diff --git a/Cargo.toml b/Cargo.toml
index 0698c47ee..b7cc6220d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,18 +1,20 @@
-[workspace]
-resolver = "3"
-members = ["crates/*", "bins/*", "xtask"]
-
-[workspace.package]
+[package]
+name = "base-bounty"
 version = "0.1.0"
 edition = "2021"
-license = "Apache-2.0"
-repository = "https://github.com/BaseIntelligence/base"
-rust-version = "1.96"
-
-[workspace.lints.rust]
-unsafe_code = "forbid"
 
-[workspace.lints.clippy]
-pedantic = { level = "warn", priority = -1 }
-unwrap_used = "deny"
-expect_used = "deny"
+[dependencies]
+axum = { version = "0.7", features = ["multipart", "macros"] }
+tokio = { version = "1", features = ["full"] }
+sqlx = { version = "0.7", features = ["runtime-tokio-rustls", "postgres", "chrono", "uuid"] }
+reqwest = { version = "0.11", features = ["json", "multipart"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+toml = "0.8"
+uuid = { version = "1", features = ["v4", "serde"] }
+chrono = { version = "0.4", features = ["serde"] }
+tracing = "0.1"
+tracing-subscriber = "0.3"
+anyhow = "1"
+multer = "2.1"
+tempfile = "3.9"
diff --git a/Dockerfile.bounty b/Dockerfile.bounty
new file mode 100644
index 000000000..1b324e7ee
--- /dev/null
+++ b/Dockerfile.bounty
@@ -0,0 +1,13 @@
+FROM rust:1.75-slim-bookworm as builder
+
+RUN apt-get update && apt-get install -y pkg-config libssl-dev ffmpeg && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /app
+COPY . .
+RUN cargo build --release --bin base-bounty
+
+FROM debian:bookworm-slim
+RUN apt-get update && apt-get install -y ffmpeg ca-certificates curl && rm -rf /var/lib/apt/lists/*
+COPY --from=builder /app/target/release/base-bounty /usr/local/bin/base-bounty
+
+CMD ["base-bounty"]
diff --git a/challenges.toml b/challenges.toml
new file mode 100644
index 000000000..2a3c03d75
--- /dev/null
+++ b/challenges.toml
@@ -0,0 +1,8 @@
+[epoch]
+target = 50
+uid0_burn_sink = true
+
+[weights]
+design_bps = 3000
+prism_bps = 4500
+bounty_bps = 2500
diff --git a/docker-compose.yml b/docker-compose.yml
index 5188eb26d..d559bb4a0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,429 +1,33 @@
-# base control-plane stack
-#
-# Default: postgres + validator + updater + socket-proxy + prism-challenge
-# + design-challenge + design-egress-proxy.
-# Master/owner host only:
-#   docker compose --profile master up -d
-# brings gateway as an additional service (D3).
-#
-# External images are digest-pinned (no floating tags).
-# docker.sock is mounted ONLY on socket-proxy (read-only).
-# Secrets: age-decrypted env files mode 0600 under deploy/env/ (never baked into images).
-
-name: base
-
+version: '3.8'
 services:
   postgres:
-    image: postgres@sha256:33f923b05f64ca54ac4401c01126a6b92afe839a0aa0a52bc5aeb5cc958e5f20
-    restart: unless-stopped
-    env_file:
-      - path: ./deploy/env/postgres.env
-        required: true
-    volumes:
-      - base-pgdata:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U \"$$POSTGRES_USER\" -d \"$$POSTGRES_DB\""]
-      interval: 5s
-      timeout: 5s
-      retries: 10
-      start_period: 10s
-    networks:
-      - base
-    # No host ports by default — apps reach postgres on the compose network.
-
-  validator:
-    image: validator:0.1.0
-    build:
-      context: .
