{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"e05a7321-f1be-4eb3-8341-7e0db1ed7233","kind":"skill:build-website","nodes":[{"acceptedSubmissionHash":"7db006a5a9fd5e71a3418b53654a9c7b3283c5a6153d018d949f4f68dd63b39b","dependsOn":[],"execution":{"mustProduce":["dist/index.html"],"network":true,"optionalTools":["browser"],"profile":"none","requires":["network"],"skillHash":"f2817f61355cd4a8a61a97c2607875f024f0ba742034dd6b90594af69c53b207","skillId":"build-website","tools":[]},"key":"build_website","kind":"code","role":"implement","skillHash":"f2817f61355cd4a8a61a97c2607875f024f0ba742034dd6b90594af69c53b207","skillId":"build-website","state":"accepted"},{"acceptedSubmissionHash":"d3ce6c31d9d25cc2102a5b418d4f52ab7364e46efcc2dc83aec53889f7d807d6","dependsOn":["build_website"],"execution":{"network":true,"optionalTools":["browser"],"profile":"none","requires":["network"],"skillHash":"fd33b6741366d364a55a4c0ba2bc4f5d329cec0b62f27a83289dc5b30ab03575","skillId":"design-critic","tools":[]},"key":"design_critic","kind":"code","role":"review","skillHash":"fd33b6741366d364a55a4c0ba2bc4f5d329cec0b62f27a83289dc5b30ab03575","skillId":"design-critic","state":"accepted"}],"objective":"# MISSION PRIORITAIRE — BMC ILLUMINATI WEB3 PLATFORM\n\nTu es un développeur Web3 senior, ingénieur sécurité blockchain et spécialiste Ethereum, Solidity, MetaMask, ERC-20, ERC-721 et staking.\n\n## OBJECTIF\n\nFinaliser et sécuriser le site officiel BMC Illuminati pour qu'il propose :\n\n1. Connexion sécurisée des wallets.\n2. Minting des 500 NFT BMC Illuminati Pass.\n3. Staking BMC réellement fonctionnel.\n4. Liens officiels X (Twitter), Telegram et GitHub.\n5. Dashboard des tokens, NFT et récompenses.\n6. Interface premium noir et or, adaptée aux mobiles.\n\n**Site officiel :**\nhttps://bmc-illuminati-know-create-burn.sites.imd.fun/\n\n**GitHub du projet NFT :**\nhttps://github.com/identity-md-launches/launch-1481-bmc-illuminati\n\n**Contrat NFT Ethereum Mainnet :**\n0x92789D9bb680a2Db8617270a530E9D0f80b48641\n\n**Token BMC :**\n0x38224239f2BDae357D47cb864BC533d7f72dF961\n\n**Réseau :** Ethereum Mainnet, Chain ID 1.\n\n## 1. INSPECTER LE SITE ET LES CONTRATS\n\nCommence par identifier le dépôt réellement utilisé pour publier le site IMD.\n\nExamine les fichiers du site, les contrats, les ABI, les scripts, les dépendances et le système de publication.\n\nNe remplace pas le site existant et ne supprime aucune fonctionnalité.\n\nVérifie le contrat NFT déjà déployé et le contrat BMC sur Etherscan.\n\nN'invente aucune adresse de contrat, aucun rendement de staking, aucune récompense ni aucun lien communautaire.\n\n## 2. CONNEXION WALLET SÉCURISÉE\n\nImplémente une connexion MetaMask et EIP-1193 fiable.\n\nExigences :\n\n- Connexion volontaire avec demande d'accès aux comptes uniquement.\n- Support Ethereum Mainnet.\n- Affichage de l'adresse connectée et du réseau.\n- Gestion des changements de compte et de réseau.\n- Déconnexion de l'interface.\n- Aucun accès aux clés privées ou phrases de récupération.\n- Aucune signature cachée.\n- Aucune transaction automatique.\n- Aucune autorisation illimitée de tokens.\n- Aucun mécanisme de type wallet drainer.\n- Aucune dépendance JavaScript inconnue ou non vérifiée.\n- Aucune collecte non nécessaire de données personnelles.\n\nChaque transaction doit afficher clairement le contrat destinataire, le montant, les frais estimés et l'action demandée.\n\nL'utilisateur doit confirmer lui-même dans son wallet.\n\n## 3. MINTING DES 500 NFT\n\nRéutilise les fichiers existants :\n\n- website/mint/index.html\n- website/config.js\n- website/mint-client.js\n- website/pass-abi.js\n- website/bmc-abi.js\n- website/app.js\n\nConnecte le contrat NFT Ethereum Mainnet existant.\n\nCollection : BMC Illuminati Pass.\n\nMaximum : 500 NFT.\n\nPrix Genesis : 1 000 000 BMC.\n\nPrix Mystery : 350 000 BMC.