The audit of the imported commit (c511aab) is complete, and the findings file is written. No tracked files were changed; only the ignored .imd-findings.json and test/scratch/ were added.

Verdict: one blocking gas finding. A well-formed, fully budget-compliant result manifest cannot be bound within the 16,777,216 transaction cap, so the C-GAS-01 repair is not a universal bound.

What I read. All eleven source files in full: RelayBranch, RelayFactory, RelayEncoder, RelayVerifier, RelayTypes, IIntake, and the Policy, Assets, Text, StrictJSON and ManifestJSON libraries. I also read the mocks, test base, the retained-binding measurement tool, the local-repair README and measurements, and the pinned protected tests. Not reached: the SDK and frontend code, the evidence.tar.xz archive (no xz on this machine), and the real Intake contract semantics, which only exist on mainnet.

What I reproduced.

• Full suite: 156 of 156 tests pass under the pinned toolchain.
• C-GAS-01: the project's own anvil tool binds the original 32,768-byte input, SHA-256 asserted by the tool, at 13,361,083 gas with the 16-asset witness.
• Sizes: Factory runtime 21,195 bytes, Encoder 11,498, Verifier 13,999, Branch child 12,876; fork child initcode 30,875. All within EIP-170 and EIP-3860.
• Reproducibility: runtime bytecode is byte-identical whether or not tests are in the compilation context, contrary to the README's remark about the Encoder fingerprint.
• Opcode and owner policy: the repository's scan replicates the protected scanner exactly and passes; no contract has an owner, proxy, initializer, DELEGATECALL, CALLCODE or SELFDESTRUCT.

Finding 1, high. ManifestJSON._stringInto bounds raw bytes, values, key bytes and decoded size, but not escape-induced segment flushes. Extra produced files named with alternating a and \n make the verifier cost 10,901,894 gas against 7,975,005 for the accepted shape. As a real anvil transaction with the same witness, the bind reverts at the cap and only completes at 16,751,470 gas with a 50M limit. The Branch is then stuck in ResultRecorded with the fee spent, and a revision-0 project cannot be forked. The attached proof under test/scratch/ProofBindGasCap.t.sol fails on this code. It uses an inline Vm interface and inline mocks because forge-std is not present in this repository.

Finding 2, low. The stuck-state design, where any verifier rejection or missing callback permanently kills a paid Branch, is documented in the README. I recorded it with a reproduction because it is what turns finding 1 into permanent loss.

Payer, payment, ordering, callback, file, checkpoint and fork invariants held under inspection and the existing adversarial suites. I found no reentrancy, access-control, accounting or identity defect.

Next for the adapter. Charge the parser's work budget per escape or per outer-loop iteration so MAX_WORK actually bounds verifier gas, then re-measure the worst shape as a complete transaction. Do not raise the gas limit or project the raw bytes.

The work is complete and committed. Final state, for a reader who only sees this message:

Outcome. The imported STEPS source at commit c511aab was packaged for the contracts-only Ethereum launch with no constructor, ABI, policy, limit or authority change. The high audit finding reproduced and is fixed in the parser with tests. Everything builds and passes with the pinned configuration. Two commits sit on top of the import: the source commit 33426e6 and an evidence commit 843dab0 with identical sources.

What reproduced. The audit's 32,768-byte alternating-escape result needed about 16.8M gas as a complete Branch.bind, above the 16,777,216 cap. Measurement also found a worse shape the audit did not name: retained strings of 999 plain ASCII bytes followed by one raw "é" reached about 17.3M gas with zero escapes, because the ASCII pre-scan walked the prefix and the general loop walked it again. The low finding reproduced as the documented design limit and was left unchanged, since the brief forbids recovery or timeout authority.

What changed, all driven by that finding.

• src/libraries/ManifestJSON.sol: the general loop now starts where the pre-scan stopped, so no byte is walked twice, and each simple escape that ends a raw segment is charged eight units of the existing work budget. Budget values and every other limit are unchanged.
• sdk/strict-json.mjs mirrors the charge so the SDK refuses exactly what the verifier refuses.
• test/ManifestSegmentBudget.t.sol adds 13 tests, including exact budget boundaries and full sixteen-asset bind transactions measured against the cap. One SDK parity test was added.
• config/release.json fingerprints were re-frozen after a forced clean build. ADAPTATION.md has a new top section listing each change and why.

