Implemented server-verified Expanse visitor authentication, revocable sessions, bounded stores/rates, and atomic private profiles. Read-only world behavior and Docker’s shared-module fix are preserved.

Delivered the shared browser controller, isolated demo, API contract, setup/rollback guide, screenshots, and test evidence.

Passed: 224 backend tests, 20 focused auth tests, 34 client tests, typecheck/build, and 8 simulated-wallet browser scenarios.

Remaining: current HUD integration is outside permitted paths; Docker/ARM startup and actual wallet extensions/devices remain unverified. No production changes.

Setup and limitations · Validation evidence

Integrated wallet selection and server-verified sign-in/logout into the current HUD, preserving walletless viewing and world state.

Build/typecheck passed, alongside 233 backend tests, 51 client tests, 19 browser checks and the design probe.

Setup and rollback · Evidence and screenshots

ARM startup remains unverified: docker: Permission denied. Real wallet extensions/devices and WebKit remain unverified.

There are three findings in .imd-findings.json: two medium and one low. None is high. I changed no repository files; the probe's scratch folder has been deleted.

Findings

1. bug (medium), server/src/expanse/visitor-auth.js:204: the rate limit is meant to be 60 requests per minute per visitor, but it is keyed on the network connection's address. The setup guide puts the service behind reverse_proxy 127.0.0.1:8788, so every request arrives from 127.0.0.1 and all visitors share one bucket of 60. Each signed-in tab checks its session every 30 seconds, so about 30 open tabs lock everyone else out of sign-in. The fix: an owner-set trusted-proxy option that reads the forwarded address.
2. taste (medium), web/src/expanse/VisitorWallet.tsx:141: in the static preview, the account dialog says "there's no sign-in server here" twice. Delete line 141 and rewrite the reason line once.
3. accessibility (low), VisitorWallet.tsx:121 and :124: two live regions (screen-reader status areas) hold the same status text, so every state change is announced twice. I measured this in the dialog at 390.

Requirements

• Wallet control in the current HUD, desktop and mobile, not covering controls: met. App.tsx:336, the button is 44px tall at 320 and 390, and the screenshots show nothing covered.
• EIP-6963 discovery with a fallback to the older injected provider: met. shared/visitor-auth-client.js:8-20.
• Visitor chooses when several wallets exist: met. Wallet list at VisitorWallet.tsx:129.
• Supports MetaMask, Rabby and compatible wallets; tested and untested wallets disclosed: met as disclosure. "Privacy and wallet support" section, VisitorWallet.tsx:164.
• Mobile in-wallet browsers supported, otherwise the requirement is explained: met. VisitorWallet.tsx:139.
• Disconnected, connected, signing, verified, expired and unavailable states: met. labels at VisitorWallet.tsx:7.
• Connecting is not signing in: met. Separate "Sign in with message" button, VisitorWallet.tsx:147.
• Readable message with no gas, transaction, approval or key request: met. Only personal_sign is called, visitor-auth-client.js:144.
• Recoverable errors, with a reason shown for disabled actions: met. readable() and the reason line; "Cancel attempt" at line 148.
• accountsChanged, chainChanged and disconnect clear the session; late responses are ignored: met. visitor-auth-client.js:108-110, plus attempt-number checks.
• Viewing stays free and walletless; login doesn't touch the world: met. The static preview works without a wallet.
• Nonce, verify, session and logout endpoints on the current service: met. server/src/expanse/visitor-auth.js.
• Fresh random single-use nonce, short expiry, exact binding, chain scope: met. 32 random bytes, 120-second lifetime, chains setting.
• Message checked in the browser before signing; signer recovered on the server: met. validateChallenge and the server-side verify.
• Sessions expire and are revoked; logout revokes on the server: met. docs/auth/API-v1.md and the auth tests.
• Credential kept out of URLs and storage: met. Bearer token in memory only, visitor-auth-client.js:51.
• Exact CORS origins, OPTIONS limited to auth routes: met. visitor-auth.js:213-219.
• Bounded body size, stores and request rates: met in code. The limits exist, but finding 1 shows the documented proxy setup turns the per-visitor limit into one shared limit.
• Private visitor profile written atomically, kept across restart, left out of public data: met. Temporary file plus rename at `vi

Review complete. The findings file holds four substantiated items, none critical or high, so nothing in this export blocks hosting.

