{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"d913dc06-1075-4f85-bc81-0f893a10e290","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"d9bb76bb82386832ed9ca5e271beb0753a2c8b165b0c6483a0adf5ff974382ec","dependsOn":[],"execution":{"mustProduce":["dist/index.html"],"network":true,"optionalTools":["browser"],"profile":"none","requires":["network"],"skillHash":"a60bc8b42446c13d993341179fe13c712a5addb118fc532fb2d15e71f912efc8","skillId":"build-website","tools":[]},"key":"build_website","kind":"code","role":"implement","skillHash":"a60bc8b42446c13d993341179fe13c712a5addb118fc532fb2d15e71f912efc8","skillId":"build-website","state":"accepted"},{"acceptedSubmissionHash":"3a6f41976baa67df7a5b1a3bd187a13af7d7f3179f6ec4dc90fcbd25529c5153","dependsOn":["build_website"],"execution":{"network":true,"optionalTools":["browser"],"profile":"none","requires":["network"],"skillHash":"fd33b6741366d364a55a4c0ba2bc4f5d329cec0b62f27a83289dc5b30ab03575","skillId":"design-critic","tools":[]},"key":"design_critic","kind":"code","role":"review","skillHash":"fd33b6741366d364a55a4c0ba2bc4f5d329cec0b62f27a83289dc5b30ab03575","skillId":"design-critic","state":"accepted"},{"acceptedSubmissionHash":"6f40510c406ad159220594867923c81e7ae38496880b25bad6029cb291a7abb3","dependsOn":["build_website"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","tools":[]},"key":"site_content_check","kind":"code","role":"review","skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","state":"accepted"}],"objective":"Sworn, host version 1.0.3 of the site under this project's name, sworn. Replace web/ and dist/ in this project's repository with the web/ and dist/ folders of https://github.com/banse/sworn/tree/sworn-web-1.0.3 at commit ad995de37801330cd5897a78afe6c2f757dab117 (a public repository; dist/ holds 90 files with index.html at its root and is the output of that tree's own build, npm ci and npm run build in web/), used unchanged: no file added, changed or left out, and no build run here. Then host that dist/. The page under this name currently serves version 1.0.2, the dist/ of this project's repository at commit db99d4ce0fb139184fc0ecfb57e3c4bdb16dad4e (90 files); version 1.0.3 replaces it entirely and keeps the name. The site is a static app that reads Ethereum mainnet over public RPCs, api.imd.fun, IPFS gateways and the Sworn indexer at https://sworn.vibingco.de/api from the visitor's browser. Its contract addresses (Registry 0x0da2679000ea5380d1361cc3cca7d4e8c881f766 of launch 2404) are part of these files and stay as they are; do not connect it to the addresses of this project's launch 2147. Decide, do not ask: a question blocks the job.","parentJobId":"c1d01f9f-22ea-456e-b650-0fbb45fba9a1","planHash":"e21b18624291c8c54ffa0ee3657b432efe09f05d7df2dcb184c9167cc7ee6c0d","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"c3792acf-e0c4-4268-9eea-c533b7c87935","publication":{"commit":null,"deliveredAt":null,"repoUrl":"https://github.com/identity-md-launches/launch-2147-launch-sworn-registry-symbol"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51360","feedbackHash":"ad16f1a348cfa537a40c712bae344c60492bbb58b1b0a20dc5fa2caeaa1e668d","nodeKey":"build_website","submissionHash":"d9bb76bb82386832ed9ca5e271beb0753a2c8b165b0c6483a0adf5ff974382ec","tag1":"verification:structural","tag2":"acceptance-v2","value":1},{"agentId":"50993","feedbackHash":"d2106c5b54cb59f74508150af04e847a8159966ca665050eff38f7143031d21c","nodeKey":"design_critic","submissionHash":"3a6f41976baa67df7a5b1a3bd187a13af7d7f3179f6ec4dc90fcbd25529c5153","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52290","feedbackHash":"a3dd3b3e5a6febf432caa6196a0d2675f791718089eff2e67236eaf4d258f870","nodeKey":"site_content_check","submissionHash":"6f40510c406ad159220594867923c81e7ae38496880b25bad6029cb291a7abb3","tag1":"review:submission","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"4011acfc41df397ef2eb9d6ea9396ba09de22f88494a11c59f75b2cdae0c30ab","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"75bef36d3764a939","findings":[],"hash":"3a6f41976baa67df7a5b1a3bd187a13af7d7f3179f6ec4dc90fcbd25529c5153","nodeId":"eed4376e-8986-485e-b764-58631a882c33","outcome":"completed","summary":"| Area | Count / result |\n|---|---|\n| Requirements | 10 met, 0 missing, 0 faked, 2 after review |\n| Broken features | 0 reproduced |\n| First screen at 390px | Product and action visible in both engines |\n| taste@1 | 14/16 passed; 2 brief exceptions |\n| Copy findings | 0 |\n| Share card | 5/5 metadata checks; valid 1200×630 PNG |\n\n| Explicit requirement | Status | Evidence |\n|---|---|---|\n| “version 1.0.3” | Met | `web/package.json` |\n| Replace `web/` from the pinned commit | Met | All 349 files match upstream Git blobs |\n| Replace `dist/`; 90 files, root `index.html` | Met | All 90 files match upstream |\n| “no file added, changed or left out” | Met | Independent comparison: 439/439 files identical |\n| “no build run here” | Met | Import audit records no build; review ran none |\n| “Then host that dist/” | After review | Publishing uses the unchanged export |\n| Replace 1.0.2 entirely | Met | Exact replacement; obsolete bundles absent |\n| Keep the name “sworn” | After review | Existing hosting target retained in the handoff |\n| Static browser reads: Ethereum, API, IPFS, indexer | Met | Runtime source wiring; live Ethereum/API/indexer reads exercised |\n| Preserve launch-2404 addresses | Met | `web/deployment-handoff.json`, `dist/imd-deployment.json` |\n| Do not connect to launch 2147 | Met | Runtime uses the requested Registry; old addresses absent |\n| “Decide, do not ask” | Met | Review completed without clarification |\n\nSworn presents public Ethereum wallet facts through a dark monospace instrument panel with green hexagonal records.\n\nChromium and WebKit passed wallet lookup, validation, wallet-dialog, keyboard-selection and JSON-download checks. Nine routes fit at 320, 390 and 1440px in both engines. Saved Fact Check data matched an Ethereum receipt; PNG downloading and RPC failure/recovery also passed.\n\nCommands checked:\n\n- `node .imd/reads/skills/design-critic/scripts/taste.mjs --out test/scratch/review-taste` — 14/16.\n- `node web/scripts/manifest.mjs --check` — passed.\n- `node web/scripts/static-release.mjs` — passed.\n\nThe brief’s “used unchanged” requirement overrides the probe’s uppercase-heading and monospace-prose preferences. Wallet signatures, transactions and post-review hosting were not exercised.\n\n[.imd-findings.json](/home/debian/.identitymd/work/d913dc06-1075-4f85-bc81-0f893a10e290/eed4376e-8986-485e-b764-58631a882c33/.imd-findings.json) contains `{\"findings\":[]}`. Website files remain unchanged.","treeHash":null,"usage":{"cachedInputTokens":4794368,"chain":[{"calls":93,"chainId":1,"failed":0,"own":93,"public":0,"refused":0}],"cost":{"source":"estimated","usdMicros":1511756},"inputTokens":144911,"model":"gpt-6.1-sol","outputTokens":26306,"runtime":"codex","turns":8,"wallClockMs":684034}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"5a0933543c2eb04a","findings":[{"citation":"resolved","description":"The hosted equivalent in dist/assets/FactCheckLive-DC1arzxw.js (line 1, getEnsAddress call) resolves the wallet query parameter with scopedClient, whose public client leaves CCIP-read enabled. An offchain ENS resolver can therefore make the visitor fetch a resolver-supplied URL outside the required Ethereum RPC / api.imd.fun / IPFS / sworn.vibingco.de/api allowlist. This happens on page load, without connecting a wallet. The reverse-name reader in web/src/ens-name.ts disables CCIP-read, but this forward-resolution path does not.","line":49,"path":"web/src/fact-check/FactCheckLive.tsx","reproduction":"Serve the unchanged dist/ and open /#/fact-check?wallet=jesse.base.eth in a fresh browser with DevTools Network open. No wallet connection or click is needed. Actual: the browser performs a fetch to https://api.coinbase.com/api/v1/domain/resolver/resolveDomain/0xde9049636f4a1dfe0a64d1bfe3155c0a14c54f31/0x9061b923... and resolves the wallet to 0x2211d1D0020DAEA8039E46Cf1367962070d77DA9. Reproduced against Ethereum mainnet reads via the configured public-RPC route. Expected: every external request stays within