\n\nRespecte les phases prévues par le contrat :\n\n- NFT 1 à 40 : Genesis.\n- NFT 41 à 500 : Mystery, avec mécanisme de révélation.\n\nImplémente ou valide :\n\n- Connect Wallet.\n- Balance BMC.\n- NFT déjà mintés.\n- NFT restants.\n- Prix actuel.\n- Approve BMC pour le montant exact.\n- Mint Genesis.\n- Mint Mystery.\n- Suivi des transactions.\n- Affichage du NFT reçu.\n- Galerie Genesis et Standard.\n- Métadonnées IPFS et SVG on-chain.\n- Révélation des Mystery NFT.\n\nVérifie le fonctionnement réel du burnFrom et de la destruction des BMC.\n\nNe déclenche jamais de transaction sans confirmation du visiteur.\n\nPréserve les protections PRE_LAUNCH, la vérification du bytecode et les conditions de lancement.\n\nN'appelle jamais openMinting() automatiquement : cette fonction est irréversible et nécessite une autorisation distincte du propriétaire après revue de sécurité.\n\n## 4. STAKING BMC FONCTIONNEL\n\nC'est une priorité.\n\nIdentifie d'abord si un contrat de staking BMC existe réellement sur Ethereum Mainnet.\n\nS'il existe :\n\n- Vérifie son adresse et son code source.\n- Vérifie qu'il accepte le véritable token BMC.\n- Analyse les droits administrateur.\n- Vérifie les mécanismes de dépôt, retrait et récompenses.\n- Vérifie le financement des récompenses.\n- Vérifie les conditions de verrouillage et de déblocage.\n- Vérifie les risques de perte de fonds et de blocage.\n- Vérifie son ABI et ses paramètres.\n\nEnsuite, intègre :\n\n**Stake BMC**\n- Afficher le solde disponible.\n- Choisir le montant.\n- Afficher les conditions de staking.\n- Approuver uniquement le montant nécessaire.\n- Confirmer le dépôt dans MetaMask.\n\n**My Staking**\n- BMC déposés.\n- Récompenses réellement acquises.\n- Date ou conditions de déblocage.\n- Statut des transactions.\n\n**Unstake BMC**\n- Afficher les conditions de retrait.\n- Permettre le retrait si le contrat l'autorise.\n- Gérer les erreurs et transactions en attente.\n\n**Claim Rewards**\n- Afficher les récompenses disponibles.\n- Permettre leur réclamation si la fonction existe.\n- Ne jamais afficher un rendement garanti.\n\nSi aucun contrat de staking vérifié et suffisamment sécurisé n'existe, prépare l'interface, mais garde les dépôts désactivés.\n\nNe déploie pas un nouveau contrat de staking et ne transfère aucun BMC sans mon autorisation explicite.\n\n## 5. LIENS OFFICIELS ET COMMUNAUTÉ\n\nAjoute des liens visibles vers :\n\n- X (Twitter).\n- Telegram.\n- GitHub.\n- Etherscan.\n- La collection NFT.\n- La page Staking.\n\nRetrouve les liens officiels depuis les sources du projet ou demande-moi de les confirmer.\n\nN'invente pas de comptes X ou Telegram.\n\nAffiche les liens dans la navigation et le pied de page, avec des icônes et une ouverture sécurisée dans un nouvel onglet.\n\n## 6. SÉCURITÉ RENFORCÉE\n\nAvant l'activation publique :\n\n- Vérifier les adresses et ABI de tous les contrats.\n- Comparer les bytecodes aux versions revues.\n- Analyser les fonctions sensibles et permissions.\n- Tester les flux de minting, staking, unstaking et récompenses.\n- Tester les erreurs et refus MetaMask.\n- Vérifier les protections contre les doubles soumissions.\n- Vérifier les transactions en attente et les changements de réseau.\n- Utiliser une politique CSP adaptée et des dépendances contrôlées.\n- Éviter les scripts externes non fiables.\n- Afficher clairement les risques du staking et du mint Mystery.\n- Effectuer une revue de sécurité indépendante avant de permettre au public d'engager des fonds.\n\nAucun audit automatique ne doit être présenté comme une garantie de sécurité absolue.\n## 7. DESIGN ET EXPÉRIENCE UTILISATEUR\nConserve l'identité visuelle BMC Illuminati :\n- Noir et or.\n- Design premium.\n- Navigation simple.\n- Version mobile et ordinateur.\n- Galerie NFT avec les vrais visuels.\n- Dashboard Web3.\n- Staking.\n- Mint BMC Pass.\n- X et Telegram.\n- Messages d'erreur compréhensibles.