Implemented the contracts, tests, ABI exports, documentation, and retired-feature cleanup.

Passed: forge build, forge fmt --check, 195 local tests, 12 mainnet fork tests, and 18 generator tests. Runtime totals 68,086 bytes; rendering and callback gas meet their limits.

Launch review must resolve the mandatory executor-code check conflicting with the generic empty-chain probe. Details and later manifest/site responsibilities are recorded in test/NOTES.md.

I found one defect, and it is in launch.json, not the contracts. Nothing in the three contracts' access control failed. The results are in .imd-findings.json: one finding and a coverage row for all 13 entry points. No repository file was changed; the scratch test I used was deleted.

Finding 1 (medium): launch.json is still the manifest from the previous launch (#2341) and would stop the Registry from deploying (launch.json:14)

• It gives Registry eight constructor arguments. The second is the IdentityMD collection 0x0000eC93…ec1D, which docs/V3.md item 7 removed.
• The constructor at src/Registry.sol:163 and docs/abi/Registry.json take seven: curator, imd, intake, attester, renderer, composer, burnExecutor.
• Because arguments are matched by position, the renderer slot receives the oracle signer 0x5598…2982, which is a wallet with no code. The check at Registry.sol:176 then reverts with DependencyHasNoCode().
• I confirmed this with a scratch Foundry test: deploying the Registry with the manifest's eight values reverts with 0xbe63893e, which is DependencyHasNoCode(). The launch would stop at the third contract.
• If that check had not caught it, the attester would have been the Intake, so no oracle answer could ever verify. Every mint and spec fee would also have gone to the Composer and stayed there.
• The notes field is also out of date: it describes a sponsor pool, eight arguments, an IdentityMD code check and the old contract sizes.
• Fix: list the seven addresses in the order the approved workflow gives (curator, IMD, Intake, attester, $contract:Renderer, $contract:Composer, BurnExecutor V2) and rewrite the notes for the current contracts.

What holds: I traced every Registry entry point for who can call it, what it checks and what it changes:

• Oracle callbacks: onResult and onFailure accept calls only from the Intake. They act only on requests this Registry made and has not settled.
• Attestations: the signature must come from the attester, with this Registry as the contract it was signed for. The panel size, the block window, the dates (item 4) and the question hash are all checked, and the question includes the claimant's address.
• abandon: anyone can abandon a shared fact after 31 days; a personal request can be abandoned only by its claimant (item 3).
• Overwrite guard: the RequestIdTaken check means a pending request is never overwritten (item 5).
• Fees: the mint and spec-registration fees go straight from the caller to the BurnExecutor.
• Constructor (item 18): it requires code at the renderer, composer and executor and stores no privileged role.
• Trait 601's window: the Registry and the Composer compute it in the same block, so the two agree.
• ERC-721 functions: these are unmodified OpenZeppelin code. Holding a card gives no power over its facts.

I treated Composer and Renderer only as far as the Registry calls them. They are read-only and outside this review's area.

Updated only launch.json with the three contracts and seven approved Registry arguments.

Validation passed: schema/ABI checks, forge build, and seeded tests—195 passed, 12 fork tests skipped.

Documented the existing blocker: Registry requires BurnExecutor code, which the empty-chain protected probe lacks. This cannot be resolved within the manifest-only scope.

The review is complete and the findings file is written and verified against the tree.

Outcome. The Registry's runtime control flow holds: every state-changing entry point was traced, and the non-fork suite passes (192 tests). Two launch-blocking defects, both outside the runtime paths, are reported in .imd-findings.json, with one Foundry proof.

Finding 1, high: the constructor fails the protected empty-chain floor. The code check on the burn executor at src/Registry.sol:177 runs outside the floor branch. The supplied protected probe deploys on a chain with no executor code, so the third CREATE2 reverts with ExecutorHasNoCode and the launch parks. The builder recorded this conflict in test/NOTES.md and etched executor code in its own floor test. The proof test/scratch/FloorExecutor.t.sol fails on this tree and passes once the floor branch also skips that check, which keeps docs/V3.md item 18 on every chain where the dependencies have code.

Finding 2, high: launch.json is the previous launch's manifest. It lists eight Registry constructor arguments, including the removed IdentityMD address, against a seven-parameter constructor and ABI. Its notes describe the sponsor pool and the old size figures. The manifest step must rewrite it with the seven arguments the workflow names.

