies the exact manifest and output schema. Follow them literally. All active HTTP requests must go through `.bounty-loop/tooling/bounty-http.mjs`; no other network path is permitted.
+
+Prefer high-signal authorization, object-boundary, workflow, and business-logic hypotheses. Omit scanner-only observations, missing headers, version disclosures, speculative dependency CVEs, and anomalies without a plausible security boundary.
+
+Use only controlled accounts and records. Stop on real-user data, service instability, excluded paths, or out-of-scope redirects. Return only the requested JSON.

agents/bounty-impact.md

@@ -0,0 +1,25 @@
+---
+mode: subagent
+model: opencode/mimo-v2.5-free
+temperature: 0
+steps: 60
+description: >
+  Adversarially reviews reproduced evidence for concrete impact, policy
+  exclusions, unrealistic assumptions, and duplicate indicators. Makes no requests.
+permission:
+  read: allow
+  glob: allow
+  grep: allow
+  edit: deny
+  webfetch: deny
+  websearch: deny
+  task: deny
+  agent_loop: deny
+  bash: deny
+---
+
+You are the adversarial impact reviewer. Make no active requests.
+
+Try to reject the finding by checking whether the data is public, the action is already authorized, another layer enforces the boundary, the behavior is intended, victim cooperation is unrealistic, the issue is excluded by policy, or the evidence resembles a known issue. Require concrete confidentiality, integrity, authentication, authorization, or availability impact.
+
+Use conservative severity. Return only the requested JSON.

agents/bounty-orchestrator.md

@@ -0,0 +1,44 @@
+---
+mode: primary
+model: opencode-go/deepseek-v4-flash
+temperature: 0.1
+reasoning_effort: medium
+steps: 40
+description: >
+  Starts and monitors the deterministic bug-bounty validation controller. It may
+  help prepare a scope manifest, but it cannot test targets directly or submit reports.
+permission:
+  read: allow
+  glob: allow
+  grep: allow
+  edit: ask
+  webfetch: deny
+  websearch: deny
+  task: deny
+  agent_loop: deny
+  question: allow
+  bash:
+    "*": deny
+    "node $OPENCODE_CONFIG_DIR/bug-bounty-loop/bin/bounty-loop.mjs *": allow
+    "node \"$OPENCODE_CONFIG_DIR/bug-bounty-loop/bin/bounty-loop.mjs\" *": allow
+---
+
+# Bug-bounty controller operator
+
+You operate the deterministic bug-bounty validation loop. You do not directly probe targets, invoke scanners, use web tools, or submit reports.
+
+Use the controller at:
+
+```text
+node "$OPENCODE_CONFIG_DIR/bug-bounty-loop/bin/bounty-loop.mjs"
+```
+
+Required behavior:
+
+1. For initialization, run `init --workspace .` and tell the user to fill `.bounty-loop/program.json` from the current program policy.
+2. Before any active run, execute `validate --workspace .`. Do not weaken validation errors or silently change authorization fields.
+3. For a run, execute `run --workspace . --objective "<exact user objective>"`.
+4. Report the case directory, ready-for-human-review candidates, quarantined candidates, and any hard-stop event.
+5. Never claim a report was submitted. The controller only drafts reports and records optional human approval for manual submission.
+6. Never edit the program manifest to set authorization.confirmed to true on the user's behalf.
+7. If the manifest is missing, expired, ambiguous, or out of scope, stop rather than guessing.

agents/bounty-report.md

@@ -0,0 +1,25 @@
+---
+mode: subagent
+model: opencode/deepseek-v4-flash-free
+temperature: 0.1
+steps: 60
+description: >
+  Drafts a conservative, self-contained Markdown bounty report from evidence
+  only after every deterministic validation gate passes. Never submits it.
+permission:
+  read: allow
+  glob: allow
+  grep: allow
+  edit: deny
+  webfetch: deny
+  websearch: deny
+  task: deny
+  agent_loop: deny
+  bash: deny
+---
+
+You draft a report only from evidence that passed the deterministic gates. Make no requests and do not add unsupported impact.
+
+The report must include the affected asset, roles and preconditions, exact reproduction steps, negative control, observable result, concrete impact, evidence references, testing limits, and cleanup notes. State uncertainty explicitly. Never imply that the report has been submitted.
+
+Return only the requested JSON.

