The review is complete. The findings file is written, every snippet matches its line in the tree, the scratch test is removed, and the working tree shows no other changes (the findings file is git-ignored).

Verdict: no blocking finding. Nothing in src/ or the build settings needs to change for the Sepolia rehearsal or the mainnet launch of this commit.

What I read. Registry, Composer, Renderer, Types, all five interfaces, the deploy script, the Intake v2 reference (request and complete paths), the test mocks and both protected tests. I did not read the two generated string tables (HiveData, TemplateData) line by line or the OpenZeppelin and forge-std libraries. I checked every state-changing entry point against the Pashov checklist: access control, value movement, reentrancy, arithmetic bounds, replay and the launch-forbidden patterns. There is no owner, proxy, initializer, setter, pause, DELEGATECALL or SELFDESTRUCT.

Evidence gathered.

• The test suite without the invariant and fork suites passes: 177 tests, 0 failures.
• The EIP-712 type string, domain name and version equal the protocol reference byte for byte.
• Runtime sizes are 24,561, 23,655 and 21,570 bytes, all under EIP-170, with no immutables.
• Live Sepolia reads today: the mock Curator reports settled, the mock IDMD and TestIMD have code, and the Intake prices the action at 0.5 TestIMD with a 1,000,000 gas callback stipend. The constructor's four non-floor checks therefore pass with the brief's exact arguments.
• The Sepolia V1 executor reverts on the preview selector, so sponsored claims take the BurnSkipped(1) branch as the brief states. Neither executor is a proxy or contains DELEGATECALL, so the preview's return shape cannot change under it.

Findings written to .imd-findings.json.

• Low: the per-IDMD-token lifetime allowance in upgradeSponsored restricts nobody, because claimSponsored draws the same pool under the same rules with no token gate. Confirmed with a scratch test: a wallet holding an exhausted token is refused on one path and served on the other in the same block.
• Low: upgrade names community specs by sequence number only, so a registration that lands first makes a claimant pay 0.5 IMD for a stranger's question. Confirmed with a scratch test. A fix would change the ABI, so it is reported and not applied.
• Info: the rehearsal relies on the plane signing attestation chainId 1 for a Sepolia-domain consumer. The reference supports this reading, but no attestation in the tree is for a non-mainnet consumer. The adapter should confirm it with the plane before spending TestIMD.
• Info: the documented short-return residual on the preview decode, verified non-triggerable for both configured executors.
• Info: the coverage note above, so the report in the file stands on its own.

Nothing is left for me to do here. The adapter can proceed with the manifest as specified: Renderer, Composer, then Registry with the eight arguments in the brief's order.

The project launches as it is, so I changed nothing in src/, lib/ or the build settings. Creation code with your arguments and the runtime code are the frozen candidate's build, unchanged. forge build passes. forge test --offline with the verifier's fuzz seed passed 182 tests with 0 failures. 17 fork tests were skipped because there's no RPC here. The new test also passes on its own.

What I added (tests and docs only):

• test/LaunchManifest.t.sol: deploys Renderer, then Composer, then Registry with your exact eight arguments. It runs on an empty chain with Sepolia's chain id, which is the case where the Registry constructor skips its dependency checks. It checks every stored address and the name and symbol (Sworn / SWORN).
• ADAPTATION.md: lists both changes and why nothing in the code had to change. It also gives the deploy order and arguments for the manifest step and covers each audit finding.

Why the code already fits the launch: all three constructors are nonpayable and take only addresses (Registry 8, the other two none). None of the contracts has an owner, so $owner isn't used. There's no proxy, initializer, setter, pause, DELEGATECALL, CALLCODE or SELFDESTRUCT.