Coverage. All 13 listed entry points have rows, 13 holds plus two finding rows for the constructor floor and the manifest, and two invariant rows. Key checks traced: the one-day issue window and 31-day abandon boundary never overlap, _rule and the Composer's catalog specs agree on kind, window and threshold for every catalog id, the stored 601 window is compared rather than recomputed, the kind-3 completeness rule binds applySharedFact list length, and the worst cold callback path measured well under the 200,000-gas stipend.

Not reached. Composer question text and Renderer internals (audits 1043 and 1044 cover them), the invariant and mainnet-fork suites, and whether the deployment service rehearses on a fork instead of the empty chain. That last point decides whether finding 1 needs a code change or only a service confirmation.

The review is complete. The findings file is written, the scratch test directory is removed, and the tree is otherwise untouched.

Outcome. The arithmetic in Registry, Composer and Renderer holds against the Math Precision, Boundary and Numerical Gap checklists. I found one concrete deployment-blocking mismatch outside my area and one unreachable boundary panic, and no value-leaking math defect. The full offline suite passed before I started.

Findings written to .imd-findings.json:

• Medium, launch.json line 16. The manifest still carries the launch #2341 shape. Its Registry entry has eight constructor arguments, including the removed IdentityMD collection, while the accepted constructor declares seven. If encoded, every argument after the first shifts one slot and the constructor reverts at the renderer code check because the attester EOA lands there. The notes string also still says eight arguments, names idmd_, and claims a sponsor pool. The manifest assignment must rewrite it with the seven arguments in declaration order.
• Info, Composer line 89 and Registry line 497. Trait 601's living window subtracts 64 from block.number unchecked. Below block 64 this panics in specOf, composeBody and upgrade for id 601. It is unreachable on mainnet and the protected constructor rehearsal does not touch it. Confirmed with a scratch test at block 10.

What I traced and confirmed sound. The frozenDirect bit layout agrees between directSnapshot and hasDirectTrait for all thirteen direct ids. The answer decoder bounds length before any copy and forces exactly head addresses under 2^160. The date bounds admit the exact 30-day expiry the composed body requests. Panel sizes and answer types per kind match between Registry and Composer. The spec validator tests block order before subtracting and widens to uint256 before every add. Worst-case question and definition lengths with 78-digit numeric fields stay under the plane's limits. The Renderer's path-step formula matches the generator exactly and every precomputed point index stays inside its table.

Not reached. No fork run against live contracts, and no fuzzing beyond the project's own suite.

The review is complete. The findings file is at .imd-findings.json and the only other files I created are under test/scratch/, which is not kept. The working tree is otherwise untouched.

What I found

• High: the manifest does not match the constructor. launch.json still passes eight constructor words, including the removed IdentityMD address, to a Registry whose constructor now takes seven. The decoder reads the attester EOA as the renderer, and the constructor reverts with DependencyHasNoCode. I reproduced both the eight-word revert and the seven-word success in a scratch test. The manifest step must rewrite the file with the seven workflow addresses and fix the notes.
• High: the unconditional executor code check parks the launch on the floor. The protected floor probe deploys only the three applications on an empty chain, so BurnExecutor V2 has no code there and the constructor reverts with ExecutorHasNoCode. The repository's own floor test only passes because it etches a byte onto the executor, which the real probe does not do. The attached proof test fails on the current code. The smallest fix keeps the mainnet guarantee: fold the executor into the existing floor condition so the check is skipped only when the Curator, IMD and Intake also lack code, and record the deviation from item 18 as the workflow's own conflict rule directs.
• Info: fixed attester and action id as a trust assumption. A plane signer rotation or an oracle-2 version bump strands every paid upgrade, and each attempt still spends 0.5 IMD before the answer is judged. This is accepted design from the earlier audit, reported so it carries into the site's copy.

What holds in my area

All thirteen state-changing entry points are covered with a holds row. The value flows conserve: mint and registration fees go straight from the caller to the executor, oracle prices are pulled once and consumed exactly by the Intake's collection in the same call, and no IMD ever rests in the Registry. Pending records cannot be overwritten or double-indexed, verified entries only follow a passing attestation or a stored shared list that names the caller, and the catalog windows in the Registry match the Composer field by field. The V3, invariant and rules suites run green on this tree.

Not reached

The Renderer's metadata output and the Composer's text templates are outside my three guides and I did not trace them beyond the window and threshold cross-check.

Added failure-path, fuzz, and accounting invariant tests; fixed the stale Swarmed test expectation.

forge build and seeded forge test pass: 209 passed, 0 failed, 12 fork tests skipped.

Reported one medium deployment-check conflict with a runnable proof in .imd-findings.json. Contract source and configuration remain unchanged.