\n- Statuts des transactions consultables sur Etherscan.\nNe montre jamais des statistiques fictives comme si elles étaient réelles.\n## 8. DÉPLOIEMENT\nPrépare et publie les pages web sur le domaine IMD existant après identification et validation du processus de déploiement.\nLe site peut être publié avec les interfaces wallet, NFT et staking visibles, mais les transactions sensibles doivent rester désactivées tant que les contrôles de sécurité ne sont pas validés.\n\nNe redéploie pas le contrat NFT existant.\nNe modifie pas le contrat.\n\nNe crée pas de contrat de staking sans appro\nNe signe aucune transaction pour moi.","parentJobId":"c365fa20-6fba-42d5-b73f-6d4050abce8f","planHash":"1dbc34bee7a9d1e98d7992d237556e88e4cc319cfd1ff9eda13a0237df97c044","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"c365fa20-6fba-42d5-b73f-6d4050abce8f","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-1481-bmc-illuminati"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51044","feedbackHash":"40fa9e610d68dfb92d04ab7e6a25b02a94204211659ebdf6f78407a312f80faa","nodeKey":"build_website","submissionHash":"7db006a5a9fd5e71a3418b53654a9c7b3283c5a6153d018d949f4f68dd63b39b","tag1":"verification:structural","tag2":"acceptance-v2","value":1},{"agentId":"51415","feedbackHash":"d0411cc24082461a057eb65c8edf2a293d9baf69ac87248df8374c93c8280a1b","nodeKey":"build_website","submissionHash":"e58c17ddbc9ae38b7a45d0182dd2daa152152f770811f8ea18681b80ec82bc81","tag1":"verification:structural","tag2":"acceptance-v2","value":1},{"agentId":"51548","feedbackHash":"642493a381a773672295fb7b62ea8fe23fb2a2ac3736bdfab52e475ef9661b87","nodeKey":"design_critic","submissionHash":"db3f52559fb9e2c26c6021fce70b4aaaa685c517bd1eb446488356f3989bb80d","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51248","feedbackHash":"fa9689c52c141c4b4430187e58fbf59d5803bb36ed564bf5ae8a83e59aaf5ddf","nodeKey":"design_critic","submissionHash":"d3ce6c31d9d25cc2102a5b418d4f52ab7364e46efcc2dc83aec53889f7d807d6","tag1":"review:submission","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"6e1bc70206f98830e118268c11b58e7521cfab74b6f165c7ce479efff9cfb1b8","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"b739871ac69810b589c8a66814ad971e351a249aa2619d3ebd7d2fb9cc6099aa","device":"42423bf7250e09c0","findings":[],"hash":"7db006a5a9fd5e71a3418b53654a9c7b3283c5a6153d018d949f4f68dd63b39b","nodeId":"c2884bcc-3282-4f0b-9437-47c1d91c9524","outcome":"completed","summary":"Les trois signalements sont corrigés :\n\n- Erreurs wallet visibles dans le bandeau et le menu mobile.\n- Expiration Mystery précisant le recours aux Genesis restants.\n- Aperçu réduit à huit emplacements, avec accès aux 500.\n\n`dist/` reconstruit, documentation et `.imd-responses.json` renseignés.\n\nValidation réussie : Chromium, WebKit, 43 tests JavaScript, TypeScript et contrôle visuel 16/16. PRE_LAUNCH reste actif ; aucune transaction ni publication effectuée.","treeHash":"265f8358b8897358a93cd600b82e2dc0a99dbc53","usage":{"cachedInputTokens":3677056,"inputTokens":138906,"model":"gpt-6-astra","outputTokens":21771,"runtime":"codex","turns":7,"wallClockMs":623487}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"468e1f512c9ac6ca","findings":[],"hash":"d3ce6c31d9d25cc2102a5b418d4f52ab7364e46efcc2dc83aec53889f7d807d6","nodeId":"c5d42953-79d1-43c1-83a4-4c12b8302fd2","outcome":"completed","summary":"| Area | Previous review | This review |\n|---|---:|---:|\n| Requirements | Counts not supplied | 98 checks: **71 met, 0 missing, 0 faked, 26 needs the requester, 1 after review** |\n| Broken features | 1 | **0** |\n| Product/action on first screen at 390px | Not supplied | **Yes** |\n| taste@1 | Not supplied | **16/16 passed** |\n| Copy findings | 1 | **0** |\n| Share card | Not supplied | **Present; 5/5 metadata checks** |\n| Taste findings | 1 | **0** |\n\nAll three previous findings are **fixed**. No new reproducible defect was found. [`.imd-findings.json`](/root/.identitymd/work/e05a7321-f1be-4eb3-8341-7e0db1ed7233/c5d42953-79d1-43c1-83a4-4c12b8302fd2/.imd-findings.json) contains `{\"findings\":[]}`. Project files were unchanged.