Approved workflow

Release Pixel Wall (ERC-20 symbol PIXL) on Sepolia as an evm_project: the fixed-supply launch token plus one application contract. Token: Pixel Wall (PIXL), total supply 1,000,000,000 PIXL with 18 decimals, minted once to the deployer. Application contract: PixelCanvas. Currency: PIXL is the app's working currency. PixelCanvas takes the PIXL address as its only constructor argument (constructorArgs ["$token"]), stores it immutable, exposes it as token(), and holds no PIXL at deploy; players get PIXL by swapping Sepolia ETH in the launch pool the factory seeds. Every payment in is approve + SafeERC20.safeTransferFrom (permit not required). PixelCanvas has no payable function and no receive/fallback, so it never holds ETH. Payouts are pull-based (the recipient calls to collect; nothing is pushed to third parties), follow checks-effects-interactions and are nonReentrant. Burns are transfers to 0x000000000000000000000000000000000000dEaD. No owner, admin, pause or upgrade path. A 32x32 shared canvas paid in PIXL. Pixels: index = y * 32 + x with x, y in 0..31; any other index reverts. A colour is a uint24 0xRRGGBB; the canvas starts all 0x000000. Colours are stored packed and canvas() returns all 1,024 colours in one call as bytes of length 3,072 (3 bytes per pixel, index order). Price: every pixel has its own price, starting at 10 PIXL (10 * 10^18 base units). paint(index, colour) charges the pixel's current price; afterwards that pixel's price becomes floor(old * 11 / 10), capped at 1,000,000 PIXL. paintBatch(indices, colours) paints up to 64 pixels with one safeTransferFrom of the summed cost; mismatched lengths, an empty batch or more than 64 entries revert; a repeated index in one batch is processed in order, each at its then-current price. Split: the first paint of a pixel burns 100% of the price; a repaint credits floor(price / 2) to the previous painter's withdrawable balance and burns the rest in the same call. Repainting your own pixel is allowed (you are credited half, the rest burns). withdraw() pays the caller's whole withdrawable balance and reverts on zero. Views: canvas(), priceOf(index), painterOf(index), withdrawable(address), token(). Events: Painted(index, colour, painter, price), Withdrawn(account, amount). Tests (Foundry) must cover: price growth and the 1,000,000 PIXL cap; the first-paint vs repaint split with odd prices; batch limits and a repeated index; out-of-range index reverts; withdraw of zero reverts and cannot pay twice; and the invariant that PIXL held by PixelCanvas always equals the sum of withdrawable balances (the rest was burned at paint time). The independent adversarial review must attack: rounding in the 50/50 split and the 10% step, the price-cap boundary, batch cost arithmetic (a batch must never cost less than the same paints one by one), and reentrancy or griefing through withdraw. Deploy through the project factory, then publish a one-page website to draw the live canvas from canvas() and Painted events, pick a colour, queue up to 64 pixels and show the total cost before painting. The page reads the PIXL address from PixelCanvas.token(), shows the connected wallet's PIXL balance, allowance and withdrawable balance, has an Approve step before every paying action and a Withdraw button, and says that PIXL comes from swapping Sepolia ETH in the launch pool (no in-page swap). Lists come from contract views and events only (no backend, no indexer). Keep it to one small page; the static export has index.html in dist/.

Sepolia (11155111) only. GitHub publication and IPFS hosting are approved. Launch token: a separate fixed-supply ERC-20, 18 decimals, no constructor arguments, exactly 1,000,000,000 minted to msg.sender, no mint or admin functions. The factory sends that supply to LP and rewards, so no application contract may need a launch-token balance at deploy. Application contracts are fully configured in nonpayable constructors using only address, uint, bool or bytes32 arguments (no strings, arrays, proxies, delegatecall or selfdestruct); anything else is set at runtime. No owner unless the request names one, and then it is $owner. No external oracles, VRF or keepers: randomness is commit-reveal or a future blockhash read within 256 blocks with a refund path. foundry.toml sets bytecode_hash = "none". The website is a static export with index.html in dist/. Site label lab-pixel-canvas.

Build PIXL and PixelCanvas (PixelCanvas takes constructorArgs ["$token"] and charges PIXL) with Foundry tests and an independent adversarial review, deploy them through the project factory, then build the one-page website against the live deployment.

One static page, no framework beyond what the skill needs, reading the live deployment's ABI and address. Approve PIXL before paying; show PIXL balance and allowance and the withdrawable balance.