{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"1fb039a0-e51e-4875-9692-e3a216eaab89","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"fce837b99ed1415deafd0064a7795f383a55a3a886dd4907a6e525c14bae4ffc","dependsOn":[],"execution":{"mustProduce":["dist/index.html"],"network":true,"optionalTools":["browser"],"profile":"none","requires":["network"],"skillHash":"a60bc8b42446c13d993341179fe13c712a5addb118fc532fb2d15e71f912efc8","skillId":"build-website","tools":[]},"key":"build_website","kind":"code","role":"implement","skillHash":"a60bc8b42446c13d993341179fe13c712a5addb118fc532fb2d15e71f912efc8","skillId":"build-website","state":"accepted"},{"acceptedSubmissionHash":"07d9c28228e18e1d8d3a44758c1e55b2962fd2c2f6211a91ec3a51ab96a8ccc7","dependsOn":["build_website"],"execution":{"network":true,"optionalTools":["browser"],"profile":"none","requires":["network"],"skillHash":"fd33b6741366d364a55a4c0ba2bc4f5d329cec0b62f27a83289dc5b30ab03575","skillId":"design-critic","tools":[]},"key":"design_critic","kind":"code","role":"review","skillHash":"fd33b6741366d364a55a4c0ba2bc4f5d329cec0b62f27a83289dc5b30ab03575","skillId":"design-critic","state":"accepted"},{"acceptedSubmissionHash":"4bbf8c2875701cfc9a5e5c1a9be1378e4989babb2f186923b6f0c80a8066b04d","dependsOn":["build_website"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","tools":[]},"key":"site_content_check","kind":"code","role":"review","skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","state":"accepted"}],"objective":"Publish the redesigned Weir website to the existing IMD site label weir (https://weir.sites.imd.fun). The design is DONE and approved by the owner: do NOT redesign, restyle, rewrite copy, rename anything, or add features. This job only imports and publishes it.\n\nSOURCE. The approved design lives in the public repository https://github.com/SwarmStream/swarmstream at commit fc3ac859dfbcd4f5bb030c577b4dec6657e33303 (web/ source, dist/ export, including the new receipt pages at #/stream/N/receipt/client and /freelancer). Replace this project's front end with that repository's web/ and dist/ contents. That repository is the Weir front end: Vite + React + wagmi source in web/ and a committed static export in dist/. dist/ is the build the owner approved and it is what gets published.\n\nWHAT TO DO. Publish dist/ as the site for label weir, replacing the previous build. If web/ builds cleanly with its documented commands, the result may be used; if it does not, publish the committed dist/ as it is. The published site must load its index page, render the hash routes (#/, #/create, #/streams, #/records), serve its fonts from the site itself, and load no external script, analytics or tracker.\n\nHARD RULES. Leave dist/imd-deployment.json and everything under dist/abi/ exactly as committed. Leave the contract addresses, chain id 4663 and the Weir ABI as they are. Leave the pixel-art plates in dist/assets/plates and web/public/assets/plates as they are. The product name is written exactly \"Weir.\" with the period. Keep all contract calls and wallet flows as they are. Do not claim an audit beyond the swarm's panel. The site must work at 360 px wide with no horizontal page scroll (the home page street pans sideways inside its own frame on phones by design).\n\nSIZE. The repository is about 4.6 MB of unique data and fits the submission cap. Do not recompress, resize, convert or otherwise change the PNG plates; they are already optimised palette images.","parentJobId":"424bfed2-74ac-4942-a618-5c4f6f84a748","planHash":"006681cd9001f4b7bbf2ebc3677dfc146f1a3bde27aeccec5f49c507a369043b","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"1f76ab2a-d781-4e31-a46a-9e9011488e7f","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1790-workflow-frontend-stage-context"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52009","feedbackHash":"651e9ce6c35168fc33fc50200f535835fd59b7ea373304eb9a4f286bbe353cf6","nodeKey":"build_website","submissionHash":"8c60d9be907027e53e0d65ad14e894b27fa9b1539e96d7f8f2d14e5d62c5e683","tag1":"verification:structural","tag2":"acceptance-v2","value":1},{"agentId":"51754","feedbackHash":"7e8422aad75cbbbf84278287c82f212d0f74633468d7c1967ecb9afc839c234e","nodeKey":"build_website","submissionHash":"fce837b99ed1415deafd0064a7795f383a55a3a886dd4907a6e525c14bae4ffc","tag1":"verification:structural","tag2":"acceptance-v2","value":1},{"agentId":"51358","feedbackHash":"f8a5427c2670e9b821c3b9da5d44fc3743a3d62d8fb8b9c6999595d7377e47ba","nodeKey":"design_critic","submissionHash":"7d3ffa7f30d6008b81c8fa0b1ca5d31780494656ef5b16e49dd92b20b4d6b3ca","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52290","feedbackHash":"1b3755191cc2b5761dc158a4c4e8463ef595679004b5bac9ec894979375124a6","nodeKey":"design_critic","submissionHash":"07d9c28228e18e1d8d3a44758c1e55b2962fd2c2f6211a91ec3a51ab96a8ccc7","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51884","feedbackHash":"4a2210a6017dcafcc406558e93d309b88fcb0562f0c1e3a9fca5377ca52daf65","nodeKey":"site_content_check","submissionHash":"cdfdaa3ac116be06037acb66ed47d17c7dcf129820b57228f03191cbb56551cf","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"50903","feedbackHash":"f519f6d34c371b2b00b1f7361f46fbc6ffa6a50cd386011052e36705f6bac0e1","nodeKey":"site_content_check","submissionHash":"4bbf8c2875701cfc9a5e5c1a9be1378e4989babb2f186923b6f0c80a8066b04d","tag1":"review:submission","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"537af6f61f2186fa8345ab711a5923f9969b903aa77c3b8b4a93f4967ac2d0c1","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"60c045240bb09c33","findings":[],"hash":"07d9c28228e18e1d8d3a44758c1e55b2962fd2c2f6211a91ec3a51ab96a8ccc7","nodeId":"f7dae06a-6cf9-4315-9ded-0786b40e3f13","outcome":"completed","summary":"| Area | Last review | This review |\n| --- | --- | --- |\n| Brief requirements | 14 met, 0 missing, 0 faked, 3 after review, 1 needs the requester | 14 met, 0 missing, 0 faked, 3 after review, 2 needs the requester |\n| Broken features | 2 (1 high, 1 medium) | 0 |\n| Product on the first screen at 390 | yes | yes |\n| taste@1 checks passed | 12 of 16 | 12 of 16 |\n| Copy findings | 0 | 0 |\n| Share card | present | present |\n\n**Both findings from last round are fixed.** The findings file is written as an empty list.\n\n**Wrong-network overflow at 360 px (high).** Fixed. I re-ran my reproduction with my own harness, using the unchanged mock-chain fixture on chain 1 with the switch rejected, in Chromium 156 at 360 and 390 px. Document scrollWidth is now 360 on all seven routes, and the \"Switch to Robinhood Chain\" button wraps onto three lines inside the header, right edge at x=344. The fix is the scoped white-space override in web/src/style.css at line 1184, and the compiled rule is present in the shipped stylesheet. WebKit could not launch here either, for the same missing host libraries the author reported. The fix is a plain CSS wrap with no engine-specific feature, so I accept the Chromium evidence.\n\n**Wallet error blocking navigation (medium).** Fixed. Without an injected wallet at 360 and 390 px on Create and Home, after choosing Browser wallet and pressing Escape, the alert is now static and full width. On Create at 360 px it sits at y=80 to 153.59 and navigation begins at y=153.59. elementFromPoint at the centre of every nav link returns the link, and a real click on Records navigates to #/records. The same holds in the wrong-network state, where the \"Request declined\" alert also sits in its own row.\n\n**Requirements, one line each.**\n- \"Publish dist/ as the site for label weir\": after review, IMD publishes.\n- \"Replace this project's front end with that repository's web/ and dist/\": met, settled last round; only the two CSS files changed since.\n- \"load its index page\" and \"render the hash routes\": met, all seven routes render an h1 in my harness.\n- \"serve its fonts from the site itself\": met, probe reports no missing local files and no external font host.\n- \"load no external script, analytics or tracker\": met, the only external host is the public chain RPC, a data request.\n- \"Leave dist/imd-deployment.json and everything under dist/abi/ exactly as committed\": met, both unchanged.\n- \"contract addresses, chain id 4663 and the Weir ABI\": met, unchanged.\n- \"pixel-art plates ... as they are\": met, unchanged.\n- \"Weir.\" with the period: met, title reads \"Weir. · Pay as the work flows\".\n- \"Keep all contract calls and wallet flows as they are\": met, no JavaScript changed.\n- \"Do not claim an audit beyond the swarm's panel\": met.\n- \"work at 360 px wide with no horizontal page scroll\": met now, measured above.\n- \"Do not recompress, resize, convert ... PNG plates\": met, plate hashes unchanged.\n- Hosting, live URL, deploy: after review.\n- Needs the requester: the manifest's inventory digest for the stylesheet is now stale, since the brief forbids editing the manifest and the CSS fix changed the file. The site's runtime never reads that digest, so nothing breaks in the browser, but the project's own export check fails on it. Only the requester can say whether the inventory may be refreshed.\n\n**The idea.** A pixel-art street where money flows from the client's house to the freelancer's as the work happens, and the page keeps that one image at the centre of a quiet, mostly monochrome layout.\n\n**Probe.** The four remaining probe flags, which are all-caps signs inside the street, the brand tracking, eight type sizes and four families, are inherited parts of the approved design the brief forbids restyling. No new defect reproduced this round.","treeHash":null,"usage":{"cachedInputTokens":780682,"inputTokens":450,"model":"claude-fable-5-1","outputTokens":10556,"runtime":"claude","turns":17,"wallClockMs":178276}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"523ef565dd740e25","findings":[{"citation":"resolved","description":"Re-check of finding b154100d297c50c2958bf5eb70c1fe61ba07a4ed201ce78f605b4a6a62a9a608. The revision (commit 6a6138c) changed only web/src/style.css, dist/assets/index-YTgPKy3v.css and docs; App.tsx line 139 and the compiled string in dist/assets/index-qzWPrTG1.js line 49 are byte-identical to the previous round. The site footer on every hash route still reads \"Audited by IMD Swarm. Use at your own risk.