# IMD public website: step 2 verification report

The requested independent verification could not be completed because `artifacts/findings.md`, the required step 1 input, was absent from the supplied working tree. The `artifacts/` directory itself was also absent before this run. No original finding was available to reproduce, confirm, or drop. **This is an incomplete verification, not a finding that the website has no bugs.** The missing input was requested during the session but was not available when this report was written.

Limited, read-only baseline checks succeeded on September 25, 2026. The landing page, docs, token page, explorer root, and API health endpoint all returned HTTP 200. No Vercel checkpoint blocked these requests. These observations establish access from this environment only; they do not establish that browser flows work.

## Verified findings

| ID | Severity | Title | Where |
| --- | --- | --- | --- |
| — | — | No step 1 bug findings could be assessed: source artifact missing | `artifacts/findings.md` |

There are no verified bug details or recommended product fixes to present. Assigning a severity or impact to an unavailable claim would manufacture evidence. The actionable next step is to restore the accepted step 1 artifact and repeat independent verification of each recorded finding.

## Attributable baseline evidence

All timestamps below are UTC request-start times. Requests were unauthenticated GETs with `User-Agent: IMD-public-QA/1.0` and `Accept: */*`. Automatic redirect following was disabled. Exact response headers, statuses, body locations, and timestamps are saved in [baseline.json](evidence/baseline.json); bodies are linked below.

| Public source / exact URL | Timestamp (UTC) | Observed result | Saved response |
| --- | --- | --- | --- |
| [Landing](https://imd.fun/) | 2026-09-25T07:41:31.839276Z | 200; HTML title `IMD` | [Body](evidence/baseline-1.body) |
| [API docs](https://imd.fun/docs/) | 2026-09-25T07:41:32.974991Z | 200; HTML title `IMD › API docs` | [Body](evidence/baseline-2.body) |
| [Token](https://imd.fun/token/) | 2026-09-25T07:41:34.120038Z | 200; HTML title `IMD › $IMD` | [Body](evidence/baseline-3.body) |
| [Explorer root](https://explorer.imd.fun/) | 2026-09-25T07:41:35.258357Z | 200; HTML title `IMD › Explorer › Jobs` | [Body](evidence/baseline-4.body) |
| [API health](https://api.imd.fun/health) | 2026-09-25T07:41:37.243047Z | 200; parseable JSON object | [Body](evidence/baseline-5.body) |

To reproduce an individual baseline request, substitute the exact URL from the table into this command. Run requests sequentially with at least one second between them:

```sh
curl --request GET --max-time 25 --include \
  --user-agent 'IMD-public-QA/1.0' --header 'Accept: */*' \
  'https://imd.fun/docs/'
```

The baseline expectation was a reachable public page or JSON endpoint, which these responses satisfy at the HTTP level. No assertion about the documented health schema was tested.

A local HTML parser checked every `<a href="#…">` in the saved docs response against HTML `id` attributes. All 34 same-document links had literal matching targets. The token page's single same-document link also had a matching target. [Static check results](evidence/static-check.json) record the titles, counts, and unmatched fragments. This is a static presence check, not proof of correct scroll position, visible content, or browser interaction. External links and links with path-plus-fragment URLs were not checked.

## Dropped findings

None can be enumerated. The step 1 findings file was missing, so its finding IDs, claims, evidence, and reproduction steps are unknown. **No original finding has been marked disproved, resolved, or unreproducible.** Missing source evidence is a verification dependency, not a failed reproduction.

## Limits, uncertainty, and unanswered questions

- **Observed:** the working tree lacked the required input; the five named baseline URLs returned 200; the saved docs' same-document fragment targets exist.
- **Inference:** these requests were not served a bot checkpoint, based on the returned page titles and HTML content. Other clients or later requests may behave differently.
- **Suspected bugs:** none advanced. There was no supplied claim set against which to assess suspicions.
- **Unanswered:** every step 1 claim; exhaustive link coverage; public GET documentation versus live schemas, limits, and errors; invalid IDs and query boundaries; explorer counts, filters, and freshness; 390px browser layout; mixed content; error disclosures; and paid-route browser CORS behavior. Response headers were preserved, but no security finding was inferred from missing headers alone.
- **Method and budget:** five network requests total, sequentially, with a 1.1-second pause after each response. No retries, followed redirects, browser asset loads, credentials, transactions, payments, signatures, write requests, or publication. The static checks made no network requests.
- **Verification authority:** this report and its local evidence are this run's observations only. No independent reviewer or behavioral verifier has certified them.