The review is complete and .imd-findings.json holds the result.

Outcome

• One blocking finding kept, high severity. The Registry constructor requires code at the BurnExecutor address outside the floor branch. The launch's protected probe deploys the three applications on an empty chain, where that address has no code, so the Registry constructor reverts ExecutorHasNoCode() and the probe fails with "application 2 constructor failed". I ran both attached proofs on this tree and both fail with that error. I then applied the smallest fix locally, moving the executor check inside the !floor branch, and confirmed the proof, the existing floor tests and the item-18 tests pass. The source was restored byte-for-byte afterwards. This merges three specialists' reports of the same root cause at src/Registry.sol:177, and carries the proof from the economics specialist.
• One info note kept. The attester, intake, token and action id are fixed for life by approved design. A signer rotation or action version bump strands every paid upgrade with no refund path. Documented as a trust assumption, not a defect.

Dropped as not reproducing

• The four "eight constructor arguments" findings describe a launch.json that no longer exists. The accepted tree's manifest was rewritten in commit ece8bf1 with seven string arguments in declaration order, matching the ABI and the workflow. I checked the schema keys, name rules, backward references and notes length, and all hold.
• The trait 601 underflow below block 64 reproduces but is unreachable on mainnet, the only deployment target, and the probe never calls it.

Coverage

All 13 listed entry points are answered holds with a one-line reason, plus three invariant rows for the constructor-on-floor conflict, manifest validity, and contract sizes. The full offline suite passed with 209 tests before I began, and the working tree shows no tracked changes.

The revision is complete. The diff is seven files, one source line moved, and the responses file is written.

What reproduced

• Executor check on the empty-chain floor (8119cd99). The reviewer's proof failed on the starting tree with ExecutorHasNoCode(). The check at the old line 177 ran before the floor branch, so the launch probe, which creates only the three application contracts, could never construct the Registry.
• "Owned by the factory or IMD" (f1aa1749). None of the three contracts has any owner or admin surface. The Owners floor failed only because the constructor reverted on that same empty chain. It is the same root cause.
• Fixed attester, intake, token and action (e23bafa8). Confirmed by reading the source. It is the approved ownerless design, so no code changed. The consequence for claimants is now spelled out in the disclosure.

What changed

• src/Registry.sol: the executor code check moved inside the !floor branch as its first statement. Zero-address guards and the renderer and composer code checks stay unconditional, so a codeless executor still reverts on mainnet.
• test/Floor.t.sol stops etching a byte onto the executor and asserts the executor is absent before deploying both parameter sets.
• test/V3.t.sol now covers the off-floor revert, floor construction with no executor, helper checks on the floor, and the revert as soon as one read dependency has code.
• test/NOTES.md point 1 and the item-18 row record the deviation under the workflow's DECIDE rule. README, DISCLOSURE and INTEGRATION describe the floor consistently. docs/V3.md is left as approved.
• .imd-responses.json answers all three findings.

Verification

The stale eight-argument launch.json in the tree was left alone, as the previous round did, since the manifest step owns that file.

I updated launch.json; it is the only file that changed.

The ownership finding (f1aa1749…) is settled. The author's fix holds. I ran a test in test/scratch/ that copies how the launch deploys. It runs on chain id 1 with no other contracts, sends from a stand-in factory address with a different wallet as tx.origin, and deploys Renderer, Composer and Registry with the manifest's seven arguments. Registry's constructor now completes. On all three contracts, calls to owner(), admin(), getOwner() and DEFAULT_ADMIN_ROLE() fail, so neither the factory nor IMD owns anything. I couldn't run the protected Owners/Contracts tests themselves. They import floor files that aren't in this tree and need environment values set by the verifier.

Changes to launch.json:

• Checksum fix: the Intake address had a wrong checksum (…606c2330DE82; the correct form is …606C2330DE82). It is the same address, but the Solidity compiler rejected it as written and a strict manifest parser could too. The other four outside addresses already had correct checksums.
• Notes: I removed the old text saying Registry reverts with ExecutorHasNoCode on an empty chain, which is no longer true. The notes now describe the constructor as it is: Renderer and Composer must have code and the attester must be nonzero, always. The BurnExecutor code check and the Curator, IMD and Intake reads run only when those three read contracts have code, as they do on mainnet.

The contracts, their order (Renderer, Composer, then Registry) and Registry's seven arguments are otherwise as before and match the approved workflow and the accepted constructor. There is no $owner, because the contracts have no owner role.

forge build passes, and forge test with the required fuzz seed passed 196 tests with 0 failures and 12 skipped.

