{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"1616d854-79c1-43c1-bf56-3be746b55146","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"93871b67bc55c4e8d0499e48e755e44b2dc9807bd0d755af7e8bf6ff44dd29b6","dependsOn":[],"execution":{"mustProduce":["dist/index.html"],"network":true,"optionalTools":["browser"],"profile":"none","requires":["network"],"skillHash":"a60bc8b42446c13d993341179fe13c712a5addb118fc532fb2d15e71f912efc8","skillId":"build-website","tools":[]},"key":"build_website","kind":"code","role":"implement","skillHash":"a60bc8b42446c13d993341179fe13c712a5addb118fc532fb2d15e71f912efc8","skillId":"build-website","state":"accepted"},{"acceptedSubmissionHash":"883c366c8d079700383428b4558544522ddb2982ebc20da64dab529b991c266e","dependsOn":["build_website"],"execution":{"network":true,"optionalTools":["browser"],"profile":"none","requires":["network"],"skillHash":"fd33b6741366d364a55a4c0ba2bc4f5d329cec0b62f27a83289dc5b30ab03575","skillId":"design-critic","tools":[]},"key":"design_critic","kind":"code","role":"review","skillHash":"fd33b6741366d364a55a4c0ba2bc4f5d329cec0b62f27a83289dc5b30ab03575","skillId":"design-critic","state":"accepted"},{"acceptedSubmissionHash":"254d2975007c2d943138e6d73e6e18e94f7de765cae6937a1079446de3c469dc","dependsOn":["build_website"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","tools":[]},"key":"site_content_check","kind":"code","role":"review","skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","state":"accepted"}],"objective":"Sworn, host version 1.0.1 of the site under this project's name, sworn. Replace web/ and dist/ in this project's repository with the web/ and dist/ folders of https://github.com/banse/sworn/tree/sworn-web-1.0.1 at commit 5e0dce32d16e034d02dc018323c8615f37188383 (a public repository; dist/ holds 90 files with index.html at its root and is the output of that tree's own build, npm ci and npm run build in web/), used unchanged: no file added, changed or left out, and no build run here. Then host that dist/. The page under this name currently serves the dist/ of this project's repository at commit 0209e333704d3e7c07fca73dca1438601a592294 (90 files); version 1.0.1 replaces it entirely and keeps the name. The site is a static app that reads Ethereum mainnet over public RPCs, api.imdnotdead.fun, IPFS gateways and the Sworn indexer at https://sworn.vibingco.de/api from the visitor's browser. Its contract addresses (Registry 0x0da2679000ea5380d1361cc3cca7d4e8c881f766 of launch 2404) are part of these files and stay as they are; do not connect it to the addresses of this project's launch 2147. Decide, do not ask: a question blocks the job.","parentJobId":"07dd1608-a8a5-4beb-9903-d37865d68a70","planHash":"48ff4f378b10f7c89f7df65559d682037af78aee63f10dd619dd5bacb6ddff8a","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"c3792acf-e0c4-4268-9eea-c533b7c87935","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2147-launch-sworn-registry-symbol"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51012","feedbackHash":"9ca1e4ab063ef17189c505da2a045a7a09d57dcd1fcf703c1d05b498f92a69f8","nodeKey":"build_website","submissionHash":"93871b67bc55c4e8d0499e48e755e44b2dc9807bd0d755af7e8bf6ff44dd29b6","tag1":"verification:structural","tag2":"acceptance-v2","value":1},{"agentId":"51158","feedbackHash":"4634153ac881e50c556f5c15a65e1c7fa54603b1c6b5efa5bb9dfff671470a52","nodeKey":"design_critic","submissionHash":"883c366c8d079700383428b4558544522ddb2982ebc20da64dab529b991c266e","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"55444","feedbackHash":"e2485c0cf18b2287d10ee2e32ac7c72adc0e98da3af9981975c6d0b222010be7","nodeKey":"site_content_check","submissionHash":"254d2975007c2d943138e6d73e6e18e94f7de765cae6937a1079446de3c469dc","tag1":"review:submission","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"86509adce065b5e799e384807745ac639f70e17ec9b332299bdb0576554beaea","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"322201e0794fc891","findings":[{"citation":"resolved","description":"The hosted index.html declares og:image as the relative path ./share.png. The Open Graph protocol requires an absolute URL for og:image, and the common scrapers (X, Discord, Telegram, Slack, Facebook) ignore or fail to resolve relative values, so the preview card for the site falls back to no image. Advisory only: it does not affect what the page does or requests. This file is the unchanged upstream build output at commit 5e0dce32, so the fix belongs in