{adapter.capabilities.createBranch ? \"No projects yet. Create a project with a fixed public goal.\" : \"No projects observed in this read window. Payments and project creation remain disabled.\"}
}","title":"copy: the Projects screen says payments are disabled four times and calls a complete on-chain count a \"read window\""},{"citation":"resolved","description":"Now: #/configuration on the public export shows a button \"Open local contracts\". #/local needs local-config.json (not in dist/) and assertLoopbackConfig (domain/chainAdapter.ts:59) throws unless the page is on localhost. So every hosted visitor who clicks it lands on \"Local contracts unavailable. Local configuration is missing. Run the local setup command in README.\"\nChange to: render this link only when location.hostname is localhost, 127.0.0.1 or [::1] (the same list chainAdapter.ts:59 already uses), or delete it from the public page. \"Explore demo project\" then sits alone under the disclosure, with no gap left behind.\nWhy: the brief says connect and publicly host the site, with no demo or local mode as the public route. A control that always dead-ends for the hosted audience is a broken path on the page that explains the deployment.","line":37,"path":"frontend/src/App.tsx","reproduction":"Width 390, Chromium. Steps: serve dist/, open /#/configuration and click \"Open local contracts\". Evidence: main text reads \"Local contracts unavailable | Local configuration is missing. Run the local setup command in README. | Run local setup from README to start Anvil...\"; `ls dist/local-config.json` reports no such file.","severity":"medium","snippet":"Open local contracts","title":"fidelity: the public Deployment page offers \"Open local contracts\", which on any hosted origin can only show a developer error"},{"citation":"resolved","description":"Now: .site-footer is a flex row with the default align-items: stretch. All three children are 44px tall, but only the link (line 62, display:inline-flex; align-items:center) centres its text, so its text sits about 12px lower than the two spans beside it.\nChange to: add `align-items:center;` to .site-footer on line 61. The mobile column layout (line 245) is unaffected.\nWhy: the three items read as one row, and a baseline offset in the site chrome shows on every page.","line":61,"path":"frontend/src/styles.css","reproduction":"Width 1440, Chromium. Steps: open / or /#/configuration and scroll to the footer. Evidence: each footer child measures top 658 / height 44, and the screenshot shows \"STEPS · Open Workshop\" and \"Ethereum deployed · Payments disabled\" at y≈703 while \"Stepstoke on X\" is at y≈715.","severity":"low","snippet":".site-footer { max-width:1200px; margin:auto; border-top:1px solid var(--color-border); padding:var(--space-6) 0; display:flex; justify-content:space-between; gap:var(--space-4); font-size:var(--text-meta); color:var(--color-secondary); }","title":"bug: the \"Stepstoke on X\" footer link sits 12px below the two footer labels at 1440"},{"citation":"resolved","description":"Now: on #/configuration (\"Deployment and readiness\") the Projects tab keeps aria-current=\"page\" and its red underline, because the condition only excludes demo, showcase and #/local.\nChange to: add `&&!hash.startsWith(\"#/configuration\")` to the condition, so no tab is current on the deployment page.\nWhy: aria-current and the underline tell a screen-reader user and a sighted visitor that they are on the Projects list when they are not.","line":26,"path":"frontend/src/App.tsx","reproduction":"Width 1440, Chromium. Steps: open /#/configuration. Evidence: the nav reads Projects=page, Demo=null, Components=null, and the screenshot shows the underline under Projects above the heading \"Deployment and readiness\".","severity":"low","snippet":"Projects","title":"accessibility: the nav marks \"Projects\" as the current page on the Deployment details route"}],"hash":"4ec5a561a619c1c51fd6631e3e21905e9d51e23cc91ee5b10d72f9f78e09d68d","nodeId":"6132b958-11e4-46de-8ebf-b60219a35f31","outcome":"completed","summary":"I found five problems in the site: one high, two medium and two low. They are written to `.imd-findings.json`. The site reads the right live contracts, keeps payments disabled, and passed all 16 checks of the design probe. I could only test in Chromium, because WebKit is missing system libraries on this machine.