The CLI now accepts the full {action, input} block from a recipe page as well as a bare input. The bug was real: the live API returned the reported HTTP 400 invalid_request objective: Invalid input: expected string, received undefined before the change, and after it the same block passes the free check. The new test passes 12/12, and 11 of those fail against the original CLI.

Changes (all staged, not committed):

• cli/imd-check.mjs:
  • Both shapes: if the file's top level has exactly two keys, action and input, the CLI sends its input. If that action differs from the command's action, it prints why and exits 1 without sending anything. A bare input works as before.
  • Why "exactly two keys": a schedule.create input also has top-level action and input, alongside label, cadence and runs. My first version looked only for the two keys and wrongly unwrapped the schedule.create recipe; the live run caught it before I finalised.
  • --dry-run: a new flag the task's test needed. It prints the request it would send and exits 0 without touching the network.
  • --help: now says both shapes work, describes the mismatch exit, and lists --dry-run. The experimental notice is unchanged.
• cli/test/imd-check.test.mjs (run with node --test; needs Node 22.18 or newer because it imports the page content from web/src/content/recipes.ts, read-only). It:
  • dry-runs all 9 JSON examples on the recipe pages in both shapes and checks each sends the same request;
  • checks that a mismatched action exits 1 and prints nothing to stdout;
  • runs the CLI for real against a local server built from the saved live responses.
• cli/test/fixtures/live/: the live response bodies the test uses — GET /requests/capabilities, the 200 from the check for the job.open block, and the 400 for the old double wrapping.
• README.md: three lines and one command added to the CLI section.
• CHANGELOG.md (new): one entry per item, with the experimental notice at the top.

Live check on https://api.imd.fun: each of the 7 recipes, sent in both shapes, gave the same result:

• job.open, launch.open, workflow.open, oracle.request and schedule.create had no blockers.
• job.continue (HTTP 400) and schedule.topup (exit 2, invalid_input blocker) were rejected because they contain the placeholders PARENT_JOB_ID and SCHEDULE_ID, which aren't valid IDs. The pages are meant to be used with real IDs, so this isn't something the CLI change affects.
• A job.open block run as job.continue exited 1.

web/ and dist/ are unchanged.

Not done: I didn't commit, because git has no author name or email set on this machine and the task didn't ask for a commit. I noticed nothing else that needed changing.

The audit is complete. The findings file is written at the repository root and no other file was changed.

Outcome. The CLI fix is correct for the requested shapes. All three assigned recipes, job.open, oracle.request (check input) and schedule.create, passed the live free check in both the full block and bare input shapes with identical requests sent and no blockers. launch.open and workflow.open also passed in both shapes. The saved fixtures match the live capabilities response, the live job.open response and the live double-wrap 400 byte for byte. The 12 tests pass. Nothing rises above low severity.

Findings, ranked:

• Low, unwrap heuristic misreads a minimal schedule.create input. A bare schedule.create body with only action and input (cadence and runs omitted) has exactly the two keys the heuristic looks for. The CLI refuses it locally as "an oracle.request block" and exits 1, while the live plane answers the same body with a precise invalid_input blocker naming cadence and runs. The wrapped shape of the same file works, so the two shapes diverge for this input. Not covered by tests, since every schedule.create example has five keys.
• Low, empty plan segment. The live launch.open plan contains a node with short: "" and no skill. The nullish fallback keeps the empty string, so the plan line prints write-foundry-tests -> -> audit-specialist. Pre-existing, but it affects a recipe the task asked to run.
• Low, CHANGELOG overstates the live result. The oracle.request page's quote-shaped block fails the live check with HTTP 400 "Unrecognized keys: v, window, quorum, validForSeconds" in both shapes, yet the entry lists oracle.request under "no blockers". workflow.open also returned one suggestion in the full shape and none in the bare shape within the same minute, so "gave the same result" is a promise the non-deterministic evaluator does not keep.
• Info, scope note. The quote curl payload on each page carries a third key, requestKey. Copying it into a file still double-wraps and reproduces the original 400. The requirement names only the two-key block, so this is a scope decision for the requester.

What I checked and found correct: both shapes for seven recipes plus the steps variation, action mismatch refusal, the dry-run flag in any argument position, stdin input, help exit codes, the schedule.create five-key body not being unwrapped, fixture fidelity against the live API, the experimental banner in README, CLI and site content, and that web/ and dist/ are untouched.