Audit findings — none blocking, none changed code:

• Low, sponsor allowance: the per-token allowance on upgradeSponsored restricts nobody, because claimSponsored draws from the same pool without it. This is a sponsor-pool design decision, so I only reported it. Fixing it would mean different runtime bytes.
• Low, community spec ids: upgrade() picks a community spec by its number alone. If someone else's registerSpec lands first, the caller pays for that stranger's spec. Fixing it would change the ABI and the bytes, so I reported it and left it. Callers should wait for their own SpecRegistered event before calling upgrade().
• Info, Sepolia chainId: the rehearsal relies on the oracle signing chainId 1 for a contract in the Sepolia signing domain. This is your stated design decision and existing tests cover both cases. Nothing in the repository shows a real signed answer for a Sepolia contract, so confirm this with the oracle team before spending TestIMD.
• Info, preview decoding: a malformed preview reply from the burn executor could block every sponsored claim. Neither configured executor can return one, and it's already recorded in test/NOTES.md.
• Info, coverage: the auditor's summary of what they read and checked, not a defect.

The protected checks you supplied wouldn't compile here: they need a compiler version (0.8.26) that isn't installed and helper files that aren't in the repo. I couldn't run them, so they're left to the verifier.

I found one low-severity defect in the math, boundary and numerical-gap area, and nothing blocking for the launch. The results are in .imd-findings.json. I changed no files and wrote no Foundry proof, since proofs are only required for critical or high findings.

Finding (low): src/Registry.sol:635 — traitId = nextSpecId++;

• nextSpecId is a uint16 that starts at 10001. Once spec 65535 has been registered, every later registerSpec call reverts (arithmetic overflow, panic 0x11).
• The registry has no owner and no upgrade path, so community spec registration would stop for good.
• Reaching the cap costs about 355,424 IMD in spec fees (6.4 IMD each), and that money goes into the sponsor pool.
• To reproduce: set nextSpecId to 65535, register one spec (it gets id 65535), then try to register another. It reverts instead of returning a new id.
• The fix would be a wider counter type, which means different bytecode. This launch forbids that, so the finding stays non-blocking and is mainly something the docs should mention.

Coverage: All 16 entry points have a row: 15 hold and one (registerSpec) carries the finding. The checks that came out correct:

• Prices and fees: upgrade's price * k is overflow-checked, and the IMD it pulls equals what it spends. The burn-fee comparison and the 0.005 ETH cap work as the brief describes.
• Answer decoding: the answer's length is checked before it is sliced. The shared-fact list length (at most 64) fits in uint16 without loss, and the head limit is the smaller of the list length and the threshold (at most 32).
• Time limits: the abandon deadline (request time plus 14 days) cannot overflow. The UTC-day boundary for sponsored claims is correct. The per-IDMD-token cap allows exactly 9 requests.
• Spec windows: the spec window arithmetic is safe from overflow. The constants in mainnetHeightBound match the brief (block 15,537,395 at slot 4,700,014, 12-second slots).

I did not go through the rest of Composer and Renderer (string building and rendering) beyond validateSpec and mainnetHeightBound.

I found no access-control defects in src/Registry.sol, so .imd-findings.json holds an empty findings list plus one coverage row for each of the 16 entry points, all marked holds, and an extra row for the constructor. I changed no repository files.

What I traced, against the Access Control, Trust Gap and Asymmetry guides:

• Roles at deployment: the registry has no owner, setters, pause, upgrade, receive or fallback, and the constructor hands out no roles. The card (ERC-721) functions use the standard OpenZeppelin permission checks; overriding the transfer hook only adds a metadata-refresh event.
• Oracle callbacks: onResult and onFailure only accept calls from the Intake and only for a pending request the registry made itself. The request is cleared before any check runs. Answers must be signed by the fixed attester over a digest bound to this registry and chain, and the panel, block window, expiry and question hash are all checked. onFailure stores nothing and moves no funds.
• Abandon: only the stored claimant can abandon a personal request, anyone can abandon a shared fact, and only after 14 days. This matches the documented design.
• Sponsor pool:
  • Pool claims require Curator membership and IDMD ownership. They are limited to the catalog chain traits, to one per wallet per UTC day, to one per wallet and trait, and to nine per IDMD token.
  • Each limit is recorded before the request goes out.
  • The burn-or-refund step only ever forwards or returns the ETH sent with that call.
• Fees: upgrade, requestSharedFact, mintCard and registerSpec each take an exact amount from the caller. There is no way to withdraw IMD; the documentation says no administrator can recover sponsor-pool IMD.
• Shared facts: applySharedFact only marks the caller, only once, and only if the submitted list matches the stored answer and the caller is within the allowed head of the list.

