{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"ba164ffa-1c3e-4183-93bd-4a11d24b76bd","kind":"audit","nodes":[{"acceptedSubmissionHash":"07664397f0a85bce575ce8aa5e1f5cb3e2233b9fb5c607ae03462e656e7d1db0","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_economics","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"bf10a1a3b1e500acfc9e295cdb38b1b8e0c76460ac8d74d15a7a4a8416995d40","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_flow","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"f34a05740ccaf0949061883721df0473c93cd57e49f5d729ccc425dbed6ee40d","dependsOn":["audit_math","audit_permissions","audit_economics","audit_flow"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","subagents":4,"tools":[]},"key":"audit_judge","kind":"code","role":"review","skillHash":"b89279670f5a00f5d26286edee00c97dd158b997031350a01cafe6e0329ad227","skillId":"audit-judge","state":"accepted"},{"acceptedSubmissionHash":"593a4b4c08dd2d3c0d719e6d5107e342838fc6de0ba8059edc7c8d1e3e4b4e05","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_math","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"},{"acceptedSubmissionHash":"6b2d42c1f56696e76461272e213704d9492cee8d1dc6402cccbe74a7965cd378","dependsOn":[],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","subagents":3,"tools":[]},"key":"audit_permissions","kind":"code","role":"review","skillHash":"bc5bfc8455464381f2db18badb2b55cf8bec1e535c019349a0378fa990741171","skillId":"audit-specialist","state":"accepted"}],"objective":"Audit the imd-flop folder only, at exactly commit 8b5a068 (head of PR #4, which stacks on PR #3 and PR #1; none of them is on main). Review everything these three PRs change from main (df10e3d) to this commit. PR #1: a paid run (--provider flop) must refuse before any quote or child-key mint unless eth_chainId is 1 and the faucet and devnet RPC genesis both equal the pinned hash, with a recheck before the mint (src/gateway.ts, src/networks.ts, src/providers.ts, src/run.ts, src/cli.ts). PR #3: run --json must print only the text the response file stored, so text the secret scan withholds never reaches stdout (src/run.ts). PR #4: while spend is unresolved the ledger keeps the padded quote as cap_charge, reported usage never lowers it, and an explicit settled amount, including zero, is the charge (src/run.ts, src/ledger.ts). What worries us: a paid call or child-key mint that still happens when a check fails, times out or gets a malformed answer; the daily or per-call cap being bypassed or under-counted across repeated, failed or timed-out calls; ledger or receipt rows whose spend or cap_charge are wrong, lowered or erased; and any path where an API key, child key or withheld completion text reaches stdout, stderr, logs or the ledger. A later PR builds on this commit and was audited separately; this audit is for these three PRs as they would merge on their own, so report what is wrong here even if later work changes it. Every other folder is out of scope. Work offline and read-only, with no live FLOP or IMD calls, no keys and no spending. Give each finding a file and line, its impact, and steps to reproduce it.","parentJobId":null,"planHash":"27db98f36a6e607e8814a90203d6ac7f36fa2dfcad807a3843dfb643be4512c4","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"ba164ffa-1c3e-4183-93bd-4a11d24b76bd","publication":{"commit":null,"deliveredAt":null,"repoUrl":null},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"52627","feedbackHash":"dfa28753e4938a773dddff82cd4bd4ae39201838256c78c9aae5f2ff0b49b66b","nodeKey":"audit_economics","submissionHash":"07664397f0a85bce575ce8aa5e1f5cb3e2233b9fb5c607ae03462e656e7d1db0","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51875","feedbackHash":"465cce87b785c2684f672ac2d2eb256b09abbd8e41efb6c6e086c8a5bd58b4e1","nodeKey":"audit_flow","submissionHash":"bf10a1a3b1e500acfc9e295cdb38b1b8e0c76460ac8d74d15a7a4a8416995d40","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51492","feedbackHash":"f4c39ff25354b1970d1689e4648cdbba391bb4fa187f4ff4a8785670b32924a7","nodeKey":"audit_judge","submissionHash":"f34a05740ccaf0949061883721df0473c93cd57e49f5d729ccc425dbed6ee40d","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"51509","feedbackHash":"7122fcd9e2ef040bd73e7bc178fe8e3cb03426bb76b3ea1a2c524c83394d48d0","nodeKey":"audit_math","submissionHash":"593a4b4c08dd2d3c0d719e6d5107e342838fc6de0ba8059edc7c8d1e3e4b4e05","tag1":"review:submission","tag2":"acceptance-v2","value":1},{"agentId":"52623","feedbackHash":"b6600c6b7b619f8121914e321fabd2c16ec8ea43f39ad412f3664e722a175d4a","nodeKey":"audit_permissions","submissionHash":"6b2d42c1f56696e76461272e213704d9492cee8d1dc6402cccbe74a7965cd378","tag1":"review:submission","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"7a91de167cc56bfa63662ef4f928b8ece4719ebd2f4fc65964c49840cc9d0707","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"aefe32dd2527eb68","findings":[{"citation":"resolved","description":"PR #4 makes any numeric receipt settled_spend the ledger charge (classifyReceipt only checks typeof === 'number'). Nothing checks that the value is finite and >= 0. spentToday/jobSpent (ledger.ts:54-68) add cap_charge across the latest rows, so one malformed or hostile receipt with a negative settled_spend lowers today's total, or the job's requester total, by that amount. The daily-cap check at run.ts:178-180 then lets through calls that go far past the configured cap. The ledger row also records spend/cap_charge = -10, which is not a real charge. Fix: treat settled as known only when Number.isFinite(settled) && settled >= 0. Otherwise keep unresolvedCharge (the padded quote, raised by reported cost) and flag the receipt as malformed.","line":238,"path":"imd-flop/src/run.ts","reproduction":"Offline vitest with a provider named 'mock' that wraps MockProvider and returns a receipt {state:'settled', settled_spend:-10}. Steps: readySeat(h,'42','0.5') (daily cap 0.5, per-call 0.5), then `run --job job-abc --prompt 'Say hi' --max-tokens 8 --no-link --json` once with that provider, then 40 more runs with normal unresolved receipts (settled_spend:null, padded quote 0.18). Expected: the first ledger row's cap_charge is at least the padded quote 0.18 (or the receipt is rejected), and at most 2 later calls are allowed under the 0.5 cap. Actual: printed cap_charge is -10, all 40 later calls are sent, and `status --json` shows today_utc.mock = -2.8. The same applies to provider flop and to jobSpent for payer=requester.","severity":"medium","snippet":" const capCharge = classified.settled ?? unresolvedCharge;","title":"A negative settled_spend from the receipt becomes a negative cap_charge and removes the daily cap"},{"citation":"resolved","description":"requestId is passed to classifyReceipt only as a fallback for a missing receipt.request_id, and receipt.state is never checked. At line 238, classified.settled (even 0) replaces the padded reservation whenever the field is numeric. Two cases follow. (a) A receipt whose state is 'reserved' or 'estimated', so spend is unresolved, but which carries settled_spend:0 drops the reservation to cap_charge 0. That breaks PR #4's rule that the padded quote stays the cap_charge while spend is unresolved. (b) A receipt returned for a different request_id (gateway bug, cache or idempotency mix-up) sets this attempt's charge to that other request's settled amount. Either way an unresolved paid call is charged 0 against the daily or per-job cap, and more calls are allowed. Fix: use classified.settled only when rr.http === 200, receipt.request_id === requestId and receipt.state is 'settled' (or 'released' with an explicit amount). Otherwise use unresolvedCharge.","line":229,"path":"imd-flop/src/run.ts","reproduction":"Offline vitest with a provider named 'mock' whose readReceipt returns the MockProvider receipt changed to (a) {state:'reserved', settled_spend:0} or (b) {request_id:'some-other-request', state:'settled', settled_spend:0}. Run `run --job job-abc --prompt 'Say hi' --max-tokens 8 --no-link --json` after readySeat(h,'42','0.5'). Expected: the latest ledger row keeps cap_charge = quote_padded (0.18), because spend is unresolved or the receipt is not for this request. Actual: (a) the ledger row is state 'reserved', cap_charge 0, quote_padded 0.18; (b) the printed cap_charge is 0 while receipt.request_id is 'some-other-request' and request_id is 'mock-42-…'.","severity":"medium","snippet":" const classified = classifyReceipt(rr.receipt, { job, provider: provider.name, http: rr.http, error: rr.error, requestId, mock: provider.name === \"mock\" });","title":"Receipt settled_spend is taken as final even when the receipt is still reserved/estimated or names another request_id"},{"citation":"resolved","description":"The run timer (run.ts:192) aborts req.signal, but complete() never checks the signal before or between assertPaidNetwork (up to 3 x 15 s of its own timeouts) and mintChildKey (15 s), and does not pass it to them. If --timeout-ms elapses during the pre-mint recheck, the child key is still minted after the deadline. createChatCompletion then fails at once on the aborted signal. run.ts:200 classes that failure as timeout_unknown, so the ledger keeps the padded charge and the CLI reports 'Spend is UNKNOWN' for a call whose inference was never sent. The result is an unneeded mint after a failed (timed-out) check, plus a phantom unresolved charge against the daily cap that never resolves (receipt --refresh does not update the ledger). Fix: call req.signal.throwIfAborted() before the recheck and before the mint, and throw it as PreSendError. Pass req.signal (combined with the 15 s timeouts) into assertPaidNetwork and mintChildKey.","line":146,"path":"imd-flop/src/providers.ts","reproduction":"Offline vitest: FlopProvider(NETWORKS.devnet, keyFile, stubFetch, 'https://eth.example/rpc'). The stub answers eth_chainId 0x1, faucet /chain with the pinned genesis, and /keys/ephemeral with 201 {token:'flop_ek_'+'A'*24}, and counts mints. A fake WebSocket answers with the pinned hash. Call complete() with an AbortController already aborted with DOMException('no answer within 1 ms','TimeoutError'). Expected: 0 mints and a PreSendError. Actual: mints = 1, then TimeoutError (not PreSendError), which runJob records as timeout_unknown with cap_charge = padded quote.","severity":"low","snippet":" const child = await mintChildKey(this.net, this.parent, { model: req.model, maxSpend: req.maxCostFlop }, this.f);","title":"FlopProvider.complete ignores the run deadline: the genesis recheck and child-key mint still run after the timeout fires"},{"citation":"resolved","description":"The strip only replaces lowercase-'0x'-prefixed 64-hex runs. The secret scan's HEX64 rule also matches a bare 64-hex run and one after '0X'. Text from outside the program reaches err.message unchanged: an Ethereum RPC 'error.message', a faucet or fetch error, or the RPC 'rpc error: …' message. When that text holds such a run, appendLedger at line 205 throws 'secret scan blocked writing ledger.jsonl', the refused_local cap_charge 0 line is never written, and the pre-call 'sent' row with cap_charge = padded quote stays the latest line. A call that sent nothing is then counted against the daily cap and shown as a pending paid attempt, and the user sees the secret-scan error instead of 'nothing sent'. Fix: strip every HEX64 match (same regex as secrets.ts, case-insensitive prefix). If the append still fails, write a fixed reason (for example 'pre-mint check failed') so the cap_charge 0 line always lands.","line":204,"path":"imd-flop/src/run.ts","reproduction":"Offline vitest (paid-gate pattern): readySeat + wallet-signed link + gateway.key. Stub fetch answers the first two eth_chainId calls (gate and owner check) with 0x1 and the third (the complete() recheck) with {error:{message:'header not found '+'ab'.repeat(32)}}. Faucet and fake WebSocket return the pin and estimate returns 0.012. Run `run --job job-abc --prompt 'Say hi' --max-tokens 8 --provider flop --live` with ETH_RPC_URL set. Expected: the latest ledger row is refused_local with cap_charge 0, and status today_utc.flop is 0. Actual: exit 5, stderr 'secret scan blocked writing ledger.jsonl: reason: 64-hex (key-shaped) value', the ledger has only ['sent', 0.132], status shows today_utc.flop 0.132 and 1 pending receipt, and no paid call was made.","severity":"low","snippet":" const reason = timedOut ? `${err.name}: no answer; spend unknown, not retried` : preSend ? `nothing sent: ${err.message.replace(/0x[0-9a-fA-F]{64}/g, \"[hash]\")}` : `HTTP ${http}`;","title":"A pre-mint refusal whose message carries a non-0x 64-hex cannot be written, so the padded 'sent' charge stays on the ledger"},{"citation":"resolved","description":"Node's fetch rejects a URL with userinfo with TypeError 'Request cannot be constructed from a URL that includes credentials: '. readEthereumChainId wraps that message unchanged, and assertPaidNetwork adds it to the CliError that run.ts:118 builds ('refused locally, nothing sent: …'). cli.ts:422 prints that to stderr. Several RPC providers use basic auth (https://user:secret@host). The secret in ETH_RPC_URL then goes to stderr and into any logs the caller captures, which this PR's gate adds for every paid run (and for link verify through readVerifiedSeatOwner). ETH_RPC_URL is never registered as a secret, so nothing redacts it. Fix: never interpolate the transport error message or URL. Report a fixed 'eth_chainId unavailable' (or redact userinfo and path), and registerSecret any userinfo in ETH_RPC_URL.","line":205,"path":"imd-flop/src/gateway.ts","reproduction":"Real Node 24: `node -e 'fetch(\"https://user:s3cretpass@eth.example/rpc\",{method:\"POST\"}).catch(e=>console.log(e.message))'` prints 'Request cannot be constructed from a URL that includes credentials: https://user:s3cretpass@eth.example/rpc'. Through the CLI (offline vitest, with io.fetch emulating that constructor check and a provider named 'flop'): `run --job j --prompt hi --provider flop --live` with ETH_RPC_URL=https://user:s3cretpass@eth.example/rpc. Expected: stderr does not contain 's3cretpass'. Actual: stderr is 'imd-flop: refused locally, nothing sent: eth_chainId unavailable: Request cannot be constructed from a URL that includes credentials: https://user:s3cretpass@eth.example/rpc'.","severity":"low","snippet":" throw new Error(`eth_chainId unavailable: ${(e as Error).message}`);","title":"Credentials embedded in ETH_RPC_URL are printed to stderr when the paid-run chain-id gate fails"}],"hash":"07664397f0a85bce575ce8aa5e1f5cb3e2233b9fb5c607ae03462e656e7d1db0","nodeId":"75a91488-1cdc-4996-9639-30dcdd495bd7","outcome":"completed","summary":"I found five defects in `imd-flop` at 8b5a068 (two medium, three low), and each one fails a check I wrote for it. The findings are in `.imd-findings.json` at the repository root. Each was reproduced offline with throwaway vitest tests against stubbed fetch and WebSocket, with no live FLOP or IMD calls and no keys. I deleted those tests and the installed packages afterwards, so the working tree is clean apart from the findings file. The project's own test suite runs green.\n\n| # | Sev | Location | Defect | Failing input → actual result |\n|---|---|---|---|---|\n| 1 | medium | `imd-flop/src/run.ts:238` | PR #4 uses any numeric `settled_spend` from the receipt as the charge, with no check that it is finite and ≥ 0 | A receipt with `settled_spend:-10` and a daily cap of 0.5 gives `cap_charge` −10. The next 40 calls all go out and the daily total reads −2.8. The requester-pays budget is affected the same way. |\n| 2 | medium | `imd-flop/src/run.ts:229` | The receipt's `state` and `request_id` are never checked before its settled amount replaces the padded reservation | A receipt still in state `reserved` with `settled_spend:0` gives `cap_charge` 0 instead of the padded 0.18. A receipt naming another `request_id` also sets this call's charge to 0. |\n| 3 | low | `imd-flop/src/providers.ts:146` | `complete()` ignores the run's timeout signal during the pre-mint recheck and the child-key mint | With the signal already aborted, a child key is still minted (1 mint). The run then records `timeout_unknown` at the padded charge for a call that never sent anything. |\n| 4 | low | `imd-flop/src/run.ts:204` | The hash strip only catches hashes with a lowercase `0x` prefix; the secret scan also rejects bare or `0X` ones | A recheck RPC error containing a bare 64-character hex string blocks the `refused_local` line. The padded `sent` charge (0.132) stays on the ledger with nothing sent, and the user sees a secret-scan error instead of \"nothing sent\". |\n| 5 | low | `imd-flop/src/gateway.ts:205` | The transport error message is copied into the refusal text as is | With `ETH_RPC_URL=https://user:s3cretpass@…`, Node's fetch error includes the full URL and the password is printed to stderr. |\n\nFor #5 I confirmed the Node fetch error text with real Node 24. Inside the CLI test, that fetch behaviour was simulated by a stub.\n\n**What I checked and found no defect in:**\n- **PR #1:** both network checks fail closed on a wrong chain id, a reset genesis, HTTP errors, timeouts and malformed JSON. A malformed mint response is recorded at the full padded charge rather than lowered.\n- **PR #3:** `run --json` prints only the stored text. Error and timeout paths print the error name or HTTP status, never the completion body, child token or bearer.\n- **Cap check concurrency:** the step from reading the cap to writing the `sent` row has no wait inside it, so runs in the same process cannot slip past the cap together.\n\n**Limits:**\n- The work was split into the economics passes (Economic Security, Invariant, Flow Gap) and done without helpers.\n- I didn't report two minor leads:\n - A completion with no `usage` field crashes the run before the final ledger line is written. The over-charge stays in place, so it errs on the safe side.\n - The ledger's `day` is fixed before the estimate, so a call that starts just before midnight UTC is charged to the previous day. That code is older than these PRs.\n- None of the findings carries a `proof` field, because those are Foundry tests and this code is TypeScript. Each reproduction is written out step by step instead.","treeHash":null,"usage":{"cachedInputTokens":1452919,"cost":{"source":"runtime","usdMicros":1636406},"inputTokens":38,"model":"claude-opus-5-5","outputTokens":29255,"runtime":"claude","turns":22,"wallClockMs":333772}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"74a99f640688d37b","findings":[{"citation":"resolved","description":"PR #4 added a Number.isFinite guard for cost_reported (line 237) but not for the settled amount. classifyReceipt (imd-flop/src/receipts.ts:57) passes any JS number through, and @flop-labs/contracts' CredentialReceipt validator (checked in node_modules/@flop-labs/contracts) accepts settled_spend: -5, so a negative value from the gateway reaches the ledger unchanged. spentToday/jobSpent (imd-flop/src/ledger.ts:58) sum cap_charge with no lower bound, so one negative row subtracts from every later check: spent_before goes negative, left = daily - spent_before grows past the cap, and further paid calls are admitted that the cap should refuse. The holder's exposure within a UTC day is then bounded only by the gateway's honesty, which is the party the cap guards against. A second path: a non-finite settled value (Infinity) is kept as cap_charge, JSON.stringify writes it as null in ledger.jsonl, and on re-read `a + null` counts the row as 0. The flop client rejects Infinity at the schema, so that path is reachable only through the Provider interface, but the ledger code itself has no guard. Fix: treat settled as resolved only when Number.isFinite(settled) && settled >= 0; otherwise fall back to unresolvedCharge (and record spend: null). Same check belongs in classifyReceipt so receipts and status never display a negative or null-as-zero charge.","line":238,"path":"imd-flop/src/run.ts","reproduction":"State: seat 9001 initialised and linked, `cap set 0.2` (daily 0.2, per-call 0.2). Prompt 'Say hi' with --max-tokens 8 quotes padded 0.18 from the mock estimate. Step 1: run with a provider whose readReceipt returns state 'settled', settled_spend -10 (scripted wrapper over MockProvider; the real FlopClient validator accepts this value). Actual: exit 0, printed cap_charge -10, ledger latest row {state:'settled', spend:-10, cap_charge:-10}, `status --json` today_utc.mock = -10. Step 2 and 3: two more runs (jobs neg-2, neg-3) with settled null. Expected: the second 0.18 call is refused ('over the remaining daily cap'), since 0.18 + 0.18 > 0.2 unless the first call settled at or below 0.02. Actual: both pass (left = 10.2 then 10.02); ledger has three 'sent' rows under a 0.2/day cap. Infinity variant: settled_spend Number.POSITIVE_INFINITY -> printed cap_charge null, ledger row cap_charge null, today_utc.mock 0, second 0.18 run admitted. Reproduced with vitest in test/scratch/math-audit.test.ts (describe 'F1'), 5/5 passing against this commit.","severity":"high","snippet":" const capCharge = classified.settled ?? unresolvedCharge;","title":"cap_charge takes settled_spend with no sign or finiteness check: a negative settled value lowers the day's total and reopens the daily cap"},{"citation":"resolved","description":"PR #4's rule is 'while spend is unresolved the ledger keeps the padded quote'. The code decides 'resolved' purely by settled_spend being a number and never looks at receipt.state. The gateway contract (CredentialReceipt in @flop-labs/contracts) defines reserved as 'holds quota with no completion checkpoint' and estimated as 'retains the reservation after completion without reconciled actual spend'; both are unresolved by definition, and its validator accepts settled_spend: 0 alongside state 'reserved'. A gateway that fills settled_spend with a placeholder 0 (the field comes from a 'legacy floating-point ledger') or any out-of-sync receipt therefore produces a ledger row {state:'reserved', spend:0, cap_charge:0} while the quota is still reserved server-side, and the daily/job cap is under-counted by the whole padded quote. Related: the receipt's request_id is never compared with the request the run made, so a receipt for another request would be applied the same way. Fix: use classified.settled only when classified.state === 'settled' (or 'released'); for reserved/estimated keep unresolvedCharge and spend null; refuse to apply a receipt whose request_id differs from requestId.","line":237,"path":"imd-flop/src/run.ts","reproduction":"State: seat 9001 linked, `cap set 0.2`. Run job res-0 with a provider whose readReceipt returns {state:'reserved', settled_spend:0, reserved_spend:0.18}. Expected: cap_charge 0.18 (reservation kept, spend null) because the receipt says the reservation is still held. Actual: exit 0, printed receipt.state 'reserved' and cap_charge 0, ledger latest row {state:'reserved', spend:0, cap_charge:0}. Then run job res-1 (settled null): expected refusal for the 0.2/day cap (0.18 + 0.18), actual exit 0 and a second 'sent' row. Reproduced in test/scratch/math-audit.test.ts (describe 'F2').","severity":"medium","snippet":" const unresolvedCharge = costReported !== null && Number.isFinite(costReported) ? Math.max(q.padded, costReported) : q.padded;\n const capCharge = classified.settled ?? unresolvedCharge;","title":"settled_spend is accepted as the charge regardless of receipt state: a reserved or estimated receipt carrying settled_spend 0 zeroes a reservation the gateway still holds"},{"citation":"resolved","description":"runJob starts the --timeout-ms timer before provider.complete (imd-flop/src/run.ts:191-195) and passes req.signal, but complete() only hands the signal to createChatCompletion. The pre-mint recheck added by PR #1 (assertPaidNetwork at line 140, up to three network reads with their own 15 s limits) and mintChildKey (line 146) ignore it. When the deadline passes during the recheck, the child key is still minted with the parent bearer, registerSecret is called, and only then does the completion fail on the already-aborted signal. runJob then classifies it as timeout_unknown ('no answer; spend unknown, not retried', exit 6) and charges the full reservation, although no completion was sent. Effects: a live single-use credential capped at the quote is created after the run declared itself timed out; the holder's daily cap loses the padded quote for a call that never happened; `receipt ` will never resolve it because no completion exists; the holder is told spend is unknown. Fix: call req.signal.throwIfAborted() before assertPaidNetwork and again before mintChildKey, pass the signal into both, and classify an abort before the mint as PreSendError (nothing sent, cap charge 0).","line":146,"path":"imd-flop/src/providers.ts","reproduction":"State: seat 42 initialised, linked, wallet-signed (EIP-712 over the link), `cap set 1`, seats/42/gateway.key present, ETH_RPC_URL set. Scripted fetch: eth_chainId -> 0x1, eth_call -> owner, /models/estimate -> {estimated_cost_flop:0.012, 1 in, 1 out}, first /chain -> pinned hash immediately, second /chain (the pre-mint recheck) -> pinned hash after a 60 ms delay (well inside its 15 s limit), /keys/ephemeral -> 201 {token:'flop_ek_...'