{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"6427f320-f79e-4da3-bf1f-b2e8135eb877","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"d5988ba077eeb1d6466f7f7da9917e971dfb08a3fe33bd9296ee10c25a077982","dependsOn":[],"execution":{"mustProduce":["dist/index.html"],"network":true,"profile":"none","requires":["network"],"skillHash":"d85feeeba61710fcde95b6484d4ed21af1a49b2b609a1b0ea33f16d5a47ec9ca","skillId":"import-site","tools":[]},"key":"import_site","kind":"code","role":"implement","skillHash":"d85feeeba61710fcde95b6484d4ed21af1a49b2b609a1b0ea33f16d5a47ec9ca","skillId":"import-site","state":"accepted"},{"acceptedSubmissionHash":"54edc2c97e1a3ae9ae176b88230eb0d49beff1d3c6703918dfbf06de8e5c9f56","dependsOn":["import_site"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","tools":[]},"key":"site_content_check","kind":"code","role":"review","skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","state":"accepted"}],"objective":"IMD Burn tracker, host its static site. dist/ is the finished site: dist/index.html, dist/fonts.css (IBM Plex Mono, embedded), dist/d3.v7.9.0.min.js and dist/data/*.json, ten data files the page fetches from its own origin. Build it with the repository's own build script (package.json), which needs network access: it refreshes the data files in dist/data/ from public sources, or keeps them and notes why in dist/data/imd-refresh-status.json. Change nothing else: the hosted files are dist/ after that build, every other file as committed. The page loads only same-origin files (no CDN, no RPC, no wallet, no analytics); its inline scripts are part of the page. Decide, do not ask: a question blocks the job.","parentJobId":null,"planHash":"09ce07d1d974ee145001344a5c0780e39f00b5644b93586f3da8d7b242eefee0","previousHash":"f5d76af3817daed28c72a5f32440db6fee8d6c675d420c496b000ef72582924c","projectId":"6427f320-f79e-4da3-bf1f-b2e8135eb877","publication":{"commit":"92207e1c0031bd9510c7b997a0dc3c2ca20ec949","deliveredAt":"2026-10-24T18:16:22.037Z","repoUrl":"https://github.com/identity-md-launches/launch-2552-imd-burn-tracker-host"},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[],"site":{"cid":"bafybeihccivnsijexinjjmrg24vz27vwbxzmfktj6pa2afd2xds4jh3byy","ensName":"burned-6427.identitymd.eth","namingTransaction":"0x70f7e2d52b98fef18cc0e642589a0ff3881c874951063f4acc1cb669ec7918db"},"snapshotHash":"294f121767235b9a599a67d76294875653c3a52c908fec1c321db5acd32f7aa8","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":null,"device":"c2e167266d13dcf4","findings":[{"citation":"resolved","description":"dist/data/imd-burn-coins.json is rebuilt from the imd-communitycoins indexer (refresh/refresh.mjs, IMD_INDEXER_URL) and carries whatever name and symbol a coin's creator typed. Two rows already contain foreign content: line 2320 holds a link to an x.com post and line 1900 holds a 32-byte hash. dist/index.html renders name, symbol and type into the 'Launched tokens with built-in burns' table and the Top 10 bars through textContent (index.html:978 and :990), so they appear as plain text, are not clickable, and cannot inject markup; the search box (index.html:995) also matches on them. Nothing here is unlawful or deceptive, and the page itself requests nothing from those strings: no request left the site's origin in a headless Chromium load at 1280 and 390 px (13 requests, all to 127.0.0.1). It is advisory: any future coin creator can place a URL, a brand name or a scam message in this table on the next build, and the build's sanity checks (refresh.mjs:486) only check the list length. Does not block hosting.","line":2320,"path":"dist/data/imd-burn-coins.json","reproduction":"Serve dist/ and open index.html. In the 'Launched tokens with built-in burns' section type 'plumber' in the search box: the row 'Plumber https://x.com/surfcoderepeat/status/2088622333078474880?s=46' (symbol PLUMBER) is listed as inert text. Expected: curated token labels; actual: creator-supplied free text including an off-site link. Also visible with `grep -n 'https://' dist/data/imd-burn-coins.json`.","severity":"low","snippet":"  \"name\": \"Plumber https://x.com/surfcoderepeat/status/2088622333078474880?s=46\",","title":"Third-party token names from the community-coins indexer are shown verbatim, including an external URL and a transaction hash"},{"citation":"resolved","description":"The status line at the bottom (index.html:321) and the 'Snapshot' line (index.html:101) format the UTC timestamps from dist/data/imd-refresh-status.json and imd-burns.json with toLocaleString and no time-zone name. The line does show the data's last refresh time, so the acceptance criterion is met; in the headless check it read 'Last refresh Oct 24, 2026, 6:12 PM · last request Oct 24, 2026, 6:07 PM: refreshed · Rebuilt