\" while .imd/reads/deployment.json manifest.notes states the source is \"reviewed by the swarm's panel only; it is not an audit\" and the project's own README.md line 89 now says \"**Not audited.** Tests and the swarm's review panel are not an audit.\" The README and the footer therefore contradict each other. Still advisory: the sentence names the swarm, is not an invented third-party endorsement and is not a deceptive financial claim, so it does not block hosting. The copy is in the owner-approved upstream commit fc3ac859, so changing the one word needs the owner's sign-off.","line":139,"path":"web/src/App.tsx","reproduction":"Serve dist/ and open #/ (or #/create, #/streams, #/records) at 360 px; scroll to the footer under the brand mark. Headless Chromium 156 this round rendered the footer text on all four routes as \"Weir.Open source. No application fee.Audited by IMD Swarm. Use at your own risk.…\". Expected: wording consistent with deployment.json and README.md line 89 (\"not an audit\"). Actual: \"Audited by IMD Swarm\". Also: grep -n 'Audited by IMD Swarm' web/src/App.tsx dist/assets/index-qzWPrTG1.js prints App.tsx:139 and index-qzWPrTG1.js:49.","severity":"medium","snippet":"            Audited by IMD Swarm. Use at your own risk.","title":"Not fixed: footer on every route still says the contract is \"Audited\"; the deployment manifest says it is not an audit"},{"citation":"resolved","description":"The revision rebuilt dist/assets/index-YTgPKy3v.css (35 new source lines compiled in; file grew from 35428 to 36065 bytes) but kept the asset inventory in dist/imd-deployment.json unchanged because the assignment says to leave that manifest exactly as committed. The manifest therefore attests sha256 4e13b0b5…c9d9d for assets/index-YTgPKy3v.css while the file actually served hashes to d1abad81cda1acb41adaf17728d65fe3c282723aaf071a33ec05c88faaa836b5. The project's own `npm run check:export` fails on the delivered export with \"Manifest differs from handoff or asset inventory\" (the author documents this in docs/revision-validation/export-delivery-check.txt). Runtime code does not enforce the inventory, the chain id, addresses and ABI hashes are untouched, and I confirmed the CSS delta is exactly the minified form of the source additions (wallet-error grid rows and white-space:normal on the wallet button), so this is not a hosting-safety issue. It is advisory: the two hard rules (keep the manifest as committed; fix the mobile wallet layout) conflict, and the requester must decide whether the manifest's inventory entry may be updated or the CSS fix must be published without a matching attestation.","line":94,"path":"dist/imd-deployment.json","reproduction":"sha256sum dist/assets/index-YTgPKy3v.css prints d1abad81cda1acb41adaf17728d65fe3c282723aaf071a33ec05c88faaa836b5; grep -n -A1 'index-YTgPKy3v.css' dist/imd-deployment.json prints sha256 4e13b0b5f858e094e00a2ddf2508d931557b538c72f5bf68f9c91ff0195c9d9d at line 94. Expected: the inventory hash equals the served file's hash (all other 40 entries do). Actual: they differ, and `node web/scripts/export.mjs check` (npm run check:export) exits with 'Manifest differs from handoff or asset inventory'. git show HEAD~1:dist/assets/index-YTgPKy3v.css | sha256sum reproduces the manifest's old hash.","severity":"medium","snippet":"      \"sha256\": \"4e13b0b5f858e094e00a2ddf2508d931557b538c72f5bf68f9c91ff0195c9d9d\"","title":"New in this revision: dist/imd-deployment.json records a stale SHA-256 for the delivered stylesheet, so the export's own integrity check fails"},{"citation":"resolved","description":"Re-check of finding 2cd6d50bd804ad0167c5e2b8db26c8601f33716f045a0f04bfab945f49d9f881. Create.tsx and the compiled dist/assets/index-qzWPrTG1.js are unchanged this round; the USDG preset (0x5fc5360D…1d168) and the ETH/WETH preset and wrap target (0x0Bd7D308…AD73) are still compiled into the bundle and absent from dist/imd-deployment.json and .imd/reads/deployment.json. Both addresses were verified on chain last round (symbol() returns USDG / WETH), so no visitor funds are misdirected; this remains a maintenance and trust hazard because the published bundle cannot be re-pointed through the manifest. Advisory, does not block hosting.","line":84,"path":"web/src/Create.tsx","reproduction":"grep -c '0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168' web/src/Create.tsx dist/assets/index-qzWPrTG1.js dist/imd-deployment.json prints 1, 1, 0. Open #/create: the token chooser offers USDG and ETH presets. Expected: every contract address used by the site comes from imd-deployment.json. Actual: two addresses are compiled in. On-chain check: cast call --rpc-url https://robinhood-rpc.publicnode.com 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168 'symbol()(string)' -> \"USDG\".","severity":"low","snippet":"      address: \"0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168\",","title":"Not fixed: Create form still hard-codes two token addresses (USDG, WETH) that are not in deployment.json"},{"citation":"resolved","description":"Re-check of finding fca2dba676938ef36773e685053bad620c325cc1611c508e244710162eadf92e. Receipt.tsx is unchanged. On #/stream/N/receipt/client and /freelancer, when the stream's on-chain termsURI is an https URL the page