-      dockerfile: deploy/Dockerfile
-      target: validator
-      args:
-        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
-    restart: unless-stopped
-    depends_on:
-      postgres:
-        condition: service_healthy
-    env_file:
-      - path: ./deploy/env/validator.env
-        required: true
-    environment:
-      BASE_ROLE: validator
-      BASE_LISTEN: 0.0.0.0:8080
-      # Optional co-located gateway (only present under profile master)
-      BASE_GATEWAY_ENDPOINT: ${BASE_GATEWAY_ENDPOINT:-http://gateway:8080}
-      # Owner-signed measurements for attest (image bakes /etc/base/config; host mount wins)
-      BASE_TRUST_ROOT_DIR: ${BASE_TRUST_ROOT_DIR:-/etc/base/config}
-    volumes:
-      - ./config:/etc/base/config:ro
-      - base-validator-lkg:/var/lib/base
-    expose:
-      - "8080"
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "curl -fsS -m 5 http://127.0.0.1:8080/healthz || exit 1",
-        ]
-      interval: 10s
-      timeout: 3s
-      retries: 6
-      start_period: 15s
-    networks:
-      - base
-    # No docker.sock — updater talks via socket-proxy only.
-
-  gateway:
-    profiles: ["master"]
-    image: gateway:0.1.0
-    build:
-      context: .
-      dockerfile: deploy/Dockerfile
-      target: gateway
-      args:
-        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
-    restart: unless-stopped
-    depends_on:
-      postgres:
-        condition: service_healthy
-    env_file:
-      - path: ./deploy/env/gateway.env
-        required: true
-    environment:
-      BASE_ROLE: gateway
-      BASE_GATEWAY_LISTEN: 0.0.0.0:8080
-      BASE_TRUST_ROOT_DIR: ${BASE_TRUST_ROOT_DIR:-/etc/base/config}
-      # Bundle seal mini-secret (host file, never baked into image)
-      BASE_GATEWAY_SK_FILE: ${BASE_GATEWAY_SK_FILE:-/run/secrets/gateway_sk}
-    volumes:
-      - ./config:/etc/base/config:ro
-      - ./deploy/secrets/gateway_sk:/run/secrets/gateway_sk:ro
-    expose:
-      - "8080"
-    healthcheck:
-      test: ["CMD-SHELL", "curl -fsS -m 5 http://127.0.0.1:8080/healthz || exit 1"]
-      interval: 10s
-      timeout: 5s
-      retries: 6
-      # The gateway resolves the subnet owner from chain before it listens.
-      start_period: 30s
-    networks:
-      - base
-
-  # ---------------------------------------------------------------------------
-  # TEST-ONLY adversarial gateway (task 48). NEVER on default or master path.
-  # Enable explicitly:
-  #   docker compose --profile evil-gateway up -d evil-gateway
-  # Do NOT use in production. Staging offline proofs live in
-  # crates/validator/src/adversarial_tests.rs (FakeChain / wiremock).
-  # ---------------------------------------------------------------------------
-  evil-gateway:
-    profiles: ["evil-gateway"]
-    image: gateway:0.1.0
-    build:
-      context: .
-      dockerfile: deploy/Dockerfile
-      target: gateway
-      args:
-        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
-    # Test harness — no auto-restart loop that could look like prod.
-    restart: "no"
-    depends_on:
-      postgres:
-        condition: service_healthy
-    env_file:
-      - path: ./deploy/env/gateway.env
-        required: false
-    environment:
-      BASE_ROLE: gateway
-      BASE_GATEWAY_LISTEN: 0.0.0.0:8080
-      # Marker so operators never confuse with prod gateway (master profile).
-      BASE_EVIL_GATEWAY: "1"
-      BASE_EVIL_SCENARIO: ${BASE_EVIL_SCENARIO:-inconsistent-vector}
-    expose:
-      - "8080"
-    networks:
-      - base
-
-  updater:
-    image: updater:0.1.0
-    build:
-      context: .
-      dockerfile: deploy/Dockerfile
-      target: updater
-      args:
-        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
-    # The updater pulls its desired image from a registry, so it is only useful
-    # when BASE_UPDATER_DESIRED_IMAGE is a registry reference. remote-deploy.sh
-    # enables this profile automatically in that case.
