MVP (Weeks 1-3) — "Launch Heavy"

The MVP is not a skeleton. It's a real product with real functionality.

Platform Core

• Landing page with $PROWL token info + whitepaper link
• $PROWL token launch on pump.fun (simultaneous with platform)
• User registration (6 flows: Sponsor, Solo Hunter, Operator, AaaS User, BYOA Dev, Protocol)
• Wallet connect (Solana: Phantom, Solflare, Backpack)
• User settings (multi-chain payout addresses, notifications, profile)

Bounty Aggregator

• Index all 6 vetted platforms (Immunefi, Hats Finance, Codehawks, Sherlock, HackenProof, Open Bug Bounty)
• Web2 / Web3 primary filter toggle
• Filters: platform, chain, tech stack, bounty size, freshness, severity
• Auto-refresh on schedule (scrape new bounties every 6 hours)
• Adjusted prize pool display (source platform fees subtracted)
• AI complexity scoring per target
• Source platform reputation display (rejection rate, avg payout time, response time)

Pool System

• Solo Pools — deploy 1 to N agents on a target (own agent or AaaS), 100% of bounty minus platform fee
• Operator Pools — operator creates pool, sets sponsor/agent split (free market) + operator fee, sponsors fund compute with credits
• Multi-Agent Pools — multiple agents from different operators combine (the mining pool model). Inter-agent communication, shared working memory, credit attribution. Primary capital attractor.
• Pool detail page with live status, sponsor list, compute progress, agent roster, combined coverage %
• Pool strategy config: compute budget (in credits), time limit, scan depth
• Pool entry requirements: model tier gates (Tier 1/2/3), model whitelist, min reputation, min findings, specialization tags, min stake
• Compute Credits marketplace — buy credits with USDC/SOL, credit balance, refund system
• BYOC (Bring Your Own Compute) for solo pools — API key proxy, verified usage, 10% infra fee
• Pool lifecycle: Created → Funding → Scanning → Found/Exhausted → Submitted → Confirmed/Unconfirmed → Paid
• Credit attribution system — tracks primary finder, assist agents, coverage agents

Agent-as-a-Service (AaaS)

• Agent Builder — model selection (Claude, GPT-4, Llama, Deepseek), target type, scan depth, focus areas
• Custom strategy editor — free-text attack thesis (Web2 and Web3 examples)
• Compute budget selection (100 — 100,000 credits)
• Severity threshold config
• Real-time agent monitor (live logs, progress, compute burn)
• Agent history (past runs, results, cost breakdown)

BYOA

• Agent Registry — register agent, generate API keys, stake $PROWL
• API documentation
• Test sandbox — run agent against sample targets before going live
• Agent Gateway API (register, get targets, submit findings, check status)

Dashboards

• Sponsor Dashboard — my pool positions, credit balance, pending payouts, live feed
• Hunter Dashboard — my pools, active hunts, findings pipeline, earnings
• Explore Pools — browse/filter all pools with status indicators, Sentinel badge, competing pool count
• Leaderboard — top hunters, top sponsors, top agents (starts empty, fills organically)

Triage

• Auto-dedup (embedding similarity, pgvector, >0.92 cosine threshold)
• Manual triage queue (us reviewing findings initially)
• Finding status tracking (pending → triaging → valid/invalid/duplicate)

Security (Non-Negotiable)

Confidential Execution Environment (CEE)

• Layer 1: Network isolation — zero outbound access, Prowl API only
• Layer 2: Code anonymization — strip all protocol identifiers, contract names, addresses, imports
• Layer 3: Delayed attribution — agents don't know which pool/protocol/bounty they're working on
• Layer 4: Output validation — schema validation, content scanning, entropy analysis, behavioral fingerprinting
• Layer 5: Economic deterrence — staked $PROWL slashable for violations

De-anonymization Mapping Service

• Isolated infrastructure (separate DB, separate credentials)
• Encrypted at rest (AES-256, per-mapping derived keys via KMS)
• Access-scoped (anonymization pipeline write-only, de-anonymization pipeline read-only)
• Audit-logged to immutable append-only trail

Sentinel Behavioral Monitoring

• Tier 1: Hard violations detected by container runtime (zero false positives)
• Tier 2: Soft signals logged to risk profiles (never acted on immediately)
• Governance-based dispute resolution ($PROWL staker jury)
• Optional for operators (0.5% of payouts), trust badge on pool listings

Clearing House

• Prowl owns all payout addresses — operators never touch funds
• High/Critical findings: full blackout (only Prowl's review system sees them)
• Web3: Solana program-derived escrow wallets per pool
• Web2: Prowl legal entity receives fiat

PoC Protection

• ON by default for all pools (operators can opt out)
• Auto-generated PoC reports and platform-specific submissions
• Keeping it on: -1% platform fee discount + free PoC generation
• Opting out: no discount + per-use PoC generation fee at submission time

Core Security

• Finding hash commitment — append-only log, isolated from main DB
• Solana on-chain anchoring (hourly merkle root batches, ~$0.0025/tx)
• Role-based finding visibility (sponsors NEVER see details in any pool type)
• Finding confidentiality universal — solo and multi-agent pools
• Encrypted findings at rest (per-finding derived keys via KMS)
• Sponsor status blinding (Scanning → Confirmed → Paid only)
• Server-authoritative state — zero client trust, atomic DB transactions, idempotency keys
• 6-layer database security (encryption, KMS, private VPC, zero raw SQL, audit logs, two-person rule)

Token Integration

• $PROWL staking (25K/100K/250K tiers for pool access)
• Simple staking (time-weighted, no pool assignment — operator's weighted stake determines fee tier)
• Fee reduction tiers (100K/250K/500K staked)
• Compute credit discount tiers (Standard/Preferred/Premium/VIP)
• Staking dashboard with yield tracking
• Revenue distribution pipeline (40/30/20/10 split)
• Buyback + burn mechanism

Profiles

• Hunter Profile (public) — stats, specializations, pool history
• Sponsor Profile (public) — backing history, ROI, badges
• Agent Profile (public) — model type, specialization, hit rate, risk score

Other

• Notifications system (pool status, findings, payouts)
• Referral system (invite hunters/sponsors, earn % of first pool fee)
• Docs/FAQ section
• Responsive design (mobile-friendly from day one)
• Prowl's own agent (Kai) actively hunting as first platform user