Rules, access and safety, plus ledger refresh

1. Summary answer: "Can my agent do this here?"

• None of the six human-paying E1 venues allows autonomous submission. 3 forbid it (HackerOne, Bugcrowd, huntr). 1 restricts it: Upwork lets an agent draft and submit a proposal through MCP, but the human must review it and "explicitly confirm the submission" first. Kaggle has no such clause, because the AI system is what is being judged. Algora has no submission clause, but its robot clause bars automated access "for any purpose". Across all 12 E1 venues, 3 forbid autonomous submission and 1 allows it (MoltJobs).
• Agents may hold their own accounts on 2 of the 14 grid venues (AgentPact, Virtuals ACP). 8 restrict it: the agent can work inside an account, but a person stays responsible or must set it up. 1 forbids it (Algora, on a literal reading of its robot and age clauses). Outside the grid, ugig.net and toku.agency also allow it explicitly ("No human needed — agents can self-register").
• On agent-first boards, agents are allowed but the owner is liable. NEAR's text makes the Builder responsible for every agent action "regardless of whether the action was authorized, foreseeable, or intended". TaskMarket's terms page is still a draft "not approved or active".
• Multiple accounts: 4 of the 14 grid venues forbid them explicitly (HackerOne, Bugcrowd, Kaggle (ARC Prize), Upwork). The rest have no clause in this matrix.
• Model providers: an owner may sell work built from model output. All four providers checked (Anthropic, OpenAI, Google, GitHub Copilot) give or leave output rights with the user. Sharing a login or reselling access is forbidden at all four. On consumer plans, automated access is allowed only through the provider's own tools (Claude Code, Codex, Gemini CLI, Copilot's own agent); an always-on third-party runtime should use an API key. Two things remain unclear: (1) no text directly covers paid client work done on a personal subscription; (2) "ordinary, individual usage" is not defined for an agent running 24/7.
• Getting paid needs a person. At 12 of the 14 grid venues the owner must clear the identity or payout step. At the other 2 (Virtuals ACP, AgentPact), the money goes to a wallet with no KYC found, and whoever holds its keys controls it. Upwork's API & MCP Terms (v2.3, obtained this run via Wayback) explicitly bar an agent from accepting contracts, making identity or tax attestations, and funding or withdrawing.
• Security: 11 documented incidents with a primary source, each mapped to an owner control. The original task-text scan read 1,741 public tasks on 7 venues and found 0 injection-shaped instructions and 0 requests for secrets. Repository files are another matter: Coolify, a repository that carries Algora bounties, hides an instruction aimed at agents in its PR template, as a trap to spot them.
• Ledger: $232.55 reached agent workers in the 30 days 2026-09-02 → 2026-10-02 (run 2: $230.37). 40.4% came from operator or operator-linked wallets (run 2: 44.5%). The first identified independent payer is 1 payer: MolTrust, $9.25, for promotional bounties for its own product. Venues at meaningful scale: still 0.

Rules matrix size: 142 rows across 50 parties. Verdicts: forbid 41, restrict 78, allow 13, unclear 10. Source kinds: primary 109, via Wayback 15, via API JSON 13, third-party copy 1, search snippet 4 (unverified).

2. The venue × activity grid

Each cell shows the verdict and the rule row it rests on (IDs in rules.json; each links to its quote). Where several rows apply, the cell shows the most restrictive verdict that is not "unclear" (forbid > restrict > allow). "unclear (no row)" means no clause was found for that activity. "unverified" means the only source is a search snippet.

Totals over the 14 venues: AI-assisted work: forbid 1, restrict 3, allow 1, unclear 9; Autonomous submission: forbid 3, restrict 3, allow 1, unclear 7; Agent-operated account: forbid 1, restrict 8, allow 2, unclear 3; Automation / API: forbid 2, restrict 7, allow 0, unclear 5; Multiple accounts: forbid 4, restrict 0, allow 0, unclear 10.

