Done. Summary of the work:

What I verified first (live API, read-only GETs)

• The duplicate is real. GET /publications?q=subscription returns 2 items; one is workflow:b41fdc9b-e5bf-4bae-b3a9-070eb80327ef — Cadence (CDNC), launch 87, live, SubscriptionRegistry at 0x7bf4926e59d2fc450dc48e2ba88d8f3df361d64e: "anyone pays a fixed CDNC amount per thirty-day period to keep a subscription active … isActive(address) reads on chain". The old 06 (Access Pass/PASS) was the same product. The finding holds.
• The README exclusion claim was false in two places, not one: it claimed both "subscription-adjacent access products" and "credentials/badges" were excluded while the pack shipped 06 (a pass) and 10 (a credential verifier).
• I paged the whole catalogue (521 publications, 27 pages) and the identity-md-launches org (512 repos) to pick a shape that is actually absent, and saved every response body under test/scratch/fixtures/live/.

Changes

• workflows/06-subscription-pass.json removed; workflows/06-custody-handoff.json added — Custody Chain (CSTD), a chain-of-custody handoff log: shipper opens a consignment for a bytes32 manifest hash, the current holder offers the next leg paying a fixed CSTD carriage fee, the named holder collects it by accepting custody, and an offer unaccepted for exactly 7 days can be withdrawn. Written in the same voice/structure as the other nine bodies.
• Searches showing no duplicate: custody chain, chain of custody, consignment, shipment, freight, cargo, courier, logistics, bill of lading, proof of delivery → 0 results each. custody (6) and handover (2) return only publications that use the word in passing, each listed with why. Also recorded: the subscription search that retired the old 06, and badge/credential for entry 10.
• results.json — regenerated by a full node check-workflows.mjs run: all ten bodies HTTP 200, judged: true, no blockers, no suggestions, including the new 06. It now carries publicationSearches (15 dated queries with every returned publication).
• check-workflows.mjs — one addition: a PUBLICATION_SEARCHES constant the report copies into results.json, so a re-run can't silently drop the record (the script rewrites the file wholesale), plus one --help line. Validation, request and retry behaviour untouched.
• README.md — entry 06 rewritten; the duplicate-check section now states exactly what the ten shipped bodies avoid and says how SKIL differs from the live Badges (BDGE) launch 760a7259 (BDGE mints permissionless ERC-721 badge types for an anti-spam burn, no expiry, holder-side burn; SKIL mints nothing and keeps issuer-scoped records with an evidence hash and a uint256 expiry). Counts updated to the re-paged catalogues.
• CHANGELOG.md — created, one entry per item above, carrying the experimental banner. The banner is unchanged in the README, the script and the site.

Notes, not acted on

• The /requests/check judge is non-deterministic. On my first full run, the untouched 09-returnable-kit.json came back with a transient evaluation_unavailable blocker; three immediate retries were clean, and the committed results.json is from a re-run where all ten are clean. The script only retries transport/5xx errors, so a 200 carrying that blocker gets recorded as a refusal — that retry policy looks deliberate ("an API refusal is still a recorded response, not a silent success"), so I left it alone. Worth knowing when reading a future run.
• The task mentioned saving live bodies under fixtures/live/; that path is outside my path budget, so they are in test/scratch/fixtures/live/ (not submitted). The evidence that matters — every query, its count and every publication it returned — is in results.json, which is delivered.
• site/index.html names no products, so it needed no change.
• The deletion of the old 06 is staged and the two new files are untracked;

Review complete. No tracked file was changed. Findings are in .imd-findings.json at the repository root, and every snippet was verified against the tree at its stated line.

Assignment result: the new body 06 (Custody Chain, CSTD) duplicates no live launch. I queried the live publications API myself on 2026-10-02 for 27 keywords and paged the whole catalogue (521 items, matching the README). The ten queries the author recorded as empty are still empty. "custody" returns 6 items and "handover" 2, with the same ids the author recorded, and none is a custody product. A local scan of every live or parked launch for custody, consignment, shipping, provenance, handoff and related wording found only the word used in passing. The nearest names, Pass the Parcel (PRCL) and the Bazaar marketplace (BZR), are a Uniswap hook pot game and an NFT marketplace. The free check endpoint still returns judged with no blockers for body 06. GitHub org and page counts in the README also match.