web/index.html of github.com/banse/sworn, not in this repository.","line":18,"path":"dist/index.html","reproduction":"Serve dist/ and fetch index.html; the og:image meta tag reads ./share.png. Paste the hosted URL into a link-preview debugger (for example https://www.opengraph.xyz) or a Discord message. Expected: a preview showing share.png. Actual: a preview without an image, because the scraper cannot resolve the relative path.","severity":"low","snippet":"    <meta property=\"og:image\" content=\"./share.png\" />","title":"Open Graph image is a relative URL, so link previews will not show share.png"},{"citation":"resolved","description":"The hosted handbook page docs/index.html (and docs/full-guide.html and docs/sworn-handbook.md, which carry the same text) links to a local development mock at http://127.0.0.1:8799. For a visitor of the hosted site this is a dead link to their own machine. It is a leftover of the author's local workflow, not malicious, and no script loads from it. Advisory only; the file is the unchanged upstream build output.","line":49,"path":"dist/docs/index.html","reproduction":"Open docs/index.html from the hosted dist/, section 'Try the local version', and click 'revised local mock'. Expected: a working demo or no link. Actual: the browser tries http://127.0.0.1:8799/#/mint and reports connection refused.","severity":"info","snippet":"<p>The <a href=\"http://127.0.0.1:8799/#/mint\">revised local mock</a> demonstrates delayed wallet transactions, panel progress, community rules, card rendering and curator consumption. It uses synthetic data, eight known wallet fixtures and scripted oracle outcomes. The close button hides a verification overview without deleting its result from Review transaction steps. Its artwork approximates parts of the deployed Renderer.</p>","title":"Documentation links visitors to a localhost mock at http://127.0.0.1:8799 that does not exist on the hosted site"},{"citation":"resolved","description":"safeImageSource (web/src/fact-check/canvas-model.mjs lines 81-88, bundled into dist/assets/index-BCymCfQe.js) resolves the card image from the Renderer tokenURI metadata. It maps ipfs:// to https://ipfs.io, ar:// to https://arweave.net, and passes any http(s) URL through unchanged, which FactCheckView.tsx line 225 renders as an <img> src. In practice the Renderer at 0x3039eaf3... returns a data:application/json;base64 envelope whose image is an inline SVG data URI, so no outside image request happens today (confirmed in the browser run: only ethereum-rpc.publicnode.com and sworn.vibingco.de were contacted). The passthrough only matters if the metadata image ever points elsewhere, and it is an image fetch, never a script. Recorded so the hosted origin list is complete; no action needed for hosting.","line":86,"path":"web/src/fact-check/canvas-model.mjs","reproduction":"Read web/src/fact-check/canvas-model.mjs lines 81-88 and web/src/fact-check/swarm-snapshot.mjs line 46. Input: a tokenURI metadata image of 'ar://X' or 'https://example.com/x.png'. Expected per the hosting brief: requests only to public RPCs, api.imdnotdead.fun, IPFS gateways and sworn.vibingco.de. Actual: an <img> request to arweave.net or the given https host. With the live Renderer the image is a data URI and no such request is made.","severity":"info","snippet":"  if (/^https?:\\/\\//i.test(source) || /^\\.?\\.?\\//.test(source)) return source;","title":"Fact Check card image accepts any https origin and arweave.net, beyond the stated outside-request list"}],"hash":"254d2975007c2d943138e6d73e6e18e94f7de765cae6937a1079446de3c469dc","nodeId":"b6fd5fd0-eb62-47ab-a0b1-b815fcb126f8","outcome":"completed","summary":"The review is complete and the site is clear to host. Nothing critical or high was found. The findings file holds three advisory items only.\n\n**What was verified**\n\n- **Tree matches upstream.** The repository's web/ and dist/ are file-for-file identical to commit 5e0dce32 of github.com/banse/sworn, branch sworn-web-1.0.1. dist/ holds exactly the 90 upstream paths, and no earlier-version file remains.\n- **dist/ is that tree's own build.** Running npm ci and npm run build on a scratch copy of the upstream web/ produced output byte-identical to the committed dist/. Every sha256 in dist/imd-deployment.json matches the file it names.\n- **Addresses are right.** The bundle and manifest carry only the launch 2404 contracts, Registry 0x0da2679000ea5380d1361cc3cca7d4e8c881f766. None of this project's launch 2147 addresses appear anywhere in dist/ or web/.