the explicit allowlist; unsupported offchain-only names should fall back to the address-entry recovery state without fetching a third-party resolver.","severity":"medium","snippet":"        const found = await c.getEnsAddress({ name: normalize(target) });","title":"Fact Check ENS resolution makes requests outside the permitted origins"},{"citation":"resolved","description":"The hosted wallet picker enables the Coinbase SDK connection flow. Its bundled relay client in dist/assets/dist-dSp3oqH3.js (line 1) fetches `${this.linkAPIUrl}/events?unseen=true` with linkAPIUrl set to https://www.walletlink.org. This request originates in the Sworn page itself, independently of the separate Coinbase popup. walletlink.org is outside the explicit external-request allowlist. This is an ordinary wallet integration, not evidence of a drainer or externally loaded script in the Sworn page.","line":30,"path":"web/src/wallet.tsx","reproduction":"Serve unchanged dist/ and open /#/ in a fresh Chromium profile with no injected wallet extension. Click Connect, then Coinbase Wallet. Before approving or signing anything, inspect requests initiated by the Sworn frame: it issues GET https://www.walletlink.org/events?unseen=true. The same frame request was reproduced twice. Expected: external requests from the hosted app remain limited to public Ethereum RPCs, api.imd.fun, IPFS gateways and https://sworn.vibingco.de/api. Actual: selecting the supported Coinbase connector adds the WalletLink relay origin.","severity":"medium","snippet":"      coinbaseWallet({\n        appName: \"Sworn\",\n        appLogoUrl: new URL(\"favicon.svg\", document.baseURI).href,\n        preference: { options: \"all\" },\n      }),","title":"Coinbase Wallet connector contacts an unapproved relay origin"}],"hash":"6f40510c406ad159220594867923c81e7ae38496880b25bad6029cb291a7abb3","nodeId":"f13a92cc-d801-4d3d-9e49-e286cd2f13a0","outcome":"completed","summary":"Saved two medium findings in [.imd-findings.json](/home/imd/.identitymd-11/work/d913dc06-1075-4f85-bc81-0f893a10e290/f13a92cc-d801-4d3d-9e49-e286cd2f13a0/.imd-findings.json):\n\n- ENS resolution contacts unapproved `api.coinbase.com`.\n- Coinbase Wallet contacts unapproved `www.walletlink.org`.\n\nNo critical or high findings. `web/` and all 90 `dist/` files match the pinned commit exactly. Sixteen routes passed at both viewport widths without app console errors. No site files changed or build run.","treeHash":null,"usage":{"cachedInputTokens":6288384,"chain":[{"calls":156,"chainId":1,"failed":0,"own":156,"public":0,"refused":0}],"cost":{"source":"estimated","usdMicros":11231954},"inputTokens":342822,"model":"gpt-6-astra","outputTokens":30307,"runtime":"codex","turns":9,"wallClockMs":951012}},{"artifacts":[],"attempt":1,"bundleHash":"73b7fe3fe03af857a4e16938297cd010f69e8cada7483dbeee09e5e311b40079","device":"5f74c0ba32743d88","findings":[],"hash":"d9bb76bb82386832ed9ca5e271beb0753a2c8b165b0c6483a0adf5ff974382ec","nodeId":"01a75b24-05e9-42e5-aeee-52eacea4d5c0","outcome":"completed","summary":"Replaced `web/` and `dist/` with pinned Sworn 1.0.3. All 439 files match exactly; no build ran. The 90-file export is ready for the existing sworn publishing flow.\n\nTypecheck and 312 tests passed. Updated README and DESIGN; browser, download and WebKit limitations are recorded in [validation.md](artifacts/validation.md). Submission additions total 1.99 MB, below 8 MiB.","treeHash":"301beaf3226425fbf24ee6c9d39dab02b24103be","usage":{"cachedInputTokens":4748160,"chain":[{"calls":423,"chainId":1,"failed":0,"own":423,"public":0,"refused":0}],"cost":{"source":"estimated","usdMicros":1546872},"inputTokens":123310,"model":"gpt-6.1-sol","outputTokens":35062,"runtime":"codex","turns":8,"wallClockMs":1076337}}],"verification":[{"checks":[],"detail":"paths and tree verified; no suite was run for this kind of work","evaluation":"structural","profile":"none","status":"accepted","submissionHash":"d9bb76bb82386832ed9ca5e271beb0753a2c8b165b0c6483a0adf5ff974382ec","verifiedTreeHash":"301beaf3226425fbf24ee6c9d39dab02b24103be","verifierVersion":"0.1.0+8bb77c84"}]}