Done. The deliverable is src/WorkerWallet.sol, committed as the only changed file. No dependencies, no config files, no submodules.

What the contract does

• Owner is an immutable nonzero constructor argument. Only the owner can call setWorker, allowDomain, and execute. Each emits an event.
• Worker starts at zero and has no function of its own. Every state-changing path is owner-gated, so no worker-reachable path moves assets.
• Receiving works through a payable receive and an onERC721Received that returns the ERC-721 selector. Both emit events.
• ERC-1271 check never reverts. It refuses to use abi.decode on untrusted bytes. Instead it requires the exact 224-byte canonical encoding of abi.encode(bytes32, bytes32, bytes) with offset 0x60 and inner length 65, reads the fields with calldataload, and rejects anything else. It then checks the hash reconstruction, the domain allowlist, a nonzero current worker, v in {27, 28}, low s, and an inline ecrecover over the wallet-bound WorkerApproval(bytes32 hash) digest.
• Nothing is cached. The wallet domain separator is recomputed from chain id and address on every call, and the worker is read from storage each time, so rotation, revocation, forks and sibling wallets all invalidate signatures immediately.
• Helper views domainSeparator() and workerApprovalDigest(bytes32) are public so the test author can build signatures without reimplementing the hashing.

Verification

forge build succeeds with the default layout and no foundry.toml. Only lint warnings remain, all about missing zero checks on execute and the post-call event, which are intentional.

I wrote a scratch suite at test/scratch/WorkerWallet.t.sol with an inline Vm interface, a mock ERC-721, a SignatureChecker-style mock application and a reentrant callee. All 18 tests pass under forge test:

• valid signature accepted by the wallet and by the mock app
• disallowed domain, second wallet with the same worker, other chain id, rotation, revocation, wrong signer and hash mismatch all return 0xffffffff
• malleable s, bad v, empty, short, bare 65-byte, 64 and 66-byte inner, bad offset, 224 bytes of junk and a 10 kB blob all return 0xffffffff without reverting
• worker calling execute, setWorker, allowDomain or transferring the NFT reverts, and assets stay put
• owner moves the NFT and ETH out, revert data bubbles from failed calls
• safeTransferFrom into the wallet and plain ETH transfers succeed
• reentering execute from a callee reverts with NotOwner and nothing moves

The scratch directory is not part of the commit. One deliberate design choice to flag: non-canonical ABI encodings of an otherwise correct signature are rejected, which is stricter than abi.decode but is what keeps the function revert-free without a self-call.

The control plane deliberately excludes the findings file, scratch dir and build outputs from git, so the tree is exactly as expected: only test/WorkerWallet.t.sol is the new tracked deliverable. Work is complete.

Delivered: test/WorkerWallet.t.sol, a self-contained Foundry suite for src/WorkerWallet.sol with an inline Vm interface, a mock ERC-721, a SignatureChecker-style mock application, and reentrancy/revert/echo helper contracts. No dependencies were added and nothing outside the allowed path was touched.

Verification: forge build compiles with only lint warnings. forge test passes all 49 tests (45 unit, 4 fuzz at 256 runs each). Formatting with forge fmt was applied and the suite re-run afterwards. The verifier needs solc 0.8.26, which is already cached in the local svm store.

What the suite covers:

• Happy path: valid worker signature under an allowed domain returns the ERC-1271 magic value, and the mock app fills an order on the wallet's behalf.
• Replay defences: same signature against a disallowed domain, a sibling wallet with the same worker (both directions), another chain id (including when the domain is re-allowed on the fork), after rotation and after revocation, all return the failure value. Relabelling the domain inside the encoding, swapping fields, and signing the bare app hash or a wrong wallet domain all fail.
• Malformed input: high-s, bad v values, wrong recovery id, lengths 0/1/65/192/223/225/256, bad offset and inner-length words, all-zero, all-0xff, pseudo-random and single-bit-flipped blobs. Every check goes through staticcall so a revert is reported distinctly from a rejection. Two fuzz tests confirm arbitrary bytes and arbitrary 224-byte words never revert or validate.
• Assets: worker calling execute, transferFrom, safeTransferFrom, approve, or unknown selectors reverts. Owner moves the NFT and ETH out with the Executed event. Failing callees bubble ExecutionFailed. A callee reentering during execute cannot set the worker, allow a domain, or execute, and a self-call through execute cannot bypass the owner check.
• Receiving: ETH via receive with event, ERC-721 safe transfer in with event, and a sanity test proving the mock token really enforces the receiver check.

Reported in .imd-findings.json, not asserted:

• Low: the decoder does not check that the 31 padding bytes after v are zero, so unlimited distinct signature byte strings validate for one approval. Not a forgery vector, but it breaks signature-byte uniqueness. Confirmed by a scratch probe.
• Info: rotating the worker back to a former key revives every signature that key made. This follows literally from the spec's "nothing is cached" and is a design note, confirmed by a scratch probe.

Nothing was committed, since the control plane commits the workspace itself.

Recorded one low-severity finding in .imd-findings.json: nonzero ABI padding is accepted as a valid signature.

Reproduced in Foundry Chisel. Contracts and tests remain unchanged; nothing was deployed.