\n- **Browser run.** Served dist/ to headless Chromium at 1280 and 390 px across the landing, Catalog, Fact Check, Mint Card, Mint Rule, About and docs pages. The Sworn site renders at both widths. Zero console errors and zero page errors. No favicon error either, since favicon.svg is present.\n- **Outside requests.** At runtime the page contacted only ethereum-rpc.publicnode.com and sworn.vibingco.de. No script was loaded from another origin and no frame was attached. In source, the read RPC list adds gateway.tenderly.co, rpc.mevblocker.io and 1.rpc.thirdweb.com, all public Ethereum RPCs. api.imdnotdead.fun is used for oracle request and intake lookups, ipfs.io for ipfs:// images. The Coinbase Wallet connector opens keys.coinbase.com only when a visitor chooses that wallet.\n- **Scripts read.** All nine bundles plus docs/app.js and docs/search-data.js. No eval, Function constructor, document.write, iframe, obfuscation, or seed-phrase and private-key prompts. The script-element creation and \"private key\" strings are React DOM internals and the noble-curves library. Transactions go through the visitor's own wallet. The only approvals are IMD approvals of the exact quoted amount to the Registry, labelled as such, preceded by a balance and allowance check and re-checked before signing.\n\n**Advisory findings written to .imd-findings.json**\n\n- **Low:** og:image in dist/index.html is a relative path, so link previews will not show share.png.\n- **Info:** the handbook in dist/docs links to a localhost mock at port 8799 that no visitor can reach.\n- **Info:** the Fact Check card image resolver passes any https URL and maps ar:// to arweave.net. Unreachable today because the live Renderer returns an inline data URI, confirmed by the browser run.\n\nAll three live in the unchanged upstream build, so any fix belongs in banse/sworn rather than here. No repository file was modified apart from the findings file, which git ignores.","treeHash":null,"usage":{"cachedInputTokens":1494646,"inputTokens":898,"model":"claude-fable-5-1","outputTokens":20560,"runtime":"claude","turns":31,"wallClockMs":592495}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"4f6165fcd0deb045","findings":[{"citation":"resolved","description":"Now: Explorer reads site.error inside its wallet-loading effect but omits site.error from the dependency list. If the initial health read fails while health remains null, the explorer keeps an empty status and never renders its existing Retry reads button; only the distant footer reports the failure.\nChange to: In a subsequent authorized upstream release, add site.error to this effect dependency list so the existing setError(site.error) branch updates the local status and exposes Retry reads. Keep this task's pinned web/ and dist/ unchanged; taking the fix requires the requester to authorize a new upstream commit.\nWhy: A failed public wallet lookup must explain the failure and expose its existing recovery action beside the submitted address. This finding concerns the application's error presentation, not public-RPC availability or the successful byte-for-byte release import.","line":417,"path":"web/src/pages.tsx","reproduction":"Chromium, fresh browser context, viewport 390x844. Serve the committed dist/ and intercept requests leaving the site origin, returning HTTP 503 with body offline and Access-Control-Allow-Origin: *. Open /#/explorer?address=0x0030a5dad847818cb0898ecb18d8106f69cd5f33 before the first health read completes. Wait for footer .status to say Cannot read the chain, retrying. Expected: the same error appears in #explorer with its Retry reads button. Actual: #explorer .status texts are [Public facts. No wallet connection needed., empty string], and #explorer contains 0 Retry reads buttons. The only error is at viewport y=5641.90625 with scrollY=383, far below the 844px viewport. The blank status also persisted through a separate 20-second outage check. Click Explore wallet again with the same input: the local error appears and Retry reads count becomes 1, demonstrating that the missing dependency, not unavailable error information, prevents the initial update. Restoring RPC responses allows the same wallet to load successfully.","severity":"medium","snippet":"  }, [address, site.health, site.specs, site.client, site.r, site.readRetry, tick]);","title":"bug: Explorer hides the initial chain-read error and Retry reads