GETs it directly from the visitor's browser, so whoever created the stream learns the IP and user agent of anyone opening that receipt. This round I reproduced it live: opening #/stream/1/receipt/client and /freelancer in headless Chromium against the served dist/ issued a request to raw.githubusercontent.com (stream #1's termsURI) in addition to the site origin and robinhood-rpc.publicnode.com. Mitigations stand: credentials omitted, no referrer, only text/plain bodies, 2000-char cap, rendered through React escaping, 6 s abort. No code is executed from the remote host, so this is not a remote-script or drainer pattern. Advisory: disclose it on the page or drop the fetch; it does not block hosting.","line":31,"path":"web/src/Receipt.tsx","reproduction":"Serve dist/ locally, open #/stream/1/receipt/client at 360 px with the network panel open (or Playwright's request listener). Expected: requests only to the site origin and the RPC hosts listed in imd-deployment.json. Actual: one additional GET to raw.githubusercontent.com, the host of stream #1's termsURI. The request originates from the fetch at web/src/Receipt.tsx line 31 (compiled into dist/assets/index-qzWPrTG1.js).","severity":"low","snippet":"    fetch(href, { signal: ctl.signal, credentials: \"omit\", referrerPolicy: \"no-referrer\" })","title":"Not fixed: receipt pages fetch an arbitrary https URL chosen by the stream's creator from the visitor's browser"},{"citation":"resolved","description":"Settles finding 03eb5ad9f64d236001b87326ac884307b5adca0612aa0d53fbf83cc76657e5ec and checks the revision. Commit 6a6138c touches only web/src/style.css (+35 lines: wallet-error rows in the header grid under 900 px, white-space:normal on the wallet button under 640 px), dist/assets/index-YTgPKy3v.css (the minified equivalent; the only differing rules in the compiled file are those selectors) and docs. All JavaScript bundles, index.html, fonts, plates, dist/abi/ and the addresses/chain id 4663 are byte-identical to the previous round, which was byte-identical to SwarmStream/swarmstream@fc3ac859. This round I installed Playwright Chromium 156 outside the repository and served dist/: every route (#/, #/create, #/streams, #/records, #/stream/1/receipt/client, #/stream/1/receipt/freelancer) reports document.documentElement.scrollWidth 360 at a 360 px viewport, six local fonts loaded, page titles use \"Weir.\" with the period, and the only hosts contacted were the local origin, robinhood-rpc.publicnode.com (RPC from imd-deployment.json) and raw.githubusercontent.com (stream #1 termsURI, see the low finding). No analytics, tracker, iframe, remote script, eval or new Function is present; api.imdnotdead.fun (OracleLink.tsx:54), the Coinbase Wallet SDK popup and viem's CCIP helper are as inventoried last round. Nothing here blocks hosting.","line":1117,"path":"web/src/style.css","reproduction":"git diff --stat HEAD~1 HEAD shows only style.css, index-YTgPKy3v.css and docs/DESIGN/README. Serve dist/ with a static server and, in headless Chromium at viewport 360x740, evaluate document.documentElement.scrollWidth on each hash route: all return 360. grep -ohE 'https?://[A-Za-z0-9._/%-]+' dist/assets/*.js dist/index.html | sort -u lists the same hosts as last round.","severity":"info","snippet":"  .topbar:has(.wallet-error),","title":"Revision verified: CSS-only change, 360 px routes have no horizontal scroll, no external scripts or trackers; external calls unchanged from last round"}],"hash":"4bbf8c2875701cfc9a5e5c1a9be1378e4989babb2f186923b6f0c80a8066b04d","nodeId":"5184c327-a1ea-4627-a5bc-9feb396f965a","outcome":"completed","summary":"Review complete. The findings file is written and validated, and no repository file was changed.\n\n**Outcome:** nothing blocks hosting. The revision is a CSS-only change, and I confirmed it in a real browser this time.\n\n**What I verified this round**\n\n- **The revision touches only styling.** Commit 6a6138c changes 35 lines in the source stylesheet, the matching compiled stylesheet, and docs. Every JavaScript bundle, index page, font, plate, ABI, address and chain id is byte-identical to the previous round.\n- **360 px works.** I installed Playwright Chromium outside the repository and served the export. All six routes, including both receipt pages, measure exactly 360 px wide with no horizontal scroll. Fonts load from the site itself.\n- **No trackers or remote scripts.** The only hosts contacted were the local origin, the Robinhood RPC from the manifest, and one third-party URL on the receipt page described below.\n\n**How the earlier findings settled**\n\n- **Footer \"Audited\" wording (medium, not fixed).** The text is unchanged on every route. The project's own README now says \"Not audited\", so the site contradicts its own documentation. Still advisory, and the copy is owner-approved upstream.\n- **Hard-coded USDG and WETH addresses (low, not fixed).** Unchanged in the create form and bundle. Both addresses still resolve to the real tokens.\n- **Receipt page fetches a creator-chosen URL (low, not fixed).** Reproduced live: opening the receipt for stream 1 issues a GET to a raw.githubusercontent.com terms file. Mitigations remain in place and no remote code runs.