\n\n| Previous finding | Verification |\n|---|---|\n| **bug: hidden header/menu wallet errors** | Fixed in `website/site.js:110–185` and `website/platform.css:286`. Chromium and WebKit: open `/#/pass`, connect without a provider or reject with code 4001. The complete error appears beside the active control at 320, 390, 768, 1250 and 1440px. Menu reopening preserves it; retry clears the refusal. No clipping or horizontal overflow. |\n| **fidelity: Mystery expiry omits Genesis fallback** | Fixed in `website/mint/index.html:84`. At 390px, expand “Mystery randomness and expiry”: it correctly describes Standard inventory first, then Genesis. The existing expiry test passes, confirming 423 Standard outcomes followed by 37 Genesis outcomes. |\n| **taste: excessive initial placeholder slots** | Fixed in `website/site.js:2362`: `Mu = 8`. At 390px, both engines show eight slots in an **850.75px** grid, previously 5,184.5px. Pagination reaches slot #500; every rarity filter resets correctly. |\n\nValidation: Chromium and WebKit browser regressions passed, **42 client/page tests passed**, and the expiry contract test passed. The design probe ran offline. Wallet transactions used fixtures; no public transaction was signed or broadcast.\n\nThe requirement checklist below consolidates repeated wording. **Met** describes the implemented interface, protections and available evidence; it does not authorize public financial actions. The requester-dependent rows chiefly share five prerequisites: NFT-address reconciliation, verified staking deployment, official social destinations, explorer/source confirmation and independent release approval.\n\n| # | Explicit requirement | Status | Evidence |\n|---:|---|---|---|\n| 1 | “dépôt réellement utilisé pour publier le site IMD” | Met | `docs/WEBSITE-SECURITY.md`; retained launch-1481 source and build process. |\n| 2 | Examine “fichiers… contrats… ABI… scripts… dépendances… publication” | Met | `website/`, `src/`, `script/`, `web/`, validation records. |\n| 3 | “Ne remplace pas le site”; preserve functionality | Met | Preservation-hash tests pass; all seven routes remain. |\n| 4 | Verify NFT and BMC “sur Etherscan” | Needs the requester | Explorer/source confirmation remains outstanding; explorer pages were inaccessible during this review. Recorded in `docs/CHAIN-VERIFICATION.json`. |\n| 5 | No invented addresses, yields, rewards or community links | Met | `website/config.js`; explicit unavailable/unconfirmed states. |\n| 6 | Reliable “MetaMask et EIP-1193” connection | Met | `website/mint-client.js:275`; connection/refusal/retry tests. |\n| 7 | Voluntary connection requesting accounts only | Met | Connect controls; browser test confirms zero initial wallet calls. |\n| 8 | “Ethereum Mainnet… Chain ID 1” | Met | `website/config.js`; client network gate. |\n| 9 | Display connected address and network | Met | Mint `#account`/`#network`; dashboard full address. |\n| 10 | Handle account and network changes | Met | Client event handlers and passing session-change tests. |\n| 11 | Interface disconnection | Met | WalletControls and mint `#disconnect`. |\n| 12 | No private-key or recovery-phrase access | Met | No credential inputs or collection path; account-access API only. |\n| 13 | No hidden signature | Met | Client r","treeHash":null,"usage":{"cachedInputTokens":2231936,"inputTokens":112627,"model":"gpt-6-astra","outputTokens":16007,"runtime":"codex","turns":7,"wallClockMs":435045}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"0116c8455d2c62d4","findings":[{"citation":"resolved","description":"Now: WalletControls suppresses every status message in compact/quiet mode. The global header uses compact mode and the mobile menu uses quiet mode, so collection visitors receive no feedback when connecting fails.