Checks on the final source. Clean forced build and release check pass. Full contract suite with the verifier's fuzz seed: 169 of 169. SDK suite: 85 of 85. Bytecode policy and ABI checks pass. Real local transactions on Prague Anvil all stay below the cap, including the exact C-GAS-01 input with the recorded SHA-256, which now binds at 13,427,365 gas. The three-name deployment rehearsal passed on an empty local chain 1 at 10,266,963 gas. Evidence is in docs/validation/launch-packaging-v1/.

What is not in the tree, by design. No launch.json, no key, broadcast, addresses, launch ID or handoff fields. Readiness stays productionReady false and live profiles NOT_RUN. The frontend export was not rebuilt, since no website step is in this order. The gas ceiling gate remains open for the service's own simulation, because finite measurements do not prove a universal bound.

Done. launch.json is written, validated against the manifest schema, and the full suite passes with the verifier's fuzz seed.

What the manifest declares (matching the accepted source and the brief's proposal in docs/CONTRACTS.md):

• RelayEncoder with no constructor arguments. The contract has no constructor, so its default nonpayable zero-argument constructor applies.
• RelayVerifier with no constructor arguments, same situation.
• RelayFactory with $contract:RelayEncoder and $contract:RelayVerifier. Its constructor at src/RelayFactory.sol:31 stores the two addresses as immutables and checks only nonzero and distinct. It makes no external call and reads no code, so it survives the empty-chain probe in the protected test. Dependency code and policy identity are checked at first product use.

Why there is no $owner entry. No contract in the accepted source has an owner, admin, upgrade, pause, treasury or token role, so no constructor takes an owner address. The owner-checks protected test therefore has nothing to flag. The notes say this explicitly.

Checks run

Check	Result
Manifest schema (keys, kind, unique names, backward references, string args, notes length)	ok, notes 2141 chars
forge build	ok
forge test with the verifier's fuzz seed	169 passed, 0 failed

The existing LaunchCompatibility suite already rehearses the three-name CREATE2 batch and the empty-dependency factory constructor, and it passed in that run.

Scope. Only launch.json was added. No source, configuration, library or documentation file was touched, and no key, broadcast or public RPC was used. The official launch ID, transaction hash, receipt, deployed addresses, sender and verified source links are not in this deliverable because they only exist after the service's own deployment step, and the notes say they must come from the official handoff rather than be invented.

The review is complete. The findings file is written at the repository root with three findings and thirteen coverage rows, and all three cited snippets match the tree exactly.

Outcome: the economics hold. I traced every value flow in RelayBranch against the verified mainnet Intake and IMD token sources, and found no loss-of-funds or conservation defect in the Economic Security, Invariant and Flow Gap areas.

What I verified:

• Real Intake dependency. The verified source of the mainnet Intake pulls exactly the paid amount and forwards it whole to its treasury, never refunds, and only calls back from the writer's complete with a fixed stipend. The Branch's pre/post balance and allowance checks match this behavior exactly.
• Real IMD token. It is a LayerZero OFT built on the OpenZeppelin ERC20 with no transfer fees, hooks, pause or blacklist. The owner can only rename it.
• Live state. Both job actions are priced at 0.5 IMD and the callback stipend is 200,000 gas at block 26,245,260.
• Tests. All 168 tests plus the two invariant suites pass locally. Capacity rules in the encoder and verifier agree, so an admitted proposal cannot become unbindable for capacity reasons.

Findings reported:

1. Low. The Intake's callback stipend is owner-settable and the Branch never reads it before paying. A stipend below about 62,000 gas leaves every completed job stranded in Pending with the fee spent. The repository nowhere mentions this setter. Reproduced in a scratch test.
2. Info. The failure mapping is inverted against the Intake's own documented semantics. Transient status 2 freezes a Branch forever while deterministic status 1 invites repeated paid identical retries. This is documented as required design, so it is recorded as an observation.
3. Info. Permissionless single-slot sponsorship allows pre-empting another sponsor for one price per round. Documented as the "No FIFO" design, no funds lost.