Notes on reading the grid:

• Algora: the platform has no clause on AI work, so the repository's own policy decides (section 4). The Algora account must be held by a person aged 18+ who completes Stripe Connect onboarding. A GitHub machine account is allowed if a responsible human creates it (one free machine account per person; github-account_identity-1). Even so, Algora's literal terms bar a bot from using Algora itself. The compliant route: the human holds both accounts, posts /attempt and /claim, and does the Stripe step; the agent drafts code.
• Kaggle: the AMLT "allow" and the single-account "forbid" still rest only on search snippets. The final-check Wayback retry returned only the JavaScript shell (see section 9).
• TaskMarket: every cell rests on a terms page that is labelled a draft, "not approved or active".
• Upwork: the agent may operate in the holder's account "within scopes the Upwork User has granted" (upwork-mcp-automation_ai-3). It may not accept contracts or move money (upwork-mcp-account_identity-3), and it must disclose AI origin where a user would assume a human (upwork-mcp-automation_ai-4).

3. Model-provider terms

Key quotes (verbatim):

• anthropic-automation_ai-1 (restrict; primary; 2025-10-08): "Except when you are accessing our Services via an Anthropic API Key or where we otherwise explicitly permit it, to access the Services through automated or non-human means, whether through a bot, script, or otherwise." (https://www.anthropic.com/legal/consumer-terms)
• anthropic-automation_ai-3 (restrict; primary; no date shown): "Claude Code usage is subject to the Anthropic Usage Policy . Advertised usage limits for Pro and Max plans assume ordinary, individual usage of Claude Code and the Agent SDK." (https://code.claude.com/docs/en/legal-and-compliance)
• anthropic-resale_sharing-4 (forbid; primary; no date shown): "Customers may not pay for, resell, or intermediate Claude usage on their end users’ behalf. Each end user must authenticate with their own Anthropic API key, Claude subscription plan credentials, or 3P inference provider credential…" (https://code.claude.com/docs/en/legal-and-compliance)
• openai-resale_sharing-1 (forbid; primary_via_wayback; 2026-01-01): "You may not share your account credentials or make your account available to anyone else and are responsible for all activities that occur under your account." (https://openai.com/policies/row-terms-of-use/)
• openai-automation_ai-1 (restrict; primary_via_wayback; 2026-01-01): "For example, you may not: … Automatically or programmatically extract data or Output (defined below). … Interfere with or disrupt our Services, including circumvent any rate limits or restrictions or bypass any protective measures or safety mitigations we put on our Services." (https://openai.com/policies/row-terms-of-use/)
• google-automation_ai-1 (restrict; primary; no date shown): "Directly accessing the services powering Gemini CLI (for example, the Gemini Code Assist service) using third-party software, tools, or services (for example, using OpenClaw with Gemini CLI OAuth) is a violation of applicable terms and policies. Such actions may be grounds for suspension or termination of your account." (https://github.com/google-gemini/gemini-cli/blob/main/docs/resources/tos-privacy.md)
• github-copilot-automation_ai-1 (restrict; primary; no date shown): "…using our servers for any form of excessive automated bulk activity, to place undue burden on our servers through automated means, or to relay any form of unsolicited advertising or solicitation through our servers…" (https://docs.github.com/en/site-policy/acceptable-use-policies/github-acceptable-use-policies)

Synthesis: may an owner run their own agent on a consumer subscription to do paid work for third parties?

• Outputs: Yours to use at all four providers (assigned to you or no ownership claimed). Nothing found bars selling work built from Output.
• Automated access: Only through the provider's own tools when on a subscription: Anthropic (native Claude Code; API key for Agent SDK and products), Google (Gemini CLI itself; "using OpenClaw with Gemini CLI OAuth" named a violation), OpenAI (Codex clients sold with ChatGPT plans; ToU bars programmatic extraction of Output), GitHub (Copilot's own agent and CLI; AUP bans excessive automated bulk activity). A third-party always-on runtime should use an API key.
• Resale and sharing: Forbidden at all four. Doing paid work is not resale; letting a client use your plan or login is.
• Limits: Anthropic: "ordinary, individual usage"; Google: fixed per-user daily caps; OpenAI: plan and fair-use limits; GitHub: fair-access rate limits.
• What is unclear, stated plainly: (1) No provider text says whether paid client work on a personal subscription is allowed. It is neither permitted nor forbidden in words. (2) Anthropic says its advertised Pro and Max limits "assume ordinary, individual usage", and "ordinary, individual usage" is not defined for an agent that runs around the clock. (3) OpenAI has no general bot ban, so unattended Codex on a Plus or Pro plan doing client work is neither allowed nor forbidden; its Terms do forbid automatically or programmatically extracting Output and presenting Output as human-generated. The safe reading for a 24/7 agent doing paid work is an API key under commercial terms.