\n- **External call inventory (info).** Updated to record the browser verification.\n\n**One new advisory finding (medium).** The rebuilt stylesheet no longer matches the SHA-256 recorded for it in dist/imd-deployment.json, because the manifest had to stay as committed. The export's own check script fails on the delivered tree. The requester has to decide whether the inventory entry may be updated or the mismatch is accepted.","treeHash":null,"usage":{"cachedInputTokens":677310,"inputTokens":482,"model":"claude-fable-5-1","outputTokens":14308,"runtime":"claude","turns":16,"wallClockMs":296346}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"0e53ef0bd01824cb","findings":[{"citation":"resolved","description":"Now: Both mobile headers force the wallet button onto one line. A wallet on another chain changes its label to \"Switch to Robinhood Chain\", expanding the 360 px home page to 434 px and the other routes to 385 px in Chromium.\nChange to: At max-width: 640px, set .wallet-button and .mobile-topbar .wallet-button to white-space: normal; min-width: 0, and set .header-right to min-width: 0. This lets the full network label wrap within the existing header. Keep the approved text, colors, fonts and wallet switching logic unchanged. Browser-only trials restore document width to 360 px on home and Create in both engines.\nWhy: The brief explicitly requires 360 px with no horizontal page scrolling. This overflow is in the header, outside the intentionally scrollable street. It is inherited from the approved commit; the import itself is exact.","line":120,"path":"web/src/town.css","reproduction":"Chromium 145 or WebKit 26, viewport 360×800, #/: connect an EIP-1193/EIP-6963 wallet reporting chain 1; decline wallet_switchEthereumChain to chain 4663, then close the connection dialog. Reproduced without a real wallet using unchanged web/tests/mock-chain.mjs: newState(), set rejectSwitch=true, installMock(page,state), click .mobile-topbar .wallet-button, choose Test browser wallet, wait for the dialog alert, press Escape. Expected document.documentElement.scrollWidth=360 and the complete switch button inside the header. Chromium: home scrollWidth=434; button x=190.015625, width=244, right=434.015625. Navigate by hash to /create, /streams, /records, /stream/1 and both receipt routes: each becomes 385 px wide. WebKit: home=417 px and the six other routes=367 px. Injecting only @media(max-width:640px){.wallet-button,.mobile-topbar .wallet-button{white-space:normal;min-width:0}.header-right{min-width:0}} in the test browser restores home and Create to 360 px in both engines. The shared nowrap declaration also occurs at web/src/style.css:301. No transaction is signed or broadcast.","severity":"high","snippet":"  .mobile-topbar .wallet-button { font-family: var(--font-pixel); font-weight: 400; font-size: 0.6rem; white-space: nowrap; background: var(--px-yellow); border: 2px solid var(--px-ink); border-radius: 0; min-height: 40px; padding: 6px 12px; }","title":"bug: wrong-network wallet labels cause horizontal page scrolling at 360 px"},{"citation":"resolved","description":"Now: After a failed browser-wallet connection is dismissed, the absolutely positioned .wallet-error overlays Start a stream, My streams and Records, and covers the top of the page heading.\nChange to: Place the existing error message in a full-width, normal-flow header row below the wallet controls and above navigation; remove its absolute positioning and top/inset offsets so the header reserves its height. Preserve the approved message, styling tokens and all wallet connection logic.\nWhy: The brief requires a working 360 px site. An error must remain readable without making navigation unclickable. This is an inherited runtime defect in the approved source, not an import mismatch.","line":303,"path":"web/src/style.css","reproduction":"Chromium, 360×800, no injected wallet: open #/create, click the header Connect wallet button, choose Browser wallet, wait for \"No browser wallet was found. Install a wallet, or choose Coinbase Wallet.\", then close the dialog with Escape or ×. Try clicking Records. Expected: navigation remains visible and changes to #/records. Actual: .wallet-error occupies x=92..344, y=78..176.39; navigation occupies y=80..127.69. elementFromPoint at the centers of Start a stream, My streams and Records returns .wallet-error; Playwright Records.click times out because that paragraph intercepts pointer events. Confirmed again at 390 px. No wallet or signature is required. WebKit 26 also reproduces the blocked Records click at 360 px.","severity":"medium","snippet":".wallet-error {\n  position: absolute;\n  inset-inline-end: 0;\n  top: 48px;\n  width: min(300px, 70vw);\n  padding: 12px;\n  background: var(--color-error-bg);\n  color: var(--color-error);\n  z-index: 2;\n}","title":"bug: wallet connection errors cover and block the mobile navigation"}],"hash":"7d3ffa7f30d6008b81c8fa0b1ca5d31780494656ef5b16e49dd92b20b4d6b3ca","nodeId":"f7dae06a-6cf9-4315-9ded-0786b40e3f13","outcome":"completed","summary":"| Area | Count / result |\n|---|---|\n| Requirements | 18: 15 met, 1 missing, 0 faked, 1 after review, 1 needs requester |\n| Broken features | 2: 1 high, 1 medium |\n| First screen at 390 px | Yes; “Start a stream” appears at y=74–110 |\n| taste@1 | 11/16 passed |\n| Copy | 0 findings |\n| Share card | Present; naming needs requester |\n\nSaved verified findings to [.imd-findings.json](/home/seat/.identitymd/work/1fb039a0-e51e-4875-9692-e3a216eaab89/f7dae06a-6cf9-4315-9ded-0786b40e3f13/.imd-findings.json). All 118 imported files match the approved commit exactly. No website files were changed.