\nChange to: Render nonempty wallet errors in an always-visible role=\"status\" region next to the active header/menu wallet control; keep only the default account-access hint optional.\nWhy: The brief requires reliable wallet connection, handled MetaMask refusals and understandable error messages. A visitor without an injected wallet must be told how to continue.","line":182,"path":"website/site.js","reproduction":"Chromium, 390 × 844, no wallet extension: open /#/pass, open the menu, click Connect wallet. The button returns to Connect wallet with no error anywhere in document.body.innerText. BMCPlatform.snapshot().wallet.message is exactly \"No injected wallet found. Open this page in MetaMask or another EIP-1193 wallet browser.\" but document.body.innerText.includes(\"No injected wallet\") is false. The same WalletControls branch is used by the desktop header. Expected: visible actionable error, as /mint/ already displays for the same click. Also reproduced in Chromium and WebKit at 390 and 1440px with an injected EIP-1193 stub rejecting eth_requestAccounts with code 4001: client state contained \"Request rejected in your wallet. No further transaction was sent.\" while the rendered body omitted that error in all four cases.","severity":"high","snippet":"    !compact && !quiet\n      ? h(\n          \"p\",\n          { className: \"wallet-message\", role: \"status\" },\n          s.wallet.message || \"Connection requests account access only.\",\n        )\n      : null,","title":"bug: header and mobile-menu wallet failures have no visible error"},{"citation":"resolved","description":"Now: The Mystery disclosure unconditionally says an expired Pass settles as Standard. The reviewed contract instead awards remaining Genesis inventory when no Standard slots remain.\nChange to: Replace that sentence with \"After the 8,191-block history window (roughly 27 hours at 12 seconds per block), reveal selects a remaining Standard outcome if available; otherwise it selects from the remaining Genesis inventory.\" Keep the manipulation warning.\nWhy: The brief requires clear Mystery risks and accurate contract behavior before an irreversible BMC burn. The current sentence promises an outcome the contract does not always produce.","line":84,"path":"website/mint/index.html","reproduction":"390 × 844, /mint/: scroll to Understand the burn and reveal and expand Mystery randomness and expiry. Read the unconditional \"a Pass settles as Standard\" sentence. Compare src/BMCIlluminatiPass.sol::_drawStandard and the existing test test_ExpiredWindowWithOnlyGenesisLeftStillSettles: mint all 460 Mystery slots, advance 8,193 blocks, reveal 423 expired tokens, then reveal the remaining 37. The first 423 are Standard and tokens 464–500 are Genesis despite expiry. Verified by forge test --offline --out /tmp/bmc-review-forge-out --cache-path /tmp/bmc-review-forge-cache --match-test test_ExpiredWindowWithOnlyGenesisLeftStillSettles -vv: 1 passed. This finding concerns website copy, not a request to modify the deployed contract.","severity":"medium","snippet":"  <details><summary>Mystery randomness and expiry</summary><p>Mystery uses the hash of the block after minting, not Chainlink VRF. It is <strong>not cryptographically manipulation-resistant</strong>: block proposers can bias outcomes and builders can influence ordering. The burn happens before the outcome exists.</p><p>Anyone may reveal pending Passes in mint order. Press “Reveal pending passes” after the next block is available and review the transaction. If nobody reveals within the 8,191-block history window (roughly 27 hours at 12 seconds per block), a Pass settles as Standard. This is not guaranteed fairness or tamper-proof randomness.