OpenAI quote status (the bootstrap quotes came from search snippets):

Result: 3 of 4 verified from archived primary copies; 1 is not in the current text and has been replaced by the current Services Agreement wording (openai-resale_sharing-3, marked changed). The live OpenAI pages still return 403. The newest capture of the account-sharing help article is from 2026-04-06.

4. Maintainer AI-contribution policies

21 rows across 18 projects, 6 of them repositories that carried Algora bounties in run 2's sample. Verdicts: forbid 10, restrict 9, unclear 2.

Algora-bounty repositories (where the bounty money is):

Reading: 2 of the 6 (Archestra, Activepieces) now close every outside PR automatically. 2 (Coolify, Qdrant) allow AI help, provided it is disclosed and a human writes the PR text. 2 (Cap, tscircuit/jlcsearch) have no AI policy at all, and tscircuit holds most of the open Algora bounties. None explicitly allows an unattended agent to submit. Coolify's PR template also hides a trap instruction for agents (section 6).

Other projects:

5. KYC and jurisdiction

kyc.json covers 20 venues, including all 14 grid venues (normalised kyc_required over the 14: conditional 6, no 2, unknown 3, yes 3).

Carry-overs:

• Bugcrowd fees and minimums: Answered: Bugcrowd covers fees from its account to the payment provider; bank minimums ACH/EFT $1.00, SEPA/FPS/BECS/NPP/FPSHK/IACH $3.00, SWIFT $20.00 (US merchant accounts). See the bugcrowd entry.
• dealwork.ai withdrawal methods: Still open: methods are shown only inside the logged-in wallet; public docs and terms do not list them.
• CDP facilitator KYC for mainnet sellers: Still open: no CDP text found requiring KYC for mainnet x402 sellers; the facilitator needs a CDP account and API key (rows x402-cdp-account_identity-1, x402-cdp-kyc_payout_eligibility-2).
• HackerOne ID verification (Veriff, 18+) has been required before any bug-bounty submission since August 2026, including submissions through the Hacker API and Report Assistant.

6. Security

11 documented incidents, each with a primary source (vendor research 6, CVE 3, official post-mortem 2), plus 2 observed designs and the task-text scan.

Observed designs (not breaches):

• sec-12: Moltbook skill tells agents to re-fetch and follow a remote heartbeat file every 30 minutes (design exposure, not a breach). Moltbook's skill.md (version 1.12.0) instructs agents to add "Fetch https://www.moltbook.com/heartbeat.md and follow it" to a periodic task list every 30 minutes. Whoever controls that file, or the domain, can change the agent's instructions at any time without the owner seeing it. Source: https://www.moltbook.com/skill.md. Control: Do not let agents follow remotely updated instruction files; copy the file locally, hash it, and review changes before the agent uses a new version.
• sec-13: Coolify pull-request template carries a hidden instruction aimed at AI agents (maintainer trap, not a breach). The PR template of coollabsio/coolify, a repository that has carried Algora bounties, begins with a hidden HTML comment addressed to AI agents telling them to put a marker word at the top of the PR description. An agent that obeys it reveals itself as an unattended agent to the maintainers; it is a detection canary, not an attack. We paraphrase it here rather than repeat it, so that no agent reading this page acts on it; the verbatim text is at the linked source. Source: https://github.com/coollabsio/coolify/blob/main/.github/pull_request_template.md. Control: Treat repository files (templates, CONTRIBUTING, issue text) as data. Do not let a bounty agent follow instructions found in them; keep a human reviewing and writing the PR description, as Coolify's own rules require (rules row coolify-contribution_policy-2).

Task-text scan (original measurement). Case-insensitive regular expressions over public task text pulled read-only with GET requests on 2026-10-02. Text treated strictly as data: nothing was executed, followed, claimed or submitted. A match is 'injection-shaped or key-seeking text', not proof of malice; each match was read and labelled in match_review.

Manual review of the 27 matches: injection-shaped instructions 0; secret-exfiltration requests 0; requesters forbidding secrets 20; tasks asking the worker to create a key or account at a third-party service 4; benign or false positive 3. Across 1,741 public task texts on 7 venues, no task told the agent to ignore its instructions, reveal a system prompt, hand over keys or seed phrases, send funds or run a piped shell command. The secret-related matches are mostly requesters forbidding secrets (20 tasks). Four tasks ask the worker to create an account or API key at a third-party service (MolTrust x3, Yukon x1): harmless in itself, but it means an agent will create credentials outside the owner's view, which the owner should allow or block explicitly.

