{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"a95c621a-081b-4aed-9101-b08c059574f5","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"7c3a319d5f2624373e55040d6eb9c7d437ee912f19c2b4693d39fbcba9711d73","dependsOn":[],"execution":{"mustProduce":["dist/index.html"],"network":true,"profile":"none","requires":["network"],"skillHash":"b166f8ae3180dd8550019d4ca11bb9ac637e46ce9c93c32a5d519709af082637","skillId":"import-site","tools":[]},"key":"import_site","kind":"code","role":"implement","skillHash":"b166f8ae3180dd8550019d4ca11bb9ac637e46ce9c93c32a5d519709af082637","skillId":"import-site","state":"accepted"},{"acceptedSubmissionHash":"933de12826acddcd61ebaae3e1b69e6c01df7a10667879180d4906e061c8e12a","dependsOn":["import_site"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","tools":[]},"key":"site_content_check","kind":"code","role":"review","skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","state":"accepted"}],"objective":"A Squeekchain arcade where a real hamster triggers bonus rounds and players compete on a shared leaderboard.","parentJobId":null,"planHash":"69253930af5c67839b79af0ad1d3e8257bccbea96d6376d592e1514ba7557eab","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"a95c621a-081b-4aed-9101-b08c059574f5","publication":{"commit":null,"deliveredAt":null,"repoUrl":null},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51518","feedbackHash":"d71d0287087e5f8afa12d0b8727efedb347b5a8a31c4f5833c1e4194064a2574","nodeKey":"import_site","submissionHash":"7c3a319d5f2624373e55040d6eb9c7d437ee912f19c2b4693d39fbcba9711d73","tag1":"verification:structural","tag2":"acceptance-v2","value":1},{"agentId":"51317","feedbackHash":"3b3182c879bd7c58ce5f28548bcbf6e04d7866c73dfcd9ce34063b056815905a","nodeKey":"site_content_check","submissionHash":"933de12826acddcd61ebaae3e1b69e6c01df7a10667879180d4906e061c8e12a","tag1":"review:submission","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"0c3a341564d428bccbfc0d2bff997c08518bb209e259f3b7760fc9f0c450bf88","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"fc450219207b2fb7f97dd992929104705f8a9aa6bed090f81305f83e94272176","device":"12fbd676b2122512","findings":[],"hash":"7c3a319d5f2624373e55040d6eb9c7d437ee912f19c2b4693d39fbcba9711d73","nodeId":"4a4dd05f-49e7-4a6e-aebe-d175c4c8ada8","outcome":"completed","summary":"Built the static hosting export successfully.\n\n- Package manager: npm\n- Build command: `npm run build -- --prerender-all`\n- Output: [`dist/index.html`](/home/imd-worker/.identitymd/work/a95c621a-081b-4aed-9101-b08c059574f5/4a4dd05f-49e7-4a6e-aebe-d175c4c8ada8/dist/index.html)\n\nVerified generated HTML/assets match the build output, serve successfully, and total 595,478 bytes (under 8 MiB). Only `dist/` and the permitted `dist` ignore entry in `.gitignore` changed.","treeHash":"bbdc0ee2a703bc24abeeaf5bcddf6ea87ce28873","usage":{"cachedInputTokens":1244160,"inputTokens":113957,"model":null,"outputTokens":12065,"runtime":"codex","turns":11,"wallClockMs":364404}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"0476c44a80aa9574","findings":[{"citation":"resolved","description":"The export in dist/ contains only index.html, 404.html, the client chunks, CSS and two SVGs. Every dynamic feature (pulse feed, leaderboard, auth/nonce, auth/verify, auth/session, runs) is a same-origin fetch to /api/<path>, implemented only by the Cloudflare Worker route in app/api/[...path]/route.ts with a D1 binding (lib/server.ts line 4-7). None of that is in the export, so on an IPFS/ENS gateway every /api call returns the gateway's 404 (HTML or text) and r.json() throws. Consequences on the hosted page: the Squeekchain card shows OFFLINE / 'Live feed unavailable' permanently, the leaderboard shows 'Scores unavailable', and pressing 'Connect wallet' then a wallet still triggers eth_requestAccounts in the visitor's wallet before the following auth/nonce call fails with a JSON parse error toast. The wallet flow itself is honest (only eth_requestAccounts and personal_sign of a sign-in message that says it authorizes no transaction; no approvals, permits, typed-data or transactions anywhere in the export), so this is a broken-feature finding, not a drainer. Advisory: host behind the Worker or point the client at an absolute API origin that will exist.","line":1,"path":"dist/_next/static/chunks/page-BAhNHl9l.js","reproduction":"Serve dist/ as static files (e.g. `python3 -m http.server -d dist 8080`), open http://localhost:8080/. Expected: live hamster status and leaderboard load. Actual: Squeekchain card says OFFLINE / Live feed unavailable, leaderboard says 'Scores unavailable' (GET /api/leaderboard returns 404). With an EIP-1193 wallet installed click 'Connect wallet' then the wallet name: the wallet's account-access prompt appears, then a toast with a JSON SyntaxError ('Unexpected token' ...) because POST /api/auth/nonce returned a non-JSON 404.","severity":"medium","snippet":"async function L(e,t,n){let r=await fetch(`/api/${e}`,t||n?{method:n||`POST`,headers:{\"Content-Type\":`application/json`},body:t?JSON.stringify(t):void 0}:{cache:`no-store`}),i=await r.json();if(!r.ok)throw Error(i.error||`Please try again.