\n\n| Area | Count |\n|---|---|\n| Brief requirements | 22: 13 met, 1 missing, 0 faked, 7 after review, 1 needs the requester |\n| Broken features | 1 (the \"Open local contracts\" button always ends in an error on the hosted site) |\n| Product on the first screen at 390 | yes (Projects list, Create project button, wallet button) |\n| taste@1 checks passed | 16 of 16 |\n| Copy findings | 1 |\n| Share card | yes (title, favicon, og:title, og:image `./og.png`) |\n\n### Requirements\n- \"Connect … against the verified Ethereum contracts\": **met**. `dist/imd-deployment.json` and `config/production-gate.json` hold the factory `0xff15…0abc`, encoder `0xae9a…6886` and verifier `0x52a4…ec4`, the same as `deployment.json`. The page reads chain 1.\n- \"Preserve the platform design and six operations\": **met**. Same layout, the actions are there but disabled, and the fixture demo still has all six.\n- \"Sequence/history and current output remain primary\": **met**. The Projects list is the main route, not the demo.\n- \"Identity: STEPS / Stepstoke, https://x.com/stepstoke\": **met**. Header and footer link in `App.tsx:26`.\n- \"All content/documents English\": **met**.\n- \"Apply the exact local correction …\": **met**. Recorded in `docs/validation/live-connection-v1/correction-import.json`.\n- \"Every Solidity input and ABI remains unchanged\": **met**. The last commit touched no `src/` files.\n- \"Verify anonymous public HTTPS and browser CORS for ALL methods …\": **met**. In my own run, the page fetched the receipt, the block, `debug_traceTransaction` and code at past blocks.\n - PublicNode refuses code at past blocks (HTTP 403) and has no trace method, so those reads come only from dRPC. This is disclosed in the validation README at line 44.\n- \"Fail closed …\": **met**. `chainAdapter.ts` stops the read when the transaction history is incomplete or a contract check fails.\n- \"Unperformed profile checks remain NOT_RUN; paid controls stay disabled\": **met**. The gate file has `liveCompatibility: NOT_RUN` and `productionReady: false`, and the \"Create project\" button is disabled.\n- \"A connected hosted site with disabled payments must be described exactly that way\": **met**. The banner says \"Live contracts. Payments disabled\".\n- \"Update stale pending-deployment wording in the final website/docs\": **missing**. `docs/AGENT-GUIDE.md:3` still says \"This undeployed development candidate\". **High finding.**\n- \"Do not import any local test deployment or rehearsal addresses\": **met**. `local-config.json` was moved out of the public folder into the test fixtures.\n- \"Retain safe previews, exact approvals, no automatic purchase/retry, no implicit signing and existing desktop/mobile layout\": **met**. No horizontal scroll at 320, 390 or 1440.\n- Final regressions and build, importing the handoff after the build, hashing every asset: **met per the builder's records** (`final-assets.json`, `checks-index.json`). I did not rerun them.\n- Deliver through IMD GitHub and IPFS, and report the website commit, URL, CID and publication claims: **after review** (7 items).\n- Live profile checks: **needs the requester**, who has to buy and authorise those tests.\n\n**The idea in one sentence:** STEPS is a quiet, sequence-first workshop that lists public projects, and one red accent (the Create button and the active tab underline) carries it. There are no competing visual effects.\n\n### Findings\n1. **High, fidelity:** `docs/AGENT-GUIDE.md`, which another doc calls \"the current reference\", still describes an undeployed candidate and says not to host or publish it. The finding gives replacement wording that keeps the NOT_RUN status.