\n\n- **High — bug: wrong-network wallet labels cause horizontal scrolling.** At 360 px, connect a wallet on chain 1, decline the network switch and close the dialog. Chromium expands the home page to **434 px** and other routes to **385 px**; WebKit also overflows. Allow the existing button label to wrap and its container to shrink. This restores 360 px without changing wallet logic.\n- **Medium — bug: wallet errors block mobile navigation.** At 360 px, choose an unavailable Browser wallet and close the dialog. The error occupies **y=78–176**, covering navigation at **y=80–128** and intercepting Records clicks. Put the existing error in normal document flow so navigation remains usable.\n\nBoth defects are inherited from the approved source and reproduced in Chromium and WebKit.\n\n| Explicit requirement | Status | Evidence |\n|---|---|---|\n| “Do NOT redesign, restyle, rewrite copy, rename…or add features” | Met | All 118 files unchanged |\n| Replace `web/` and `dist/` from commit `fc3ac859…` | Met | Independent archive comparison; identical file sets and hashes |\n| Include client and freelancer receipt routes | Met | Both routes render in both engines |\n| Publish the approved `dist/`; rebuilding is optional | Met | Committed export preserved exactly |\n| Publish to existing label `weir`, replacing the previous build | After review | Publication remains the hosting pipeline’s step |\n| “load its index page” | Met | Local export loads without script errors |\n| Render `#/`, `#/create`, `#/streams`, `#/records` | Met | All four routes tested in both engines |\n| “serve its fonts from the site itself” | Met | Loaded fonts returned HTTP 200 from `/fonts/` |\n| “no external script, analytics or tracker” | Met | Source inspection and observed browser requests |\n| Preserve `dist/imd-deployment.json` | Met | Exact upstream hash |\n| Preserve `dist/abi/` and the Weir ABI | Met | Exact upstream hashes; runtime ABI verification passes |\n| Preserve contract addresses and chain 4663 | Met | Manifest matches supplied deployment/network data |\n| Preserve both plate directories; no PNG transformations | Met | Every plate matches upstream bytes |\n| Product name exactly “Weir.” | Needs requester | Headers comply; approved `dist/share.png` says lowercase `weir`. An approved replacement is needed to reconcile this with the no-change rule |\n| Preserve contract calls and wallet flows | Met | Source and bundles unchanged |\n| No audit claim beyond the swarm’s panel | Met | Footer limits its claim to IMD Swarm |\n| Work at 360 px without page scrolling; street pans internally | Missing | Street pan works; wrong-network headers overflow |\n| Fit the submission cap | Met | Tracked files plus report: approximately 8.12 MB, below 8 MiB |\n\nThe visual idea is a pixel-art street showing payments flowing from client to freelancer through a dispute-review system.\n\nThe five probe flags concern approved typography and 320 px overflow; they were not treated as redesign requests. Seven routes passed ordinary layout checks at 360, 390 and 1440 px in both engines. No real transactions were signed.","treeHash":null,"usage":{"cachedInputTokens":2890752,"inputTokens":134608,"model":"gpt-6-astra","outputTokens":19873,"runtime":"codex","turns":7,"wallClockMs":832690}},{"artifacts":[],"attempt":1,"bundleHash":"80c3f888afa062c5d870f1a26d021b5702472fa6af52738dc40485e052f13fa6","device":"6ce0cec991d77172","findings":[],"hash":"8c60d9be907027e53e0d65ad14e894b27fa9b1539e96d7f8f2d14e5d62c5e683","nodeId":"0ea8ab21-baad-46c1-bba4-63fb7d9f16c0","outcome":"completed","summary":"Imported the approved `web/` and `dist/` unchanged.\n\n- Build, typecheck, 11 unit tests and 12 browser scenarios passed.\n- Complete snapshot bundle: 3.95 MB, below 8 MiB.\n- [Validation report](docs/IMPORT_VALIDATION.md) records the inherited 320 px issue and unverified Safari behavior.\n\nReady for IMD’s `weir` publication pipeline. Live publication has not been verified.","treeHash":"6b9a59a54666533a92e85b1f8945f16bcd7d2077","usage":{"cachedInputTokens":4973824,"inputTokens":172717,"model":"gpt-6-astra","outputTokens":37201,"runtime":"codex","turns":9,"wallClockMs":1689735}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"4aa8623bfb8d8e5e","findings":[{"citation":"resolved","description":"The site footer (rendered by App.tsx on every hash route, shipped in dist/assets/index-qzWPrTG1.js line 49 as the string `Audited by IMD Swarm. Use at your own risk.`) tells visitors the application was audited. The verified deployment manifest (.imd/reads/deployment.json, manifest.notes) states the opposite: \"Source is MIT and reviewed by the swarm's panel only; it is not an audit.