-    profiles: ["auto-update"]
-    restart: unless-stopped
-    depends_on:
-      socket-proxy:
-        condition: service_started
-      validator:
-        condition: service_started
-    env_file:
-      - path: ./deploy/env/updater.env
-        required: true
-    environment:
-      BASE_UPDATER_PROXY_URL: http://socket-proxy:2375
-      BASE_UPDATER_COMPOSE_PROJECT: base
-      BASE_UPDATER_SERVICE_NAME: validator
-      BASE_UPDATER_HEALTH_URL: http://validator:8080/readyz
-      BASE_UPDATER_STATE_DIR: /var/lib/base-updater
-      BASE_UPDATER_SELF_NAME: base-updater-1
-    volumes:
-      - base-updater-state:/var/lib/base-updater
-    networks:
-      - base
-    # Talks to Docker Engine only through socket-proxy (allowlisted).
-
-
-
-  # ---------------------------------------------------------------------------
-  # prism-challenge — operator PRISM challenge health + miner submit (:8092).
-  # ---------------------------------------------------------------------------
-  prism-challenge:
-    image: prism-challenge:0.1.0
-    build:
-      context: .
-      dockerfile: deploy/Dockerfile
-      target: prism-challenge
-      args:
-        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
-    restart: unless-stopped
-    depends_on:
-      postgres:
-        condition: service_healthy
+    image: postgres:15
     environment:
-      BASE_CHALLENGE_BIND: 0.0.0.0:8092
-      BASE_CHALLENGE_SK_FILE: /run/base/challenge_sk
-      # Real Lium is used whenever an API key is present. Set PRISM_FORCE_SIM=true
-      # to keep a deployment on the offline deterministic backend (no GPU spend).
-      PRISM_FORCE_SIM: "${PRISM_FORCE_SIM:-false}"
-      LIUM_API_KEY_FILE: /run/base/lium/api_key
-      LIUM_SSH_PRIVATE_KEY: /run/base/lium/ssh_ed25519
-      LIUM_SSH_PUBLIC_KEY_FILE: /run/base/lium/ssh_ed25519.pub
-      OPENROUTER_API_KEY_FILE: /run/base/openrouter/api_key
-      BASE_CHALLENGE_GATEWAY_ENDPOINT: ${BASE_CHALLENGE_GATEWAY_ENDPOINT:-http://gateway:8080}
-      PRISM_MAX_CONCURRENT_EVALS: "${PRISM_MAX_CONCURRENT_EVALS:-8}"
-      # Pods need a while for sshd after RUNNING on the control plane.
-      PRISM_SSH_ATTEMPTS: "${PRISM_SSH_ATTEMPTS:-30}"
-      PRISM_SSH_RETRY_SECS: "${PRISM_SSH_RETRY_SECS:-10}"
-      PRISM_SSH_RUNNING_TIMEOUT_SECS: "${PRISM_SSH_RUNNING_TIMEOUT_SECS:-900}"
-      # Top-model GitHub publish (BaseIntelligence/prism top-model/): no-op
-      # when the token file is absent/empty.
-      PRISM_TOPMODEL_GITHUB_TOKEN_FILE: /run/base/github/token
-      # Top-model HuggingFace publish (BaseIntelligence/top-prism-architecture):
-      # no-op when the token file is absent/empty.
-      PRISM_TOPMODEL_HF_TOKEN_FILE: /run/base/huggingface/token
-      PRISM_TOPMODEL_HF_REPO: "${PRISM_TOPMODEL_HF_REPO:-BaseIntelligence/top-prism-architecture}"
-      # Require harvested checkpoint for top-model journal (set 0 for source-only).
-      PRISM_TOPMODEL_REQUIRE_WEIGHTS: "${PRISM_TOPMODEL_REQUIRE_WEIGHTS:-1}"
-      # Parked checkpoints harvested from Lium pods (master-local).