</p></details>","title":"fidelity: Mystery expiry disclosure omits the Genesis fallback"},{"citation":"resolved","description":"Now: After the real artwork gallery, Planned token slots initially renders 48 allocation glyph cards. At 390px this secondary grid is 5,184.5px tall, making repetitive placeholders dominate the collection page.\nChange to: Set Mu to 8, matching the real gallery initial count. Keep the existing rarity filters and Show more control so all 500 planned slots remain accessible. The rarity explanation and footer move up 4,333.75px in the measured mobile layout.\nWhy: The brief asks for a premium mobile experience and real NFT visuals. The real artwork should carry the page; allocation placeholders need only a short preview without removing the preserved feature.","line":2365,"path":"website/site.js","reproduction":"Chromium, 390 × 844: open /#/pass, leave the All 500 filter selected, scroll past the real gallery and mint details to Planned token slots. It says Showing 48 of 500 slots. document.querySelector(\".gallery\").children.length is 48 and its bounding height is 5184.5px; the footer begins at document y=10542.78px. A browser-only measurement retaining the first eight existing cards reduces that grid to 850.75px and moves the footer to y=6209.03px. No repository page was edited for the measurement.","severity":"medium","snippet":"  Mu = 48;","title":"taste: the collection opens 48 placeholder slots below the real artwork"}],"hash":"db3f52559fb9e2c26c6021fce70b4aaaa685c517bd1eb446488356f3989bb80d","nodeId":"c5d42953-79d1-43c1-83a4-4c12b8302fd2","outcome":"completed","summary":"| Area | Count / result |\n|---|---|\n| Requirements | **107:** 77 met, 2 missing, 0 faked, 2 after review, 26 need requester |\n| Broken features | **1** |\n| First screen at 390px | **Yes:** mint action and real artwork visible |\n| taste@1 | **78/80** across five routes; two false positives involving buttons |\n| Copy findings | **1** |\n| Share card | **2/2 entry pages** have metadata and image |\n| Findings | **3:** 1 high, 2 medium |\n\nSaved the reproducible findings to [.imd-findings.json](/home/imd-worker/.identitymd/work/e05a7321-f1be-4eb3-8341-7e0db1ed7233/c5d42953-79d1-43c1-83a4-4c12b8302fd2/.imd-findings.json). Website and configuration files remain unchanged.\n\n- **High — bug:** Header and mobile-menu wallet failures display no error. Reproduced in Chromium and WebKit at 390px and 1440px, including rejected connection requests.\n- **Medium — fidelity:** Mystery expiry copy incorrectly promises Standard outcomes unconditionally. The contract awards Genesis when no Standard inventory remains.\n- **Medium — taste:** The collection initially displays 48 placeholder cards, occupying 5,184.5px on mobile. Showing eight initially preserves the existing filters and pagination.\n\nChecks passed: 42 client/page tests, the complete 500-mint local integration, two deployed-contract fork tests, and browser flows in Chromium and WebKit. Compiled NFT bytecode and ABI match the pinned deployment. No public transaction was sent.\n\nThe NFT-address conflict requires authoritative resolution. Staking appropriately remains disabled: its [project repository](https://github.com/identity-md-launches/launch-1357-project-bmc-illuminati) describes an undeployed, source-only implementation. Etherscan verification and authenticated social destinations remain unresolved.\n\nThe checklist below consolidates repeated wording. **Met** for transaction flows means implemented, tested locally, and correctly gated—not publicly activated. `Client` means `website/mint-client.js`; `UI` means `website/site.js`; `Platform` means `web/src/platform.ts`; mint-page selectors refer to `website/mint/index.html`.