Coverage: all eight entry points have rows, plus five invariant and dependency rows. Documented design limits such as stuck Pending on a missing callback, stuck ResultRecorded on an unverifiable result, and the no-refund model were traced and confirmed as disclosed, not reported as defects. No tracked files were changed; the only writes were the findings file and a scratch test.

The review is complete and .imd-findings.json holds the result. Nothing in the tree was modified outside the findings file and the scratch test directory.

Outcome: no permission bypass found. The permission model is small and holds up under the Access Control, Trust Gap and Asymmetry checklists. Both factory entry points and five of the six branch entry points are permissionless by design. The two Intake callbacks are the only restricted functions, and their guard binds caller, phase, active request id and single delivery, so a cross-branch or attacker-registered Intake request cannot settle a victim branch. The Branch pulls tokens only from the caller, resets its Intake allowance to zero and asserts balances, so there is no confused-deputy path through approvals. Reentrancy through token hooks or a synchronous Intake callback is blocked by the guard and the phase checks. Checkpoints, asset hashes and job identity have single writers. Runtime sizes are all under the limit, no owner, proxy or linked library exists, and the constructor policy for the three launch contracts is satisfied.

Two findings were recorded, neither blocking:

• Low: any sponsor whose attempt is refused with status 1 locks the whole public branch to that one proposal. Other users can propose but never sponsor anything else; their only options are to pay for the refused body again or fork to a new address that loses the job-continuation head. This is documented in the operations runbook as intentional, so it is reported as a trust assumption with an unprivileged amplifier, with a scratch test in test/scratch/RefusedLock.t.sol demonstrating the locked state.
• Info: the success callback reverts on a URI over 1024 bytes while the failure callback bounds nothing, so one over-long URI from the Intake leaves a paid attempt pending forever. Also documented, and the deployment order protects current budgets.

Verification: the adversarial, payment, history and profile suites were run on this tree, 73 tests passed including the state-machine invariant, and the author's own test confirms the refusal lock is intended behaviour.

Coverage: all eight listed entry points have rows, plus five invariant rows. The JSON parser libraries behind the verifier are marked unreached since they are outside the assigned area and were only skimmed.

Every real envelope in the fixtures carries name and path on each file entry, so that lead is closed. The review is complete and the findings file is in place.

Result: one low-severity finding, no blocking defects in the control-flow area.

The findings record is at .imd-findings.json with one finding and twelve coverage rows, one per listed entry point plus the launch constructor policy, the periphery libraries, a read-only mainnet dependency check, and an honest "unreached" row.

The finding (low). The Intake result callback records any digest it is handed, including zero, and moves the branch to ResultRecorded. No byte string hashes to zero, so bind reverts forever, and sponsor and retry are gated on other phases, so the branch is permanently stuck. That is the same outcome as Frozen, but under the phase the operations guide and UI treat as "awaiting a gas-only bind". The failure callback classifies unrecoverable deliveries as Frozen explicitly, so the fix is a one-line classification in src/RelayBranch.sol at the result callback. It is reproduced by test/scratch/ZeroResultHash.t.sol, which passes on current code because it asserts the stuck state. Only a misbehaving Intake delivery triggers it and no funds move, which is why it is low rather than medium.

What holds, and why.

• Purchase path: all admission checks precede the token pull, balance deltas are verified on both sides, Intake allowance is set then cleared and asserted zero, and the guard plus the callbacks' entered check stop synchronous callbacks and token reentrancy. The slither and aderyn reentrancy lines are on a pure encoder call and are not reachable.
• State machine: one active request at a time. Refused only exits through an identical-body paid retry, and Frozen never exits. Both are documented design, not defects.
• Bind: the witness, callback hash, declared-file uniqueness, job reuse, project identity and inherited-parent-project rules all trace correctly, and every effect lands in one transaction.
• Factory: static two-address constructor with no external calls, dependencies checked at use, forks only from accepted revisions with an exact witness.
• Periphery: the quoting, hex, path, conflict, sorted-replace and both JSON parsers were traced against the Pashov periphery checklist, including escape decoding, surrogates, overlong UTF-8 and per-depth duplicate keys. The static-analysis uninitialized-local and divide-before-multiply lines are intentional.
• Evidence: the full suite passes with 169 tests, the C-GAS-01 32 KiB 16-asset bind shape is measured below the 16,777,216 cap, and read-only mainnet calls show code at both hardcoded dependencies, a 0.5 IMD price for both actions, and the request selector in the Intake runtime. Live profile checks remain NOT_RUN.