}, /chat/completions -> rejects with the aborted signal's reason as real fetch does; a fake WebSocket answers chain_getBlockHash(0) with the pin. Command: run --job job-abc --prompt 'Say hi' --max-tokens 8 --provider flop --live --timeout-ms 20. Expected: once the 20 ms deadline passes, no mint; 'nothing sent' with cap charge 0. Actual: POST /keys/ephemeral is issued after the deadline, exit code 6 with 'Spend is UNKNOWN', ledger latest row state timeout_unknown with cap_charge 0.012, no responses directory. Reproduced in test/scratch/math-audit.test.ts (describe 'F4').","severity":"medium","snippet":" const child = await mintChildKey(this.net, this.parent, { model: req.model, maxSpend: req.maxCostFlop }, this.f);","title":"FlopProvider.complete mints the child key after the run's own deadline has fired: the abort signal is not consulted before the mint"},{"citation":"resolved","description":"PR #3 routes stdout through the stored response, with a fallback that nulls text and rewrites the record. The fallback re-spreads the whole responseRecord, including usage, which the gateway contract allows to carry arbitrary extra keys (`[k: string]: unknown`), and the ledger-visible receipts already carry 64-hex ids (terminal_event, channel_id). If the completion's usage holds such a value, assertNoSecrets rejects the first write on usage., and the second write fails for the same field. The CliError escapes runJob after the paid call has completed: the receipt is never read, the receipt file is never written, the final ledger row is never appended (the row stays at 'sent'), stdout is empty (no request_id, no response path), and the completion text is lost although it is benign. Exit code 5 (REFUSED_RULE) is reported for a call that was paid for. Fix: on scan failure, store a record with usage reduced to the four numeric fields (prompt_tokens, completion_tokens, total_tokens, cost_flop) and text nulled only if text itself tripped the scan; or scan text and usage separately and withhold only the offending part; and make sure the receipt read and the final ledger row still run (try/finally).","line":225,"path":"imd-flop/src/run.ts","reproduction":"State: seat 9001 linked, `cap set 5`. Provider: MockProvider('ok') wrapped so complete() returns text 'benign text' and usage {prompt_tokens, completion_tokens, total_tokens, cost_flop, x_flop_event:'ee'*32} (a synthetic 64-hex marker, not a key). Command: run --seat 9001 --job usage-marker --prompt 'Say hi' --max-tokens 8 --provider mock --json. Expected: exit 0, a response file with the benign text (or with the offending usage field withheld), a receipt file, and a final ledger row. Actual: complete() was called once (paid), exit code 5, stdout empty, stderr 'secret scan blocked writing response: usage.x_flop_event: 64-hex (key-shaped) value', readReceipt never called, no responses/ or receipts/ files, ledger rows for the request_id = ['sent'] only. Reproduced in test/scratch/withhold-fallback.test.ts.","severity":"medium","snippet":" writeJsonSafe(responseFile, { ...responseRecord, text: null, withheld }, \"response\");","title":"Withheld-text fallback assumes the key-shaped value is in text: a completion whose usage carries a 64-hex field fails both writes after payment, losing the response and the receipt"},{"citation":"resolved","description":"padQuote returns null (refuse, 'no usable cost') when raw is not > 0, but the 6-decimal rounding can still produce padded 0 for a positive raw quote whenever raw * (1 + 20/(tin+tout)) < 5e-7. Downstream, 0 is a valid number: the per-call check (`q.padded > cap.perCall`) and the daily/job checks pass, the 'sent' row is charged 0, and the real provider would mint a child key with scope.max_spend 0 and send max_cost_flop 0. Whether the gateway reads 0 as a zero ceiling or as 'no ceiling' is not verified here; either way the local reservation is 0 until a reported cost or settlement arrives, so the per-call cap is applied to a quote the code itself considers unusable. Fix: after rounding, treat padded <= 0 as 'no usable cost' (return null), or round up (Math.ceil) so a positive quote never becomes 0.","line":59,"path":"imd-flop/src/run.ts","reproduction":"padQuote({estimated_cost_flop: 4e-7, estimated_input_tokens: 5000, estimated_output_tokens: 5000}) returns {raw: 4e-7, padded: 0} (perTok 4e-11, sum 4.008e-7, *1e6 = 0.4008, rounds to 0). Run: seat 9001 linked, `cap set 0.2`, provider whose estimate returns that object. Expected: refusal with 'estimate returned no usable cost' (exit 7). Actual: exit 0, complete() called once with maxCostFlop 0, ledger 'sent' row {quote_padded: 0, cap_charge: 0}. Reproduced in test/scratch/math-audit.test.ts (describe 'F3').","severity":"low","snippet":" return { raw, padded: Math.round((raw + TEMPLATE_PAD * perTok) * 1e6) / 1e6 };","title":"padQuote rounds a positive sub-microFLOP quote to padded 0, which passes every cap check and mints a child key with max_spend 0"},{"citation":"resolved","description":"Unlike --max-tokens (checked 1..8192) and --job-budget (num()), the timeout goes straight into setTimeout. Node clamps NaN (e.g. '--timeout-ms 60s'), negatives, and anything above 2147483647 to 1 ms with a warning; 0 fires at once. With the flop provider the deadline then always passes during the pre-mint recheck, so (see the mint-after-deadline finding) the child key is minted, the completion aborts, the run exits 6 'Spend is UNKNOWN', and the padded quote is charged to the day's cap for a call that was never sent. A typo in the flag therefore costs the holder daily budget and creates an unused credential each time. Fix: validate with Number.isSafeInteger(n) && n >= 1000 && n <= 2147483647, and reject anything else with EXIT.USAGE before any network read.","line":322,"path":"imd-flop/src/cli.ts","reproduction":"node -e 'setTimeout(()=>{},2147483648); setTimeout(()=>{},Number(\"abc\"))' prints TimeoutOverflowWarning and TimeoutNaNWarning, 'Timeout duration was set to 1'. In the CLI: run --provider flop --live --timeout-ms 2147483648 (or --timeout-ms 60s) with the scripted gateway from the mint-after-deadline reproduction. Expected: exit 2 usage error, nothing read, nothing minted. Actual: the first gate and estimate run, the 'sent' row is written with the padded quote, the 1 ms timer fires during the recheck, POST /keys/ephemeral is issued, and the run ends with exit 6 and a timeout_unknown row that keeps the reservation. Reproduced for --timeout-ms 2147483648 and --timeout-ms 60s in test/scratch/math-audit.test.ts (describe 'F4', it.each).","severity":"low","snippet":" timeoutMs: Number(values[\"timeout-ms\"] ?? 60000),","title":"--timeout-ms is not validated: NaN, 0, negative or values above 2^31-1 become a 1 ms deadline, so every paid run times out after the mint and charges the reservation"}],"hash":"593a4b4c08dd2d3c0d719e6d5107e342838fc6de0ba8059edc7c8d1e3e4b4e05","nodeId":"8060d36b-46fc-4337-b805-0a7c2b00d715","outcome":"completed","summary":"The audit is complete. The findings file is written and validated, and the tree is unchanged apart from my scratch tests and the gitignored install.\n\n**Outcome.** Six findings at commit 8b5a068, all reproduced with vitest against the current code and recorded in `.imd-findings.json`. No Solidity is in scope, so no Foundry proofs apply. The existing suite passes (71 tests), and my 8 scratch reproductions pass, meaning each defect behaves as described today.\n\n**Findings, by severity**\n\n- **High, settled_spend trusted unchecked** (run.ts:238). PR #4 guards cost_reported with isFinite but not the settled amount. A receipt with settled_spend -10 passes the gateway client's schema validator, lands as cap_charge -10, and the day's total goes negative. Under a 0.2/day cap, three 0.18 calls were admitted. Infinity is stored as null and counts as zero.\n- **Medium, receipt state ignored** (run.ts:237). A receipt in state reserved or estimated with settled_spend 0 zeroes the charge while the gateway still holds the reservation. This contradicts PR #4's own rule that unresolved spend keeps the padded quote. The receipt's request_id is also never compared with the run's.\n- **Medium, child key minted after the deadline** (providers.ts:146). The run's abort signal is not consulted before the PR #1 recheck or the mint. When the timeout fires during the recheck, the key is still minted, then the completion aborts, and the run reports \"spend unknown\" and charges the full reservation for a call never sent.\n- **Medium, withheld-text fallback fails after payment** (run.ts:225). If the completion's usage object carries a 64-hex field, both response writes fail. The paid completion is lost, no receipt is read, no final ledger row is written, stdout is empty, and the exit code is 5.\n- **Low, padQuote rounds to zero** (run.ts:59). A quote of 4e-7 FLOP over 10000 tokens pads to 0, passes every cap check, and would mint a child key with max_spend 0.\n- **Low, timeout flag unvalidated** (cli.ts:322). NaN or values above 2^31-1 become a 1 ms deadline, so every paid run hits the mint-after-deadline path and burns daily budget.\n\n**Coverage.** I read every file the three PRs change plus receipts, secrets, store, config and match, and the gateway client and contracts package the ledger depends on. Chain-id and genesis parsing in PR #1 held up: malformed, one-sided and agreeing-wrong answers all refuse before any paid call, and the existing tests cover them well. PR #3's stdout path is correct for text; the defect is in its fallback write. Not reported: the cross-process race between reading the day's spend and appending the sent row, which predates these PRs and has a sub-millisecond window.\n\n**Next.** The fixes are small: a `>= 0` and isFinite check plus a state check on settled, a signal check before the recheck and mint, a narrower fallback record, a zero guard after rounding, and flag validation. The scratch tests under `imd-flop/test/scratch/` can be inverted into regression tests.","treeHash":null,"usage":{"cachedInputTokens":2218050,"cost":{"source":"runtime","usdMicros":5519696},"inputTokens":706,"model":"claude-fable-5-1","outputTokens":44564,"runtime":"claude","turns":41,"wallClockMs":775239}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"a800aae85243bc87","findings":[{"citation":"resolved","description":"runJob uses classified.settled as the charge whenever it is a number. classifyReceipt (src/receipts.ts:369) accepts any typeof number, with no check that it is finite or non-negative. A receipt with settled_spend < 0 (a malformed or hostile gateway answer) is stored as cap_charge < 0. spentToday/jobSpent (src/ledger.ts:302,310) add that row, so the negative value cancels real spend already on the books, and run's `left = daily - spentBefore` check lets more calls through. PR #4 made 'an explicit settled amount is the charge' the rule but never limited it to valid amounts. Impact: the daily cap (and the requester job budget) can be bypassed by as much as the negative amount. Fix: count a settled amount only if Number.isFinite(s) && s >= 0, and otherwise keep the padded reservation (unresolvedCharge). Better still, reject the receipt row.","line":238,"path":"imd-flop/src/run.ts","reproduction":"Offline, vitest, mock-named provider. `cap set 1` for seat 42. Run 1: a provider whose readReceipt returns {state:'settled', settled_spend:-5}. The ledger's last row is cap_charge -5 and `status --json` gives today_utc.mock = -5. Then 40 runs whose receipts are unresolved ({state:'estimated', settled_spend:null}, padded quote 0.18 each). Expected: the run that would push today's total past 1 FLOP is refused with exit 3, so about 5 calls succeed. Actual: 33 calls succeed. Their unresolved rows reserve 5.94 FLOP against the 1 FLOP/day cap. The same flaw applies to payer=requester through jobSpent.","severity":"high","snippet":" const capCharge = classified.settled ?? unresolvedCharge;","title":"A negative settled_spend becomes a negative cap_charge, which removes spend from the daily total so later calls go over the daily cap"},{"citation":"resolved","description":"PR #4 requires that 'while spend is