What I read and verified

• Every hosted file in dist/: the HTML entry, both JS chunks, the stylesheet, the config JSONs, licence texts and the demo checkpoint manifest. The bundle's only outbound request targets are the owner's configured world server or a server the visitor chooses. There is no third-party script, iframe, beacon, eval, WebSocket, or external font/CSS URL.
• The wallet code uses only eth_requestAccounts, eth_accounts, eth_chainId and personal_sign. No typed-data, approval, permit or transaction methods exist in the shipped bundle or the source. The legacy wagmi/Coinbase client is not bundled, and the licence notice says so.
• Static preview mode cannot fake a login: with no backend the controller has a null base URL, makes no auth request, and the sign-in button is not rendered. The demo page labels itself as isolated.
• Server handlers were exercised live with a disposable signer: wrong address, cross-origin cancel, header edge cases and public world routes all behaved as documented. Private profiles stay in a separate directory and never appear in public routes or world snapshots.
• The 27 auth server and client tests pass on this tree. The export's index hash matches the delivery record.

Findings written to .imd-findings.json

• Medium. A rate-limited reply on the periodic session check is treated as the session having ended. The server limits per TCP peer and ignores forwarded headers, so behind the documented same-origin proxy all visitors share one bucket. Roughly thirty verified tabs polling every 30 seconds will sign each other out while the server sessions remain valid. Reproduced with a probe.
• Low. The client accepts any 256-character string as the challenge's World field, including newlines. A visitor-chosen hostile backend can inject sentences into the message the wallet displays. It stays a plain signed message with no asset effect, so this is phishing surface, not a drainer.
• Low. The Expanse compose file tells owners to use the legacy Caddyfile, which proxies to port 8787. The setup guide says auth must reach the Expanse process on 8788. Following the compose comment yields a site with sign-in unavailable.
• Info. Logout by nonce revokes a minted session without the bearer token. Documented design, but the nonce should be treated as a secret in the API contract.

Known gaps the delivery itself discloses and I could not close: the ARM Docker image was never built or started, and real MetaMask/Rabby extensions and physical devices are untested. Both are stated in the UI and the validation notes.

Review complete. The findings file holds seven substantiated defects, and the working tree is otherwise unchanged apart from the required JSON.

What passed. The 27 server auth tests, 34 web unit tests, TypeScript check and Vite build all succeed. Cryptographic verification, nonce single-use, wrong signer/origin/chain/message rejection, origin-scoped logout, and anonymous read-only routes behaved correctly under my probes. Private profiles live only in the private-visitors directory and are not exposed by any world route.

Findings, ranked:

• Medium, profile store lockout. Anyone with throwaway keys can verify 10,000 distinct addresses and permanently block every new visitor with 429 profile_store_full. Profiles are never evicted and the state survives restart. Reproduced with maxProfiles set to 3.
• Medium, client discards live sessions on transient errors. A 429 or 503 on the session poll flips the client to expired and queues a logout that then revokes the still-valid server session. Behind the documented same-origin proxy, all visitors share one 60-per-minute bucket, so polling alone triggers this at modest scale.
• Medium, Docker image does not start from a hardened checkout. COPY preserves 0600/0700 host modes, the import check runs as root, and the container exits with MODULE_NOT_FOUND under USER node. The validation document itself records Docker startup as never run, so that acceptance item is unmet.
• Low, session store. One signer can mint all 2,000 sessions and lock other visitors out of sign-in for up to an hour.
• Low, hostile backend message injection. The client accepts any 256-character world string, so a visitor-chosen backend can inject newlines and fake consent text into the signed message.
• Low, deployment docs disagree. The Expanse compose comment points owners at the legacy Caddyfile, which proxies to port 8787 and never serves the auth routes.
• Info, nonce as revocation credential. Logout by nonce needs no bearer token, so the nonce shown in the signing prompt can end a session.

Not verified in this run: real extension and mobile device flows, the Playwright browser scripts, and ARM execution of the image. The delivery itself discloses those as untested.