Not reached: the SDK, CLI and frontend JavaScript, the Node deployment-rehearsal tooling, and the byte-level SHA-256 of the C-GAS-01 fixture. Note that forge-std is not vendored in this tree, so proof tests must use the project's test/TestBase.sol rather than the forge-std import the assignment template names.

Findings file written and validated. The review is complete.

Result: one medium finding, one informational note, all 8 entry points covered (13 coverage rows), in .imd-findings.json.

Medium: a conforming paid result with 20 produced files can never bind. ManifestJSON retains the six standard descriptor keys for every entry of the files array, not just the declared output, so each file costs 13 retained tokens against MAX_RETAINED_TOKENS = 256 at src/libraries/ManifestJSON.sol:26. The root costs 9, so 19 files hit exactly 256 and bind, while 20 files revert with Policy.Limit at only 4,696 raw bytes, far below the documented 32,768-byte envelope. The sponsor's fee is spent, the result is authenticated, and the Branch is stranded in ResultRecorded forever since retry and sponsor revert Busy. The repository's own evidence records real 17-file public envelopes, and no document discloses a file-count ceiling. The attached self-contained proof test/scratch/RetainedTokenCapProof.t.sol passes at 19 files and fails with Limit() at 20 on current code. Suggested minimal fix: raise the retained-token cap so the existing value and work budgets bind first, mirror it in the SDK, and re-measure the 16,777,216-gas regressions.

Info: callback URI over 1,024 bytes leaves the Branch Pending forever. src/RelayBranch.sol:223 reverts the single-shot success callback, which the suite asserts as intended. Reported as an external-input liveness dependency, not a defect.

What held in the math area. Base64 overhead formula is a bounded ceiling division with no overflow. Size parsing caps at 10 digits before the uint32 cast. Hex, UTF-8 and escape decoders agree across Text, _stringInto and _skipString. Slot-reservation arithmetic in the encoder matches Assets.validate after replacement. Payment deltas are exact. Every static-analysis lead was traced and dismissed with a reason in the coverage rows. The baseline suite passed 169 of 169.

Not reached. No live Intake behaviour was checked, so the real production URI length and file counts remain unverified, and the fix was not rehearsed against the gas ceiling since the review writes no source changes.

Added failure-path, fuzz, and stateful invariant tests under test/release/.

• forge build passed.
• All 175 Foundry tests passed with the required seed.
• All 85 SDK tests passed.
• Exact C-GAS-01 calldata replay used 13,427,365 gas, below 16,777,216.
• Local launch rehearsal passed.

No contract or configuration changes. No public deployment performed; productionReady=false and live checks remain NOT_RUN.

The findings file is written and validated. Final state:

Outcome: 5 findings kept, all reproduced on this tree, written to .imd-findings.json with an 11-row coverage record covering all 8 entry points plus three invariants. The full repository suite passes (175 tests), and the three launch contracts are within size limits with a schema-clean manifest.

Findings kept (merged from 8 specialist reports):

• Medium. The retained-token cap of 256 in the manifest parser strands a paid, well-formed result once the plane lists 20 files, even at 4.7 KB. The specialist's proof fails on this tree for exactly that reason and is attached. The ceiling is undocumented, and the repository's own evidence shows real 17-file envelopes.
• Low. The success callback accepts a zero result hash and lands in a ResultRecorded phase that can never bind or exit. The verified Intake source explicitly allows a zero hash on a status-0 completion.
• Low. A URI over 1,024 bytes reverts the success callback while the failure callback is unbounded. I confirmed from the verified Intake source that it marks the request completed and delivers exactly once, so the Branch stays Pending forever. Two specialist reports merged.
• Low. The Branch pays before checking the Intake's stipend. I confirmed on mainnet that the stipend is owner-settable and currently 200,000, and that callbacks fail below roughly 62,000 gas.
• Low. Any sponsor can lock a Branch to a refused body or freeze it for one job price. Three specialist reports merged into one documented-design finding with an unprivileged amplifier.

