{"assessments":[],"deployments":[],"fuzz":[],"identity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"interpretation":"Records acceptance and evidence. Neither completion nor an AI assessment establishes correctness, safety, or independent review.","jobId":"db99b89c-3655-43f9-b576-eea15fcb1055","kind":"shape:chain","nodes":[{"acceptedSubmissionHash":"7e82d414361b91cdd217f729f6e3c6b3eff165b2fe85259357e1a2169aafd1d9","dependsOn":["refine_project"],"execution":{"mustProduce":["dist/index.html"],"network":true,"profile":"none","requires":["network"],"skillHash":"d85feeeba61710fcde95b6484d4ed21af1a49b2b609a1b0ea33f16d5a47ec9ca","skillId":"import-site","tools":[]},"key":"import_site","kind":"code","role":"implement","skillHash":"d85feeeba61710fcde95b6484d4ed21af1a49b2b609a1b0ea33f16d5a47ec9ca","skillId":"import-site","state":"accepted"},{"acceptedSubmissionHash":"3ade0c17a253403e75ac629790a69274fb29ff8cd85bbf6ea56e9e5d03c19434","dependsOn":[],"execution":{"network":false,"profile":"none","requires":[],"skillHash":"99cccc7e3e2e1b515c66d54cc6d4bd9832d528aaf0ec0ba48c87a4182db4b7ca","skillId":"refine-project","tools":[]},"key":"refine_project","kind":"code","role":"implement","skillHash":"99cccc7e3e2e1b515c66d54cc6d4bd9832d528aaf0ec0ba48c87a4182db4b7ca","skillId":"refine-project","state":"accepted"},{"acceptedSubmissionHash":"f34ec8e2d34dea8a2ecb968dc1244deafdbc61aee3bfb2a86d08edd43ce533fa","dependsOn":["refine_project","import_site"],"execution":{"network":false,"profile":"foundry","requires":[],"skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","tools":[]},"key":"site_content_check","kind":"code","role":"review","skillHash":"8189a3059fc9bb774ad7dcee66b87f32e25d781025f0e9f82a4c75182fe0ef19","skillId":"site-content-check","state":"accepted"}],"objective":"Publish the next version of the Swarmcaster Lite site under the name swarmcaster-lite. The change is GitHub commit 98ce777 of pepegobig/swarmcaster-lite: it adds NOTICES.md (third-party notices for the bundled code and fonts), and the site now serves index.html, LICENSE and NOTICES.md. index.html is unchanged.","parentJobId":"d12ea63d-36c2-4a60-b782-f4ab3bfd9c1e","planHash":"0b0e2fcd6f0f3fbee51fef2aa0d872571bf5fb3920ba695ca09175101f9e7e78","previousHash":"0000000000000000000000000000000000000000000000000000000000000000","projectId":"719f64f6-1c18-4425-9e0c-754237e7a225","publication":{"commit":null,"deliveredAt":null,"repoUrl":null},"receiptIdentity":{"adapter":"0xde152afb7db5373f34876e1499fbd893a82dd336","chainId":1,"collection":"0x0000ec93127baa929e58e97dd0095a2bfb38ec1d","registry":"0x8004a169fb4a3325136eb29fa0ceb6d2e539a432"},"registry":"0xb6d0a187b050fa5bb0b87033a203f37becf4a775","research":[],"schema":"identitymd-work-v1","signals":[{"agentId":"51152","feedbackHash":"74aba1e2870f044de0235b6ccf3c87ac1e8d6685e426889b08d918d7e4c4a792","nodeKey":"import_site","submissionHash":"7e82d414361b91cdd217f729f6e3c6b3eff165b2fe85259357e1a2169aafd1d9","tag1":"verification:structural","tag2":"acceptance-v2","value":1},{"agentId":"51736","feedbackHash":"db59fb3175554096ff358f6ddfdd19583e51e5f9f2bde879aeb1e1297f3bd452","nodeKey":"refine_project","submissionHash":"3ade0c17a253403e75ac629790a69274fb29ff8cd85bbf6ea56e9e5d03c19434","tag1":"verification:structural","tag2":"acceptance-v2","value":1},{"agentId":"51460","feedbackHash":"7825adddf4f273a1453942ab9b8a160fb9abbe5326cfca6feb2dfa30bf261a1a","nodeKey":"site_content_check","submissionHash":"f34ec8e2d34dea8a2ecb968dc1244deafdbc61aee3bfb2a86d08edd43ce533fa","tag1":"review:submission","tag2":"acceptance-v2","value":1}],"site":null,"snapshotHash":"2a49a1d96f10d3f948838354a179159de9b29f642c636281b25b2cb3dda56020","state":"completed","submissions":[{"artifacts":[],"attempt":1,"bundleHash":"d3a4f92043e7add2b91e7733fe7eddee1ac1dbc5ec47138a108c369a8e625bc3","device":"080b27034220eb6f","findings":[],"hash":"3ade0c17a253403e75ac629790a69274fb29ff8cd85bbf6ea56e9e5d03c19434","nodeId":"9f45fe28-733a-404f-9f5d-93f31dad7879","outcome":"completed","summary":"Added `NOTICES.md` exactly as supplied in commit `98ce77706aaa901f4d82aaa7fdad9a74872a2264`.