\n\n| # | Requirement | Status | Evidence |\n|---|---|---|---|\n| 1 | “identifier le dépôt réellement utilisé” | Met | `docs/WEBSITE-SECURITY.md`, `web/scripts/build.mjs`; launch-1481 source |\n| 2 | “Examine… fichiers… contrats… ABI… scripts… dépendances… publication” | Met | Inspected `website/`, `src/`, `web/`, deployment documentation |\n| 3 | “Ne remplace pas… ne supprime aucune fonctionnalité” | Met | Seven routes retained; preservation test passes |\n| 4 | “Vérifie… NFT… et… BMC sur Etherscan” | Needs the requester | Explorer inaccessible; `EXPLORER_VERIFIED=false`; independent verification required |\n| 5 | “N’invente aucune adresse… rendement… récompense… lien” | Met | Null staking/social configuration; unavailable data labelled |\n| 6 | “Connexion sécurisée… MetaMask et EIP-1193 fiable” | Met | Client connection/session checks; error-display exception at #100 |\n| 7 | “Connexion volontaire… accès aux comptes uniquement” | Met | `connect()` requests accounts after a click |\n| 8 | “Ethereum Mainnet… Chain ID 1” | Met | Configuration and session checks enforce `0x1` |\n| 9 | “Affichage de l’adresse… et du réseau” | Met | Wallet controls, dashboard, mint account/network fields |\n| 10 | “changements de compte et de réseau” | Met | Client invalidates sessions and balances; browser tests |\n| 11 | “Déconnexion de l’interface” | Met | `disconnect()` clears account and listeners |\n| 12 | “Aucun accès aux clés privées ou phrases” | Met | No secret-entry controls; injected provider |\n| 13 | “Aucune signature cachée” | Met | No signing RPC in active client |\n| 14 | “Aucune transaction automatique”… “sans confirmation” | Met | Explicit review, wallet confirmation, separate reveal |\n| 15 | “Aucune autorisation illimitée” | Met | Exact-price approval; allowance tests |\n| 16 | “Aucun mécanisme… wallet drainer” | Met | Fixed contract destinations; no arbitrary transfer flow |\n| 17 | “Aucune","treeHash":null,"usage":{"cachedInputTokens":5591168,"inputTokens":189720,"model":"gpt-6-astra","outputTokens":28522,"runtime":"codex","turns":9,"wallClockMs":902765}},{"artifacts":[],"attempt":1,"bundleHash":"5a984c913b2bc155fac9aede8aae3d0c5c0e1109142006813b4dae0e57467337","device":"a98849c24da2bfc2","findings":[],"hash":"e58c17ddbc9ae38b7a45d0182dd2daa152152f770811f8ea18681b80ec82bc81","nodeId":"c2884bcc-3282-4f0b-9437-47c1d91c9524","outcome":"completed","summary":"[Export prêt pour publication IMD](/home/seat17/.identitymd/work/e05a7321-f1be-4eb3-8341-7e0db1ed7233/c2884bcc-3282-4f0b-9437-47c1d91c9524/dist/index.html) : wallet, galerie authentique, dashboard et interface mobile noir/or.\n\nBuild, typecheck, 43 tests JavaScript, Chromium/WebKit et 16 contrôles visuels validés. Livraison : 6,81 MiB.\n\n**Mint et staking restent verrouillés** : adresses NFT divergentes, aucun staking vérifié et trois alertes Slither à examiner. X/Telegram restent à confirmer. Aucun contrat modifié ni transaction Mainnet envoyée.\n\n[Résultats et limites](/home/seat17/.identitymd/work/e05a7321-f1be-4eb3-8341-7e0db1ed7233/c2884bcc-3282-4f0b-9437-47c1d91c9524/docs/VALIDATION.md).","treeHash":"dbca0ca60da2bd5ba4cc567534bdddfdf915f79c","usage":{"cachedInputTokens":11986688,"inputTokens":444590,"model":"gpt-6-astra","outputTokens":109755,"runtime":"codex","turns":11,"wallClockMs":3007827}}],"verification":[{"checks":[],"detail":"paths and tree verified; no suite was run for this kind of work","evaluation":"structural","profile":"none","status":"accepted","submissionHash":"7db006a5a9fd5e71a3418b53654a9c7b3283c5a6153d018d949f4f68dd63b39b","verifiedTreeHash":"265f8358b8897358a93cd600b82e2dc0a99dbc53","verifierVersion":"0.1.0+7129bf9d"},{"checks":[],"detail":"paths and tree verified; no suite was run for this kind of work","evaluation":"structural","profile":"none","status":"accepted","submissionHash":"e58c17ddbc9ae38b7a45d0182dd2daa152152f770811f8ea18681b80ec82bc81","verifiedTreeHash":"dbca0ca60da2bd5ba4cc567534bdddfdf915f79c","verifierVersion":"0.1.0+7129bf9d"}]}