\" The hard rule for this job is \"Do not claim an audit beyond the swarm's panel\": the sentence names the swarm, so it is not an invented third-party endorsement, but the word \"Audited\" overstates a panel review as an audit. This is a wording defect in approved copy and is advisory; it is not a deceptive financial claim and does not block hosting. The upstream commit fc3ac859 carries the same text, so fixing it needs the owner's sign-off on a one-word change (e.g. \"Reviewed by the IMD Swarm panel\").","line":139,"path":"web/src/App.tsx","reproduction":"Serve dist/ and open #/ (or any route) at any width; scroll to the footer under the brand mark. Expected: a statement consistent with deployment.json (\"reviewed by the swarm's panel; not an audit\"). Actual: the footer reads \"Audited by IMD Swarm. Use at your own risk.\" Also: grep -n 'Audited by IMD Swarm' dist/assets/index-qzWPrTG1.js prints line 49.","severity":"medium","snippet":"            Audited by IMD Swarm. Use at your own risk.","title":"Footer on every route says the contract is \"Audited\"; the deployment manifest says it is not an audit"},{"citation":"resolved","description":"The token picker presets for chain 4663 in Create.tsx lines 81-104 (shipped in dist/assets/index-qzWPrTG1.js line 47) include USDG at 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168 and ETH/WETH at 0x0Bd7D308f8E1639FAb988df18A8011f41EAcAD73 (also used by the `WETH` wrap map on line 104, which sends the visitor's ETH to that contract's payable deposit()). Neither address appears in .imd/reads/deployment.json or dist/imd-deployment.json; the project rule is to never hard-code an address not in deployment.json. I verified both on chain over https://robinhood-rpc.publicnode.com: symbol() returns \"USDG\" (decimals 6) and \"WETH\" (decimals 18), so the presets point at the real tokens today and no visitor funds are misdirected. Low because the addresses check out; it remains a maintenance and trust hazard since the published bundle cannot be re-pointed by editing imd-deployment.json.","line":84,"path":"web/src/Create.tsx","reproduction":"Open #/create; the token chooser offers USDG and ETH presets. grep -n '0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168\\|0x0Bd7D308f8E1639FAb988df18A8011f41EAcAD73' dist/imd-deployment.json returns nothing, while the same grep on dist/assets/index-qzWPrTG1.js matches line 47. Expected: every contract address used by the site comes from imd-deployment.json. Actual: two addresses are compiled into the bundle. On-chain check: cast call --rpc-url https://robinhood-rpc.publicnode.com 0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168 'symbol()(string)' -> \"USDG\".","severity":"low","snippet":"      address: \"0x5fc5360D0400a0Fd4f2af552ADD042D716F1d168\",","title":"Create form hard-codes two token addresses (USDG, WETH) that are not in deployment.json"},{"citation":"resolved","description":"On #/stream/N/receipt/client and #/stream/N/receipt/freelancer, when the stream's on-chain termsURI is an https URL, the page fetches that URL directly from the visitor's browser and shows the response body as text. The URL is chosen by whoever created the stream, not by the site, so a stream creator can learn the IP address and user agent of anyone who opens that stream's receipt. The code limits the exposure: credentials omitted, no referrer, only text/plain responses are used, at most 2000 characters, and the text is rendered through React (escaped, never innerHTML), so no remote code runs and this is not a script loaded from an unowned origin. Advisory: disclose it or proxy nothing; it does not block hosting.","line":31,"path":"web/src/Receipt.tsx","reproduction":"Serve dist/, open #/stream/N/receipt/client for a stream whose termsURI is an https link (e.g. one created on #/create with an https terms link), and watch the network panel. Expected: the receipt page talks only to the site origin and the chain RPCs listed in imd-deployment.json. Actual: one GET is issued to the third-party host named in the stream's termsURI.","severity":"low","snippet":"    fetch(href, { signal: ctl.signal, credentials: \"omit\", referrerPolicy: \"no-referrer\" })","title":"Receipt pages fetch an arbitrary https URL stored by the stream's creator from the visitor's browser"},{"citation":"resolved","description":"Inventory of everything the export contacts beyond the site origin, read from dist/assets/index-qzWPrTG1.js, dist/assets/dist-CAU-0hSY.js and dist/assets/ccip-De_7gWPL.js: (1) the two Robinhood Chain RPCs loaded at runtime from imd-deployment.json; (2) OracleLink.tsx:54 GETs https://api.imdnotdead.fun/intake/<chain>/<tx> to find the oracle job id for a disputed stream, data only, IdentityMD's own service; (3) dist-CAU-0hSY.js is the Coinbase Wallet SDK, which opens a keys.coinbase.com popup and a walletlink WebSocket only after the visitor chooses Coinbase Wallet; (4) ccip-De_7gWPL.js is viem's CCIP-read helper, invoked only if a contract returns OffchainLookup (Weir does not); (5) the metamask/rabby/phantom/coinbase deep links in Wallet.tsx are plain anchors shown on phones. The ipfs.io, arweave.net and 4byte.sourcify.dev strings are viem defaults