Sepolia constructor check (read-only cast against a public RPC):

• Curator, IDMD, IMD, Intake and the burn executor all have code.
• MockCurator.isSettled() returns true.
• Intake.priceOf returns 0.5 IMD for the oracle action.

So the Registry constructor will not revert with the given arguments.

Limits of this review:

• I reviewed Composer and Renderer only through the calls the registry makes into them.
• I did not separately review the Composer's spec validation.
• I wrote no Foundry tests, since there was nothing to prove.
• I didn't check launch.json, because the repository doesn't have one yet.

The design decisions listed in the brief (who can abandon, the burn rule, membership coming from mock contracts on Sepolia) I treated as accepted trust assumptions, not findings.

I added test/SepoliaLaunchArgs.t.sol, which tests the Registry with the exact Sepolia constructor arguments from the brief. The full forge test run with the verifier's fuzz seed passes: 191 passed, 0 failed. Another 17 tests are skipped; they were written to skip by earlier contributors, and none of them are mine.

The new file has 8 tests:

• Empty-chain launch check: with no code at any dependency address, the Registry deploys with the brief's addresses. It stores each one and reports name "Sworn" and symbol "SWORN".
• Zero addresses: a fuzz test sets each of the seven required arguments to zero, with and without contracts at the dependency addresses, and every case reverts ZeroAddress.
• Dependency checks:
  • If only the Curator has code, deployment reverts DependencyHasNoCode because IDMD has none.
  • A zero Intake price reverts with "Intake price".
  • An executor address with no code reverts ExecutorHasNoCode.
• The V1 executor stand-in: I put a contract at 0x097A…2A2E whose previewBridge() reverts. A sponsored claim sent with ETH then emits BurnSkipped(1) and refunds the ETH, but the Intake price and the allowance are still spent. A second sponsored claim the same day reverts PoolDailyLimit.

The existing suite already covered the rest, including invariant tests over random call sequences for the contract that holds value.

I found no defects, so there is no .imd-findings.json. I changed nothing in src/ or the build settings.

Created launch.json with Renderer → Composer → Registry and the exact approved arguments. No source, library, or build-setting changes.

forge build passed. Tests with the supplied fuzz seed: 183 passed, 0 failed, 17 skipped.

The separate protected harness was not executed locally; it declares Solidity 0.8.26, while the frozen build remains 0.8.24.

The review is complete and .imd-findings.json is written with two info-level findings and a coverage row for all 16 entry points plus five invariants. No file other than the findings file was changed, and nothing in test/scratch/ was needed because no finding reached high or critical.

Outcome: no economic defect found in the frozen candidate. The Registry, Composer and the Sepolia launch set hold against the Economic Security, Invariant and Flow Gap checklists. The existing 183-test suite re-ran green, and I verified the live dependency state on both chains over public RPCs.

What I checked in depth:

• Value conservation. Pool IMD leaves only through Intake requests; a paid upgrade leaves the pool balance unchanged; every claim either forwards all attached ETH to the executor, refunds it, or reverts atomically with the Intake request and the allowances.
• Pending and verified couplings. One pending record per pair or fact, request ids consumed once, abandon releases without refunding allowance, late answers for abandoned ids never touch a successor.
• Burn rule seams. The registry's preview fee equals the executor's in-call re-quote, surplus goes back to the claimant, a reverting or starved preview skips. Mainnet today quotes 456 IMD for about 0.0002 ETH with an estimated preview cost under the 600,000 forwarded.
• Sepolia constructor preconditions. All five dependencies have code, the mock curator is settled, the Intake quotes 0.5 TestIMD, and the V1 executor reverts both its preview selector and empty calldata, so no silent-success decode trap exists.