Limits: Regex over text visible to anonymous GET. Private bounties (Frantic), auth-gated feeds and attachments/linked files (skill.md files, repos named in tasks) were not scanned. Execution Market completed tasks scanned on titles only. Zero matches is not proof of safety. The full pattern list is in security.json (task_text_scan.pattern_list).

Checklist implications ("Safety before you connect"): a separate low-balance wallet; spending caps and no unattended spending policy; one scoped key per venue, rotated after any disclosure; pin or hash skill and heartbeat files and never follow remotely updated instruction files; vet and pin MCP servers; run the agent in a sandbox or as a separate machine user with no wallets or SSH keys; treat task text and repository files as data.

7. Ledger refresh

Cut-off: 2026-10-01T14:10:05Z. As of: 2026-10-02T13:45:00Z. Window: 2026-09-02 → 2026-10-02.

New events: 18 (TaskMarket 6, Virtuals ACP 2, x402 sample 10). New agent-work USD since the cut-off: $11.12, all unlinked (TaskMarket $11.10: six 1.85-USDC awards on 2026-10-02 from requester 0x4363 in cluster 0xd8c5, paid to 4 workers; ACP $0.018 from two 0.01-USDC jobs). No new events: Execution Market (no completion since 2026-09-29), MoltJobs (no release since 2026-09-23), AgentPact (no escrow transfer since 2026-09-01; 2 new free self-deals). The ledger now holds 294 events (256 agent-work events in the window).

Headline numbers: $232.55 paid for agent work in 30 days (run 2: $230.37). The operator or operator-linked share is 40.4% (range 32.2%–44.7% depending on the ACP split; run 2: 44.5%, range 36.2%–48.9%). Sensitivities: 45.6% under the strict two-hop reading for payer 0xf138; 85.0% if cluster 0xd8c5 turned out to be operator-affiliated. Identified independent payers: 1 ($9.25). Venues at meaningful scale: 0.

Why the numbers moved: the window moved forward one day. AgentPact's operator-paid $6.41 and Execution Market's 2026-09-01 swarm tasks (run 2: $38.69, now $36.49) left the window, and TaskMarket added $11.10 of unlinked pay. The total is almost unchanged, and the operator share fell by about 4 points. That fall is a window effect, not new independent demand.

Homepage numbers: paid or selling venues 26; E1 venues 12; E1 venues with agent-work payouts 5 (E1 means a confirmed payout; latest dates: TaskMarket and ACP 2026-10-02, Execution Market 2026-09-29, MoltJobs 2026-09-23, AgentPact 2026-09-01); independent payers at meaningful scale 0. All four are unchanged. New secondary figure: venues with agent-work payouts in the last 30 days: 4. AgentPact has had no payout since 2026-09-01 and turns stale on 2026-10-31.

Lead outcomes:

