Approved workflow

Release Heartbeat (ERC-20 symbol BEAT) on Sepolia as an evm_project: the fixed-supply launch token plus one application contract. Token: Heartbeat (BEAT), total supply 1,000,000,000 BEAT with 18 decimals, minted once to the deployer. Application contract: DeadMansSwitch. Currency: DeadMansSwitch holds only Sepolia test ETH and never touches BEAT. It is a Sepolia test toy, not a custody or inheritance product, and the README and the page say so. DeadMansSwitch has no constructor arguments (constructorArgs []), no owner, admin, pause or upgrade path. Many switches by id (from 1). create(beneficiary, period) payable (msg.value may be 0; the depositor can fund later): period 1 day to 365 days in seconds, beneficiary non-zero and not the caller; the caller is the depositor and lastPing = block.timestamp. A switch lapses when block.timestamp >= lastPing + period. Before the lapse, and only from the depositor: ping(id), deposit(id) (payable, > 0), withdraw(id, amount) (0 < amount <= balance), setBeneficiary(id, newBeneficiary) (non-zero, not the depositor) and setPeriod(id, period) (same bounds); each also sets lastPing = block.timestamp. From the lapse on those calls revert, and the beneficiary may claim(id, to) (to != address(0), so a beneficiary contract that cannot take ETH can name another address), which sends the whole balance (possibly 0) to to. Recovery so nothing is stranded by a lost beneficiary key: if a lapsed switch is still unclaimed at lastPing + period + 365 days, the depositor may reclaim(id, to), which does the same for the depositor; from then on whichever of claim and reclaim lands first wins. claim and reclaim close the switch: its balance is zeroed and every later call on it reverts. withdraw, claim and reclaim follow checks-effects-interactions, are nonReentrant, send with call and revert entirely if the send fails. Nothing else can move a switch's ETH; plain ETH sent to the contract reverts (no receive/fallback). Views: switchInfo(id) (depositor, beneficiary, balance, period, lastPing, closed), switchCount(), timeLeft(id) (0 once lapsed). Events (depositor and beneficiary indexed): Created, Pinged, Deposited, Withdrawn, BeneficiaryChanged(id, depositor, newBeneficiary), PeriodChanged, Claimed(id, beneficiary, to, amount), Reclaimed(id, depositor, to, amount). Tests (Foundry) must cover: the lapse boundary (a ping at lastPing + period - 1 works; at lastPing + period it reverts and claim works), the reclaim boundary at lastPing + period + 365 days, period bounds, calls from non-depositors and non-beneficiaries, beneficiary and period changes resetting the clock, partial and full withdraws, claim to another address, any call after a switch is closed, a receiver that reverts, and the invariant that the contract's ETH equals the sum of open switch balances. The independent adversarial review must attack: the depositor/beneficiary race at the lapse boundary and at the reclaim boundary, reentrancy on withdraw, claim and reclaim, a third party keeping a switch alive or claiming it, and cross-switch balance leaks. Deploy through the project factory, then publish a one-page website to show each switch of the connected account (as depositor or beneficiary, from Created and BeneficiaryChanged events) with its time left, and ping, deposit, withdraw, change beneficiary or period, claim and reclaim. Lists come from contract views and events only (no backend, no indexer). The page shows a banner that it is a Sepolia test toy. Keep it to one small page; the static export has index.html in dist/.

Sepolia (11155111) only. GitHub publication and IPFS hosting are approved. Launch token: a separate fixed-supply ERC-20, 18 decimals, no constructor arguments, exactly 1,000,000,000 minted to msg.sender, no mint or admin functions. The factory sends that supply to LP and rewards, so no application contract may need a launch-token balance at deploy. Application contracts are fully configured in nonpayable constructors using only address, uint, bool or bytes32 arguments (no strings, arrays, proxies, delegatecall or selfdestruct); anything else is set at runtime. No owner unless the request names one, and then it is $owner. No external oracles, VRF or keepers: randomness is commit-reveal or a future blockhash read within 256 blocks with a refund path. foundry.toml sets bytecode_hash = "none". The website is a static export with index.html in dist/. Site label lab-deadmans-switch.

Build BEAT and DeadMansSwitch (DeadMansSwitch has no constructor arguments and holds ETH per switch) with Foundry tests and an independent adversarial review, deploy them through the project factory, then build the one-page website against the live deployment.

One static page, no framework beyond what the skill needs, reading the live deployment's ABI and address.