Approved workflow

Build VolatilityGuard Lab end to end in one multi-step job: implement and test the Uniswap v4 hook and VGL token, independently review the contracts and deployment manifest, deploy and seed the pool on Sepolia through the verified launch pipeline, then build and publicly host a working RainbowKit React swap and observability dapp using the verified deployment. Publish source and provide live URLs and transaction links.

The user explicitly approved one complete multi-step swarm task, including contracts AND the live website. Do not omit, defer to a manually submitted task, or silently split out the frontend. Coordinate the deployment-address handoff within the workflow. GitHub publication, public IPFS website hosting and the existing Sepolia univ4_hook launch policy are authorized. No mainnet deployment. Use the Uniswap v4/security/DeFi reference skills. Two workers are online; preserve independent final review and schedule true dependencies honestly.

Build VolatilityGuardHook: a complex but coherent Uniswap v4 market-regime protection hook, then deploy a working demonstration pool to Sepolia through the existing univ4_hook launch pipeline. Produce real implementation, tests, adversarial findings, gas measurements, deployment manifest, ABIs, and integration documentation.

Implement per-PoolId isolation; a bounded observation ring and time-weighted reference tick; bounded EWMA volatility; adaptive per-swap price-deviation limits; a rolling volume budget resistant to transaction splitting; and NORMAL/WARMUP/GUARDED/RECOVERY states with explicit stale-history, low-liquidity and cooldown behavior. Protect callback entry to the canonical PoolManager. Authenticate anything that affects accounting; never trust a router-supplied sender or hookData as proof of identity. Define exact-input and exact-output behavior in both directions, numeric units, rounding and caps. Keep every callback bounded in time/storage. Liquidity removal must remain possible in every guard state. Demonstrate how blocked swaps and reverted transactions affect state: a revert cannot persist a breaker transition. No claim that an internal pool TWAP prevents all manipulation or MEV. Prefer permissionless, deterministic recovery and immutable bounded defaults; do not introduce an unspecified admin wallet.

Deployment compatibility is mandatory: use ordinary static LP fee 3000, tickSpacing 60, paired native Sepolia ETH (zero currency address), initial sqrtPriceX96 79228162514264337593543950336. Dynamic-fee pool flags are outside the current launch manifest/policy and are not required. The hook must support arbitrary pool currencies for the protected floor, no hardcoded token-only restriction. Seed observations safely at initialization and choose non-bricking warmup defaults compatible with normal liquidity and swap flows. Include a distinct fixed-supply demonstration ERC20 named Volatility Guard Lab, symbol VGL, 18 decimals, no constructor arguments, exactly 10^27 units minted to its deployer, no mint backdoor. The system factory deploys token/hook, mines permission bits and seeds liquidity; workers never receive keys or broadcast. Use the real Sepolia PoolManager at 0xe03a1074c86cfedd5c142c4f04f1a1536e203543 and verify its published address. No other deployed helper may be required for launch: use existing verified v4 periphery or document a supported public router and exact calldata for the subsequent website.

Build a standalone Foundry tree with source, vendored pinned dependencies, tests, and bytecode_hash=none; offline forge build, forge test and forge fmt --check must pass. Include deterministic stress simulations, fuzz/property tests for accounting conservation, cross-pool isolation, ring wraparound, same-block updates, stale/zero-time history, decimals, overflow, fee/amount signs, split swaps, flash manipulation, donation/griefing, reentrancy, unauthorized callbacks, initialization, legitimate large trades, guard recovery and LP exits. Run at least 10000 fuzz cases for key properties where feasible and record actual counts, counterexamples and limitations, never invented passes. Reviewers must attack the design and deployment configuration and report severity, concrete exploit/reproduction and affected code. Resolve blocking findings through the normal repair loop before deployment. Passing tests is not an audit certificate.

Deliver docs/architecture.md, docs/threat-model.md, docs/frontend-integration.md, artifacts/gas.md and machine-readable frontend integration data: ABI JSON, exact pool-key construction, quote/swap/add-remove liquidity call recipes using verified existing periphery, custom error decoding, event schema, decimals, units, history bootstrap, and four reproducible demo scenarios (calm, burst/split volume, price shock, recovery). No fabricated chain addresses/transaction hashes. Distinguish local simulation from observed Sepolia behavior. Include precise positive and negative test vectors so the React dapp can plot tick/TWAP, volatility, allowed deviation, volume budget, current state and recent swaps.

The same end-to-end job must deliver and publicly host a React + Vite + TypeScript dapp with RainbowKit wallet connection and wagmi/viem. Put frontend source under web/ and final static export under dist/. Make an ETH/VGL swap card the primary interface: You pay/You receive amount boxes, token selectors, direction reversal, balances, gas-aware maximum amounts, live quotes, slippage, minimum received, explicit approval and swap buttons. Execute real Sepolia swaps through this hook-enabled pool using verified existing periphery. Show pending, rejected, reverted and confirmed transactions, decoded hook errors and explorer links. Never invent deployment addresses or quotes; obtain the accepted launch addresses, pool key and ABIs from the verified deployment before final integration. Document any WalletConnect project-ID configuration while supporting injected wallets.

Display live tick/price, reference TWAP, volatility, allowed deviation, rolling volume budget, warmup/guard/recovery state and recent swaps with timestamped charts and bounded event reads. Include calm, split-volume burst, price-shock and recovery demonstrations; clearly distinguish local simulations from real chain state. Every live transaction requires wallet signing. Include usable liquidity-exit controls where the connected wallet owns a supported position. Make read-only views accessible without connecting. Test quotes, approvals, swaps in both directions, wrong-chain/disconnected wallets, user rejection, guard reverts, insufficient funds, RPC failures and simulator parity. Verify the production build and responsive UI. Publish source to GitHub and the working static dapp through the publisher; return website URL, source links, deployment receipts, test results and limitations.

Required workflow: implementation and tests -> deployment manifest -> independent adversarial review -> protected verifier and policy admission -> Sepolia deployment -> verified deployment handoff -> complete and test frontend integration -> public website publication. Do not claim completion until both contracts are deployed and the actual swap site is published. Workers never receive deployment keys or broadcast deployment transactions themselves.