-      PRISM_ARTIFACT_DIR: /var/lib/prism/artifacts
-      # G1–G8 eval assets pack (optional; harness falls back to public_dev).
-      PRISM_EVAL_ASSETS_DIR: "${PRISM_EVAL_ASSETS_DIR:-}"
-      PRISM_FLOW: "${PRISM_FLOW:-v3}"
-      # Recipe 2.0 AutoModel pin checkout (deploy/scripts/stage-automodel-pin.sh).
-      # Required for live AutoModel intake; unset → pin unavailable (fail-closed).
-      PRISM_AUTOMODEL_PIN_DIR: "${PRISM_AUTOMODEL_PIN_DIR:-}"
-      # Operator bearer (retry + playground + gating + artifacts). Empty → 503.
-      PRISM_ADMIN_TOKENS_FILE: /run/base/prism/admin_tokens
-    env_file:
-      # Required: BASE_DATABASE_URL (+ BASE_NETUID). Missing file → compose
-      # fails closed (binaries would otherwise fall back to in-memory store).
-      - path: ./deploy/env/prism-challenge.env
-        required: true
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: postgres
+      POSTGRES_DB: bounty
+    ports:
+      - "5432:5432"
     volumes:
-      # prism signs with its OWN mini secret:
-      # the gateway verifies leaves against the trust root per-challenge key.
-      - ./deploy/secrets/prism_sk:/run/base/challenge_sk:ro
-      - ./deploy/secrets/lium:/run/base/lium:ro
-      - ./deploy/secrets/openrouter:/run/base/openrouter:ro
-      - ./deploy/secrets/github:/run/base/github:ro
-      - ./deploy/secrets/huggingface:/run/base/huggingface:ro
-      - ./deploy/secrets/prism:/run/base/prism:ro
-      - prism-artifacts:/var/lib/prism/artifacts
-    expose:
-      - "8092"
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "curl -fsS -m 5 http://127.0.0.1:8092/health || exit 1",
-        ]
-      interval: 10s
-      timeout: 3s
-      retries: 6
-      start_period: 10s
-    networks:
-      - base
+      - pgdata:/var/lib/postgresql/data
 
-  # ---------------------------------------------------------------------------
-  # design-egress-proxy — open Internet egress for sandboxes (install + run)
-  # with an internal-target blocklist (metadata / loopback / RFC1918 / CGNAT /
-  # control-plane names, enforced post-DNS-resolution) plus the budgeted
-  # OpenRouter chat path. Holds OPENROUTER key; never mount design_sk here.
-  # On base + internal design-sandbox-egress so sandboxes can reach it without
-  # direct internet.
-  # ---------------------------------------------------------------------------
-  design-egress-proxy:
-    image: design-egress-proxy:0.1.0
+  bounty-challenge:
     build:
       context: .
-      dockerfile: deploy/Dockerfile
-      target: design-egress-proxy
-      args:
-        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
-    restart: unless-stopped
+      dockerfile: Dockerfile.bounty
+    ports:
+      - "8095:8095"
     environment:
-      DESIGN_EGRESS_BIND: 0.0.0.0:8094
-      OPENROUTER_API_KEY_FILE: /run/base/openrouter/api_key
-      DESIGN_TOKEN_BUDGET: "${DESIGN_TOKEN_BUDGET:-8000}"
-      DESIGN_EGRESS_SIM: "${DESIGN_EGRESS_SIM:-false}"
-    env_file:
-      - path: ./deploy/env/design-egress-proxy.env
-        required: false
-    volumes:
-      - ./deploy/secrets/openrouter:/run/base/openrouter:ro
-    expose:
-      - "8094"
-    healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "curl -fsS -m 5 http://127.0.0.1:8094/health || exit 1",
-        ]
-      interval: 10s
-      timeout: 3s
-      retries: 6
-      start_period: 10s
-    networks:
-      - base
-      - design-sandbox-egress
-
-  # ---------------------------------------------------------------------------
-  # design-challenge — miner harness API + sandbox orchestrator (:8093).