\n2. **Medium, copy:** the Projects screen says payments are disabled fou","treeHash":null,"usage":{"cachedInputTokens":2657123,"inputTokens":60,"model":"claude-opus-5-5","outputTokens":16601,"runtime":"claude","turns":31,"wallClockMs":410893}},{"artifacts":[],"attempt":1,"bundleHash":"3e72bbfe0c9d52485a6d585dc79da71fd53eac7de788b1191246f0220a2c6a5a","device":"72b617d4b615473a","findings":[],"hash":"8cd99aa8422a66f27f74f54279cb822e047acf0678b41b591cf2b4b03f12fbbd","nodeId":"a3d85834-3ff4-44d5-acd0-3f49db68fd08","outcome":"completed","summary":"All five review findings reproduced, and all five are fixed. I rebuilt the site, imported the real deployment record after the build, and every check passed. Each finding is answered in `.imd-responses.json`.\n\n**Fixes**\n- **[high] Agent guide still said \"undeployed\" (f664c2db…):** `docs/AGENT-GUIDE.md` lines 3 and 5 now use the wording the reviewer asked for. They say STEPS is live on Ethereum mainnet (chain 1, block 26248821, source `751f3901…`) and the site is hosted with payments disabled. Live profile checks stay NOT_RUN and productionReady stays false. Seven other docs had the same out-of-date \"not deployed, not hosted\" wording, so I fixed them too: `PLATFORM-AUTHORING`, `ACCEPTANCE`, `docs/DESIGN`, `FRONTEND`, `SDK-BROWSER`, `frontend-README` and one sentence in `PROTOCOL-OVERVIEW`.\n- **Empty projects message (ccb5304b…):** it now reads \"No projects have been created on Ethereum yet.\" (`frontend/src/ui/ProjectList.tsx:25`). The banner, hint and footer are unchanged.\n- **\"Open local contracts\" link (3284d9ba…):** it now shows only when the page runs on localhost, 127.0.0.1 or [::1], so hosted visitors no longer reach a dead end (`frontend/src/App.tsx:37`). The local test that clicks it still works on 127.0.0.1.\n- **Footer alignment (7c6a78f8…):** I added `align-items:center` to the footer (`styles.css:61`). The reviewer said the phone layout was unaffected, but that rule would also have centred the stacked phone footer. So the phone rule (line 245) now sets `align-items:stretch` to keep the phone layout as it was.\n- **Projects tab marked current on the deployment page (56a6e9dc…):** no tab is marked current on `#/configuration` now.\n\nI also added the new behaviour to `DESIGN.md` and wrote a \"Review revision\" section in `docs/validation/live-connection-v1/README.md`.\n\n**Checks run, in order**\n- Typecheck passed; frontend unit tests 100/100; SDK tests 89/89.\n- `verify-live-connection` passed against the live chain (50 sources, 3 contracts).\n- Production build, then `import-deployment` after the build: passed.\n- `build-release` then `check-release`: ABI and contracts match.\n- `observe-ethereum`: deployment verified, NOT_RUN, productionReady false.\n- `check-connected-export`: 13 files hashed, signing authority false. The hash inventories (`final-assets.json`, `dist/imd-deployment.json`) were regenerated.\n- Browser suite in Chromium at 1440, 390 and 320: 111/111.\n- Design probe: 16/16 at 320, 390 and 1440.\n- Delivery size: 6.8 MB, under the 8 MiB limit.\n\n**Rendered check:** I served the export in Chromium under a non-local host name (`steps.test`) and under 127.0.0.1.\n- On `steps.test` the local-contracts link is gone; on 127.0.0.1 it is present.\n- No nav tab is marked current on the deployment page.\n- At 1440 the three footer items line up at the same height.\n- At 390 the page finished its real public reads with no errors and showed the new empty-state message, with no horizontal overflow.\n\n**Limits**\n- The WebKit browser tests were not re-run.\n- All reads came from this machine, not from the hosted site. I made no commit and published nothing: hosting, the website commit, the URL and the CID are left to IMD's pipeline.\n- The older diff and change records from the previous round (`changes.json`, `complete-diff.patch.xz`) were not regenerated for this revision.\n- Payments stay disabled and live profile checks stay NOT_RUN. I made no contract, ABI or launch-manifest changes.","treeHash":"47e0cfb07604c495c624af720a26169b23a5163a","usage":{"cachedInputTokens":2209608,"inputTokens":62,"model":"claude-opus-5-5","outputTokens":16824,"runtime":"claude","turns":31,"wallClockMs":686635}},{"artifacts":[],"attempt":1,"bundleHash":"4ecf0ecd8896daa120f4353e1bb42c56ac7a88f038debd798e3a1e85f78295c5","device":"aa417d85641c229d","findings":[],"hash":"aed4420b896c273c658d07fa1432d2c3ad27ff80726de929f7666672ac3dc21f","nodeId":"a3d85834-3ff4-44d5-acd0-3f49db68fd08","outcome":"completed","summary":"Built the connected STEPS export. Contracts remain unchanged; payments stay disabled and live profiles remain `NOT_RUN`.