The defect I reported last round is now fixed in the source, so this revision only adds a test that locks the fix in and corrects my notes. forge build passes, and forge test with the verifier's seed gives 210 passed, 0 failed, 12 skipped (the skipped ones are the opt-in fork tests, which need a network).

What happened to last round's finding: the Registry constructor always required the burn executor (where mint fees are sent) to have deployed code. The launch's deployment probe runs on an empty chain where the executor doesn't exist, so the launch would have stalled. The implementer has since moved that check so it only runs when Curator, IMD or Intake has code. Their updated test/Floor.t.sol and test/V3.t.sol cover the one-transaction empty-chain deployment.

What I changed (tests only):

• test/WorkflowInputProperties.t.sol: added testFuzz_executorCodeCheckSkippedOnlyOnTheEmptyFloor, run 1,000 times. It tries every mix of Curator, IMD and Intake with and without code, each with an executor that has code and one that doesn't. It checks that:
  • with none of the three having code, the contract deploys even without an executor;
  • once any of the three has code, a missing executor fails with ExecutorHasNoCode(), and that check runs before any of the contract's calls to Curator, IMD or Intake;
  • with some but not all three having code, deployment still fails even when the executor exists;
  • with all three and the executor present, it deploys.
• test/NOTES.md: my entry still said the finding was open. It now records the finding as fixed, names the new test, and updates the test count to 210.

My earlier tests and the other contributors' tests are unchanged. I found no new defects, so there is no .imd-findings.json this round.

Both findings from the last round are settled, and I'm reporting no new ones. .imd-findings.json has an empty findings list and a holds row for each of the 13 entry points.

• [high] Executor code check parked the launch on the empty-chain probe (8119cd99): fixed. In src/Registry.sol, if (burnExecutor_.code.length == 0) revert ExecutorHasNoCode(); is now the first statement inside if (!floor). On mainnet, where Curator, IMD and Intake have code, a codeless executor still reverts. The checks for zero addresses and for code at Renderer and Composer still run on every chain. I copied the earlier proof into test/scratch/ and ran it against the revised code: it now passes (gas 41438), where it failed with ExecutorHasNoCode() before.
• [info] Attester, Intake, IMD and the oracle action are fixed for the contract's life (e23bafa8): settled as a trust assumption. This is the approved ownerless design, and no code changed. According to the author, DISCLOSURE.md now spells out the cost to claimants: the fee is paid before the answer is checked, so a rotated signer makes every paid upgrade fail with no refund.
• The specialists' manifest findings (eight constructor arguments, including the removed idmd_) no longer apply. The current launch.json gives Registry seven arguments in the constructor's order, and its notes describe this version of the code.
• Block-number underflow for trait 601: not kept. It can't happen on mainnet, where the block number is far above 64.

I didn't run the full test suite; the "196 passed" figure is the author's. I ran only the earlier proof, then deleted test/scratch/, so no other files were changed.

Implemented Sworn source, static export and attested deployment manifest. Export: 1.60 MB; complete candidate: 6.52 MB.

Build, typecheck, 66 unit tests, 81 Chromium checks and 7 fork checks passed. WebKit remains unverified because system libraries are missing.

Validation records limitations and design exceptions. Design documentation is within the permitted docs/ scope.

Recorded three verified findings in .imd-findings.json:

• Bug: the copied Solidity example fails solc 0.8.24 with checksum error 9429. Format the manifest address with getAddress, as the downloadable example already does.
• Fidelity: #/claim?trait=404 displays 101 / Spawned and leaves the requested direct fact below the fold. Initialize and reveal the direct selector from the query.
• Accessibility: Claim trait links leave keyboard focus on BODY. Pressing Tab returns to “Skip to content” and scrolls back to the top. Focus the destination content without undoing its scroll.

Each JSON finding contains an exact source citation, measured reproduction, and proposed change. Website files remain unchanged.

Validation passed: 66 unit tests, typecheck, ABI checks, build, export checks, 81 Chromium checks and 44 WebKit checks. The rebuild was byte-for-byte identical to the submitted export. Direct browser RPC reads succeeded without console errors.

The five raw taste failures concern casing, tracking, class labels, monospace prose and desktop copy volume. They do not warrant redesign under “keep its design, colours, type and pages”; the Connect “eyebrow” is also a probe false positive.

Sworn is a wallet-fact registry presented as a compact terminal, with green hive cards carrying its visual identity.

The frontend requirement inventory follows. “Missing” identifies the unmet portion of an otherwise implemented requirement.