unresolved the ledger keeps the padded quote as cap_charge'. The code decides 'resolved' only by whether settled_spend is a number. It ignores the receipt's own state. A receipt that says state 'estimated' or 'reserved' but carries settled_spend: 0 (a gateway that fills the field with 0 before settlement, or a malformed answer) is charged 0. The row is then written as state 'estimated', spend 0, cap_charge 0, and stops counting toward the daily or per-job cap even though the gateway says spend is still pending. Repeated calls like this are all charged 0, so the cap is under-counted. Fix: use classified.settled as the charge only when classified.state === 'settled' (and the value is valid as in the finding above). Otherwise use unresolvedCharge.","line":238,"path":"imd-flop/src/run.ts","reproduction":"Offline, vitest. readySeat, `cap set 1`. Run `run --job j --prompt 'Say hi' --max-tokens 8 --json` with a mock-named provider whose readReceipt returns {state:'estimated', settled_spend:0, reserved_spend:}. Expected: the last ledger row has cap_charge == quote_padded (0.18). Actual: state 'estimated', spend 0, cap_charge 0, so `cap show` / `status` count 0 for a call the receipt reports as still pending.","severity":"medium","snippet":" const capCharge = classified.settled ?? unresolvedCharge;","title":"A numeric settled_spend on an unresolved receipt (state reserved/estimated) replaces the padded reservation, so pending spend can be charged as 0"},{"citation":"resolved","description":"FlopProvider.complete runs assertPaidNetwork, which makes three reads with their own 15 s timeouts each (up to about 45 s), and then mintChildKey (its own 15 s timeout). None of these receive req.signal. If --timeout-ms passes while the recheck is still running, the recheck goes on, the parent bearer mints a child key after the deadline, and only then does createChatCompletion see the aborted signal and reject. runJob treats that as a timeout ('spend UNKNOWN') and keeps cap_charge = padded quote, but no inference was ever sent. Impact: a child-key mint happens even though the run's time check has already failed, the ledger and the user message claim possible paid work that cannot have happened, and the daily cap is charged for it. Fix: check req.signal.aborted, or pass req.signal into the recheck and the mint, and throw PreSendError before minting if it is aborted, so the row becomes refused_local with cap_charge 0.","line":140,"path":"imd-flop/src/providers.ts","reproduction":"Offline, vitest, real FlopProvider through cli(). Scripted fetch: eth_chainId 0x1, ownerOf = the wallet that signed the link, faucet /chain returns the pinned genesis but waits 400 ms on its 2nd call (the pre-mint recheck), the fake WebSocket returns the pinned genesis, /keys/ephemeral returns 201 {token:'flop_ek_AAAA…'}. Run `run --job job-abc --prompt 'Say hi' --max-tokens 8 --provider flop --live --timeout-ms 100`. Expected: no mint after the 100 ms deadline, and the row is refused_local with cap 0. Actual: the mint is sent at about 415 ms, the chat request starts with signal.aborted=true and is rejected, exit 6 'Spend is UNKNOWN', ledger rows sent:0.132 then timeout_unknown:0.132.","severity":"medium","snippet":" await assertPaidNetwork(this.net, this.ethRpc, this.f);","title":"The pre-mint recheck and the child-key mint ignore the run's timeout signal, so a key is minted after the deadline and the attempt is recorded as timeout_unknown with the full cap charge"},{"citation":"resolved","description":"PR #1 writes the pre-mint refusal as refused_local with cap_charge 0. It strips only `0x`-prefixed 64-hex values from err.message before appendLedger. The message also contains RPC-controlled text (`eth_chainId error: ${j.error.message}`, `rpc error: ...`, `faucet unavailable: ...`). A bare 64-hex run in that text (for example a block hash without 0x), or a 'Bearer xxxxxxxx' string, makes assertNoSecrets throw inside the catch block. The refused_local line is never written. The latest row is the pre-call 'sent' row with cap_charge = padded quote. The user gets 'secret scan blocked writing ledger.jsonl' (exit 5) instead of the refusal, and `status` lists the attempt as a pending paid call that uses up the daily cap, although nothing was minted or sent. The code's own comment says this case is supposed to be handled. Fix: do not put free-form upstream error text into the ledger reason (use a fixed reason code), or scrub the reason with the same patterns assertNoSecrets checks for. Fall back to a fixed reason if the append still fails.","line":204,"path":"imd-flop/src/run.ts","reproduction":"Offline, vitest, real FlopProvider. The first gate and the owner check pass (eth_chainId 0x1 on calls 1–2, faucet/WS give the pin). On the 3rd eth_chainId (the recheck inside complete) the RPC returns {error:{message:'header not found for block ' + 'ab'.repeat(32)}}. Expected: no mint (true) and a latest row refused_local with cap_charge 0. Actual: exit 5 'secret scan blocked writing ledger.jsonl: reason: 64-hex (key-shaped) value', the only ledger row is sent:0.132, `status --json` shows today_utc.flop 0.132 and one pending_receipts entry with ledger_state 'sent'.","severity":"low","snippet":" const reason = timedOut ? `${err.name}: no answer; spend unknown, not retried` : preSend ? `nothing sent: ${err.message.replace(/0x[0-9a-fA-F]{64}/g, \"[hash]\")}` : `HTTP ${http}`;","title":"A pre-mint refusal whose RPC error text contains a bare 64-hex run is blocked by the secret scan, so the 'sent' row stays as a pending paid attempt charged to the cap"},{"citation":"resolved","description":"PR #3's withhold path assumes the scan failed because of `text`. It retries with text:null but keeps usage and the other fields. If the hit was in res.usage (gateway-controlled, for example a 64-hex cache/request hash field), the second writeJsonSafe throws as well. runJob then exits before readReceipt, the receipt file, and the final ledger line. The paid call did happen, but the CLI returns EXIT.REFUSED_RULE (5), which scripts read as 'refused, nothing sent'. No response file exists and the ledger stays at 'sent' with only the padded reservation, and the reported cost_flop is never recorded even when it is higher. Fix: on a scan failure, write a minimal record (request_id, output_sha256, withheld) without the untrusted usage. Always go on to the receipt read and final ledger row, and return a non-refusal exit code for a call that was sent.","line":225,"path":"imd-flop/src/run.ts","reproduction":"Offline, vitest. A mock-named provider returns normal text but usage {…, cache_key: 'cd'.repeat(32)}, with an unresolved receipt. Run `run --job j --prompt 'Say hi' --max-tokens 8 --json`. Expected: exit 0, text withheld or null, receipt and final ledger row written. Actual: exit 5 'secret scan blocked writing response: usage.cache_key: 64-hex (key-shaped) value', provider.calls = 1, ledger states ['sent'], no responses/ or receipts/ directory.","severity":"low","snippet":" writeJsonSafe(responseFile, { ...responseRecord, text: null, withheld }, \"response\");","title":"A secret-scan hit outside `text` makes the fallback response write throw after a completed paid call: no final ledger row, no receipt, and exit 5 (the local-refusal code)"}],"hash":"6b2d42c1f56696e76461272e213704d9492cee8d1dc6402cccbe74a7965cd378","nodeId":"eb237916-9c13-4679-ba2e-abfaaf6c7d84","outcome":"completed","summary":"I found five reproducible defects in the three PRs and wrote them to `.imd-findings.json`. Each one was confirmed by a vitest repro that fails on 8b5a068.\n\nThe repros ran offline in a throwaway copy (`git archive` of HEAD into `/tmp/aud`, `npm ci` there) with scripted fetch and WebSocket, so there were no live FLOP or IMD calls and no keys. The repository itself is unchanged apart from the findings file. None of the findings has a `proof` field: the code is TypeScript, and the Foundry-proof requirement only covers Solidity.\n\n| Severity | Where | What fails |\n|---|---|---|\n| High | `imd-flop/src/run.ts:238` | A **negative `settled_spend`** in a receipt is written as a negative `cap_charge`, and the daily total adds it in. Repro: one receipt with `settled_spend: -5` puts today's total at -5. After that, 33 unresolved calls go through against a 1 FLOP/day cap (5.94 FLOP reserved) instead of about 5. Requester job budgets are affected the same way. |\n| Medium | `imd-flop/src/run.ts:238` | A receipt that says spend is still pending (state `estimated` or `reserved`) but carries **`settled_spend: 0`** gets `cap_charge` 0 instead of the padded quote (0.18 in the repro). This breaks PR #4's rule that unresolved spend keeps the padded quote. |\n| Medium | `imd-flop/src/providers.ts:140` | The **pre-mint recheck and the child-key mint ignore the run's timeout**. With `--timeout-ms 100` and a faucet that takes 400 ms to answer the recheck, the key is minted at about 415 ms, after the deadline. The chat request is then cancelled, so no inference is sent. The run still exits 6 (\"Spend is UNKNOWN\") and charges 0.132 to the cap. |\n| Low | `imd-flop/src/run.ts:204` | The **refusal row can be blocked by the secret scan**. The code strips only `0x`-prefixed hashes from the error text it writes to the ledger. If the recheck's RPC error contains a hash without `0x`, the secret scan blocks that row. The only ledger row left is `sent`, so a call that was never minted or sent counts 0.132 against today's cap and shows as pending. |\n| Low | `imd-flop/src/run.ts:225` | When the scan hit is in `usage` rather than `text`, the **fallback response write also throws**. This happens after the paid call: no receipt, no final ledger row, no response file, and the run exits 5, the code that means \"refused locally\". |\n\n**Checked and fine:**\n- **Run gates:** the gate before the quote, the recheck before the mint, and the chain-id and genesis parsers fail closed on HTTP errors, malformed JSON, short hashes, RPC errors and timeouts.\n- **Failed and timed-out calls:** HTTP errors and timeouts keep the padded charge.\n- **Reported cost:** usage cost can raise the charge but never lower it.\n- **Withheld text:** it does not reach stdout on the `run --json` path.\n- **Keys:** no API key or child key reaches stdout or stderr through the error messages.\n\n**Not reported:**\n- **Concurrent runs:** two runs started at the same time can both pass the cap check, because nothing locks the ledger between the check and the `sent` write. That behaviour is older than these PRs.\n- **Tiny estimates:** an estimate small enough to round to 0 gives a 0 reservation. `padQuote` is outside this diff.