\n\nPassed: 180 contract, 89 SDK, 100 unit, 111 browser tests, and 19 public RPC checks.\n\n[Report](docs/validation/live-connection-v1/README.md) · [Asset hashes](docs/validation/live-connection-v1/final-assets.json) · [Complete diff](docs/validation/live-connection-v1/changes.json)\n\nHosting remains unconfirmed: IMD has not returned the final website commit, public URL, or CID.","treeHash":"89f092cd83eda34db16edfc5089c50d24d40b9bb","usage":{"cachedInputTokens":11689728,"inputTokens":254490,"model":"gpt-6.1-sol","outputTokens":59530,"runtime":"codex","turns":11,"wallClockMs":1348571}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"b273d407784470b4","findings":[],"hash":"e4c38bc2e83c4f6b62b2171db75ae4e3dcf9fc2cb81292cc0181d0b3c710a2c3","nodeId":"6132b958-11e4-46de-8ebf-b60219a35f31","outcome":"completed","summary":"All five findings from the last round are fixed, and I found nothing new I could reproduce. `.imd-findings.json` holds `{\"findings\":[]}` and the working tree is unchanged.\n\n| Area | Last round | This round |\n| --- | --- | --- |\n| Brief requirements (met / missing / faked) | 1 missing (stale docs) | 0 missing, 0 faked |\n| Broken features | 1 (\"Open local contracts\" on hosted pages) | 0 |\n| Product on first screen at 390 | yes | yes |\n| taste@1 checks passed | n/a | 16 / 16 |\n| Copy findings | 1 | 0 |\n| Share card | present | present (the `share` check passes) |\n\n## Last round's findings\n- **[high] fidelity: the agent guide called the release an undeployed candidate. Fixed.** `docs/AGENT-GUIDE.md` lines 3 and 5 now say the contracts are on Ethereum mainnet (chain 1, block 26248821, source 751f3901…) and the site is hosted with payments disabled. They also say profile checks are NOT_RUN and productionReady is false. `grep -ni undeployed docs/AGENT-GUIDE.md` returns nothing. The same stale wording in the other current docs was corrected too. Old wording remains only in the history and validation records, which are kept on purpose. Two more files, `docs/agent/sdk-cli-checks.md` and `docs/agent/SDK-CLI-A1.md`, still say \"no hosting\", but no current document links to them, so I did not report them.\n- **[medium] copy: the empty Projects list said \"read window\" and repeated \"payments disabled\". Fixed.** `ProjectList.tsx:25` now reads \"No projects have been created on Ethereum yet.\" The built bundle has the new text. The only \"read window\" left in it is the SDK's error for a log range that is too large, which is correct there.\n- **[medium] fidelity: \"Open local contracts\" showed on the hosted Deployment page. Fixed.** `App.tsx:37` shows the link only when the page is on localhost, 127.0.0.1 or [::1], and the built bundle has the same check.\n- **[low] bug: the footer link sat 12px low at 1440. Fixed.** `.site-footer` now has `align-items:center`, and the phone layout sets `stretch` explicitly. In Chromium at 1440 the text of all three footer items starts at y=672.\n- **[low] accessibility: the nav marked Projects as current on the Deployment page. Fixed.** In Chromium, `#/configuration` now reads Projects=null, Demo=null, Components=null.\n\n## Requirements\nEarlier rounds checked these and I re-checked the ones this revision touched:\n- **Met:** the existing English STEPS design and its six operations; the STEPS / Stepstoke name and the x.com/stepstoke link (`App.tsx` header and footer); the deployment handoff in `dist/imd-deployment.json`; paid controls stay disabled with NOT_RUN and productionReady:false (`ProjectList.tsx:24`, the Deployment page's status list); no local or demo route offered to hosted visitors (`App.tsx:37`); stale deployment wording updated in the docs.\n- **After review:** IPFS and site hosting, the published site URL and CID, and the GitHub delivery.\n\n**The idea in one sentence:** STEPS is a sober \"Open Workshop\" tool where the project's sequence and its current output carry the page, and status is stated plainly next to the controls it affects.