Requested outcome

Create a Tripwire-owned open database of listed contributor accounts, with manual curation, and an opt-in workflow rule that blocks a pull request when its author has an active entry. This issue tracks discovery and a reviewable implementation proposal; it does not enable the database or enforcement today.

References

• Fossier: trust tiers, registry integration, maintainer decisions and decision history.
• UnsafeLabs/Bounty-Hunters.
• Clankers leaderboard.

Study source, licenses and demonstrated behavior before borrowing mechanics. Treat the database and Tripwire rule as separate capabilities.

Discovery deliverables

• Compare evidence collection, account identity, public distribution, corrections and automation interfaces in the references; distinguish demonstrated behavior from claims.
• Define identity as forge plus immutable account ID, with handles as display metadata; cover rename/deletion without inferred cross-forge identity.
• Specify manual add/remove, review states, evidence/provenance, reasons, timestamps, expiry/reversal and appeal/correction. Define listing criteria; leaderboard appearance or AI usage alone must not silently become the policy.
• Propose public format/API or versioned snapshot, license, update/caching model, integrity and unavailable-source behavior. Decide whether outsiders may report and who publishes active entries.
• Design a versioned, opt-in rule through existing rules/workflows/actions. Distinguish active match, no match and unavailable evidence; record matched entry and database version in each run. Keep lookup I/O in the worker and core evaluation pure.
• Decide whether block means merge-blocking check, configured close action, or both; preserve explicit workflow configuration, exemptions and overrides. An outage must not become a fabricated account match.
• Produce the smallest scoped implementation plan, schemas, regression/rollout criteria and open decisions. No new packages/apps/dependencies or production activation during discovery.

Done when

A cited discovery note and scoped proposal explain the data lifecycle, public distribution and match-to-enforcement path, with explicit admission/removal policy and recovery behavior. No real accounts are imported or listed during discovery.

Background discovery is underway. GitCafe protection remains a separate active implementation priority.

Initial discovery findings — 2026-10-28

• Bounty-Hunters is a PR-opener tracker, not a reviewed misconduct feed. Its tracking workflow automatically adds/increments every PR author's username. There is no bot or misconduct adjudication in that path. Its sync workflow combines aggregate counts by username without incident-level provenance. Borrow inspectable, machine-readable publication; do not automatically import those people into an enforcement list.
• Fossier demonstrates useful registry consumption and withdrawal mechanics. Its registry client checks/reports by username and supports withdrawing a repository's report. Server moderation, independence of reports, appeals, retention and data licensing remain unverified. Configuration makes registry checking/reporting opt-in. Do not copy mutable-handle identity or infer that a report count establishes a verified incident.
• Smallest proposed implementation: one owner-curated, explicitly licensed, versioned snapshot and one optional versioned pure rule. Worker fetches/validates; core matches the normalized PR author's forge-qualified immutable account ID. Reuse existing workflows, run evidence, exemptions, human review and forge actions. No new service, federation, public reporting flow, auto-import, classifier or global activation is implied.
• Three separate outcomes: active eligible match fails the requirement; complete fresh snapshot with no match passes; missing/stale/invalid/incomplete source skips with a bounded reason. Persist snapshot/case revision in evaluated evidence. Existing degraded-floor policy may hold a skipped evaluation for human review; unavailable is neither a match nor a clean result.
• Block differs from Close: merge-blocking checks/reviews leave the PR open; closing requires explicit workflow configuration. Neither prevents a user from opening another PR. Effective merge enforcement requires the repository's branch protections.
• Open decisions: listing criteria and terminology; manual admission authority; evidence visibility and license; correction/appeal/reversal/expiry; snapshot publication home and freshness; precedence with local exemptions; reevaluation after removal. No real accounts were imported, reports submitted or enforcement enabled during discovery.

Source inspection is not a live registry or accuracy evaluation. The public leaderboard was inspected without authentication; prompt datasets and private/user environment information were not collected.