and error-message text, never requested. index.html loads one module script and one stylesheet from ./assets, all 16 fonts from ./fonts, no third-party script, iframe, beacon, eval or new Function. dist/ and web/ are byte-identical to SwarmStream/swarmstream@fc3ac859; all 41 sha256 entries in dist/imd-deployment.json match; the canonical keccak of dist/abi/Weir.json and dist/abi/LaunchToken.json equals the abiHash values in deployment.json; addresses and chain id 4663 match. The 360 px no-horizontal-scroll rule is covered by docs/import-validation/interactions.json (document width 360 at viewport 360 on all seven routes, passed); I could not re-run it here because no browser is installed on this machine.","line":54,"path":"web/src/OracleLink.tsx","reproduction":"grep -ohE 'https?://[A-Za-z0-9._/%-]+' dist/assets/*.js dist/index.html | sort -u lists only the hosts above plus w3.org namespaces and library doc links. sha256sum dist/assets/* dist/fonts/* matches dist/imd-deployment.json assets[]. diff -rq <upstream fc3ac859>/dist dist prints nothing.","severity":"info","snippet":"      const response = await fetch(","title":"External network calls present in the bundle, all accounted for; no analytics, trackers or remote scripts"}],"hash":"cdfdaa3ac116be06037acb66ed47d17c7dcf129820b57228f03191cbb56551cf","nodeId":"5184c327-a1ea-4627-a5bc-9feb396f965a","outcome":"completed","summary":"Review complete. Nothing in the export blocks hosting. Findings are written to `.imd-findings.json` with no tracked file changed.\n\n**What I verified**\n\n- The working tree's `web/` and `dist/` are byte-identical to SwarmStream/swarmstream at commit fc3ac859, fetched fresh from GitHub.\n- All 41 asset checksums in `dist/imd-deployment.json` match the files. The canonical keccak of both shipped ABIs equals the abiHash values in the deployment manifest. Addresses and chain id 4663 are unchanged.\n- The index page loads one module script and one stylesheet from the site's own assets folder, and all fonts from its own fonts folder. There is no third-party script, iframe, beacon, eval, dynamic script injection or analytics in any of the three bundled scripts.\n- The two preset token addresses that are not in the manifest resolve on chain to real USDG and WETH contracts.\n- The 360 px no-horizontal-scroll rule is covered by the previous contributor's recorded browser run across all seven routes. No browser exists on this machine, so I confirmed the evidence rather than re-running it.\n\n**Findings, none blocking**\n\n- **Medium.** The footer on every route reads \"Audited by IMD Swarm. Use at your own risk.\" The deployment manifest says the source was reviewed by the swarm's panel and is not an audit. The wording overstates the review and is in approved copy, so changing it needs the owner's sign-off.\n- **Low.** The create form hard-codes USDG and WETH addresses that are not in the deployment manifest. They are correct on chain today, but cannot be re-pointed by editing the manifest.\n- **Low.** Receipt pages fetch the stream's terms URL directly from the visitor's browser when it is an https link, so the stream's creator can see the visitor's IP. Credentials are omitted, only plain text is accepted, and it is rendered escaped.\n- **Info.** Inventory of every external host the bundle can contact: the manifest's RPCs, IdentityMD's intake API for oracle job lookup, and Coinbase Wallet's relay only after the visitor picks that wallet.","treeHash":null,"usage":{"cachedInputTokens":761327,"inputTokens":418,"model":"claude-fable-5-1","outputTokens":13630,"runtime":"claude","turns":14,"wallClockMs":272065}},{"artifacts":[],"attempt":1,"bundleHash":"a057723900fd0073e0a14434482f36d68b1b092b65f1eb9ad7dff4b42ca58002","device":"e9bb398fec9e3e04","findings":[],"hash":"fce837b99ed1415deafd0064a7795f383a55a3a886dd4907a6e525c14bae4ffc","nodeId":"0ea8ab21-baad-46c1-bba4-63fb7d9f16c0","outcome":"completed","summary":"Fixed both wallet layout defects and updated `dist/`. Recorded both responses in `.imd-responses.json`.\n\nBuild, typecheck, 11 unit tests and 28 Chromium scenarios passed. Submission snapshot: 3.97 MB.\n\nWebKit lacked required libraries. The protected manifest retains its original CSS digest; this limitation is documented. IMD publication follows submission.","treeHash":"f60821c390c67900239cbc2b067732a7e67be123","usage":{"cachedInputTokens":2759808,"inputTokens":122581,"model":"gpt-6-astra","outputTokens":26906,"runtime":"codex","turns":7,"wallClockMs":948150}}],"verification":[{"checks":[],"detail":"paths and tree verified; no suite was run for this kind of work","evaluation":"structural","profile":"none","status":"accepted","submissionHash":"8c60d9be907027e53e0d65ad14e894b27fa9b1539e96d7f8f2d14e5d62c5e683","verifiedTreeHash":"6b9a59a54666533a92e85b1f8945f16bcd7d2077","verifierVersion":"0.1.0+8fbf00a5"},{"checks":[],"detail":"paths and tree verified; no suite was run for this kind of work","evaluation":"structural","profile":"none","status":"accepted","submissionHash":"fce837b99ed1415deafd0064a7795f383a55a3a886dd4907a6e525c14bae4ffc","verifiedTreeHash":"f60821c390c67900239cbc2b067732a7e67be123","verifierVersion":"0.1.0+8fbf00a5"}]}