\n\nVerified its SHA-256 matches `bdb3e428f34033c5cdbf893fc73721355d65179c51a4d4472dcba5912c6f7941`. No other files changed.","treeHash":"c11f1e54414eb21a0a49ca37bb7e1c71c7b2c0dd","usage":{"cachedInputTokens":66944,"inputTokens":9455,"model":null,"outputTokens":375,"runtime":"codex","turns":2,"wallClockMs":16184}},{"artifacts":[],"attempt":1,"bundleHash":"d07d09e8eba654322ee6d240b020e576f3200e8d3dbfcbc088279f35a90580c2","device":"0b3b16f4e82a0732","findings":[],"hash":"7e82d414361b91cdd217f729f6e3c6b3eff165b2fe85259357e1a2169aafd1d9","nodeId":"ab08ce7e-adff-4afc-b022-37462b1bd75f","outcome":"completed","summary":"Prepared `dist/` with exactly `index.html`, `LICENSE`, and `NOTICES.md`, each byte-identical to its root file. No source or configuration changed.\n\nPackage manager: none.\nBuild step: none; copied with `cp index.html LICENSE NOTICES.md dist/`.\nOutput: `dist/` (806,925 bytes).","treeHash":"11cb6607ec83f21fc6f7033ebed5c6fb0871410e","usage":{"cachedInputTokens":90624,"inputTokens":16029,"model":null,"outputTokens":496,"runtime":"codex","turns":2,"wallClockMs":15905}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"080780b6898c2241","findings":[],"hash":"d9dd079b276679cdf3e08d94e2bc3816d002b2a6400e202e8fed2b7127f89bbd","nodeId":"9f45fe28-733a-404f-9f5d-93f31dad7879","outcome":"failed","summary":"Error: Upgrade to Pro to access this model (https://devin.ai/…\n","treeHash":null,"usage":{"cachedInputTokens":0,"inputTokens":0,"model":null,"outputTokens":0,"runtime":"codex","turns":0,"wallClockMs":440}},{"artifacts":[],"attempt":1,"bundleHash":null,"device":"a74f2bc0ce11ed16","findings":[{"citation":"resolved","description":"The hosted NOTICES.md lists package/license names and links to IBM, but omits the accompanying license texts and most upstream copyright notices. dist/LICENSE is the project MIT license, attributed only to pepe. dist/index.html embeds five IBM Plex WOFF2 fonts, verified byte-for-byte against @fontsource/ibm-plex-sans@5.3.0 and @fontsource/ibm-plex-mono@5.3.0; their metadata has copyright and a license URL but no OFL text. OFL condition 2 requires the copyright notice and license to accompany redistributed fonts. The same export includes React 19.2.9 but omits its Meta Platforms copyright notice required by its MIT license. Include the actual upstream notices for assets present in the bundle. This is an advisory distribution-notice defect, not evidence of malicious content. References: https://openfontlicense.org/open-font-license-official-text/ and https://raw.githubusercontent.com/facebook/react/main/LICENSE.","line":6,"path":"dist/NOTICES.md","reproduction":"Inspect the exact export: dist/ contains only index.html, LICENSE and NOTICES.md. Open NOTICES.md lines 6–7 and its React table entry, then LICENSE: the notices supply package/license names and an IBM repository URL, while LICENSE attributes the MIT text only to pepe. Search all three files for the full OFL heading or Meta Platforms; neither is present. Decode the five data:font/woff2;base64 URLs in index.html and inspect their name tables with fontkit: they have a licenseURL but no license text. Compare with package/LICENSE from @fontsource/ibm-plex-sans@5.3.0, @fontsource/ibm-plex-mono@5.3.0 and react@19.2.9. Expected: the distributed copy includes the OFL text and the bundled code’s upstream copyright/permission notices. Actual: the OFL text and React copyright attribution are absent.","severity":"medium","snippet":"- **IBM Plex Sans and IBM Plex Mono** (latin subset, embedded): Copyright © 2017 IBM Corp., SIL Open Font License 1.1,\n  https://github.com/IBM/plex. The fonts are not sold on their own and keep their reserved font name.","title":"Include complete license notices for the bundled