\n\n**Coverage:** I did the Access Control, Trust Gap and Asymmetry passes myself, without helpers. They covered everything under `imd-flop/src` that the three PRs change, plus the code it calls (`receipts.ts`, `secrets.ts`, `store.ts`, `match.ts`), and the PRs' tests. I did not run the project's full test suite, and nothing outside `imd-flop` was reviewed.","treeHash":null,"usage":{"cachedInputTokens":1137188,"cost":{"source":"runtime","usdMicros":1563565},"inputTokens":30,"model":"claude-opus-5-5","outputTokens":25288,"runtime":"claude","turns":18,"wallClockMs":280393}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"672c29f92850efe0","findings":[{"citation":"resolved","description":"classified.settled is copied straight from the gateway receipt's settled_spend whenever it is a JSON number (receipts.ts:57) and becomes cap_charge with no sign or range check. spentToday()/jobSpent() (ledger.ts:54-68) sum cap_charge, so one receipt with a negative settled_spend pushes the day's total below zero and every later run sees a larger remaining daily cap than the configured one. The daily cap is the local defence against a misbehaving gateway; a malformed answer from that same gateway should never widen it. Impact: with cap 1 FLOP/day, a single receipt reporting settled_spend -100 lets the holder's seat make about 100 FLOP of further calls that day (each still bounded by the per-call cap), and the ledger carries a row whose spend and cap_charge are -100. Fix: treat a settled_spend that is not a finite number >= 0 (and arguably > reserved_spend by a margin) as unresolved: keep unresolvedCharge and record the raw value in cost_reported/receipt only.","line":238,"path":"imd-flop/src/run.ts","proof":"/** Proof for: a negative settled_spend lowers cap_charge and today's spend. Fails on the current code. */\nimport { describe, expect, it } from \"vitest\";\nimport { mkdtempSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { main, type IO } from \"../../src/cli.js\";\nimport { MockProvider, type CompleteReq, type CompleteRes, type Provider } from \"../../src/providers.js\";\n\nconst SEAT = \"42\";\nconst tmpHome = () => mkdtempSync(join(tmpdir(), \"imd-flop-proof-\"));\nasync function cli(home: string, args: string[], extra: Partial = {}) {\n const out: string[] = [];\n const err: string[] = [];\n const code = await main(args, { out: (s) => out.push(s), err: (s) => err.push(s), env: { IMD_FLOP_HOME: home }, ...extra });\n return { code, out: out.join(\"\\n\"), err: err.join(\"\\n\"), json: () => JSON.parse(out.join(\"\\n\")) };\n}\nconst readLines = (p: string) => readFileSync(p, \"utf8\").split(\"\\n\").filter(Boolean).map((l) => JSON.parse(l));\nasync function readySeat(home: string, cap = \"1\") {\n await cli(home, [\"init\", \"--seat\", SEAT]);\n await cli(home, [\"link\", \"--token\", SEAT, \"--agent\", \"7\"]);\n await cli(home, [\"cap\", \"set\", cap]);\n}\nconst rpc = (obj: unknown, status = 200) => new Response(JSON.stringify(obj), { status, headers: { \"content-type\": \"application/json\" } });\n/** Completion is the plain mock; the receipt is scripted. */\nclass ReceiptProvider implements Provider {\n readonly name = \"mock\" as const;\n calls = 0;\n private inner = new MockProvider(\"ok\");\n constructor(private settled: number | null, private state: \"reserved\" | \"estimated\" | \"settled\" | \"released\") {}\n estimate(b: { model: string; prompt: string; max_tokens: number }) { return this.inner.estimate(b); }\n async complete(req: CompleteReq): Promise { this.calls++; return this.inner.complete(req); }\n async readReceipt(requestId: string) {\n const rr = await this.inner.readReceipt(requestId);\n return { ...rr, receipt: { ...rr.receipt!, settled_spend: this.settled, state: this.state } };\n }\n}\nconst RUN = (job: string) => [\"run\", \"--seat\", SEAT, \"--job\", job, \"--prompt\", \"Say hi\", \"--max-tokens\", \"8\", \"--provider\", \"mock\", \"--json\"];\ndescribe(\"cap_charge never goes below zero\", () => {\n it(\"a receipt with settled_spend -100 must not lower the daily total or be accepted as a charge\", async () => {\n const h = tmpHome();\n await readySeat(h, \"1\");\n const a = await cli(h, RUN(\"neg\"), { provider: new ReceiptProvider(-100, \"settled\") });\n expect(a.code).toBe(0);\n // Expected: a negative settlement is malformed; the charge stays at the padded quote (0.18), never below 0.\n expect(a.json().cap_charge).toBeGreaterThanOrEqual(0);\n const st = await cli(h, [\"status\", \"--seat\", SEAT, \"--json\"]);\n expect(st.json().today_utc.mock).toBeGreaterThanOrEqual(0);\n const b = await cli(h, RUN(\"after-neg\"), { provider: new ReceiptProvider(null, \"estimated\") });\n const rows = readLines(join(h, \"ledger.jsonl\")) as { job: string; spent_before: number | null }[];\n expect(rows.find((r) => r.job === \"after-neg\")!.spent_before).toBeGreaterThanOrEqual(0);\n expect(b.code).toBe(0);\n });\n});","reproduction":"State: seat 42 initialised, linked, `cap set 1`. Input: a run whose receipt read returns {state:'settled', settled_spend:-100} (scripted provider in the proof file; the completion itself is the normal mock). Expected: cap_charge >= 0 (0.18, the padded quote, since the settlement is malformed) and status today_utc.mock >= 0. Actual: run --json prints cap_charge -100, the ledger's latest row has spend -100 / cap_charge -100, `status --json` shows today_utc.mock = -100, and a second run records spent_before = -100 and passes the daily check. Run: cd imd-flop && npx vitest run test/scratch/r1-negative-settled.test.ts","severity":"medium","snippet":" const capCharge = classified.settled ?? unresolvedCharge;","title":"PR #4: a negative settled_spend becomes a negative cap_charge and lowers today's spend, defeating the daily cap"},{"citation":"resolved","description":"The charge decision looks only at whether settled_spend is a number; it never consults the receipt's own state field ('reserved' | 'estimated' | 'settled' | 'released'). The same statement then writes that non-terminal state into the ledger row (run.ts:239, state: classified.state), so the row says the spend is not settled yet while cap_charge says it is 0. PR #4's own rule is 'while spend is unresolved the ledger keeps the padded quote as cap_charge'; a gateway that fills settled_spend with 0 before settlement (a common API shape, and exactly the 'null must never become 0' case the receipt rules warn about, only produced by the server instead of the client) under-counts the cap by the whole padded quote per call. Repeated calls against such a gateway are each charged 0 and the daily cap never fills. Fix: accept settled_spend as the charge only when state is 'settled' or 'released'; otherwise use unresolvedCharge.","line":238,"path":"imd-flop/src/run.ts","proof":"/** Proof for: settled_spend 0 on a receipt still in state \"estimated\" is charged as 0. Fails on the current code. */\nimport { describe, expect, it } from \"vitest\";\nimport { mkdtempSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { main, type IO } from \"../../src/cli.js\";\nimport { MockProvider, type CompleteReq, type CompleteRes, type Provider } from \"../../src/providers.js\";\n\nconst SEAT = \"42\";\nconst tmpHome = () => mkdtempSync(join(tmpdir(), \"imd-flop-proof-\"));\nasync function cli(home: string, args: string[], extra: Partial = {}) {\n const out: string[] = [];\n const err: string[] = [];\n const code = await main(args, { out: (s) => out.push(s), err: (s) => err.push(s), env: { IMD_FLOP_HOME: home }, ...extra });\n return { code, out: out.join(\"\\n\"), err: err.join(\"\\n\"), json: () => JSON.parse(out.join(\"\\n\")) };\n}\nconst readLines = (p: string) => readFileSync(p, \"utf8\").split(\"\\n\").filter(Boolean).map((l) => JSON.parse(l));\nasync function readySeat(home: string, cap = \"1\") {\n await cli(home, [\"init\", \"--seat\", SEAT]);\n await cli(home, [\"link\", \"--token\", SEAT, \"--agent\", \"7\"]);\n await cli(home, [\"cap\", \"set\", cap]);\n}\nconst rpc = (obj: unknown, status = 200) => new Response(JSON.stringify(obj), { status, headers: { \"content-type\": \"application/json\" } });\n/** Completion is the plain mock; the receipt is scripted. */\nclass ReceiptProvider implements Provider {\n readonly name = \"mock\" as const;\n calls = 0;\n private inner = new MockProvider(\"ok\");\n constructor(private settled: number | null, private state: \"reserved\" | \"estimated\" | \"settled\" | \"released\") {}\n estimate(b: { model: string; prompt: string; max_tokens: number }) { return this.inner.estimate(b); }\n async complete(req: CompleteReq): Promise { this.calls++; return this.inner.complete(req); }\n async readReceipt(requestId: string) {\n const rr = await this.inner.readReceipt(requestId);\n return { ...rr, receipt: { ...rr.receipt!, settled_spend: this.settled, state: this.state } };\n }\n}\nconst RUN = (job: string) => [\"run\", \"--seat\", SEAT, \"--job\", job, \"--prompt\", \"Say hi\", \"--max-tokens\", \"8\", \"--provider\", \"mock\", \"--json\"];\ndescribe(\"an unresolved receipt keeps the reservation\", () => {\n it(\"settled_spend 0 with state estimated must keep cap_charge at the padded quote\", async () => {\n const h = tmpHome();\n await readySeat(h, \"1\");\n const r = await cli(h, RUN(\"zero-pending\"), { provider: new ReceiptProvider(0, \"estimated\") });\n expect(r.code).toBe(0);\n const rows = readLines(join(h, \"ledger.jsonl\")) as { state: string; cap_charge: number; quote_padded: number }[];\n const latest = rows.at(-1)!;\n expect(latest.state).toBe(\"estimated\"); // the receipt itself says spend is not settled\n // Expected: while the receipt state is not settled/released, the reservation (0.18) stays.\n expect(latest.cap_charge).toBe(latest.quote_padded);\n const st = await cli(h, [\"status\", \"--seat\", SEAT, \"--json\"]);\n expect(st.json().today_utc.mock).toBe(latest.quote_padded);\n });\n});","reproduction":"State: seat 42 initialised, linked, `cap set 1`. Input: a run whose receipt read returns {state:'estimated', reserved_spend:0.18, settled_spend:0}. Expected: latest ledger row state 'estimated' with cap_charge 0.18 (= quote_padded) and status today_utc.mock 0.18. Actual: latest row state 'estimated', spend 0, cap_charge 0; status today_utc.mock = 0; the next run has the full daily cap available. Run: cd imd-flop && npx vitest run test/scratch/r2-settled-zero-pending.test.ts","severity":"medium","snippet":" const capCharge = classified.settled ?? unresolvedCharge;","title":"PR #4: settled_spend 0 on a receipt whose state is still 'estimated' is charged as 0, dropping the reservation while spend is unresolved"},{"citation":"resolved","description":"runJob starts the --timeout-ms timer (run.ts:191-192) before provider.complete(). Inside complete(), assertPaidNetwork() runs eth_chainId, the faucet read and the devnet WebSocket read with their own 15 s timeouts and never looks at req.signal; mintChildKey() likewise uses a fixed AbortSignal.timeout(15000). If the run deadline fires during that recheck, the recheck still completes, POST /keys/ephemeral is still sent (a live single-use child key scoped to the padded quote is created and then never used), and only createChatCompletion observes the already-aborted signal and throws the TimeoutError before any request. In runJob's catch that error is neither FlopHTTPError nor PreSendError, so the row becomes timeout_unknown with cap_charge = padded quote and the user is told 'Spend is UNKNOWN', while status lists a pending receipt forever. Nothing paid happened, so the ledger is wrong in the over-counting direction, and a credential was minted after the caller's deadline. Fix: pass req.signal into assertPaidNetwork/mintChildKey (or check req.signal.aborted and throw a PreSendError before the mint), so a deadline before the mint is recorded as refused_local with charge 0.","line":140,"path":"imd-flop/src/providers.ts","proof":"/** Proof for: the run deadline does not cover the pre-mint recheck; a child key is minted after it. Fails on the current code. */\nimport { describe, expect, it } from \"vitest\";\nimport { mkdtempSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { main, type IO } from \"../../src/cli.js\";\nimport { MockProvider, type CompleteReq, type CompleteRes, type Provider } from \"../../src/providers.js\";\n\nconst SEAT = \"42\";\nconst tmpHome = () => mkdtempSync(join(tmpdir(), \"imd-flop-proof-\"));\nasync function cli(home: string, args: string[], extra: Partial = {}) {\n const out: string[] = [];\n const err: string[] = [];\n const code = await main(args, { out: (s) => out.push(s), err: (s) => err.push(s), env: { IMD_FLOP_HOME: home }, ...extra });\n return { code, out: out.join(\"\\n\"), err: err.join(\"\\n\"), json: () => JSON.parse(out.join(\"\\n\")) };\n}\nconst readLines = (p: string) => readFileSync(p, \"utf8\").split(\"\\n\").filter(Boolean).map((l) => JSON.parse(l));\nasync function readySeat(home: string, cap = \"1\") {\n await cli(home, [\"init\", \"--seat\", SEAT]);\n await cli(home, [\"link\", \"--token\", SEAT, \"--agent\", \"7\"]);\n await cli(home, [\"cap\", \"set\", cap]);\n}\nconst rpc = (obj: unknown, status = 200) => new Response(JSON.stringify(obj), { status, headers: { \"content-type\": \"application/json\" } });\nimport { generatePrivateKey, privateKeyToAccount } from \"viem/accounts\";\nimport { NETWORKS } from \"../../src/networks.js\";\nimport { gatewayKeyFile } from \"../../src/paths.js\";\nimport { writeSecretFile } from \"../../src/store.js\";\nimport { clearSecretRegistry } from \"../../src/secrets.js\";\nimport type { LinkFile } from \"../../src/link.js\";\n\nconst PIN = NETWORKS.devnet.genesisHash;\nconst ETH = \"https://eth.example/rpc\";\nasync function signHolder(h: string): Promise {\n const file = join(h, \"seats\", SEAT, \"link.json\");\n const link = JSON.parse(readFileSync(file, \"utf8\")) as LinkFile;\n const wallet = privateKeyToAccount(generatePrivateKey());\n const td = link.eip712;\n const sig = await wallet.signTypedData({ domain: td.domain, types: td.types, primaryType: td.primaryType, message: { ...td.message, tokenId: BigInt(td.message.tokenId), issuedAt: BigInt(td.message.issuedAt) } });\n writeFileSync(file, JSON.stringify({ ...link, wallet: { address: wallet.address, signature: sig } }));\n return wallet.address;\n}\ntype Seen = { url: string; method?: string };\n/** Offline stand-in for every HTTP endpoint the paid run touches. Paid inference is never answered. */\nfunction paidFetch(owner: string, seen: Seen[], opts: { faucetDelayMs?: number }): typeof fetch {\n return (async (input: unknown, init?: RequestInit) => {\n if (init?.signal?.aborted) throw init.signal.reason; // fetch spec: already-aborted signal sends nothing\n const url = String(input);\n let method: string | undefined;\n if (init?.body) { try { method = (JSON.parse(String(init.body)) as { method?: string }).method; } catch { /* not json */ } }\n seen.push({ url, method });\n if (method === \"eth_chainId\") return rpc({ jsonrpc: \"2.0\", id: 1, result: \"0x1\" });\n if (method === \"eth_call\") return rpc({ jsonrpc: \"2.0\", id: 1, result: \"0x\" + \"0\".repeat(24) + owner.slice(2).toLowerCase() });\n if (url.endsWith(\"/chain\")) { if (opts.faucetDelayMs) await new Promise((r) => setTimeout(r, opts.faucetDelayMs)); return rpc({ genesisHash: PIN }); }\n if (url.endsWith(\"/models/estimate\")) return rpc({ estimated_cost_flop: 0.012, estimated_input_tokens: 1, estimated_output_tokens: 1 });\n if (url.endsWith(\"/keys/ephemeral\")) return rpc({ token: \"flop_ek_\" + \"a\".repeat(40), expires_at: 0 }, 201);\n if (url.includes(\"/chat/completions\")) throw new Error(`paid inference ${url}`);\n throw new Error(`unexpected url ${url}`);\n }) as typeof fetch;\n}\n/** Fake devnet WebSocket RPC; `answer` is called with the socket index (0 = the up-front gate, 1 = the pre-mint recheck). */\nfunction withWs(answer: (socketIndex: number) => string, fn: () => Promise): Promise {\n const real = globalThis.WebSocket;\n let n = 0;\n class FakeWS {\n onopen?: () => void;\n onmessage?: (ev: { data: string }) => void;\n private idx = n++;\n constructor() { setTimeout(() => this.onopen?.