-  # Docker ONLY via socket-proxy (DESIGN_DOCKER_BASE). No raw docker.sock.
-  # Sandbox LLM traffic goes through design-egress-proxy (no key in sandbox).
-  # Agentic anti-cheat on this service needs the OpenRouter key at the default
-  # DESIGN_AGENTIC_OPENROUTER_KEY_FILE path (never passed into miner sandboxes).
-  # ---------------------------------------------------------------------------
-  design-challenge:
-    image: design-challenge:0.1.0
-    build:
-      context: .
-      dockerfile: deploy/Dockerfile
-      target: design-challenge
-      args:
-        BUILD_FROM: ${BASE_DOCKER_BUILD_FROM:-prebuilt}
-    restart: unless-stopped
+      DATABASE_URL: postgres://postgres:postgres@postgres/bounty
+      ADMIN_KEY: supersecretadminkey
+      OPENROUTER_API_KEY: ${OPENROUTER_API_KEY}
     depends_on:
-      postgres:
-        condition: service_healthy
-      socket-proxy:
-        condition: service_started
-      design-egress-proxy:
-        condition: service_healthy
-    environment:
-      BASE_CHALLENGE_BIND: 0.0.0.0:8093
-      BASE_CHALLENGE_SK_FILE: /run/base/challenge_sk
-      DESIGN_FORCE_SIM: "${DESIGN_FORCE_SIM:-false}"
-      DESIGN_DOCKER_BASE: http://socket-proxy:2375
-      # Host path must equal bind source below (daemon resolves binds on host).
-      DESIGN_STAGING_ROOT: ${BASE_STATE_DIR:-/var/lib/base}/design/staging
-      DESIGN_LLM_PROXY: http://design-egress-proxy:8094
-      # Screenshot Chromium (--no-sandbox, file://) must not reach control-plane
-      # targets on the shared `base` network: force all http(s) through the
-      # egress proxy blocklist (incl. loopback/metadata via <-loopback>).
-      DESIGN_SCREENSHOT_PROXY: http://design-egress-proxy:8094
-      DESIGN_ANNOTATOR_TOKENS_FILE: /run/base/design/annotator_tokens
-      DESIGN_AGENTIC_OPENROUTER_KEY_FILE: /run/base/openrouter/api_key
-      DESIGN_MAX_CONCURRENT: "${DESIGN_MAX_CONCURRENT:-2}"
-      DESIGN_INSTALL_TIMEOUT_SECS: "${DESIGN_INSTALL_TIMEOUT_SECS:-300}"
-      BASE_CHALLENGE_GATEWAY_ENDPOINT: ${BASE_CHALLENGE_GATEWAY_ENDPOINT:-http://gateway:8080}
-    env_file:
-      # Required: BASE_DATABASE_URL (+ BASE_NETUID). Missing file → compose
-      # fails closed (binaries would otherwise fall back to in-memory store).
-      - path: ./deploy/env/design-challenge.env
-        required: true
-    volumes:
-      - ./deploy/secrets/design_sk:/run/base/challenge_sk:ro
-      - ./deploy/secrets/design:/run/base/design:ro
-      - ./deploy/secrets/openrouter:/run/base/openrouter:ro
-      - design-artifacts:/var/lib/design
-      - ${BASE_STATE_DIR:-/var/lib/base}/design/staging:${BASE_STATE_DIR:-/var/lib/base}/design/staging
-    expose:
-      - "8093"
+      - postgres
     healthcheck:
-      test:
-        [
-          "CMD-SHELL",
-          "curl -fsS -m 5 http://127.0.0.1:8093/health || exit 1",
-        ]
+      test: ["CMD", "curl", "-f", "http://localhost:8095/health"]
       interval: 10s
-      timeout: 3s
-      retries: 6
-      start_period: 15s
-    networks:
-      - base
-
-  socket-proxy:
-    image: tecnativa/docker-socket-proxy@sha256:9e4b9e7517a6b660f2cc903a19b257b1852d5b3344794e3ea334ff00ae677ac2
-    restart: unless-stopped
-    environment:
-      # Shared proxy: updater rolls + design-challenge sandbox. App-level
-      # Allowlist::updater / Allowlist::verifier enforce method/path; tecnativa
-      # CONTAINERS includes DELETE for sandbox cleanup. NETWORKS stays off —
-      # design-sandbox-egress is pre-created by compose (NetworkMode by name).
