Review complete. The findings file is written and every snippet matches the tree.

Verdict: nothing reproduced at critical, high or medium severity in SwarmDesk. The launch is not blocked by this review. The file .imd-findings.json holds one low and three info findings.

What I verified against the brief

• The repo build with the pinned foundry.toml gives SwarmDesk creation hash 0x65968358…5745, exactly the required value.
• The SwarmCode pins equal the built GameRegistry and Params creation hashes, so bind can succeed against the real job A.
• The policy word decodes to chain 1, window 26122900–26122901, price cap 0.5 IMD, 200 bps, high bits zero.
• The two pinned body hashes equal the keccak of docs/oracle-v37/event.json and regulator.json, and the repo's question-hash vectors pass against protocol records.
• The protected floor test passes with the exact twelve words on chain 4663, and a scratch deployment of that init code reads registry() == 0, gameConfigHash equal to the last word, and runtime of 20,797 bytes with no forbidden opcodes.
• Both oracle streams, on both the direct and relay paths, succeed under an explicit 200k gas limit on chain 4663 with the ArbSys clock. The heaviest path, a cold regulator answer, measured 177,879 gas, about 11% of margin.
• The ten launch-relevant suites pass, 61 tests. The full offline suite with invariants did not finish inside the 7-minute cap I gave it, so I cannot report it.

Findings

• Low, line 416 and 425. A regulator word whose key byte is above 45 is clamped onto RepairHours instead of skipped, and a feature code above 8 announces feature 7. Reproduced: key byte 0xff with target 7e18 moves RepairHours from 6e18 to 6.6e18 and burns its cooldown; v[9]=1000 sets a notice for feature 7. Bounded by the existing clamps, so not launch-blocking.
• Info, line 308. Anyone can buy the pinned question naming the Desk as consumer and relay the first answer of a slot; the only panel guard is 5/4, which is also what the pinned bodies ask for. Documented design and a trust assumption on the IMD panel and single attester key.
• Info, line 249. Signer, intake, action and price cap are frozen. A signer rotation or a price above 0.5 IMD strands the Desk permanently, with the game running on fallback plans. This follows the brief's no-owner rule, which wins over the oracle-consumer reference.
• Info, line 94. The severity comment says GridOperator admits 5000–10000, but its floor is 3000. Documentation only.

Known items to carry into the launch notes, not re-opened: finding b2ccff (announceCap rollback while the market is uninitialized, unreachable in this bind order), M-2 twin front-run of bind (griefing only, mitigated by binding right after job A), L-1 dual toolchain pins, and the reserved Params keys register.

Coverage. Read in full: SwarmDesk, OracleAttestation, SignatureCheckerCompat, SwarmCode, Params, GameRegistry, GridOperator, Civic, Enhancement, GameModule, ChainClock, the interfaces and Errors. Read only the functions the Desk calls: Economy, PackSale, FarmRewards. Not read: FarmCore, FarmEngine, FarmItems, FeeRouter, RewardPool, Season, StarterClaim, Billboards, V4Market, the market adapters and EndowmentEscrow, which are outside the Desk's scope. Not reached: the live ProjectFactory and launch registry on 4663, which I did not query over RPC. Scratch tests live under test/scratch/ and are not part of the submission.

Prepared the launch handoff in ADAPTATION.md. Contract source is unchanged; accepted audit findings are recorded.

Verified the exact creation hash, twelve constructor words, unbound registry and GAME_CONFIG_HASH locally. Build passed; tests: 284 passed, 6 skipped. Protected checks passed.

The confirmed address will come from IMD’s deployment step; no live deployment was broadcast.

Created launch.json with one SwarmDesk, the exact twelve constructor words, and accepted audit notes.

Verified manifest structure, constructor ABI, required creation hash, and unbound deployment state. forge build passed; forge test: 278 passed, 0 failed, 6 skipped, including the protected check.

Only launch.json is changed for submission. No live deployment was broadcast; confirmed address recording remains with the deployment service.

Findings file is written and valid. Recap of the review:

Outcome: no critical, high or medium defect in SwarmDesk. Nothing here should stop the launch. The findings file .imd-findings.json holds two info-level notes for the launch notes and a coverage row for all 156 listed entry points plus three invariants.

What I verified for this launch

• The repo build reproduces the pinned creation hash 0x65968358…5745, and the Params and GameRegistry creation hashes equal the SwarmCode pins.
• The constructor-args tool reproduces the brief's twelve words from the config files. The policy word decodes to chain 1, window 26122900 to 26122901, max price 0.5 IMD, heartbeat 200 bps, with the top bits zero.
• The constructor makes no external call, the Desk deploys unbound, and the binding config carries the game-config hash as the last word. The EIP-712 domain and the 15-field attestation struct match the oracle reference.

