Acceptance criteria

• Hook isolates every PoolId, supports arbitrary currencies and bounded observation ring/TWAP plus EWMA volatility, adaptive price-deviation limits and rolling volume budgets resistant to split swaps. Implement NORMAL/WARMUP/GUARDED/RECOVERY, stale/low-liquidity handling and deterministic recovery; LP exits and initialization/warmup stay possible. Explain how recovery works when reverts cannot persist breaker transitions.

• Authenticate canonical PoolManager callbacks and accounting; never trust sender/hookData identity. Specify/test both directions, exact input/output, units, signed amounts, rounding, bounded execution and caps; prevent unauthorized callbacks/reentrancy and accounting inconsistencies. No extra admin behavior. Every token/hookAdmin/treasury/LP owner is 0x09ec38170e94532eddb57c69dfc4f1fdcd0d4a60.

• VolatilityGuardToken is Volatility Guard Lab (VGL), 18 decimals, no constructor args; fixed 10^27 base units minted to deployer with no mint backdoor. Preserve 80% LP, 10% treasury, 10% contributors, 1h contributor lock and 30% per-wallet cap; document allocation enforcement and units for policy/manifest review.

• Pool pairs VGL with native ETH (zero address), static fee 3000, tickSpacing 60, initial sqrtPriceX96 792281625142643375935439503360000 (0.00000001 ETH/VGL). Factory seeds up to 8e26 VGL units and ZERO ETH; derive widest aligned token-only range from opening price/spacing and round liquidity down. Simulate initialization, seeding, ETH-first buys, reverse trades after ETH accrual and LP exits through actual contract interactions.

• Run offline forge build, forge test and forge fmt --check with pinned/vendored ordinary dependencies. Include meaningful success/failure, fuzz, invariant and stress tests covering accounting, isolation, manipulation, split volume, unauthorized callbacks, reentrancy, stale history, edge values, recovery and LP exits. Record actual test counts, fuzz/invariant settings, gas, contract sizes, failures and limitations; surface undeployable bytecode as blocking.

• ABI exports match implemented contracts. Architecture/threat-model/integration docs specify real public actions, telemetry/events, exact ordered pool key, existing verified quote/router/position-manager addresses and ABIs, allowances, slippage, native-value handling, liquidity/exit recipes, permissions, decoded errors, assumptions and operational risks. Document supported position discovery without assuming a position ID in the later handoff.

• Provide reproducible factory deployment inputs and evidence suitable for generated launch.json review under Sepolia univ4_hook policy v2; validate hook address permission bits, constructor/code hashes, owners, supply/allocation/lock/cap, token-only range, liquidity rounding and configured gas ceiling. No keys, broadcasts, extra helper deployment, discretionary powers, new funding or mainnet authorization.

Acceptance criteria

• Every finding names a concrete failing input or state, impact, severity and reproduction evidence; distinguish tested properties from assumptions and limitations. Review is independent of authors by device and wallet and writes no repository files.

• Inspect code AND generated launch.json, ABI hashes, deployment bytecode/configuration, factory compatibility and hook permission bits. Verify canonical PoolManager and existing verified periphery, chain 11155111, native ETH/VGL key, fee 3000, spacing 60, initial sqrt price, owners, fixed supply/splits, 1h lock, 30% cap, zero ETH seed, maximum VGL seed, range/liquidity rounding and existing 0.3 ETH gas ceiling.

• Challenge accounting/callback authentication, sender/hookData misuse, arbitrary currencies, both swap directions and exact input/output, units/rounding/caps, isolation, TWAP/EWMA manipulation, split volume, stale/low liquidity, edge values, reentrancy, all state transitions and deterministic recovery including non-persisting revert transitions. Verify initialization, bootstrap and exits cannot brick.

• Inspect and run applicable offline build/test/fmt and adversarial checks; assess fuzz/invariant/stress coverage, actual counts, gas and deployability, not only successful mocks. Inspect documented swap/quote/liquidity integration and economic limitations, no mint backdoor, extra administration, helper deployment or total MEV protection claim.

• Publish review findings through the review result, including manifest consistency and remaining limitations. Blocking findings must be fixed and re-reviewed before service admission; unresolved blockers after two revisions stay recorded and refuse deployment. Review completion is source/manifest based and never contingent on later live deployment receipts.

Acceptance criteria

• Consume only promised handoff fields: version, launchId, chainId, repoUrl, sourceCommit, attestationHash, manifest, contracts and abiInstructions; contracts supply name/address/txHash/blockNumber/creationCodeHash/abiHash. Build ABIs from exact sourceCommit, compare canonicalKeccak(abi) to abiHash and verify deployed code/chain before enabling transactions. Missing/mismatched evidence disables affected actions with a useful explanation.

• Fetch receipts and derive position/allocation data from manifest, transaction hashes, logs and public chain reads where needed. Handoff does not promise full receipts, seeded position IDs, allocation proofs, live swap receipts or frontend URLs. Never fabricate them. Position exits require discovered/entered verified supported positions and connected-wallet ownership/authorization; do not assume deployer authority.

• Responsive UI explains hook behavior, all states, bootstrap, risks and limitations without claiming total MEV protection. Live dashboard reads tick/TWAP, EWMA volatility, deviation, volume budget/state and events from real deployed interfaces, clearly marking unavailable/stale/RPC-error states and keeping simulation data explicitly labeled.

• Primary ETH/VGL swap controls cover amounts, both directions, balances/max with gas allowance, real periphery quotes, slippage/minimum received and exact-input/output semantics supported by contract recipes, approvals and visitor-wallet-signed swaps. Show pending/success/reverted/rejected states, decoded errors and Sepolia explorer links. Explain token-only bootstrap: buy with ETH first; reverse trades depend on accrued ETH liquidity.

• Expose every primary supported contract action, including supported-position exits, with live connected-wallet reads and configured chain checks. Integrate actual ABIs, pool key, router/quote/liquidity recipes and decoded errors; validate live code/state and read-only quote behavior. Do not deploy helpers, request service keys, invent worker spending authority or fabricate successful live interactions.

• Run production build, TypeScript checks and meaningful responsive/interaction validation for both directions, wallet disconnected/connected, wrong chain, rejected signing, approvals, pending/success/reverted transactions, guard errors, insufficient funds, RPC failures, bootstrap/reverse-liquidity constraints and exits. Signing/error mocks follow actual ABI/provider interfaces and are labeled; validate real integration separately with public reads and local simulations without spending.

• Commit dist/index.html and relative assets alongside source and web/ lockfile; ensure reproducible dependencies are ordinary files available offline where needed, not submodules. Document install/preview/rebuild/publish commands in web/README.md and integration/evidence in docs/. Record actual results and untested live-chain behavior in docs/frontend-validation.md; static export/source/evidence finish this worker, publication/CID/naming/reachability finish services.

File scope: web/**, dist/**, docs/**