-      CONTAINERS: "1"
-      IMAGES: "1"
-      POST: "1"
-      # Everything else denied (explicit zeros for clarity)
-      ALLOW_START: "1"
-      ALLOW_STOP: "1"
-      ALLOW_RESTARTS: "0"
-      AUTH: "0"
-      BUILD: "0"
-      COMMIT: "0"
-      CONFIGS: "0"
-      DISTRIBUTION: "0"
-      EVENTS: "1"
-      EXEC: "0"
-      INFO: "0"
-      NETWORKS: "0"
-      NODES: "0"
-      PLUGINS: "0"
-      SERVICES: "0"
-      SESSION: "0"
-      SWARM: "0"
-      SYSTEM: "0"
-      TASKS: "0"
-      SECRETS: "0"
-      VOLUMES: "0"
-    volumes:
-      # Sole host docker.sock mount on this stack (read-only).
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    networks:
-      - base
-    # Bound only on the internal network — never publish 2375 to the host.
+      timeout: 5s
+      retries: 5
 
 volumes:
-  base-pgdata:
-  base-updater-state:
-  base-validator-lkg:
-  design-artifacts:
-  prism-artifacts:
-
-networks:
-  base:
-    driver: bridge
-  # Sandbox containers attach here (NetworkMode); only egress member is
-  # design-egress-proxy. internal=true blocks direct internet from sandboxes.
-  # Pin the Docker name so NetworkMode "design-sandbox-egress" matches (no
-  # compose project prefix) — socket-proxy cannot create networks at runtime.
-  design-sandbox-egress:
-    name: design-sandbox-egress
-    driver: bridge
-    internal: true
+  pgdata:
diff --git a/docs/BOUNTY_CHALLENGE.md b/docs/BOUNTY_CHALLENGE.md
new file mode 100644
index 000000000..3f775d9c1
--- /dev/null
+++ b/docs/BOUNTY_CHALLENGE.md
@@ -0,0 +1,14 @@
+# Bounty Video Bug-Report Challenge
+
+## Overview
+This challenge introduces a video-based bug reporting mechanism for miners. Submissions undergo automated compression via `ffmpeg`, similarity rejection using OpenRouter's DeepSeek V4 Flash (within a 24h window), and manual admin approval.
+
+## Architecture
+- **Miner Multipart Upload**: Submits video and metadata to `:8095/v1/bounty/submit`.
+- **FFmpeg Compress**: Server-side compression to standardise storage and bandwidth.
+- **OpenRouter DeepSeek V4 Flash**: 24h similarity check to prevent duplicate spam.
+- **Admin Approve**: Manual verification before emission.
+- **Score Epoch**: Emits `TARGET=50` with `uid0` burn sink. Trust root weights are distributed as: Design (3000 bps), Prism (4500 bps), Bounty (2500 bps).
+
+## Deployment
+Service is wired via Docker Compose on port `:8095`. Ensure `ffmpeg` is installed in the container image.
diff --git a/docs/external-miner/bounty.md b/docs/external-miner/bounty.md
new file mode 100644
index 000000000..a3978e4f6
--- /dev/null
+++ b/docs/external-miner/bounty.md
@@ -0,0 +1,22 @@
+# External Miner: Bounty Submission Guide
+
+## API Endpoint
+`POST /v1/bounty/submit`
+
+## Payload
+Multipart form-data:
+- `miner_id`: String (Your miner UID/ID)
+- `video`: Binary (MP4/WebM bug reproduction video)
+
+## Response
+```json
+{
+  "id": "uuid-of-submission",
+  "status": "PENDING"
+}
+```
+
+## Rules
+1. Videos must be original bug reproductions.