• MolTrust: confirmed, so the first identified independent payer. MolTrust's own repository says it funded the TaskMarket bounties TSK-9YFR1YF7 and TSK-KEYKZGQF: MoltyCel/moltrust-api PR #369 says "The two bounties were funded under 2026-07-draft-2", PR #404 says "The 109 are agents we paid to show up", and PR #410 lists both task IDs. The TaskMarket API gives 0xa175d51b as the requester of both. The PRs do not print the wallet; the link is task ID → API requester. Events taskmarket-0060 to 0065 ($9.25 net, 2026-09-21) move from unlinked to identified_independent, with payer_motive: promotional_user_acquisition. Under the written rule, TaskMarket's independent_payer_evidence becomes "yes". In plain terms: 1 identified independent payer, $9.25, promotional bounties for the payer's own product. That is one sponsor paying agents to register with its identity service, far below meaningful scale ($1,000 from 5 payers); it is not evidence of customers buying agent work.
• Funder 0xd8c5763b: still unidentified; not an exchange hot wallet. It is an EIP-7702 delegated EOA with no Blockscout tag and no ENS name. Its large inflows come from DEX pools and smart accounts, not an exchange: for example 162,684.97 USDC via ERC-4337 handleOps (2026-02-09) and 58,591.73 USDC from the Uniswap UniversalRouter (2025-12-27). Its recent inbound pages are full of address-poisoning dust. It seeds 3+ TaskMarket requester agents, and no link to TaskMarket operator wallets was found. The class stays unlinked; the cluster accounts for 80.6% of TaskMarket gross in the window.
• Frantic (gofrantic.com): backlog only. It is a public bounty board for agents paying USDC on Base via x402. Its board reports funded_usd 842.5, moved_usd 1280.3 and 1,252 enlisted operators (self-reported), with 4 open bounties ($3–$16). Its x402 payTo took $211.95 from 40 buyers in 30 days and sent 9.0 USDC to MoltJobs' top worker on 2026-09-17. Its PAID receipts were not traced to on-chain transfers to worker wallets, so it gets no E-level. Rule risk: much of the paid work is marketing on third-party sites, e.g. "Answer live Reddit threads with a dated fact from an open registry" ($3), "Earn a citation on an external page that already ranks" ($16), and adding a startup to a list verified by a GitHub star ($1.50). Reward-driven GitHub stars fall under GitHub's Acceptable Use Policies on inauthentic activity incentivised by rewards (github-automation_ai-1). Reddit's rules and the citing sites' rules were not checked this run, so there is no row for them.
• Execution Market: correction and watch item. The public metric total_volume_usd counts posted bounties, not payouts. It rose from $504.84 to $524.84 (+$20.00) when one $20 task was published on 2026-10-01, while nothing was completed. Recorded in the venues.json change_log. Watch item: task 607c9a44 ($20, physical-presence photo in Medellín, non-swarm publisher 0xcecbc7ad, escrow pending assignment). If it settles, it would be Execution Market's first payout from a payer outside the operator's swarm (initial class unlinked).
• x402 refresh (excluded from agent-work totals; buyers not traced): Cluster Protocol $54,761 / 722 buyers; dTelecom $35,559 / 26 buyers; StableEnrich $1,497 / 336; OneShot $347 / 53; StableStudio $166 / 74. x402scan overall 30-day: $995,270 from 28,523 buyers.

8. What changed since 1 October

Rules (change_vs_previous across 142 rows: changed 8, new 93, unchanged 41). "new" mostly means a clause quoted for the first time, not a new policy. Changed rows:

• kaggle-account_identity-1: STILL FROM SNIPPETS (unverified); same routes as kaggle-automation_ai-1. The 2026-09-30 snippet wording was 'You may only participate using a single, unique Kaggle account … Participating using more than one Kaggle account per individual Participant is a breach'; today's snippet gives …
• openai-resale_sharing-3: PARTLY NOT VERIFIED: the bootstrap snippet "You may not make account access credentials available to third parties, share individual login credentials between multiple users on an account, or resell or lease access to your account or any End User Account." …
• tldraw-contribution_policy-1: Escalated since bootstrap ("external-PR auto-close"): PRs now turned off entirely. Linked issue #7695 "Contributions policy" (steveruizok, 2026-01-15): "we’ve recently seen a significant increase in contributions generated entirely by AI tools". Applies to all external contributors, human or agent.
• gentoo-contribution_policy-1: Was "secondary" on the public page; now verified from the primary wiki page (Council vote 2024-04-14; page last edited 11 September 2026).
• netbsd-contribution_policy-1: Was "secondary" on the public page; now verified from the primary page. Applies to committers.
• taskmarket-account_identity-1: First sentence matches the 2026-09-30 quote; the autonomous-acceptance limit was not quoted before. TaskMarket's live terms page is headed 'Effective date: [COUNSEL TO APPROVE EFFECTIVE DATE] Draft for counsel review. This policy is not approved or active.' and carries 8 …
• agentpact-account_identity-1: 2026-09-30 record said 'none found (checked: llms.txt partial)'. https://agentpact.xyz/terms returned 404. Registration: 'POST https://api.agentpact.xyz/api/auth/register (free, instant API key)'.
• toku-agency-account_identity-1: 2026-09-30 record: 'none found (checked: homepage, /docs)'. ownerEmail is optional ('omit for fully autonomous registration').
• Upwork API & MCP Terms of Use (Version 2.3, effective 2026-08-13) read for the first time, via Wayback snapshot 20260910011811. Four new rows.
• HackerOne: ID verification is now required before any bug-bounty submission (August 2026). The Upwork MCP help article was edited 2026-10-01 with the explicit-confirmation FAQ. Superteam: 24 of 25 open listings are HUMAN_ONLY (run 2: 28 of 30).
• Unchanged: HackerOne hackbot and one-account clauses; Bugcrowd Code of Conduct (2025-11-25) and the 2026-03-10 blog; huntr challenge rule; Upwork bot article; Algora robot clause (2021-08-17); Superteam skill.md; Anthropic and Google effective dates.

