Challenge: Bypass the Ed25519 signature verification ($200 bounty)

[rodchalski]

$200 to the first person who can produce a valid Authority Receipt that passes our verify endpoint — without using the approval UI.

The target:
permission-protocol/pp-demo#32

The source code:

• CI/CD enforcer: https://github.com/permission-protocol/deploy-gate
• Local proxy: https://github.com/permission-protocol/mcp-guard

What counts:

• Forge a receipt that passes signature verification
• Replay an existing receipt against a different action
• Find a flaw in the Ed25519 signing/verification flow

What doesn't count:

• Spoofing a GitHub commit status with repo write access
• Social engineering
• Attacking infrastructure (this is a crypto challenge, not a pentest)

How to claim:
Open an issue with the exploit, or DM @rodchalski.

Payment: PayPal or Venmo, within 24 hours of verified bypass.

[rodchalski]

This does not demonstrate an actual bypass against our verify endpoint. The challenge requires producing a receipt that passes deploy-gate's signature verification — not a generic Ed25519 code sample. The bounty remains open.