(), 0); }\n send() { setTimeout(() => this.onmessage?.({ data: answer(this.idx) }), 0); }\n close() {}\n }\n (globalThis as { WebSocket: unknown }).WebSocket = FakeWS;\n return fn().finally(() => { globalThis.WebSocket = real; });\n}\nconst PAID = (extra: string[] = []) => [\"run\", \"--job\", \"job-abc\", \"--prompt\", \"Say hi\", \"--max-tokens\", \"8\", \"--provider\", \"flop\", \"--live\", ...extra];\ndescribe(\"the run deadline covers the pre-mint recheck\", () => {\n it(\"when --timeout-ms expires during the recheck, no child key is minted and the ledger does not claim unknown spend\", async () => {\n const h = tmpHome();\n await readySeat(h);\n const owner = await signHolder(h);\n writeSecretFile(gatewayKeyFile(h, SEAT), \"test-gateway-bearer\\n\");\n const seen: Seen[] = [];\n try {\n const r = await withWs(() => JSON.stringify({ result: PIN }), () =>\n cli(h, PAID([\"--timeout-ms\", \"20\"]), { fetch: paidFetch(owner, seen, { faucetDelayMs: 40 }), env: { IMD_FLOP_HOME: h, ETH_RPC_URL: ETH } }),\n );\n expect(seen.some((s) => s.url.includes(\"/chat/completions\"))).toBe(false); // nothing was sent (holds today)\n // Expected: a deadline that passed before the mint means no mint and no \"spend unknown\" row.\n expect(seen.some((s) => s.url.endsWith(\"/keys/ephemeral\"))).toBe(false);\n const rows = readLines(join(h, \"ledger.jsonl\")) as { state: string; cap_charge: number }[];\n expect(rows.at(-1)!.state).not.toBe(\"timeout_unknown\");\n expect(r.code).not.toBe(6);\n } finally {\n clearSecretRegistry();\n }\n });\n});","reproduction":"State: seat 42 initialised, wallet-signed link, `cap set 1`, gateway.key present, ETH_RPC_URL set; offline stubs answer eth_chainId 0x1, ownerOf = signer, faucet /chain = pin after a 40 ms delay, devnet RPC block 0 = pin, /keys/ephemeral 201. Input: run --provider flop --live --timeout-ms 20. Expected: no POST /keys/ephemeral after the deadline, no timeout_unknown row, exit code != 6. Actual: /keys/ephemeral is called (the child key is minted), /chat/completions is never called, exit code 6 'Spend is UNKNOWN', latest ledger row timeout_unknown with cap_charge 0.132 (the padded 0.012 quote), status pending_receipts has one entry. Run: cd imd-flop && npx vitest run test/scratch/r3-mint-after-deadline.test.ts","severity":"low","snippet":" await assertPaidNetwork(this.net, this.ethRpc, this.f);","title":"PR #1: the pre-mint recheck ignores the run's AbortSignal, so a child key is minted after --timeout-ms expired and the ledger records the attempt as spend-unknown although nothing was sent"},{"citation":"resolved","description":"For a PreSendError the reason is built from err.message, which for the pre-mint recheck embeds server-supplied text: `rpc error: ${msg.error.message}` from the devnet WebSocket (gateway.ts:169), `eth_chainId error: ${j.error.message}` from the Ethereum RPC (gateway.ts:215) and fetch error text. Only 0x-prefixed 64-hex is stripped; a bare 64-hex run (a Substrate node echoing a block hash without 0x), a 'Bearer ...' token or a flop_... token shape in that message trips assertNoSecrets inside appendLedger (store.ts:19), which throws a CliError from inside the catch block. The refused_local line is never written, the earlier sent line (cap_charge = padded quote) remains the latest row, status counts it toward today's FLOP spend and lists it as pending indefinitely, and stderr reports 'secret scan blocked writing ledger.jsonl' instead of the genesis refusal. The mint itself is correctly refused. Fix: do not put remote text into the ledger reason (use a fixed reason such as 'pre-mint network check failed' and keep details on stderr), or sanitise with the same rules the scanner applies before appending.","line":204,"path":"imd-flop/src/run.ts","proof":"/** Proof for: remote RPC error text can make the refused_local ledger line unwritable. Fails on the current code. */\nimport { describe, expect, it } from \"vitest\";\nimport { mkdtempSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { main, type IO } from \"../../src/cli.js\";\nimport { MockProvider, type CompleteReq, type CompleteRes, type Provider } from \"../../src/providers.js\";\n\nconst SEAT = \"42\";\nconst tmpHome = () => mkdtempSync(join(tmpdir(), \"imd-flop-proof-\"));\nasync function cli(home: string, args: string[], extra: Partial = {}) {\n const out: string[] = [];\n const err: string[] = [];\n const code = await main(args, { out: (s) => out.push(s), err: (s) => err.push(s), env: { IMD_FLOP_HOME: home }, ...extra });\n return { code, out: out.join(\"\\n\"), err: err.join(\"\\n\"), json: () => JSON.parse(out.join(\"\\n\")) };\n}\nconst readLines = (p: string) => readFileSync(p, \"utf8\").split(\"\\n\").filter(Boolean).map((l) => JSON.parse(l));\nasync function readySeat(home: string, cap = \"1\") {\n await cli(home, [\"init\", \"--seat\", SEAT]);\n await cli(home, [\"link\", \"--token\", SEAT, \"--agent\", \"7\"]);\n await cli(home, [\"cap\", \"set\", cap]);\n}\nconst rpc = (obj: unknown, status = 200) => new Response(JSON.stringify(obj), { status, headers: { \"content-type\": \"application/json\" } });\nimport { generatePrivateKey, privateKeyToAccount } from \"viem/accounts\";\nimport { NETWORKS } from \"../../src/networks.js\";\nimport { gatewayKeyFile } from \"../../src/paths.js\";\nimport { writeSecretFile } from \"../../src/store.js\";\nimport { clearSecretRegistry } from \"../../src/secrets.js\";\nimport type { LinkFile } from \"../../src/link.js\";\n\nconst PIN = NETWORKS.devnet.genesisHash;\nconst ETH = \"https://eth.example/rpc\";\nasync function signHolder(h: string): Promise {\n const file = join(h, \"seats\", SEAT, \"link.json\");\n const link = JSON.parse(readFileSync(file, \"utf8\")) as LinkFile;\n const wallet = privateKeyToAccount(generatePrivateKey());\n const td = link.eip712;\n const sig = await wallet.signTypedData({ domain: td.domain, types: td.types, primaryType: td.primaryType, message: { ...td.message, tokenId: BigInt(td.message.tokenId), issuedAt: BigInt(td.message.issuedAt) } });\n writeFileSync(file, JSON.stringify({ ...link, wallet: { address: wallet.address, signature: sig } }));\n return wallet.address;\n}\ntype Seen = { url: string; method?: string };\n/** Offline stand-in for every HTTP endpoint the paid run touches. Paid inference is never answered. */\nfunction paidFetch(owner: string, seen: Seen[], opts: { faucetDelayMs?: number }): typeof fetch {\n return (async (input: unknown, init?: RequestInit) => {\n if (init?.signal?.aborted) throw init.signal.reason; // fetch spec: already-aborted signal sends nothing\n const url = String(input);\n let method: string | undefined;\n if (init?.body) { try { method = (JSON.parse(String(init.body)) as { method?: string }).method; } catch { /* not json */ } }\n seen.push({ url, method });\n if (method === \"eth_chainId\") return rpc({ jsonrpc: \"2.0\", id: 1, result: \"0x1\" });\n if (method === \"eth_call\") return rpc({ jsonrpc: \"2.0\", id: 1, result: \"0x\" + \"0\".repeat(24) + owner.slice(2).toLowerCase() });\n if (url.endsWith(\"/chain\")) { if (opts.faucetDelayMs) await new Promise((r) => setTimeout(r, opts.faucetDelayMs)); return rpc({ genesisHash: PIN }); }\n if (url.endsWith(\"/models/estimate\")) return rpc({ estimated_cost_flop: 0.012, estimated_input_tokens: 1, estimated_output_tokens: 1 });\n if (url.endsWith(\"/keys/ephemeral\")) return rpc({ token: \"flop_ek_\" + \"a\".repeat(40), expires_at: 0 }, 201);\n if (url.includes(\"/chat/completions\")) throw new Error(`paid inference ${url}`);\n throw new Error(`unexpected url ${url}`);\n }) as typeof fetch;\n}\n/** Fake devnet WebSocket RPC; `answer` is called with the socket index (0 = the up-front gate, 1 = the pre-mint recheck). */\nfunction withWs(answer: (socketIndex: number) => string, fn: () => Promise): Promise {\n const real = globalThis.WebSocket;\n let n = 0;\n class FakeWS {\n onopen?: () => void;\n onmessage?: (ev: { data: string }) => void;\n private idx = n++;\n constructor() { setTimeout(() => this.onopen?.(), 0); }\n send() { setTimeout(() => this.onmessage?.({ data: answer(this.idx) }), 0); }\n close() {}\n }\n (globalThis as { WebSocket: unknown }).WebSocket = FakeWS;\n return fn().finally(() => { globalThis.WebSocket = real; });\n}\nconst PAID = (extra: string[] = []) => [\"run\", \"--job\", \"job-abc\", \"--prompt\", \"Say hi\", \"--max-tokens\", \"8\", \"--provider\", \"flop\", \"--live\", ...extra];\ndescribe(\"a pre-mint refusal always lands in the ledger\", () => {\n it(\"an RPC error whose message carries a bare 64-hex run still yields refused_local with cap charge 0\", async () => {\n const h = tmpHome();\n await readySeat(h);\n const owner = await signHolder(h);\n writeSecretFile(gatewayKeyFile(h, SEAT), \"test-gateway-bearer\\n\");\n const seen: Seen[] = [];\n const hexNo0x = \"deadbeef\".repeat(8);\n try {\n const r = await withWs(\n (i) => (i === 0 ? JSON.stringify({ result: PIN }) : JSON.stringify({ error: { message: `block ${hexNo0x} unknown` } })),\n () => cli(h, PAID(), { fetch: paidFetch(owner, seen, {}), env: { IMD_FLOP_HOME: h, ETH_RPC_URL: ETH } }),\n );\n expect(seen.some((s) => s.url.endsWith(\"/keys/ephemeral\"))).toBe(false); // the mint was refused (holds today)\n // Expected: the latest line is refused_local, charge 0, today's flop spend 0, and the error names the genesis refusal.\n const rows = readLines(join(h, \"ledger.jsonl\")) as { state: string; cap_charge: number }[];\n expect(rows.at(-1)!.state).toBe(\"refused_local\");\n expect(rows.at(-1)!.cap_charge).toBe(0);\n const st = await cli(h, [\"status\", \"--json\"]);\n expect(st.json().today_utc.flop).toBe(0);\n expect(st.json().pending_receipts).toEqual([]);\n expect(r.err).toMatch(/genesis check failed/);\n } finally {\n clearSecretRegistry();\n }\n });\n});","reproduction":"State: as in the previous finding (ready paid seat, offline stubs). Input: the devnet RPC answers block 0 with the pin on the first socket (up-front gate) and on the second socket (pre-mint recheck) returns {error:{message:'block ' + 'deadbeef'x8 + ' unknown'}}. Expected: latest ledger row refused_local with cap_charge 0, status today_utc.flop 0, pending_receipts [], stderr 'genesis check failed ...'