Findings, ranked:

• High, README line 33. The rewritten exclusion sentence says Skill Credential is the only shipped shape close to a live launch. The live ?q=escrow search returns Two Party Escrow (ESCR, launch 61), whose state machine is step for step what body 08 Repair Deposit requests, with a device hash label and a non-binding completion step added. Bodies 02 and 09 are the same two-party deposit shape under other labels, and Handshake (SHAKE) and Arbiter (ARBT) are also live. Whether labelled escrows count as duplicates is the requester's call, but the README claim is false either way, and no escrow, deposit or repair search was ever recorded.
• Medium, check-workflows.mjs line 20. The task asked for the live response bodies to be saved under fixtures/live/ or test/. Neither exists, and results.json holds only a hand-typed summary constant with no raw API response. The summaries are currently accurate, but the acceptance item was not delivered.
• Low, results.json line 83. The body's own headline word "handoff" was never searched. The live API returns 115 hits for it. I read every live or parked launch among them and none is a custody product, so the conclusion holds, but the record is incomplete.
• Info, check-workflows.mjs line 154. The searches are a frozen constant copied into every run, including offline validation runs, so a later results.json shows a fresh timestamp beside a dated duplicate check. The ranOn field keeps it honest.

Live response bodies I relied on are saved under test/scratch/live/ for the record, which is discarded before submission.

Your organization has disabled Claude subscription access for Claude Code · Use an Anthropic API key instead, or ask your admin to enable access

The accepted Custody Chain body remains workflow 06. I rechecked it against the live publications API and the free check endpoint: it returned HTTP 200, was judged, and had no blockers or suggestions. The final results.json records the same clean result for all ten bodies.

The reopened findings are addressed in README.md, CHANGELOG.md, and the search record:

• Escrow overlap — fixed: the README no longer calls Skill Credential the only close shape. It names ESCR, SHAKE, and ARBT and explains the gates in the shipped deposit bodies. Those accepted bodies were left intact.
• Live evidence — fixed: 26 raw API response pages for 19 searches are indexed in manifest.json.
• handoff search — fixed: it is recorded with all six response pages; none describes a custody or consignment product.
• Static search record — confirmed: --validate remains offline and the catalogue record remains dated.

git diff --check, JavaScript syntax, saved-page counts, and the live check results passed. I did not create .imd-responses.json: the task’s explicit path allowlist excludes that file. The verdicts are stated above and in the changelog.

Review complete. All three substantive findings from the previous round are fixed, and the only new items are a low path mismatch and an informational provenance note. The findings file is at .imd-findings.json; no other file was touched.

Previous findings, settled

• High, README escrow claim. Fixed. README line 33 no longer says Skill Credential is the only body close to a live launch. It now names Two Party Escrow (ESCR, launch 61), Handshake (SHAKE, launch 82) and Arbiter (ARBT, launch 232) and states how bodies 02, 08 and 09 differ. I checked each statement against the live titles in the saved escrow page and against the three request texts. ESCR allows buyer release, seller refund and buyer deadline reclaim. SHAKE gives the seller a deadline claim and a dispute split. ARBT has an arbiter and a seller claim after delivery. Body 08 gates reclaim on the job being uncompleted, 02 on host confirmation, 09 on a borrower return mark. All accurate. Whether labelled escrows count as duplicates remains the requester's call, and the CHANGELOG says the bodies were deliberately left intact.
• Medium, no saved live responses. Fixed in substance. Twenty-six response pages for nineteen queries are committed with a manifest. I re-ran all nineteen queries live today and diffed ids page by page: every saved page matches the live catalogue exactly, counts included. The only residue is that the folder is site/fixtures/live/ rather than the fixtures/live/ or test folder the task named. Reported as low.
• Low, no handoff search. Fixed. The query is recorded with 115 results across six saved pages, and the saved set equals the live set.
• Info, static search constant. Acknowledged in CHANGELOG as a design choice. Not a defect.

My assignment: does the new 06 duplicate a live launch? No. Beyond the pack's nineteen queries I searched the live publications for carriage, supply chain, provenance, tracking, delivery, shipping, leg and holder, paging through all results, and searched the identity-md-launches GitHub org for custody, consignment, handoff, carriage and shipment. Every live or parked launch returned matches on boilerplate or on unrelated products such as the NFT transfer escrow, Keyring, Lease and Pawn. Nothing is a multi-leg custody handoff with a carriage fee. A fresh free check of the 06 body today returned HTTP 200, judged, with no blockers and no suggestions, matching results.json.

Other checks that passed. The validator run in a scratch copy reports all ten bodies valid and exits 0. The experimental label appears in README, CHANGELOG, the checker, results.json and the site. CHANGELOG lists every task item.

New findings

One note not filed as a finding: README says the searches were rerun on 2026-10-03 while the manifest timestamp is 2026-10-02 at 22:11 UTC. results.json records the Europe/Berlin timezone, which reconciles the two, but README does not say so.