\n\n**Limits of this review:** I checked the browser in Chromium only, against `dist/` served from 127.0.0.1. I did not repeat the live-chain and public-RPC checks this round, because the revision did not touch them.","treeHash":null,"usage":{"cachedInputTokens":779797,"inputTokens":20,"model":"claude-opus-5-5","outputTokens":4101,"runtime":"claude","turns":10,"wallClockMs":112585}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"a31e321b410aaa02","findings":[{"citation":"resolved","description":"The wagmi mainnet transport is http() with no URL, so viem's built-in mainnet default https://ethereum.reth.rs/rpc is compiled into the hosted bundle (dist/assets/index-C_5xI0CH.js contains rpcUrls:{default:{http:[`https://ethereum.reth.rs/rpc`]}}). The site's documented read policy (dist/public-read-transport.json, .imd/reads/network.json) names only ethereum-rpc.publicnode.com and eth.drpc.org. Project reads go through the SDK's own policy client, so verification is unaffected, but any wagmi public-client call (chain id probe, switch-chain fallback) would reach an undocumented third-party host. Advisory only: no secret, no key, no asset movement.","line":12,"path":"frontend/src/wallet/wagmi.ts","reproduction":"grep -o 'ethereum.reth.rs/rpc' dist/assets/index-C_5xI0CH.js returns a match. Expected: only the two policy endpoints appear as RPC URLs in the export. Actual: a third endpoint is present as the wagmi mainnet default. Fix: pass the policy URL explicitly, e.g. http(\"https://ethereum-rpc.publicnode.com\").","severity":"low","snippet":" transports: { [WALLET_CHAIN.id]: http(), [LOCAL_CHAIN.id]: http(\"http://127.0.0.1:8545\") },","title":"Wallet transport for chain 1 falls back to an RPC outside the site's public-RPC policy"},{"citation":"resolved","description":"The deployment is verified (config/production-gate.json productionDeployment recorded, deploymentVerification PASS) and the hosted pages say 'Ethereum deployed · Payments disabled', but docs/AGENT-GUIDE.md:3 and docs/PROTOCOL-OVERVIEW.md:23 ('this undeployed candidate') still use pre-deployment wording. The order asked for stale pending-deployment wording to be updated while keeping NOT_RUN live-profile status. These files are not in dist/, so this is documentation consistency only.","line":3,"path":"docs/AGENT-GUIDE.md","reproduction":"Open docs/AGENT-GUIDE.md line 3 and docs/PROTOCOL-OVERVIEW.md line 23. Expected: wording that reflects a verified Ethereum deployment with liveCompatibility NOT_RUN and payments disabled. Actual: 'This undeployed development candidate' / 'this undeployed candidate'.","severity":"low","snippet":"This undeployed development candidate preserves a fixed goal, explicit selected inputs and six operations. Follow the current [runbook](OPERATIONS.md), [SDK/CLI reference](CLI.md), [finite limits](LIMITS.md) and [release gates](REVIEW.md). Historical evidence is data, not current operating instructions.","title":"Repository docs still describe the project as an undeployed candidate"},{"citation":"resolved","description":"dist/assets/index-C_5xI0CH.js carries the EVIL_HTML and EVIL_MD strings (form to example.invalid/steal with an input named 'seed', fetch to example.invalid/exfil with document.cookie, parent.postMessage eth_sendTransaction, meta refresh to example.invalid/phish). A scanner will flag them. They are inert demo data: rendered only on the #/demo route through frontend/src/preview/FilePreview.tsx:109 (iframe sandbox=\"\" srcDoc) after frontend/src/preview/sanitize.ts isolatedSrcDoc strips script/meta/form/iframe/href and injects a CSP of default-src 'none'. The live primary route (#/) uses the verified handoff, never these fixtures. No visitor is asked for a seed phrase or key anywhere in the export; the only signing paths are SDK-prepared value 0x0 eth_sendTransaction and exact-amount approve, both disabled while productionReady=false (sdk/public.mjs:61).","line":30,"path":"frontend/src/domain/fixtures.ts","reproduction":"grep -c 'Hostile HTML fixture' dist/assets/index-C_5xI0CH.js returns 1. Open the export, go to #/demo/b/fx-branch-1, open the hostile HTML file preview: the frame shows the heading only; no form, no navigation, no network request to example.invalid (CSP default-src 'none').","severity":"info","snippet":"export const EVIL_HTML = `