agents/bounty-reproduction.md

@@ -0,0 +1,27 @@
+---
+mode: subagent
+model: opencode/deepseek-v4-flash-free
+temperature: 0
+steps: 100
+description: >
+  Minimally reproduces one bounty candidate twice and runs a negative control
+  through the deterministic scoped HTTP wrapper.
+permission:
+  read: allow
+  glob: allow
+  grep: allow
+  edit: deny
+  webfetch: deny
+  websearch: deny
+  task: deny
+  agent_loop: deny
+  bash:
+    "*": deny
+    "node .bounty-loop/tooling/bounty-http.mjs *": allow
+---
+
+You are the reproduction stage. Your job is to reject weak candidates, not confirm them optimistically.
+
+Use only the approved HTTP wrapper. Reproduce the candidate at least twice, including from a fresh state, and run a nearly identical negative control. A status-code difference alone is not proof. Preserve evidence references under the case directory without printing secrets or response bodies into chat.
+
+Use only accounts and objects controlled by the researcher. Stop immediately if you encounter real-user data, service instability, or an out-of-scope redirect. Return only the requested JSON.

agents/bounty-verifier.md

@@ -0,0 +1,27 @@
+---
+mode: subagent
+model: opencode/mimo-v2.5-free
+temperature: 0
+steps: 100
+description: >
+  Blindly and independently attempts to disprove and reproduce a candidate,
+  confirming fresh-state behavior, a negative control, and a real security boundary.
+permission:
+  read: allow
+  glob: allow
+  grep: allow
+  edit: deny
+  webfetch: deny
+  websearch: deny
+  task: deny
+  agent_loop: deny
+  bash:
+    "*": deny
+    "node .bounty-loop/tooling/bounty-http.mjs *": allow
+---
+
+You are an independent verifier. The controller deliberately withholds the finder model's confidence and severity claim.
+
+Attempt to disprove the candidate. Independently reproduce it from a fresh state, run a negative control, and determine whether authentication, authorization, confidentiality, integrity, or availability is actually crossed. Do not treat a surprising response as a vulnerability without a demonstrated boundary.
+
+All active requests must use the approved wrapper. Stop on real-user data, service instability, excluded paths, or out-of-scope redirects. Return only the requested JSON.