Dropped or folded: the sponsor pre-emption race is noted inside the lock finding rather than kept as a defect, since no funds of the pre-empted party are lost and permissionless single-slot sponsorship is the mandated design.

Own pass: I traced propose, fork, createProject, the purchase reconciliation, the reentrancy leads from static analysis, the parser's string and escape handling, and the launch manifest. Nothing additional reproduced as a defect. Scratch tests live under test/scratch/ and are not part of the submission.

The revision is complete. The reopened finding reproduced and is fixed; the four advisory findings are answered without contract changes.

What reproduced and what changed

• Finding 16331cb9 (medium), fixed. The reviewer's proof failed on the starting tree: a completed result listing 20 standard file entries reverted with the retained-token limit. In src/libraries/ManifestJSON.sol the cap is now twice the value budget, so it is structural and can no longer be the first limit a well-formed result reaches. The SDK constant, the release config and LIMITS.md mirror it. The proof passes on the result.
• Tests added. The new file test/ManifestRetainedTokens.t.sol covers the twenty-file result as a complete Branch transaction and shows the work budget and value budget are now the binding limits. One SDK parity test was added. Standard six-key entries bind up to 50 files; the 51st is refused by the unchanged work budget.
• Advisory findings 4d120638, 8043b46c, b500a9e0, 7ccd11b0: reproduced, answered "disputed". Each is a real but documented terminal condition that only the trusted Intake or the mandated single-active-request design can produce. Changing them would alter reviewed callback or payment semantics beyond this order's packaging scope. They are now disclosed together in LIMITS.md under a new "Delivery conditions that leave a paid Branch without an exit" section.

Verification on the final source

Check	Result
forge test with the pinned fuzz seed	174/174 pass
SDK tests	86/86 pass
check-release after forced clean build and re-freeze	pass
Bytecode policy and ABI check	pass, ABI unchanged
Anvil bind transactions, 16-asset witness	14/14 below 16,777,216
Exact C-GAS-01 input	13,687,379 gas

The larger token array adds about 260,000 gas per bind. The largest Foundry estimate is the budget-maximal mix at 14,779,323 gas.

One item deferred. The deployment rehearsal passed every on-chain step, but its handoff importer authenticates the committed HEAD against frozen source hashes and this revision is uncommitted here. It stopped with "Handoff sourceCommit differs from frozen source" and must be re-run on the service's final commit. This is stated in ADAPTATION.md and the evidence README. No launch.json, no key, no broadcast, and no website step were produced.

My earlier tests still pass against the latest source. The only things that had gone stale were the recorded measurements from the previous round, and I've refreshed those. No new contract defect turned up, so there is no .imd-findings.json. I changed only two files, both under test/release/, and committed nothing.

What changed in the source since my last round: another contributor's commit f71783b raised ManifestJSON.MAX_RETAINED_TOKENS from 256 to 2 * MAX_VALUES (1024). That changed the compiled RelayVerifier and RelayFactory, so my archived local replay evidence (code hashes, addresses, gas figures) no longer matched.

Checks run on the current source (Foundry 1.8.3, solc 0.8.26, using the verifier's fuzz seed):

• forge build passed.
• forge test: 180 tests passed across 23 suites, with no failures or skips. This includes my C-GAS-01 exact-gas regression and my payment invariant over random call sequences.
• SDK tests: 86 of 86 passed.
• The local Anvil replay (chain ID 1, 16,777,216 gas limit) passed. The bind calldata is still byte-for-byte identical to the archived original, and the 32,768-byte result still matches SHA-256 8768318d…de805.

What the replay measured now:

Measurement	Before	Now
Complete Branch.bind transaction	13,427,365 gas	13,687,379 gas (still under 16,777,216)
Three-contract deployment batch	10,266,939 gas	10,269,931 gas
RelayVerifier code size	14,124 bytes	14,138 bytes

RelayFactory's code hash changed too, and so did the local addresses for both contracts.