`);","title":"Static export depends on same-origin /api/* routes that a static IPFS pin cannot serve; wallet sign-in and leaderboard fail after prompting the wallet"},{"citation":"resolved","description":"The only external resource the export loads automatically is the Google Fonts stylesheet (and the fonts.gstatic.com font files it references). This is the sole third-party request on page load and is not mentioned anywhere on the site. It is not a script and runs no code, so it is advisory only: tracking without disclosure. Same import exists in the source at app/globals.css line 1. Self-hosting the two font families would remove the only outbound request the page makes.","line":1,"path":"dist/_next/static/css/index.B0BAHnRY.css","reproduction":"Open dist/index.html through any server with the browser network panel open. Expected: requests only to the site's own origin. Actual: a GET to https://fonts.googleapis.com/css2?family=Barlow+Condensed... followed by font-file requests to fonts.gstatic.com, carrying the visitor's IP, user agent and referer.","severity":"low","snippet":"@import \"https://fonts.googleapis.com/css2?family=Barlow+Condensed:wght@200;300;600&family=IBM+Plex+Mono:wght@400;500;600&display=swap\"","title":"Stylesheet loads web fonts from fonts.googleapis.com; every visit sends a third-party request with no disclosure on the page"},{"citation":"resolved","description":"Squeekchain is a real project (squeekchain.com, api.squeekchain.com, SQK token on Sepolia). The hosted page carries its own brand ('WHEELKEEPERS' header, '© WHEELKEEPERS' footer, an original generated hamster mark from scripts/generate-hamster-mark.mjs) and the Squeekchain references are honest data-source references (the 'SQUEEKCHAIN' card label, 'Data source' and 'DATA & DOCS' links to docs.squeekchain.com, Sepolia Blockscout settlement link). It does not use Squeekchain's logo or claim to be them, and the How-to-play modal fineprint in page-BAhNHl9l.js says 'This independent game does not grant Aura, WL or tokens.' This is therefore not impersonation and does not block hosting. The gap is that the only unaffiliated statement is hidden in a modal the visitor must open, while the meta description and the 'SQUEEKCHAIN' card label are visible at once; the README.md line 57 'not an official Squeekchain product' sentence is not in the export. Advisory: surface the independence note in the footer or Squeekchain card.","line":1,"path":"dist/index.html","reproduction":"Open dist/index.html. Expected: a visible statement that the site is independent of Squeekchain. Actual: the page body text (header, Squeekchain card, footer) contains no such statement; it appears only after clicking 'How to play', at the end of the modal: 'This independent game does not grant Aura, WL or tokens.'","severity":"low","snippet":"<meta name=\"description\" content=\"Catch seeds. Dodge glitches. Keep the wheel alive. A free Squeekchain arcade with gasless wallet sign-in and a shared leaderboard.\"/>","title":"'Independent, not official Squeekchain' disclaimer is only inside the How-to-play modal fineprint; the always-visible page and meta description describe the site as a Squeekchain arcade"}],"hash":"933de12826acddcd61ebaae3e1b69e6c01df7a10667879180d4906e061c8e12a","nodeId":"a39dd0c2-f16f-4af3-a541-7ce4f49f78e9","outcome":"completed","summary":"The review is complete. Nothing in the export must be withheld from hosting. The findings file holds three advisory items, and no tracked file was changed.\n\n**What was read.** Every file in the export: both HTML pages, all seven JavaScript chunks, the two manifests, the stylesheet and both SVGs. Also the source they were built from: the page, layout, game, draw, hamster, sound, events and server modules, the API route, the worker entry, and the build and test scripts.\n\n**What the scripts do.** The only wallet calls in the export are an account request and a plain message signature for sign-in. The signed message states that it authorizes no transaction or token access. There are no approvals, permits, typed-data signatures, transactions, iframes, redirects, eval, or remote code loading. The inline scripts in the HTML are the framework's render payload. The hamster mark is original generated art, and the site carries its own Wheelkeepers brand with honest links to the Squeekchain data source.\n\n**Findings written.**\n- **Medium.** The export is client-only, but every feature calls same-origin paths under /api that only the Cloudflare Worker serves. On a static pin the leaderboard and live feed show as unavailable, and connecting a wallet prompts the wallet and then fails with a parse error.\n- **Low.** The stylesheet imports fonts from Google, the page's only third-party request, with no disclosure.\n- **Low.** The statement that the game is independent of Squeekchain appears only inside the How-to-play modal, while the meta description and card label are visible at once.\n\nSources consulted for the brand check: [Squeekchain API docs](https://docs.squeekchain.com/developers/api/), [Pickaxe coverage of Squeekchain](https://pickaxe.io/resources/news/hamster-powered-squeekchain-and-pudgy-penguins-ignite-crypto-buzz), [Blockspot SQUEEK listing](https://blockspot.io/coin/squeekchain-squeek/).","treeHash":null,"usage":{"cachedInputTokens":787458,"inputTokens":322,"model":"claude-fable-5-1","outputTokens":13940,"runtime":"claude","turns":33,"wallClockMs":263043}}],"verification":[{"checks":[],"detail":"paths and tree verified; no suite was run for this kind of work","evaluation":"structural","profile":"none","status":"accepted","submissionHash":"7c3a319d5f2624373e55040d6eb9c7d437ee912f19c2b4693d39fbcba9711d73","verifiedTreeHash":"bbdc0ee2a703bc24abeeaf5bcddf6ea87ce28873","verifierVersion":"0.1.0+c78f45fe"}]}