. Actual: exit 5 with stderr 'secret scan blocked writing ledger.jsonl: reason: 64-hex (key-shaped) value', latest row still 'sent' with cap_charge 0.132 (the padded quote), today_utc.flop 0.132, one pending receipt. Run: cd imd-flop && npx vitest run test/scratch/r5-refusal-line-lost.test.ts","severity":"low","snippet":" const reason = timedOut ? `${err.name}: no answer; spend unknown, not retried` : preSend ? `nothing sent: ${err.message.replace(/0x[0-9a-fA-F]{64}/g, \"[hash]\")}` : `HTTP ${http}`;","title":"PR #1: remote RPC/faucet error text is written into the ledger reason; text the secret scan rejects makes the refused_local line unwritable, so the pre-call sent charge stays and the refusal reason is"},{"citation":"resolved","description":"errors.ts:8 documents REFUSED_RULE (5) as covering 'a paid-run chain/genesis refusal', and the up-front gate in runJob (run.ts:118) exits 5. The identical refusal raised one step later by FlopProvider.complete() is rethrown with EXIT.ERROR (1), which is also what an HTTP error after a real send returns (run.ts:210, 'spend recorded as unknown'). A worker or script branching on the documented exit codes cannot tell 'nothing sent, charge 0' from 'sent, spend unknown', and the README's statement that the gate 'refuses before any paid call' with the rule exit code is false for the recheck path. test/paid-gate.test.ts:471 pins the current code 1. Fix: throw with EXIT.REFUSED_RULE for preSend errors.","line":209,"path":"imd-flop/src/run.ts","reproduction":"State: ready paid seat with offline stubs. Input: faucet /chain returns the pin on the first read and a different full hash on the second (the pre-mint recheck). Expected: exit code 5 (REFUSED_RULE), as the up-front gate gives for the same mismatch. Actual: exit code 1, as asserted by the project's own test 'a real paid run whose first gate passes still mints nothing when the pre-mint gate fails' (expect(r.code).toBe(1)). Run: cd imd-flop && npx vitest run test/paid-gate.test.ts -t 'pre-mint gate fails' and read the asserted code.","severity":"low","snippet":" if (preSend) throw new CliError(`nothing sent: ${err.message}`, EXIT.ERROR);","title":"PR #1: a pre-mint chain/genesis refusal exits with code 1 (ERROR), the same code as 'gateway refused the call; spend unknown', instead of REFUSED_RULE 5"},{"citation":"resolved","description":"readEthereumChainId wraps the fetch failure message and assertPaidNetwork/runJob print it (run.ts:118 'refused locally, nothing sent: ...', and checkLinkForRun 'owner check failed: ...'). Node's fetch reports an unparsable URL as 'Failed to parse URL from '. Hosted Ethereum RPC URLs usually carry the account key in the path (…/v3/), so a value missing its scheme, a stray quote or whitespace puts the RPC API key on stderr and into any log that captures it. Nothing else in the tool prints ETH_RPC_URL. Fix: catch URL parse failures separately (new URL(rpcUrl) before fetch) and report 'ETH_RPC_URL is not a valid URL' without echoing the value.","line":205,"path":"imd-flop/src/gateway.ts","reproduction":"State: seat 42 initialised, linked, `cap set 1`, seats/42/gateway.key present (mode 600). Input: ETH_RPC_URL='mainnet.example/v3/SECRETKEY123' node dist/bin.js run --job j1 --prompt hi --provider flop --live (fully offline: the URL fails to parse before any connection). Expected: a refusal that does not repeat the configured URL. Actual stderr: 'imd-flop: refused locally, nothing sent: eth_chainId unavailable: Failed to parse URL from mainnet.example/v3/SECRETKEY123'. Verified on Node v22.23.2 against the built CLI.","severity":"low","snippet":" throw new Error(`eth_chainId unavailable: ${(e as Error).message}`);","title":"PR #1: a malformed ETH_RPC_URL is echoed verbatim to stderr by the paid gate, including any provider API key embedded in the URL path"}],"hash":"bf10a1a3b1e500acfc9e295cdb38b1b8e0c76460ac8d74d15a7a4a8416995d40","nodeId":"ab453ee2-e68c-4d2f-b69b-834af502d8e2","outcome":"completed","summary":"The review is complete and the findings file is in place at the repository root.\n\n**Scope covered.** All three PRs in `imd-flop` from df10e3d to 8b5a068: the paid-run gate and pre-mint recheck, the `run --json` text handling, and the cap_charge rule. I traced every entry path of `runJob`, `FlopProvider.complete`, `checkGenesis`, `readEthereumChainId`, the ledger aggregation and the secret scan, and read the client library's abort handling. I installed the project's dependencies locally and ran the existing suite as a baseline (71 tests pass), then reproduced each finding offline with faked fetch and WebSocket. No live FLOP, IMD or Ethereum call was made.\n\n**Findings written to .imd-findings.json (6, four with runnable proofs):**\n\n- **Medium, run.ts:238.** A receipt with a negative `settled_spend` becomes a negative cap_charge. Today's total goes below zero and later runs see a widened daily cap. Reproduced: settled -100 gives status today -100 and the next run records spent_before -100.\n- **Medium, run.ts:238.** `settled_spend: 0` on a receipt whose state is still `estimated` is charged as 0, so the reservation is dropped while spend is unresolved. The state field is never consulted.\n- **Low, providers.ts:140.** The pre-mint recheck ignores the run's abort signal. With a short `--timeout-ms` the child key is still minted after the deadline, nothing is sent, yet the ledger says `timeout_unknown` with spend unknown.\n- **Low, run.ts:204.** Remote RPC error text goes into the ledger reason. A bare 64-hex run or a bearer-shaped string in it makes the `refused_local` line unwritable, so the `sent` charge stays, status shows a pending attempt, and the real refusal reason is lost.\n- **Low, run.ts:209.** The pre-mint refusal exits 1, the same code as a post-send HTTP error, instead of the documented 5.\n- **Low, gateway.ts:205.** A scheme-less `ETH_RPC_URL` is echoed verbatim to stderr by the gate, including any provider key in its path. Verified against the built CLI.\n\n**What held up.** The chain-id and genesis parsers fail closed on every malformed shape I tried, the mock provider never touches the network, withheld completion text does not reach stdout or the ledger, and reported usage never lowers the reservation. One lead stayed unverified and is not in the file: two separate `run` processes could both read the ledger before either appends its `sent` row, since there is no file lock. In-process the read and append are synchronous, so I could not reproduce it.\n\n**Running the proofs.** Each proof is a vitest file that imports from `../../src/`. Place it under `imd-flop/test/scratch/` and run `npx vitest run test/scratch/` from `imd-flop`. Each fails on this commit for the stated reason. My scratch files and the build output were removed; only the dependency install remains, which is gitignored.","treeHash":null,"usage":{"cachedInputTokens":1780323,"cost":{"source":"runtime","usdMicros":6419476},"inputTokens":418,"model":"claude-fable-5-1","outputTokens":50999,"runtime":"claude","turns":37,"wallClockMs":787833}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"be85220723d9ce9d","findings":[{"citation":"resolved","description":"Merged from audit_economics, audit_math, audit_permissions and audit_flow. classifyReceipt (src/receipts.ts:57) accepts any typeof-number settled_spend. run.ts:238 then makes it the charge with no check that it is finite or >= 0. spentToday/jobSpent (src/ledger.ts:54-68) sum cap_charge across the latest rows with no lower bound. So one malformed or hostile gateway receipt with settled_spend < 0 subtracts from the day's total (or the requester job total), and run.ts:178-183 then admits calls well past the configured cap. That ledger row also stores spend = cap_charge = a negative number, which is not a real charge. The daily cap is the local defence against a misbehaving gateway, so the gateway's own answer must not be able to widen it. Fix: count settled as resolved only when Number.isFinite(s) && s >= 0; otherwise use unresolvedCharge with spend null and flag the receipt as malformed. Apply the same check in classifyReceipt.","line":238,"path":"imd-flop/src/run.ts","reproduction":"Reproduced in imd-flop/test/scratch/audit.test.ts (offline vitest; scratch, not kept), test F1. Setup: readySeat(h,'42','0.5') (0.5 FLOP/day, per call 0.5). Provider: a provider named 'mock' that wraps MockProvider; its readReceipt returns {state:'settled', settled_spend:-10}. Run `run --job neg-1 --prompt 'Say hi' --max-tokens 8 --json`, then 10 more runs with normal unresolved receipts (padded quote 0.18 each). Expected: at most 2 of the 0.18 calls fit under the 0.5 cap (or the -10 receipt is rejected and the padded 0.18 is charged). Actual: the first run prints cap_charge -10 and its ledger row has spend/cap_charge -10. All 10 later calls are admitted, and `status --json` shows today_utc.mock = -8.2.","severity":"medium","snippet":" const capCharge = classified.settled ?? unresolvedCharge;","title":"PR #4: a negative settled_spend from the receipt becomes a negative cap_charge, lowering today's total and bypassing the daily (and requester job) cap"},{"citation":"resolved","description":"Merged from audit_economics, audit_math, audit_permissions and audit_flow. Whether spend counts as resolved is decided only by settled_spend being a number (run.ts:238). receipt.state is never consulted. requestId reaches classifyReceipt only as a fallback for a missing receipt.request_id; nothing compares the two. (a) If the receipt says state 'estimated' or 'reserved' (spend unresolved by definition) but carries settled_spend 0, it is charged 0. The ledger row reads state 'estimated', spend 0, cap_charge 0. This breaks PR #4's rule that the padded quote stays the cap_charge while spend is unresolved. (b) A receipt naming a different request_id has its settled amount applied to this attempt. Either way an unresolved paid call is charged 0 against the daily or job cap, and every such call adds to the under-count. Fix: use classified.settled only when rr.http === 200, receipt.request_id === requestId, and state is 'settled' (or 'released'). Otherwise use unresolvedCharge with spend null.","line":229,"path":"imd-flop/src/run.ts","reproduction":"Reproduced in imd-flop/test/scratch/audit.test.ts (offline vitest; scratch, not kept), tests F2a/F2b. Setup: readySeat(h,'42','0.5'), mock-named provider wrapping MockProvider, `run --job e0 --prompt 'Say hi' --max-tokens 8 --json`. (a) readReceipt returns {state:'estimated', settled_spend:0}. Expected: latest ledger row cap_charge = quote_padded 0.18. Actual: row state 'estimated', spend 0, cap_charge 0, quote_padded 0.18, and printed cap_charge 0. (b) readReceipt returns {request_id:'some-other-request', state:'settled', settled_spend:0}. Expected: the receipt is not applied and cap_charge is 0.18. Actual: printed request_id 'mock-42-…', receipt.request_id 'some-other-request', cap_charge 0.","severity":"medium","snippet":" const classified = classifyReceipt(rr.receipt, { job, provider: provider.name, http: rr.http, error: rr.error, requestId, mock: provider.name === \"mock\" });","title":"PR #4: settled_spend replaces the padded reservation even when the receipt's state is still reserved/estimated, or when the receipt is for another request_id"},{"citation":"resolved","description":"Merged from audit_economics, audit_math, audit_permissions and audit_flow. runJob starts the --timeout-ms timer (run.ts:191-192) before provider.complete(). FlopProvider.complete then runs assertPaidNetwork (providers.ts:140; eth_chainId, faucet and WebSocket reads with their own 15 s limits, about 45 s worst case) and mintChildKey (own 15 s limit). Neither receives req.signal, and nothing checks req.signal.aborted. When the deadline passes during the recheck, POST /keys/ephemeral is still sent with the parent bearer, creating a live single-use credential scoped to the padded quote. Only then does createChatCompletion see the already-aborted signal and throw. runJob classes that as timeout_unknown: the padded quote stays charged to the daily cap, exit is 6 'Spend is UNKNOWN', and status lists the attempt as pending indefinitely, although no inference was sent. The CLI does not validate --timeout-ms (cli.ts:322, Number(...)): a value like '60s' becomes NaN and Node clamps it to 1 ms, so every paid run with such a typo hits this path. That parsing is older than these PRs and is noted here only because it makes this finding worse. Fix: call req.signal.throwIfAborted() before assertPaidNetwork and again before mintChildKey, throw a PreSendError (refused_local, charge 0), and pass the signal into both reads.","line":146,"path":"imd-flop/src/providers.ts","reproduction":"Reproduced in imd-flop/test/scratch/audit.test.ts (offline vitest; scratch, not kept), tests F3/F3b. Real FlopProvider through cli(). Seat 42 is ready and wallet-signed, gateway.key is present, ETH_RPC_URL=https://eth.example/rpc. Scripted