Files updated:

• test/release/local-replay-evidence.json now holds the new measurements. Only the fields that changed differ.
• test/release/README.md notes the source revision it was checked against and updates the gas figures and test counts.

All of this is local-only evidence. There is still no official launch ID, mainnet deployment transaction, verified source link or deployment handoff. productionReady stays false, and live profile checks stay NOT_RUN.

I updated the notes in launch.json; the contract list and constructor arguments are the same as before. launch.json is the only file changed.

Why the notes changed: they said the source was at commit e1f964c, but a later accepted revision (f71783b) changed src/libraries/ManifestJSON.sol. It raised the limit on stored JSON tokens from 256 to 1,024 (MAX_RETAINED_TOKENS = 2 * MAX_VALUES), which raised the gas cost of every bind. The notes now say:

• Source: the final source commit is whatever commit the service makes of this tree, and the compiler inputs it must match are in config/release.json.
• Gas: the C-GAS-01 regression is recorded at the re-measured 13,687,379 gas, still below 16,777,216.

Manifest (unchanged):

1. RelayEncoder(): no arguments.
2. RelayVerifier(): no arguments.
3. RelayFactory("$contract:RelayEncoder", "$contract:RelayVerifier"): its constructor only stores the two addresses and checks they are nonzero and different. It makes no external call and needs no code at those addresses, so it deploys on an empty chain.

None of the contracts has an owner, admin or other privileged role, so there is no $owner argument.

Checks:

• Manifest shape: passes. It has only kind, contracts and notes; three unique names; every argument is a string; each $contract: reference points to an earlier contract; the notes are 2,424 characters (limit 4,000).
• Build and tests: forge build succeeds, and forge test with the required fuzz seed passed 174 of 174.
• Deployment rehearsal: passes. I ran the logic of Contracts.protected.t.sol with the real creation code on an empty chain 1: all three contracts deployed at their predicted addresses, RelayFactory received those addresses, every runtime is under the 24,576-byte limit, and none has a reachable DELEGATECALL, CALLCODE or SELFDESTRUCT. The repo has no forge-std, so I ran it against a minimal stand-in for the test helpers, not the original file. I could not run Owners.protected.t.sol because a file it imports (floor/OwnerChecks.sol) is not in this tree.

The official launch ID, transaction hash, receipt, deployed addresses, sender and verified source links don't exist yet; they will come only from the service's deployment handoff, so I left them out. Readiness stays productionReady=false and live checks stay NOT_RUN.

The review is complete and .imd-findings.json is written with 5 findings and 12 coverage rows.

Prior medium finding (retained-token cap) is fixed. MAX_RETAINED_TOKENS is now 2 * MAX_VALUES and that is the only source change this round. Both attached proofs pass on the revised tree, including the 20-file bind. The cap is structural: a token is allocated only for a retained value or the key that introduces one, so the count cannot exceed twice the value budget. The full suite passes with 184 of 184 tests, the SDK suite passes with 86 of 86, and the exact C-GAS-01 bytes bind as a complete transaction below the 16,777,216 cap.

One new low finding: the release fingerprint gate fails on the combined tree. The frozen source list in config/release.json has 48 files, but the tree now compiles 50 because the independent tester's two test files under test/release were combined in after the author's re-freeze. The project's own check aborts with "Complete clean compilation source drift" before validating artifacts, while the validation README reports it as PASS. I verified separately that every runtime hash, creation hash, size, ABI and compiler version of the four contracts matches the frozen values, so this is an evidence inconsistency rather than a bytecode change. The fix is to re-run the project's re-freeze tool on the final tree.

The four advisory items stay settled as disclosed limits. I re-ran all four reproductions and each still reproduces, as the author also confirmed. Their dispute holds under this deployment order, which forbids substantive contract changes and mandates one active request with no forced unlock. Each is now disclosed in LIMITS.md. I recorded them at info severity as trust assumptions on the Intake and mandated design, not blockers.

Launch rehearsal holds. A scratch probe deployed the three manifest contracts by CREATE2 on an empty chain with the manifest's static arguments, confirmed runtimes under 24,576 bytes with no reachable forbidden opcodes, and created a runtime Branch through the factory. The manifest has only the schema's keys, unique names and backward references.