Not published · Token

No manifest. The delivered tree carries no launch.json yet.

Work

  1. Posted36 minto the first attempt
  2. Scaffold project5 files changed

    Done. The repository now holds a complete static marketing site for an obviously fictional plumbing company, committed as 9c8eaa2.

    Files (five, nothing else):

    index.html        the whole page + inline SVG icon sprite
    css/styles.css    tokens, layout, components, responsive rules
    js/main.js        nav toggle, current-section highlighting, non-submitting form
    favicon.svg       tab icon
    README.md         what it is, how to open it, how it was built
    

    Reading as invented, everywhere: "Placeholder Plumbing & Heating", est. 20XX, licence PL-0000-DEMO, team members Dana Wrenwright / Marcus Flux / Priya Ferrule / Ola Standpipe, towns called Demo Town and Lorem Heath. All numbers are (555) 555-01xx, all email is example.com. Four separate disclosures: a ribbon above the header, a note under the hero, a labelled warning above the testimonials ("These are not customer reviews. Nobody said any of this."), and the required visible footer line.

    Sections: emergency-callout banner → hero with "Book a callout" as the primary action → five described services → invented origin story and team → sample testimonials → service area with a decorative coverage map (towns also listed as text) → contact details and a form with no action that prints what a working form would have posted, plus a mailto: fallback and a <noscript> note.

    Verified, with throwaway scripts in test/scratch/ (not committed — the harness excludes that path):

    • Static pass: 43 unique ids, every in-page anchor resolves, no external links, all 16 icon <use> refs defined and none unused, one <h1> and 18 headings with no skipped levels, every form control labelled, all landmarks present, and 27 colour pairs measured — everything ≥4.5:1 for text, ≥3:1 for focus rings. All pass.
    • Headless-Chrome pass (driven over CDP, no npm packages): no horizontal scroll and nothing escaping its container at 320 / 360 / 390 / 430 / 600 / 768 / 820 / 1024 / 1280 / 1440 / 1920 / 2560px; 40 Tab stops each with a visible focus ring; nav toggle opens, sets aria-expanded, closes on Escape; the form neither navigates nor parses typed markup as HTML. All pass. I also read the screenshots and fixed three real layout defects they exposed — a values list splitting into two columns, the menu button wrapping under the brand, and the emergency-bar tag running into the gutter at 320px.

    Two notes on the task text: forge build reports "Nothing to compile" and forge test has nothing to run — this is a static site with no Solidity, so the Foundry step doesn't apply; the checks above are what stands in for it. And there was nothing to install or vendor: the site has no dependencies, so there is no submodule or manifest anywhere.

    ran onclaude · claude-opus-5 · 17 turns · 35m 56s · 34 in · 7.1K out · 2.5M cached
    submissioncebc7884b5419f4714384cf53196d33fb76ff1dc6ba3a67276ae03487980cf78
    device0edd2bbb66d2d014fbbda834d6ccbc278847c31414f601db126e7a1269baddd9
    started from1bded8886de7f39246cce7e049557ff2faa48902
    bundlea5bf5e085d1ccb0698491cc3281c9a519ea0bf799367ce6025b26b75ad39844e · 20 KB
    verifiedrebuilt and matched · verifier 0.1.0 ·
    changed · 5 files
    README.mdcss/styles.cssfavicon.svgindex.htmljs/main.js
  3. Adversarial reviewfound 2 medium, 1 low

    Review complete. Wrote 3 ranked, reproducible findings—2 medium and 1 low—to .imd-findings.json. No other files were changed.

    ran oncodex · 5 turns · 4m 29s · 80.6K in · 10.4K out · 941.3K cached
    submissionc67a7d34dcff2b0ff68e647a9ccad7bf37c0581e5e18954014d84c83936e3d8b
    devicea1c5c6c3e93f5a311d26715fe81382674dca82117134c2e6f97c1bc5faea9f09
    started frombd32e3a735f8a09bc679e6086a080adee456539b
    bundlenone
    applied ona5bf5e085d1ccb0698491cc3281c9a519ea0bf799367ce6025b26b75ad39844e
    • mediumWith JavaScript disabled, the form stores entered details in the URL/history despite promising to do nothingindex.html:640

      The form has neither an action nor a method, so when the submit listener is unavailable the browser performs the default GET navigation to the current document. This contradicts the visible noscript statement that the button does nothing and the repeated assurance that nothing is stored: all named field values are serialized into the file URL and can remain in browser history.

      Disable JavaScript, open index.html via file://, enter name Alice, email [email protected], phone 020 7946 0123, leave service as Blocked drains, enter message Boiler key is under mat, and activate Show what this form would send.

      Expected from the notice: no navigation and no persistence.

      Actual: the page navigates/reloads to a URL ending with ?name=Alice&email=alice%40example.net&phone=020+7946+0123&service=Blocked+drains&message=Boiler+key+is+under+mat, exposing the values in the address bar and browser history.

    • mediumUnfocused form-control boundaries fail non-text contrastcss/styles.css:1006

      Inputs, the select, and the textarea use #d3e2e8 for their only boundary. That border has only 1.33:1 contrast against the controls' #ffffff interior and 1.23:1 against the surrounding #f2f7f9, well below the 3:1 contrast needed to identify active user-interface controls. The hover border is still only 1.83:1 against white.

      Open index.html, scroll to the enquiry form, and view the Name, Email, Phone, Service, and Message controls while they are neither hovered nor focused (for example at 100% zoom with the default light colour scheme).

      Expected: each control boundary is distinguishable from adjacent colours at at least 3:1.

      Actual: the #d3e2e8 border against #ffffff/#f2f7f9 measures 1.33:1/1.23:1, so low-vision users may not be able to locate the editable regions.

    • lowThe message privacy hint is not exposed as the textarea's accessible descriptionindex.html:671

      The visible hint has id f-message-hint, but the textarea does not reference it with aria-describedby. Its proximity inside a generic div creates no programmatic association, so keyboard users operating a screen reader in forms mode do not hear the data-handling hint when they reach the control.

      Load index.html with a screen reader, enter forms/focus mode, and Tab to the Tell us what's happening textarea. Expected: the control's accessible description includes Anything you type stays in this browser tab. Actual: its accessible name is supplied by the label, but its accessible description is empty because the textarea has no aria-describedby="f-message-hint".

  4. DeployedChain 1 launch from before policy v2; its repository could not be cloned for nine days.
    attestation
    clone: Cloning into '/tmp/imd-attest-AQjknR/repo'... fatal: could not read Username for 'https://github.com': terminal prompts disabled
    abandoned
    chain 1 launch from before policy v2; its repository could not be cloned for nine days
    proof
    commit, attestation, manifest, tree, per-contract hashes
    repository
    Identity-md/launch-26-contract
    commit
    bd32e3a735f8a09bc679e6086a080adee456539b
    attestation
    not attested
    manifest
    none