Control-flow trace (Execution Trace, Periphery, First Principles guides)

• bind: the CREATE2 proofs over pinned code and the registry's own immutables pin the candidate's identity. A malicious candidate that reenters cannot pass the final address check. The twin race is the documented M-2 assumption.
• askBackup, onOracleResult, submit, onOracleFailure, clearExpired: once-per-slot and once-per-UUID bookkeeping, pending stream and deadline binding, exact approve-and-zero, exact ABI sizes, and slot and epoch freshness all hold. The callback peaks at 79k gas in the existing tests.
• execute: every regulator value is clamped so Params.set, submitPlan, announce and unpause cannot revert for the Desk. The optional duties sit in try/catch. The only uncaught revert is the accepted known issue on announceCap.
• Periphery: SwarmCode pins, ChainClock, SignatureCheckerCompat, OracleAttestation hashStruct split and Strings all behave as the callers assume.

Two info notes, both reproduced by test/scratch/DeskReviewNotes.t.sol

1. Between bind and job B registration, a regulator answer is accepted but execute reverts NotConfigured on role 12. The weekly slot is then spent and the answer expires unused. This is a launch-order liveness note.
2. The duplicate-UUID check emits AnswerIgnored before the signature check, so anyone can emit that event for a consumed UUID with an empty signature. Log noise only.

The panel floor of 5 seats and quorum 4 matches the requester's own pinned bodies, so I did not report it. The existing SwarmDesk suites pass (24 tests).

Confirmed: the keeper relays and executes in separate transactions, so the expiry boundary in finding 1 is reachable in practice. The findings file is complete and validated. Final state:

Outcome: no critical, high or medium defect in SwarmDesk. Nothing stops this launch. The findings file at .imd-findings.json holds 2 low and 3 info findings plus 161 coverage rows.

Verified invariants from the brief

• The built SwarmDesk creation code hashes to exactly the pinned value 0x65968358…5745 under the repo foundry.toml.
• The policy word decodes to chain 1, blocks 26122900–26122901, maxPrice 0.5 IMD, heartbeat 200 bps, reserved bits zero. The twelve constructor words match the parameter order.
• The Desk's Params clamp is exactly consistent with Params.set (same truncating old/10 step, result never leaves the hard bounds, all 45 defaults inside bounds). Every enum or index derived from an answer word is in range. Answer sizes are pinned to 288 and 608 bytes.
• All 24 existing SwarmDesk tests and the oracle conformance tests pass.

Findings (all reproduced in test/scratch/Boundary.t.sol, which passes on this tree to show the behaviour)

1. Low. An attestation with expiresAt == block.timestamp, or one accepted in a slot's last second, is stored with validUntil already reached. The slot and UUID are consumed, execute can never act, and no backup can be asked for that slot. The keeper's separate submit and execute transactions make this reachable.
2. Low. askBackup in the final seconds of a slot pays 0.5 IMD for a request whose deadline is one second away. The answer is always ignored and the slot's backup right is used up. Permissionless, so a bounded griefing of donated IMD.
3. Info. A regulator key byte of 46–255 is clamped onto RepairHours instead of ignored.
4. Info. Regulator execute reads modules 12, 11 and 4 unconditionally, so a Params-only answer accepted between bind and job B cannot execute and expires after a day.
5. Info. maxPrice equals the live oracle price exactly with no setter, so any price rise disables backups forever. This matches the no-owner design and belongs in the launch notes.

Coverage. All seven SwarmDesk entry points are traced, plus the eleven module functions the Desk calls and GameRegistry.register. The remaining entry points are marked as outside the assigned area with that reason stated, per the assignment's rule for out-of-area rows.

The review is complete and .imd-findings.json is written. Only that file is new in the tree. No source, config or test files were changed.

Result: no critical, high or medium defect in SwarmDesk. Nothing in the Access Control, Trust Gap or Asymmetry guides produced a reproducible blocking defect, so the launch is not stopped by this review.

What I verified

• Build and words. The repo build reproduces the pinned creation hash exactly. The packed policy word decodes to chain 1, window 26122900 to 26122901, max price 0.5 IMD and 200 bps. The existing bootstrap tests confirm an unbound deploy with no constructor external call and the pinned game config hash.
• Permission model. The Desk has seven entry points, no owner, setter, receive, fallback, withdrawal or upgrade path. Callbacks are restricted to the intake and delivery contracts. The relay and execute paths carry no authority of their own: every answer must be signed by the attester in this Desk's EIP-712 domain for one of the two pinned question hashes, is consumed once per UUID and once per stream slot.
• Bind proof soundness. The whole proof rests on the ProjectFactory's predictContract depending on init code. I checked this on the live Robinhood Chain factory: changing one byte of init code or the index changes the predicted address. The attester address holds no code, so no ERC-1271 path exists. The residual twin race is the documented M-2 griefing and nothing more.
• Asymmetry between the Desk's pre-checks and the module guards. Every module call that execute makes outside a try/catch has its revert conditions mirrored by the Desk, with one exception already accepted as the known cap-rollback item. The Params step, bounds and cooldown logic matches exactly. The heartbeat share the swarm can raise feeds a 1 ETH capped keeper pool, not the Desk, so nothing gets locked.

