Approved workflow

The fresh clone passed all four verifier checks; the only error was the shell losing its directory after I deleted the clone, which is harmless.

Delivered and committed on main as commit 6f7b40d: the Pocket (PCKT) launch token and the AllowanceWallet application contract, with tests, ABI exports, a review and documentation. Everything builds and tests offline from a fresh clone.

Contracts

• src/LaunchToken.sol: OpenZeppelin ERC-20 named Pocket, symbol PCKT, 18 decimals, 10^27 minor units minted to the deployer, no constructor arguments and no admin paths.
• src/AllowanceWallet.sol: one constructor argument, the token address, exposed as token(). Windows are 7-day periods anchored at the account's opening time. Child withdrawals are capped per window with no rollover. Parent actions are top-up, set-allowance effective immediately, and withdraw any amount at any time. All value moves through SafeERC20 with checks-effects-interactions and a reentrancy guard. No owner, no payable path, no receive or fallback.

Tests: 63 passing across 5 suites

• Exact boundary tests at the second before and the second of each new window, no rollover across one or many skipped windows, allowance raised or lowered mid-window, role checks on every function, unknown ids, cross-account isolation including the same parent-child pair with two accounts, and a conservation check.
• The requested fuzz test over withdrawal sequences and warps replays random amounts and warps, biased to land exactly on and one second before resets, against an independent reference model. Two further fuzz tests mix parent actions with warps and bound total withdrawals per window.
• Reentrancy tests use a hostile callback token and confirm every re-entry reverts.
• A stateful invariant run checks that the contract's PCKT balance always equals the sum of account balances and that no window is ever overdrawn.

Verification

• forge build --offline, forge test --offline, forge fmt --check and the offline deploy dry run all pass on solc 0.8.26.
• Both protected floor tests were replayed from test/scratch with the real creation code and CREATE2 addresses computed with cast, and passed 8 of 8. Those copies were removed before the commit.

Documentation

• README.md states the rules, interface, deployment parameters, the assumption that PCKT has no transfer fee, and that the allowance is a ceiling on the child and not a guarantee.
• REVIEW.md records the adversarial pass over window off-by-one, split-call and cross-window overdraw, cross-account confusion and third-party fund movement. No findings above informational.
• docs/abi/LaunchToken.json and docs/abi/AllowanceWallet.json are exported.

Notes for the manifest and review steps

• Dependencies are vendored as plain files under lib/, so no submodules exist. The commit excludes the device-node dotfiles at the workspace root, which git cannot add.
• The manifest should list AllowanceWallet with constructor args ["$token"] and no owner.

The manifest is done and verified. The only new tracked file is launch.json; the other untracked entries are sandbox device nodes and the harness's own .claude/ directory, not files I created.

What I wrote

launch.json describes the accepted tree exactly:

• kind is evm_project.
• token is LaunchToken, name Pocket, symbol PCKT, 18 decimals, matching the constructor in src/LaunchToken.sol and the ABI export, which has zero constructor inputs.
• contracts holds one entry, AllowanceWallet, with constructorArgs: ["$token"]. The compiled ABI confirms a single address constructor input, so the reference sits in an address-typed slot and points backward to the token.
• pool pairs against native ETH, fee 3000, tickSpacing 60, initialPrice 79228162514264337593543950336, no hook.
• notes run about 2,264 characters. They explain both contracts, state that no privileged role exists so $owner is unused, and note that the deployer derives the opening price from policy.

No supply, allocation, owner, chain id or hash fields were added, since the schema forbids them.

Checks run

• A scratch validator under test/scratch/ checks the full JSON Schema plus the refinements: unique names, reserved MerkleDistributor, backward-only $contract references, address-only references, initialPrice below 2^256. Result: manifest OK.
• forge build --offline succeeds. forge test --offline passes 63 of 63 tests across 5 suites. forge fmt --check passes.
• Git status shows launch.json as the only change to the repository tree. No other file was touched.

Saved {"findings":[]} to .imd-findings.json. No exploitable defect or constructor mismatch found.

Independent local EVM checks covered each requested attack. Amounts below are token minor units:

• Window boundary: Open with allowance 10, deposit 100, at time t. After spending 10, withdrawing 1 at t + 604799 reverts. Withdrawing 10 at t + 604800 succeeds; another 1 reverts.
• Splitting/across windows: Withdrawals 4 → 5 → 1 exhaust allowance 10; another 1 fails. Advancing to window five permits only 10, with no accumulated allowance.
• Cross-account confusion: Spending from a second account belonging to the same parent/child leaves other accounts unchanged. An emptied account cannot withdraw 1 despite sufficient allowance and funds elsewhere in the wallet. Invalid IDs revert.
• Moving another account’s funds: Another account’s parent, child, and a stranger each fail when calling its topUp, setAllowance, parentWithdraw, or childWithdraw.

launch.json correctly supplies ["$token"] to AllowanceWallet(address). LaunchToken takes no arguments. Neither constructor grants the factory an administrative role. Both exported ABIs match the compiled interfaces.

Accounting caveat: direct token.transfer(wallet, 1) creates one uncredited, unrecoverable unit, as already documented and tested. Exact balance equality therefore applies to accounted wallet operations; unsolicited transfers create surplus without enabling overdraw.

Only the requested findings file was created.