control"}],"hash":"883c366c8d079700383428b4558544522ddb2982ebc20da64dab529b991c266e","nodeId":"18732584-9cbc-4555-b6dc-5762778db04d","outcome":"completed","summary":"| Area | Count / result |\n|---|---|\n| Requirements | 10 met; 0 missing; 0 faked; 1 after review |\n| Broken features | 1 medium bug; 0 high |\n| First screen, 390px | Product and action visible |\n| taste@1 | 14/16 passed; 2 preservation exceptions |\n| Copy | 0 applicable findings |\n| Share card | Present; 5/5 metadata checks passed |\n\nRecorded one finding in [.imd-findings.json](/home/imd-worker/.identitymd/work/1616d854-79c1-43c1-bf56-3be746b55146/18732584-9cbc-4555-b6dc-5762778db04d/.imd-findings.json). Site files remain unchanged.\n\n| Explicit requirement | Status and evidence |\n|---|---|\n| “version 1.0.1” | **Met:** `web/package.json`. |\n| “Replace web/” from commit `5e0dce32…` | **Met:** all 333 files match the pinned upstream archive. |\n| “dist/ holds 90 files with index.html at its root” | **Met:** all 90 files match; `dist/index.html` exists. |\n| “used unchanged: no file added, changed or left out” | **Met:** all 423 file hashes match; zero extras or omissions. |\n| “no build run here” | **Met:** delivery audit records no build; this review ran none. |\n| “replaces it entirely” | **Met:** previous-only bundles are absent; the entry loads the replacement export. |\n| “static app” reading mainnet, public RPCs, api.imdnotdead.fun, IPFS and the Sworn indexer | **Met:** unchanged integrations in `rpc.mjs`, `attested-records.mjs`, `canvas-model.mjs` and `indexer.mjs`; real wallet reads succeeded in Chromium and WebKit. |\n| Registry `0x0da2679000ea5380d1361cc3cca7d4e8c881f766` stays unchanged | **Met:** `web/deployment-handoff.json` and `dist/imd-deployment.json`. |\n| “do not connect…launch 2147” | **Met:** none of its three contract addresses occurs in `web/` or `dist/`. |\n| “Decide, do not ask” | **Met:** review completed without questions. |\n| “Then host that dist/…keeps the name” | **After review:** publisher must serve root `dist/` under existing `sworn`; hosting handoff is documented in `README.md`. |\n\n**Medium — bug: Explorer hides the initial chain-read error and Retry reads control.** At [pages.tsx:417](/home/imd-worker/.identitymd/work/1616d854-79c1-43c1-bf56-3be746b55146/18732584-9cbc-4555-b6dc-5762778db04d/web/src/pages.tsx:417), the loading effect reads `site.error` without depending on it. At 390×844, opening a wallet deep link while external requests return HTTP 503 leaves the explorer status empty and renders zero retry buttons. The footer reports failure at viewport y≈5,642. Resubmitting the address exposes both.\n\nAdd `site.error` to that dependency list in a future authorized upstream release, so failure and recovery appear beside the lookup. The current exact-copy requirement prevents applying that fix here.\n\nSworn’s visual idea is a public wallet registry presented as a dark monospace instrument panel with green hive artwork. The two taste flags—uppercase headings and monospace prose—remain preservation exceptions under “used unchanged.” Wallet signatures and transactions were not exercised.","treeHash":null,"usage":{"cachedInputTokens":4009216,"inputTokens":126518,"model":"gpt-6-astra","outputTokens":18414,"runtime":"codex","turns":9,"wallClockMs":630858}},{"artifacts":[],"attempt":1,"bundleHash":"d52b0bc567c9fb3efaed7e7d6087ff64d85a5636c4c028f686a1fb4957d9be85","device":"4f8047a54bdc27c8","findings":[],"hash":"93871b67bc55c4e8d0499e48e755e44b2dc9807bd0d755af7e8bf6ff44dd29b6","nodeId":"e14176b4-2584-4fe7-b754-33373f3f57b2","outcome":"completed","summary":"Replaced `web/` and `dist/` with the exact pinned 1.0.1 release. All 423 files verified; no build run.\n\nTypecheck and 291 unit tests passed. README, DESIGN.md and validation evidence are updated, including browser/RPC limitations. Submission is under 8 MiB and ready for the existing `sworn` publisher.","treeHash":"ed86c078bd26e612466e4778b6e7b308d788cb27","usage":{"cachedInputTokens":3881728,"inputTokens":139232,"model":"gpt-6.1-sol","outputTokens":41234,"runtime":"codex","turns":8,"wallClockMs":796431}}],"verification":[{"checks":[],"detail":"paths and tree verified; no suite was run for this kind of work","evaluation":"structural","profile":"none","status":"accepted","submissionHash":"93871b67bc55c4e8d0499e48e755e44b2dc9807bd0d755af7e8bf6ff44dd29b6","verifiedTreeHash":"ed86c078bd26e612466e4778b6e7b308d788cb27","verifierVersion":"0.1.0+260efc41"}]}