One new low finding. The paid backup is permissionless and nothing ties it to a heartbeat actually having failed. Any caller can make the Desk spend 0.5 IMD per slot, about 2 IMD per day, draining donated funds while the free relay is healthy. It is bounded griefing with no attacker profit, so it is low, and it belongs in the launch notes since the accepted known-issue list does not record it.

Coverage. All 156 listed entry points plus three invariants have rows. The seven SwarmDesk functions and every module function the Desk calls or gates were traced. Entry points outside the area that the Desk never touches are marked as holding with a note that their internals were not reviewed in this pass, as the assignment instructs.

The review is complete and .imd-findings.json is written with 3 findings and a 159-row coverage record. No source files were changed.

Outcome: nothing blocks this launch. I found no critical, high or medium defect in SwarmDesk under the Economic Security, Invariant and Flow Gap guides. The constructor words regenerate byte-identically from the committed config, the policy word decodes to the stated values, and the built creation code hashes to the pinned value.

Findings recorded

• Low, epoch-boundary rejection of valid heartbeats. The accept path in src/SwarmDesk.sol:333 requires the answer's base epoch to equal the live epoch exactly, while the execute path tolerates one epoch of drift. Epochs are six hours and end six hours after each permissionless advance, so the boundary drifts through the few-minute heartbeat window periodically, and anyone can front-run a relay with an epoch advance when one is due. Each affected slot loses its plan unless a backup is bought for 0.5 IMD. I reproduced this with a Foundry test that passes on the current tree and is attached as proof.
• Low, immutable oracle configuration. The price cap, signer, intake and action can never change. An Intake repricing above 0.5 IMD disables backups forever and a signer rotation disables every oracle path. This is the documented no-owner design, recorded as a known issue.
• Info, first valid attestation per slot wins. Anyone who buys a second attester-signed answer to the pinned question picks which one the Desk acts on. The Desk's hard bounds cap the effect. Recorded as a trust assumption for the launch notes.

What held

• askBackup spending is bounded to roughly 2.07 IMD per day of donated balance and is only possible when no answer landed in the slot's first hour.
• Every swarm-gated callee was traced against the Desk's clamps: the Params double clamp can never make set revert, all 45 Params defaults sit inside their bounds, the severity band and epoch window sit inside the grid's checks, and every optional Civic or PackSale action is wrapped in try.
• bind proves both Params and GameRegistry through pinned creation hashes and factory CREATE2 prediction. The twin race remains the documented M-2 assumption.

Coverage. All seven SwarmDesk entry points and the swarm-called functions on Params, GridOperator, Civic, Enhancement, PackSale and GameRegistry are traced in depth. The remaining entry points are not deployed in this launch and are never called by the Desk, so they are marked as untouched by this area rather than examined.

Added failure-path tests, 9,000 fuzz cases, and stateful invariants covering 16,384 calls. Exact creation hash and unbound bootstrap verified.

forge build and forge test pass: 319 passed, 0 failed, 6 fork tests skipped.

Only test/ changed. Accepted issues are recorded in launch notes. No live deployment was performed.

Review complete. The findings file is written and validated. Nothing in SwarmDesk rises to medium or above, so this launch should not be stopped.

Outcome

.imd-findings.json holds 9 findings (4 low, 5 info) and a 156-row coverage record. Every finding was reproduced against the code with a scratch Foundry test in test/scratch/JudgeRepro.t.sol (8 tests, all observe the stated behaviour) plus the specialist's epoch-drift proof run as test/scratch/EpochDrift.t.sol. No source file was changed.

What I kept and merged

• Low: expiry boundary (expiresAt == block.timestamp or acceptance in the slot's last second burns the slot); askBackup at slot end pays for an unanswerable request; askBackup is permissionless and spends donations while the relay is healthy; heartbeat rejected when FarmRewards.epoch() advances before the relay.
• Info: answers accepted before job B cannot execute (flow and math duplicates merged into one); unsigned AnswerIgnored emission; out-of-range key clamps to RepairHours; immutable price cap/signer/intake (two specialist findings merged); first valid attestation wins.
• The last three info items are the same mechanisms as the requester's already accepted known issues 1c443300, ec0a447e and 5023720b, and are labelled as such.
• Dropped: nothing failed to reproduce. The specialist's attached proof passes on this tree, so it demonstrates rather than fails, and no finding here is severe enough to require one.

Independent checks I added

• Creation-code hash of the repo build equals the pinned 0x65968358…5745; runtime is 20,797 bytes.
• The policy word decodes to chain 1, blocks 26,122,900 to 26,122,901, max price 0.5 IMD, 200 bps, reserved bits zero.
• SwarmCode's Registry and Params pins match this build of GameRegistry and Params.
• Traced every module call execute makes (Params.set, submitPlan, announce, announceCap, pause/unpause, the try/catch Civic calls) and found no revert the Desk does not already pre-check, apart from the accepted b2ccff16 cap-announcement case.

Coverage

All seven SwarmDesk entry points plus the twelve module functions the Desk calls are answered as holds or finding. The other 137 entry points belong to contracts this launch does not deploy and the Desk does not call. I marked them unreached rather than copying the specialists' verdicts.