from public RPCs and indexers; all sanity checks passed.' from last_success_at 2026-10-24T18:12:03Z. A visitor in another zone sees a different clock time with nothing saying which zone it is, which makes the figure hard to compare with the on-chain block times quoted elsewhere. Cosmetic; does not block hosting.","line":623,"path":"dist/index.html","reproduction":"Serve dist/ and open index.html in a browser whose time zone is not UTC (for example TZ=America/New_York). The status line shows 'Last refresh Oct 24, 2026, 2:12 PM' while dist/data/imd-refresh-status.json holds last_success_at '2026-10-24T18:12:03Z'; no zone is named. Expected: the time with a zone label or in UTC; actual: a bare local clock time.","severity":"info","snippet":"  const when = (s) => new Date(s).toLocaleString('en', { dateStyle: 'medium', timeStyle: 'short' });","title":"Refresh and snapshot timestamps are shown in the visitor's local time without a time zone"}],"hash":"54edc2c97e1a3ae9ae176b88230eb0d49beff1d3c6703918dfbf06de8e5c9f56","nodeId":"e01e95ba-5379-4961-8348-4e82c73deea3","outcome":"completed","summary":"The review is complete. Nothing in dist/ blocks hosting, and no repository file was changed. The findings are in `.imd-findings.json` at the repository root: one low, one info, no critical or high.\n\n**What was read and verified**\n\n- `dist/index.html` was read in full, all 1065 lines. The two inline scripts load exactly ten relative paths under `data/`, build the DOM with textContent only, and contain no wallet, iframe, redirect, eval, innerHTML, or external URL. The only navigation call is a plain page reload.\n- `dist/d3.v7.9.0.min.js` is byte-identical to the official d3 7.9.0 release fetched from both d3js.org and jsDelivr.\n- `dist/fonts.css` holds three IBM Plex Mono faces embedded as data URIs, with no imports or remote URLs.\n- All eleven `dist/data/*.json` files were parsed. No markup, script, or off-site URL appears in them apart from the one token name noted below. The totals cross-check: the hero figure equals the summary total, the history's last day equals the Base burn total, and executor inflows equal bridged plus waiting plus stuck.\n- The refresh sources were read for how the data is built. They write only inside the output directory passed on the command line and talk only to public RPC endpoints, Blockscout, the imd.fun launches API, and the community-coins indexer.\n\n**Browser check**\n\nChromium ran headless against a local static server of dist/ at 1280 and 390 px. The page produced no console error or page error at either width. It made 13 requests, all to the local origin, and no request left the site. All ten data files loaded. The burn total, history chart, monthly bars, executor line, logo gauge, four bar charts, and four tables all rendered, with no skeleton or failure placeholder left. The range buttons and the token search work. The status line reads the refresh time from imd-refresh-status.json. The working tree is clean after the review.\n\n**Findings recorded**\n\n- **Low:** token names from the community-coins indexer reach the launched-tokens table verbatim. One row already carries an x.com link and another a transaction hash. They render as inert text, so this is advisory, but future creators can put any string there on the next build.\n- **Info:** the refresh and snapshot timestamps are shown in the visitor's local clock time with no time-zone label.","treeHash":null,"usage":{"cachedInputTokens":1090831,"inputTokens":450,"model":"claude-fable-5-1","outputTokens":14310,"runtime":"claude","turns":25,"wallClockMs":206637}},{"artifacts":[],"attempt":1,"bundleHash":"7b0a372da750cc112a9a52fbb36de6afd6f9b9086e47da05bc87d5815b84ec91","device":"0fce87924985c9ba","findings":[],"hash":"d5988ba077eeb1d6466f7f7da9917e971dfb08a3fe33bd9296ee10c25a077982","nodeId":"38c9b825-610e-4133-b750-b3560865caf0","outcome":"completed","summary":"Built successfully with **npm** using `npm run build`. Output is in **`dist/`**.\n\nData refreshed and all build sanity checks passed. Verified local assets, embedded fonts, JSON, and JavaScript syntax. Output totals 623,193 bytes, below 8 MiB. Only `dist/data/` changed; all other repository files remain byte-identical.","treeHash":"cdfcbb0b94c0a1462b063d5a29f044eb37b08aaf","usage":{"cachedInputTokens":1134848,"inputTokens":38895,"model":null,"outputTokens":3756,"runtime":"codex","turns":7,"wallClockMs":321174}}],"verification":[{"checks":[],"detail":"paths and tree verified; no suite was run for this kind of work","evaluation":"structural","profile":"none","status":"accepted","submissionHash":"d5988ba077eeb1d6466f7f7da9917e971dfb08a3fe33bd9296ee10c25a077982","verifiedTreeHash":"cdfcbb0b94c0a1462b063d5a29f044eb37b08aaf","verifierVersion":"0.1.0+4d02833d"}]}