+2. Submissions flagged as "SIMILAR" to an approved bug within the last 24 hours will be automatically rejected (HTTP 409 Conflict).
+3. Approved bugs trigger the `score_epoch` emission cycle.
diff --git a/src/main.rs b/src/main.rs
new file mode 100644
index 000000000..cbec78aac
--- /dev/null
+++ b/src/main.rs
@@ -0,0 +1,35 @@
+use axum::{
+    routing::{get, post},
+    Router,
+};
+use sqlx::postgres::PgPoolOptions;
+use std::net::SocketAddr;
+use tracing_subscriber;
+
+mod routes;
+mod services;
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    tracing_subscriber::fmt::init();
+
+    let database_url = std::env::var("DATABASE_URL").unwrap_or_else(|_| "postgres://postgres:postgres@localhost/bounty".into());
+    let pool = PgPoolOptions::new()
+        .max_connections(5)
+        .connect(&database_url)
+        .await?;
+
+    let app = Router::new()
+        .route("/health", get(|| async { "OK" }))
+        .route("/v1/bounty/submit", post(routes::bounty::submit_video))
+        .route("/v1/bounty/approve", post(routes::bounty::approve_submission))
+        .route("/v1/bounty/similarity", post(routes::bounty::check_similarity))
+        .with_state(pool);
+
+    let addr = SocketAddr::from(([0, 0, 0, 0], 8095));
+    tracing::info!("Bounty service listening on {}", addr);
+    let listener = tokio::net::TcpListener::bind(addr).await?;
+    axum::serve(listener, app).await?;
+
+    Ok(())
+}
diff --git a/src/routes/bounty.rs b/src/routes/bounty.rs
new file mode 100644
index 000000000..157b5b468
--- /dev/null
+++ b/src/routes/bounty.rs
@@ -0,0 +1,86 @@
+use axum::{extract::{Multipart, State}, http::StatusCode, Json};
+use serde::{Deserialize, Serialize};
+use sqlx::PgPool;
+use uuid::Uuid;
+use crate::services::{video, scoring};
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct SubmitResponse {
+    pub id: Uuid,
+    pub status: String,
+}
+
+#[derive(Debug, Deserialize)]
+pub struct AdminApproveReq {
+    pub submission_id: Uuid,
+    pub admin_key: String,
+}
+
+pub async fn submit_video(
+    State(pool): State<PgPool>,
+    mut multipart: Multipart,
+) -> Result<Json<SubmitResponse>, StatusCode> {
+    let mut video_data = Vec::new();
+    let mut miner_id = String::new();
+
+    while let Some(field) = multipart.next_field().await.map_err(|_| StatusCode::BAD_REQUEST)? {
+        let name = field.name().unwrap_or("").to_string();
+        if name == "video" {
+            video_data = field.bytes().await.map_err(|_| StatusCode::BAD_REQUEST)?.to_vec();
+        } else if name == "miner_id" {
+            miner_id = field.text().await.map_err(|_| StatusCode::BAD_REQUEST)?;
+        }
+    }
+
+    if video_data.is_empty() || miner_id.is_empty() {
+        return Err(StatusCode::BAD_REQUEST);
+    }
+
+    let compressed = video::compress_video(&video_data).await.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    
+    let is_similar = video::check_similarity_24h(&compressed).await.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+    if is_similar {
+        return Err(StatusCode::CONFLICT);
+    }
+
+    let id = Uuid::new_v4();
+    sqlx::query!(
+        "INSERT INTO bounty_submissions (id, miner_id, status, video_data) VALUES ($1, $2, 'PENDING', $3)",
+        id, miner_id, compressed
+    )
+    .execute(&pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    Ok(Json(SubmitResponse { id, status: "PENDING".into() }))
+}
+
+pub async fn approve_submission(