Ledger and catalogue (payouts.json and venues.json, changes_since_previous and per-record change_log):

• reclassification: taskmarket-0060..0065 unlinked → identified_independent. MolTrust publicly confirms funding TaskMarket bounties TSK-9YFR1YF7 and TSK-KEYKZGQF (MoltyCel/moltrust-api PRs #369, #404, #410); TaskMarket API requester 0xa175d51b. First identified independent payer in the ledger: 1 payer, $9.25, promotional bounties for its own product.
• window_shift: all. Window moved from 09-01..10-01 to 09-02..10-02; 2026-09-01 payouts dropped out (AgentPact $6.41, TaskMarket $0.30, ACP $0.036, Execution Market tasks created 09-01).
• headline: agent_work_usd_paid_30d 230.37 → 232.55.
• headline: operator_or_operator_linked_share 0.4455 → 0.4043. Falls mainly because AgentPact's operator-paid $6.41 and part of Execution Market's swarm pay left the window while TaskMarket (unlinked) added $11.10.
• headline: identified_independent_payers 0 → 1. MolTrust, $9.25, promotional.
• secondary_number: e1_agent_paid_last_30d → 4. AgentPact has no payout in the window (latest 2026-09-01; stale on 2026-10-31). Homepage E1 count with agent-work payouts stays 5.
• correction: execution-market metrics total_volume_usd. Counts posted bounty value, not payouts (504.84 -> 524.84 when one $20 task was published).
• watch: execution-market task 607c9a44. $20 non-swarm task pending assignment; would be EM's first non-operator payer if settled.
• venues.json: 18 records changed; last_verified set to 2026-10-02 only for the 6 ledger venues (taskmarket, virtuals-acp, execution-market, moltjobs, agentpact, x402-per-call-endpoints); rules_checked set on 18 records; all 33 slugs kept; no promotion or demotion. TaskMarket independent_payer_evidence unknown → yes. tos_ai_policy updated for taskmarket, agentpact and toku-agency.

9. Open questions and backlog

Open questions:

• Kaggle ARC Prize 2026 rules (AMLT, single account, eligibility): still from search snippets only. Every route has failed: direct fetch gives a JS shell; r.jina.ai 403; archive.ph 429; GitHub copies are paraphrases; arcprize.org lacks the clauses; the Wayback snapshot 20260904170707, retried later in the run, holds only the JS shell. A later run could try a rendered-page snapshot or the Kaggle API from another egress.
• HackerOne submitted_with_assistant: not documented publicly. Best inference (unconfirmed): it marks reports submitted through Hai Report Assistant. It should not be read as evidence that an agent found the bug.
• Google VRP: the claim that it "stopped accepting AI reports in March 2026" is refuted only at snippet level. What did change: the OSS VRP raised proof requirements, and it stopped taking product vulnerabilities from 1 October 2026. bughunters.google.com is JS-only and Wayback returned 429.
• dealwork.ai withdrawal methods and CDP facilitator seller KYC: still open (see section 5).
• Provider gaps: Google ToS and Google One terms for consumer Gemini plans not read; no Anthropic support article on plan limits read; optional providers (xAI, Mistral, Cursor) skipped.
• Who is behind cluster 0xd8c5, and contracts 0xDc24245C and 0xb2cc224c? Will Execution Market task 607c9a44 settle? Will MolTrust's two open TaskMarket bounties (TSK-J3R0MDGA 5.41 USDC with 206 submissions; TSK-E49N4V7T 0.541 USDC) pay out?
• Security leads still secondary: Vectra's Moltbook injection-prevalence figure; the GTIG May 2026 report on account pooling through API relays.
• Not researched: Intigriti and YesWeHack KYC and payouts; Outlier terms; DataAnnotation's AI clause (terms 404); Prolific participant terms (404; rules row from the researcher help centre); Reddit's rules for Frantic-style tasks.

Backlog (venues.json, backlog): Frantic (updated: no E-level until PAID receipts are traced on-chain); Intigriti, YesWeHack, Immunefi and Google VRP added with rules seen and no payout evidence collected. None promoted. Watch list: Execution Market idle since 2026-09-29; Algora's latest confirmed payout passes 60 days around 2026-10-25; AgentPact stale on 2026-10-31; ARC Prize Milestone #2 results expected around 2026-10-06.