The two recorded findings are non-blocking and need no source change:

1. Signed chainId on Sepolia is unverified. Every attestation in the tree is from mainnet, where the question chain and consumer chain coincide. If the plane signs 11155111 for a Sepolia consumer, every rehearsal request becomes Missed(…, 3) with its price spent. This is a documented design decision; the operator should confirm it with one Sepolia request before trusting the rehearsal's results.
2. Sepolia mocks are open-settable. Anyone can grant themselves membership or IDMD ownership, so the rehearsal exercises the registry's accounting, not the mainnet eligibility set.

Design decisions the brief listed as fixed were treated as such and not reported, including the IDMD route being no wider than the member route and sponsored requests still spending after an attester rotation.

The review is complete and written to .imd-findings.json (1 finding, 16/16 coverage rows). Nothing tracked by git changed; the findings file and my probe under test/scratch/ are both gitignored, and src/, foundry.toml and remappings.txt are byte-identical to HEAD.

Covered: the Registry's control flow across transactions, the Composer/Renderer periphery seams, and the launch path against the brief.

The one finding (low, non-blocking): upgrade() identifies a community spec by its sequential id alone (src/Registry.sol:408). A registerSpec that lands between the caller reading nextSpecId() and their upgrade means the caller pays 0.5 IMD for a question another author wrote. registerSpec itself validates correctly; the gap is the missing content binding. A fix needs a new hash argument, which changes the ABI and runtime bytes, so per the brief it is reported and left in place. The author had already recorded this residual in ADAPTATION.md; my report confirms it replicates.

What holds, with evidence: pool paths mutate lastPoolDay/poolUsed before the request and every revert rolls them back (my scratch probe confirms the failed-claim rollback restores both); onResult clears before checking, so a result arriving after a 14-day abandon stores nothing; applySharedFact on a re-requested fact is blocked by the stored hash and AlreadyVerified; the shared-fact envelope check is canonical and bounded at 64 entries. Sepolia facts, read live: MockCurator is settled, priceOf(oracle.request@oracle-1, TestIMD) is exactly 0.5e18, the V1 executor has 4,496 bytes of code and its previewBridge() reverts, so every sponsored claim there emits BurnSkipped(1) and refunds, exactly as the brief describes. Sepolia's Intake callbackGas is 1,000,000, which the docs state.

Unreached: none of the 16 entry points. Fork-only behaviour (real BurnExecutor, OFT, LayerZero), real Sepolia broadcast behaviour, and the Renderer's golden image bytes were not re-derived beyond what the existing suite already asserts; the full hermetic suite passes (183 tests).

Adaptations made: none to source or build settings. I created test/scratch/ControlFlow.t.sol (a four-test probe) and updated .imd-findings.json; both are outside the submission tree.

The review is complete and .imd-findings.json holds the result. The tree is otherwise unchanged (the findings file is git-ignored, and the scratch tests were removed).

Outcome: no blocking findings. The frozen candidate can launch as the manifest describes. Two low findings survive, both already acknowledged as non-blocking residuals and neither authorises a source change.

Findings kept, both reproduced with Foundry tests I ran:

• Low, spec id cap. The community spec counter is a uint16, so registration stops for ever once id 65534 is issued. The post-increment overflows one id earlier than the specialist stated. Reaching it costs roughly 355,000 IMD in fees, so it is a hard undocumented bound, not an attack.
• Low, spec id binding. The upgrade call names a community spec by sequential id only. A front-run registerSpec shifts what that id denotes, so a caller can pay 0.5 IMD for another author's question. Waiting for one's own registration event avoids it.

Dropped: the two economics items. The oracle reference states the signed chainId is the question's chain, which matches the design (attestation chainId 1, domain on the deployment chain). The permissionless Sepolia mocks describe the rehearsal environment, not a code defect.

Verified independently:

• All 191 existing tests pass on this tree.
• Live Sepolia reads confirm every non-floor constructor check passes with the manifest's arguments, and the V1 executor's preview reverts as the brief says.
• Runtime sizes fit EIP-170 with 15 bytes to spare on Registry; no forbidden opcodes; manifest schema, argument order and checksum are correct.

Coverage answers all 16 entry points plus three invariant rows (constructor on Sepolia, manifest, deployment limits).