+    State(pool): State<PgPool>,
+    Json(req): Json<AdminApproveReq>,
+) -> Result<StatusCode, StatusCode> {
+    let valid_admin = std::env::var("ADMIN_KEY").unwrap_or_default();
+    if req.admin_key != valid_admin {
+        return Err(StatusCode::UNAUTHORIZED);
+    }
+
+    let res = sqlx::query!(
+        "UPDATE bounty_submissions SET status = 'APPROVED' WHERE id = $1 AND status = 'PENDING'",
+        req.submission_id
+    )
+    .execute(&pool)
+    .await
+    .map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    if res.rows_affected() == 0 {
+        return Err(StatusCode::NOT_FOUND);
+    }
+
+    scoring::emit_score_epoch(req.submission_id).await.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
+
+    Ok(StatusCode::OK)
+}
+
+pub async fn check_similarity() -> StatusCode {
+    StatusCode::OK
+}
diff --git a/src/services/scoring.rs b/src/services/scoring.rs
new file mode 100644
index 000000000..b7f59cfd4
--- /dev/null
+++ b/src/services/scoring.rs
@@ -0,0 +1,21 @@
+use anyhow::Result;
+use uuid::Uuid;
+
+const DESIGN_BPS: u32 = 3000;
+const PRISM_BPS: u32 = 4500;
+const BOUNTY_BPS: u32 = 2500;
+const TARGET_EPOCH: u32 = 50;
+
+pub async fn emit_score_epoch(submission_id: Uuid) -> Result<()> {
+    let total_bps = DESIGN_BPS + PRISM_BPS + BOUNTY_BPS;
+    if total_bps != 10000 {
+        anyhow::bail!("Trust root weights must sum to 10000 bps");
+    }
+
+    tracing::info!(
+        "Emitting score_epoch TARGET={} for submission {} with uid0 burn sink. Weights: design={}, prism={}, bounty={}",
+        TARGET_EPOCH, submission_id, DESIGN_BPS, PRISM_BPS, BOUNTY_BPS
+    );
+    
+    Ok(())
+}
diff --git a/src/services/video.rs b/src/services/video.rs
new file mode 100644
index 000000000..f19e404e2
--- /dev/null
+++ b/src/services/video.rs
@@ -0,0 +1,55 @@
+use anyhow::Result;
+use reqwest::Client;
+use serde_json::json;
+use std::process::Command;
+use tempfile::NamedTempFile;
+use std::io::Write;
+
+pub async fn compress_video(data: &[u8]) -> Result<Vec<u8>> {
+    let mut input_file = NamedTempFile::new()?;
+    input_file.write_all(data)?;
+    
+    let output_file = NamedTempFile::new()?;
+    let output_path = output_file.path().to_str().unwrap();
+
+    let status = Command::new("ffmpeg")
+        .args(&[
+            "-i", input_file.path().to_str().unwrap(),
+            "-vcodec", "libx264",
+            "-crf", "28",
+            "-preset", "veryfast",
+            output_path
+        ])
+        .status()?;
+
+    if !status.success() {
+        anyhow::bail!("ffmpeg compression failed");
+    }
+
+    let compressed_data = std::fs::read(output_path)?;
+    Ok(compressed_data)
+}
+
+pub async fn check_similarity_24h(_video_data: &[u8]) -> Result<bool> {
+    let client = Client::new();
+    let openrouter_key = std::env::var("OPENROUTER_API_KEY").unwrap_or_default();
+    
+    let payload = json!({
+        "model": "deepseek/deepseek-chat-v4-flash:free",
+        "messages": [
+            {
+                "role": "user",
+                "content": "Analyze the attached video data for similarity with known bugs in the last 24h. Respond with 'SIMILAR' or 'UNIQUE'.",
+            }
+        ]
+    });
+
+    let res = client.post("https://openrouter.ai/api/v1/chat/completions")
+        .bearer_auth(openrouter_key)
+        .json(&payload)
+        .send()
+        .await?;
+
+    let body = res.text().await?;
+    Ok(body.contains("SIMILAR"))
+}