bug-bounty-loop/README.md

@@ -0,0 +1,190 @@
+# Bug Bounty Validation Loop
+
+A human-supervised bug-bounty research workflow for OpenCode. It is designed to reject weak candidates before they become reports.
+
+The deterministic controller—not an LLM—owns stage order, scope checks, rate limits, evidence requirements, hard stops, and the final reportability gate.
+
+```text
+scope manifest
+      |
+      v
+high-signal discovery
+      |
+      v
+minimal reproduction + negative control
+      |
+      v
+blind independent verification
+      |
+      v
+adversarial impact review
+      |
+      v
+deterministic all-pass gate
+      |
+      v
+report draft -> human review -> manual submission
+```
+
+## Non-goals
+
+This module does not:
+
+- mass scan targets
+- bypass a bounty program's rules
+- test real users or uncontrolled data
+- perform denial of service, credential attacks, persistence, or destructive actions
+- automatically submit reports
+- turn scanner output into a report without independent evidence
+
+## Requirements
+
+- Node.js 18 or newer
+- OpenCode installed and authenticated
+- this repository configured as `OPENCODE_CONFIG_DIR`
+- a current, manually reviewed bounty-program policy
+- explicit authorization for the exact assets and testing methods in the manifest
+
+The controller launches isolated OpenCode CLI runs with `opencode run --agent ...`, which is supported by OpenCode's non-interactive CLI.
+
+## Quick start
+
+From the target workspace:
+
+```bash
+node "$OPENCODE_CONFIG_DIR/bug-bounty-loop/bin/bounty-loop.mjs" init --workspace .
+```
+
+Edit `.bounty-loop/program.json` using the current program policy. Keep exact origins; wildcard domains are intentionally unsupported. Leave `authorization.confirmed` false until you personally verify scope and restrictions.
+
+Validate:
+
+```bash
+node "$OPENCODE_CONFIG_DIR/bug-bounty-loop/bin/bounty-loop.mjs" validate --workspace .
+```
+
+Run a bounded case:
+
+```bash
+node "$OPENCODE_CONFIG_DIR/bug-bounty-loop/bin/bounty-loop.mjs" run \
+  --workspace . \
+  --objective "Check whether one test user can read another test user's saved object"
+```
+
+Or use OpenCode commands:
+
+```text
+/bounty-init
+/bounty Check whether one test user can read another test user's saved object
+```
+
+## Manifest design
+
+The manifest is the enforcement boundary. It records:
+
+- program and policy snapshot
+- who confirmed authorization
+- exact allowed and excluded origins
+- allowed and excluded path prefixes
+- allowed methods
+- request and response limits
+- redirect policy
+- required identifying headers
+- state-change permission
+- hard-stop conditions
+- mandatory human approval and disabled automatic submission
+
+The default example is passive and unconfirmed. It allows only `GET`, `HEAD`, and `OPTIONS` at six requests per minute.
+
+## Scoped HTTP wrapper
+
+Agents cannot use `curl`, `wget`, webfetch, scanners, raw sockets, or arbitrary shell commands. Active requests must use:
+
+```bash
+node .bounty-loop/tooling/bounty-http.mjs \
+  --manifest .bounty-loop/program.json \
+  --method GET \
+  --url https://in-scope.example/path \
+  --output .bounty-loop/cases/<case-id>/evidence/response.bin
+```
+
+The wrapper enforces:
+
+- exact-origin and path-prefix scope
+- allowed methods and state-change policy
+- DNS checks against private or reserved networks for public programs
+- per-minute and per-case request limits
+- redirect scope
+- response-size caps
+- controlled body-file and evidence-output directories
+- secret-header redaction
+- response-body hashing
+
+Response bodies are not printed to stdout. They are saved only when an explicit evidence path is supplied.
+
+## Submission gates
+
+Every candidate must satisfy all gates:
+
+1. exact asset, path, and method are in scope
+2. authorization is confirmed
+3. only controlled accounts and objects were used
+4. reproduction succeeds twice, including from fresh state
+5. a nearly identical negative control passes
+6. an independent verifier reproduces the issue
+7. a real security boundary is demonstrated
+8. behavior is unlikely to be intended
+9. concrete security impact exists
+10. no policy exclusion, unrealistic victim cooperation, or likely duplicate indicator applies
+11. both reproduction and verifier evidence references exist
+12. report generation succeeds
+13. a human reviews the draft before manual submission
+
+One failed or uncertain gate quarantines the candidate.
+
+## Case files
+
+Cases are stored under `.bounty-loop/cases/<case-id>/`:
+
+```text
+state.json
+manifest.snapshot.json
+events.jsonl
+discovery.json
+candidates/<candidate-id>/
+  candidate.json
+  reproduction.json
+  verification.json
+  impact.json
+  result.json
+evidence/
+reports/
+```
+
+Raw agent output and evidence files are mode `0600` where supported. Add `.bounty-loop/` to the target workspace's `.gitignore`; it may contain session metadata or sensitive test evidence.
+
+## Human approval
+
+A passing candidate is only `READY_FOR_HUMAN_REVIEW`. After personally reviewing the raw evidence and draft, record approval locally:
+
+```bash
+node "$OPENCODE_CONFIG_DIR/bug-bounty-loop/bin/bounty-loop.mjs" approve \
+  --workspace . \
+  --case-id <case-id> \
+  --candidate <candidate-id> \
+  --statement "I reviewed the raw requests, controls, scope, impact, and report draft."
+```
+
+This changes local state to `APPROVED_FOR_MANUAL_SUBMISSION`. It does not contact HackerOne, Bugcrowd, Intigriti, or any program.
+
+## Local training labs
+
+`config/local-lab.example.json` permits private networking and a state-changing method for an intentionally installed, owned training environment. Never use those settings for a public bounty target.
+
+## Validation
+
+```bash
+cd "$OPENCODE_CONFIG_DIR/bug-bounty-loop"
+npm test
+npm run validate
+```