fetch: eth_chainId 0x1, eth_call returns the signer as owner, estimate 0.012 (padded 0.132), faucet /chain returns the pin but delays its 2nd call (the pre-mint recheck) by 200 ms, /keys/ephemeral returns 201 {token:'flop_ek_'+'A'*24}. A fake WebSocket returns the pin. Command: `run --job job-abc --prompt 'Say hi' --max-tokens 8 --provider flop --live --timeout-ms 50`. Expected: no mint after the 50 ms deadline; latest row refused_local with cap_charge 0. Actual: POST /keys/ephemeral at t≈229 ms, exit 6 'no answer within 50 ms. Spend is UNKNOWN', ledger [['sent',0.132],['timeout_unknown',0.132]]. With --timeout-ms 60s: Node prints TimeoutNaNWarning, the mint is still sent, and exit is 6.","severity":"medium","snippet":" const child = await mintChildKey(this.net, this.parent, { model: req.model, maxSpend: req.maxCostFlop }, this.f);","title":"PR #1: the pre-mint recheck and the child-key mint ignore the run's abort signal, so a child key is minted after --timeout-ms has expired and the attempt is recorded as timeout_unknown with the full c"},{"citation":"resolved","description":"Merged from audit_economics, audit_permissions and audit_flow. The PreSendError reason embeds upstream text: 'eth_chainId error: ' (gateway.ts:215), 'rpc error: ' (gateway.ts:169) and fetch error text. Only lowercase-0x-prefixed 64-hex runs are stripped, but the secret scan (secrets.ts:52 HEX64, BEARER, FLOP_TOKEN) also rejects bare 64-hex runs, '0X' runs, and bearer- or flop-token-shaped text. assertNoSecrets then throws inside the catch, so the refused_local line with cap_charge 0 is never appended. The 'sent' row with cap_charge = padded quote remains the latest row. It counts toward today's cap and shows as a pending paid attempt, although nothing was minted or sent. The user sees exit 5 'secret scan blocked writing ledger.jsonl' instead of the refusal. Fix: write a fixed reason (e.g. 'pre-mint network check failed') and keep the details on stderr only, or scrub with the scanner's own patterns and fall back to a fixed reason if the append still fails.","line":204,"path":"imd-flop/src/run.ts","reproduction":"Reproduced in imd-flop/test/scratch/audit.test.ts (offline vitest; scratch, not kept), test F4. Same paid setup as the mint-after-deadline finding, except the 3rd eth_chainId call (the recheck inside complete()) returns {error:{message:'header not found '+'ab'.repeat(32)}}. Command: `run --job job-abc --prompt 'Say hi' --max-tokens 8 --provider flop --live`. Expected: no mint, latest row refused_local with cap_charge 0, status today_utc.flop 0. Actual: no mint (correct), but exit 5 'secret scan blocked writing ledger.jsonl: reason: 64-hex (key-shaped) value', ledger [['sent',0.132]] only, status today_utc.flop 0.132, and 1 pending_receipts entry.","severity":"low","snippet":" const reason = timedOut ? `${err.name}: no answer; spend unknown, not retried` : preSend ? `nothing sent: ${err.message.replace(/0x[0-9a-fA-F]{64}/g, \"[hash]\")}` : `HTTP ${http}`;","title":"PR #1: a pre-mint refusal whose upstream error text holds a bare (non-0x) 64-hex run cannot be written to the ledger, so the pre-call 'sent' charge stays in effect"},{"citation":"resolved","description":"Merged from audit_math and audit_permissions. The fallback assumes the scan failed because of text. It re-spreads responseRecord, including the gateway-supplied usage object. If the hit was in usage (e.g. a 64-hex cache or request-hash field), the second writeJsonSafe throws the same CliError. That escapes runJob after the paid completion: readReceipt is never called, no receipt file is written, and the final ledger row is never appended. The ledger stays at 'sent' with only the padded quote, so a higher reported cost_flop is never recorded. stdout is empty and the exit code is REFUSED_RULE (5), the code scripts read as 'refused, nothing sent', for a call that was paid for. Withheld text does not leak (good), but the paid attempt goes unrecorded. Fix: on a scan failure, store a minimal record (request_id, output_sha256, numeric usage fields only, withheld). Always continue to readReceipt and the final ledger row (try/finally), and do not return a refusal code for a sent call.","line":225,"path":"imd-flop/src/run.ts","reproduction":"Reproduced in imd-flop/test/scratch/audit.test.ts (offline vitest; scratch, not kept), test F5. Setup: readySeat(h,'42','5'). A mock-named provider returns normal text but usage {...normal, cache_key:'cd'.repeat(32)}. Command: `run --job u0 --prompt 'Say hi' --max-tokens 8 --json`. Expected: exit 0, response stored with the offending part withheld, receipt file and final ledger row written. Actual: provider.calls 1 (paid), exit 5 'secret scan blocked writing response: usage.cache_key: 64-hex (key-shaped) value', readReceipt called 0 times, no receipts/ dir, ledger states ['sent'].","severity":"low","snippet":" writeJsonSafe(responseFile, { ...responseRecord, text: null, withheld }, \"response\");","title":"PR #3: if the secret scan hits a field outside text (e.g. usage), the withheld-text fallback write throws after a completed paid call: no receipt, no final ledger row, exit 5"},{"citation":"resolved","description":"From audit_flow. errors.ts:8 documents REFUSED_RULE (5) as covering 'a paid-run chain/genesis refusal', and the up-front gate (run.ts:118) exits 5. The same refusal raised by the pre-mint recheck in FlopProvider.complete exits EXIT.ERROR (1). That is also the code for an HTTP error after a real send (run.ts:210, 'spend recorded as unknown'). A script branching on the documented codes cannot tell 'nothing sent, charge 0' from 'sent, spend unknown'. test/paid-gate.test.ts:471 asserts code 1, so the suite currently enforces this behaviour. Fix: use EXIT.REFUSED_RULE for preSend.","line":209,"path":"imd-flop/src/run.ts","reproduction":"Reproduced in imd-flop/test/scratch/audit.test.ts (offline vitest; scratch, not kept), test F6. Paid setup as above, where the 3rd eth_chainId call (the recheck) returns 0x5. Expected: exit 5, as the up-front gate gives for the same chain-id mismatch. Actual: exit 1, 'nothing sent: Ethereum chain id 5 is not 1 …'.","severity":"low","snippet":" if (preSend) throw new CliError(`nothing sent: ${err.message}`, EXIT.ERROR);","title":"PR #1: a pre-mint chain/genesis refusal exits 1 (ERROR, the same code as 'sent, spend unknown') instead of REFUSED_RULE 5"},{"citation":"resolved","description":"Merged from audit_economics and audit_flow. readEthereumChainId wraps the fetch error message verbatim. Node's fetch includes the whole URL in two errors: 'Request cannot be constructed from a URL that includes credentials: ' (basic-auth RPC URLs) and 'Failed to parse URL from ' (e.g. a missing scheme on a …/v3/ URL). assertPaidNetwork propagates the message, run.ts:118 builds 'refused locally, nothing sent: …', and cli.ts:422 prints it to stderr. PR #1 runs this gate on every paid run and on the recheck (where it also lands in the ledger reason). ETH_RPC_URL is never registered as a secret. Fix: validate with new URL() first and report a fixed message without the value, and never interpolate the transport error or URL.","line":205,"path":"imd-flop/src/gateway.ts","reproduction":"Node v24.21.0, offline (the URL fails before any connection): `node -e 'fetch(\"https://user:s3cretpass@eth.example/rpc\",{method:\"POST\"}).catch(e=>console.log(e.message))'` prints 'Request cannot be constructed from a URL that includes credentials: https://user:s3cretpass@eth.example/rpc'. `fetch(\"mainnet.example/v3/SECRETKEY123\",…)` prints 'Failed to parse URL from mainnet.example/v3/SECRETKEY123'. readEthereumChainId (gateway.ts:204-205) rethrows that as 'eth_chainId unavailable: ', and runJob (run.ts:118) → main (cli.ts:422) writes 'imd-flop: refused locally, nothing sent: eth_chainId unavailable: Request cannot be constructed from a URL that includes credentials: https://user:s3cretpass@eth.example/rpc' to stderr for `run --provider flop --live` with that ETH_RPC_URL. The full-CLI step was traced by reading the code: the test setup stubs global fetch, so it was not run end to end. Expected: no URL or credential on stderr.","severity":"low","snippet":" throw new Error(`eth_chainId unavailable: ${(e as Error).message}`);","title":"PR #1: credentials or API keys embedded in ETH_RPC_URL are echoed to stderr when the paid-run eth_chainId gate fails on URL construction"}],"hash":"f34a05740ccaf0949061883721df0473c93cd57e49f5d729ccc425dbed6ee40d","nodeId":"fa79a38c-57cb-47dc-acc6-fdcc2eb98220","outcome":"completed","summary":"I kept 7 findings in `.imd-findings.json` (3 medium, 4 low). I reproduced 6 of them by running scratch tests against 8b5a068 with no network. The seventh I checked with Node's own `fetch` plus a read of the code (see the last row). The specialists' 22 reports collapsed into these 7 after merging duplicates.\n\n| Sev | Where | Finding | Reproduced result |\n|---|---|---|---|\n| medium | `src/run.ts:238` (PR #4) | A negative `settled_spend` on a receipt becomes a negative `cap_charge`. That lowers today's total, so the daily cap (and the requester job budget) no longer holds. | With a 0.5 FLOP/day cap, one receipt of -10 let 10 more 0.18 calls through; today's total read -8.2. |\n| medium | `src/run.ts:229` (PR #4) | `settled_spend` replaces the padded reservation even when the receipt is still `estimated`/`reserved`, or names a different request. | Both cases charged 0 instead of the 0.18 padded quote. |\n| medium | `src/providers.ts:146` (PR #1) | The pre-mint recheck and the child-key mint ignore the run's timeout signal. A key is minted after `--timeout-ms` has expired, and the ledger charges the full quote as \"spend unknown\" even though nothing was sent. | Mint went out about 229 ms in, after a 50 ms deadline; exit 6, ledger row `timeout_unknown` 0.132. |\n| low | `src/run.ts:204` (PR #1) | If an upstream error message contains a 64-hex run without `0x`, the secret scan blocks the refusal row. The earlier `sent` charge then stays on the books. | Exit 5, today's total 0.132 and one pending receipt, with no mint and nothing sent. |\n| low | `src/run.ts:225` (PR #3) | If the secret scan trips on a field other than the text (here `usage`), the fallback write fails after a paid call. No receipt and no final ledger row are written, and it exits 5. | Provider called once, receipt never read, ledger states `['sent']` only. |\n| low | `src/run.ts:209` (PR #1) | A refusal at the pre-mint recheck exits 1, which is also the code for \"sent, spend unknown\". The documented code for this refusal is 5. | Exit 1 when the recheck sees chain id 5. |\n| low | `src/gateway.ts:205` (PR #1) | A username/password or key embedded in `ETH_RPC_URL` is printed to stderr. Node's `fetch` puts the full URL in its error, and the code passes that message through unchanged. | Seen in Node 24's own error messages. The CLI path was traced in code, not run, because the test setup replaces `fetch`. |\n\nNotes for the requester:\n- **The NaN timeout:** `--timeout-ms 60s` becomes NaN and Node treats it as 1 ms. With the real FLOP provider, every such run then hits the mint-after-deadline bug. This parsing predates these PRs, so I folded it into the third finding instead of filing it separately.\n- **Dropped as out of scope:** the `padQuote` rounding issue (a tiny positive quote rounds to 0). It is real, but these PRs did not change that code.\n- **No proofs attached:** the code is TypeScript, and the proof field takes a Foundry (Solidity) test. Each finding's reproduction gives the exact inputs, expected result and actual result from the vitest runs.\n- **Proof paths could not be checked:** the files audit_flow named under `.imd/reads/proofs/` were not in the tree, so I could not run them. I wrote my own reproductions instead.\n- **Coverage:** I read all of the PRs' changes to `run.ts`, `ledger.ts`, `gateway.ts`, `providers.ts` and the `run` command in `cli.ts`, with `receipts.ts`, `secrets.ts`, `store.ts` and `errors.ts` as context. I did not do the twelve specialty passes one by one. Before cleanup the existing test suite passed (71 passed, 1 skipped).\n\nNothing in the repo changed apart from `.imd-findings.json`. I deleted the scratch tests and the dependencies I installed.","treeHash":null,"usage":{"cachedInputTokens":1059309,"cost":{"source":"runtime","usdMicros":1296710},"inputTokens":29,"model":"claude-opus-5-5","outputTokens":17194,"runtime":"claude","turns":15,"wallClockMs":184493}}],"verification":[]}