NUCLEI

What lands on Rekor

• NucleiPackEntry/v1 — the registry envelope wrapping a signed @sizls/pluck-bureau-core ProbePack with NUCLEI metadata (vendor scope, tags, recommended interval, license). ALWAYS rides on top of an SBOM-AI SbomEntry/v1cross-reference.
• BountyOffer/v1 — sponsor stakes payout for "first probe to red-dot vendor/model against a specific signed claim." Quorum threshold expressed N-of-M.
• BountyClaim/v1 — claimant points at a Rekor uuid for a red dot AND a Rekor uuid for a quorum vote that satisfies the offer's threshold. Adjudication is off-platform; Pluck records the cryptographic chain.

Trust model — registry ingest is TOFU

NUCLEI is a registry, not an oracle. Consumers MUST verify sbomRekorUuid against the SBOM-AI registry's findByDigestVerifiedOnly() before treating any pack as authoritative. Without an authoritative SBOM-AI cross-reference a pack lands at trustTier: "ingested" and downstream verifiers MUST refuse to honor it.

Browse the registry

• Leaderboard — top authors by first-to-red-dot count + total verified red dots.
• studio.pluck.run/bureau/nuclei/<author>/<pack> — per-pack page (alpha).

CLI

# scaffold a pack stub
pluck bureau nuclei init ./packs/honesty \
  --name canon-honesty-v0.1 \
  --vendor-scope "openai/gpt-4o,anthropic/claude-3-5-sonnet" \
  --license MIT

# attest to SBOM-AI first, capture the rekor uuid, THEN publish to NUCLEI
pluck bureau sbom-ai publish probe-pack ./packs/honesty/pack.json \
  --keys ./keys --accept-public

pluck bureau nuclei publish ./packs/honesty/pack.json \
  --keys ./keys --sbom-rekor-uuid <uuid> --accept-public

# operators subscribe + thread output into a DRAGNET runner
pluck bureau nuclei subscribe --tag training-data --vendor openai --seed <uuid>

Bounties

Vendors and third-parties stake payout for the first quorum-witnessed contradiction against a vendor's signed Disclosure/v1 claim. Adjudication / payout is off-platform; this layer just records the offer + claim predicates so a third-party arbiter can walk the chain.