code and fonts"},{"citation":"resolved","description":"The exported mini-app panel declares aria-modal=true and initially focuses Close, but it neither traps focus nor makes the background inert. Pressing Shift+Tab twice moves focus through Open in a new tab and onto the obscured app card behind the overlay. Keyboard users can then navigate and activate the background while the modal remains open. The source is app/src/MiniAppPanel.jsx, especially lines 18–31 and 74–85. Add a focus trap or use a native modal dialog with equivalent focus handling; this is an accessibility advisory and does not block hosting.","line":82,"path":"dist/index.html","reproduction":"Serve dist/ and open /#/apps with an app listed. Click an app card; Close receives focus. Press Shift+Tab once to focus Open in a new tab, then once more. Expected: focus stays among controls inside the dialog. Actual: document.activeElement is the underlying button.app-card, outside [role=dialog], while the overlay is still open. Reproduced in Chromium with GET /apps mocked as {\"apps\":[{\"name\":\"Review test app\",\"homeUrl\":\"https://review-app.example/\",\"pinned\":true}]} and that HTTPS URL fulfilled with a simple HTML page containing a button; the defect is independent of the framed app content.","severity":"low","snippet":"className:`panel`,role:`dialog`,\"aria-modal\":`true`,\"aria-labelledby\":`panel-title`","title":"Keep keyboard focus inside the mini-app dialog"},{"citation":"resolved","description":"The exported Skip to content link uses href=\"#main\", while the application stores its route in the same URL fragment. Activating it overwrites #/apps or #/seat/912; the app can switch to Seats, and reloading the resulting URL displays Page not found at #/main. A keyboard accessibility control therefore loses the current page. The source is app/src/Layout.jsx:6. Focus or scroll to the main element without replacing the router fragment. This is an advisory navigation defect, not a hosting blocker.","line":27,"path":"dist/index.html","reproduction":"Serve dist/, open /#/apps, focus the Skip to content link with the keyboard (or document.querySelector(\"a.skip\").focus()), and press Enter. Expected: Apps remains displayed and focus moves to main without changing the route. Actual in Chromium: the fragment becomes #main and the view switches to Seats. Reload that URL: the fragment normalizes to #/main and the page displays Page not found. This also reproduces with /apps returning {\"apps\":[]} and /seats returning {\"count\":0,\"seats\":[]}, so it does not depend on live service availability.","severity":"low","snippet":"(0,C.jsx)(`a`,{className:`skip`,href:`#main`,children:`Skip to content`})","title":"Preserve the active hash route when skipping to content"}],"hash":"f34ec8e2d34dea8a2ecb968dc1244deafdbc61aee3bfb2a86d08edd43ce533fa","nodeId":"b99b4962-a2e4-4059-b9b7-a0d6aea21b8e","outcome":"completed","summary":"Saved three advisory findings in [.imd-findings.json](.imd-findings.json):\n\n- Medium: incomplete third-party license notices.\n- Low: keyboard focus escapes the mini-app dialog.\n- Low: the skip link overwrites the current route.\n\nNo critical or high findings. Reviewed all hosted files and bundled code, styles, and fonts; confirmed the export matches commit `98ce777`. Site files remain unchanged.","treeHash":null,"usage":{"cachedInputTokens":2192768,"inputTokens":119908,"model":"gpt-6-astra","outputTokens":17688,"runtime":"codex","turns":6,"wallClockMs":508478}}],"verification":[{"checks":[],"detail":"paths and tree verified; no suite was run for this kind of work","evaluation":"structural","profile":"none","status":"accepted","submissionHash":"3ade0c17a253403e75ac629790a69274fb29ff8cd85bbf6ea56e9e5d03c19434","verifiedTreeHash":"c11f1e54414eb21a0a49ca37bb7e1c71c7b2c0dd","verifierVersion":"0.1.0+ead9012e"},{"checks":[],"detail":"paths and tree verified; no suite was run for this kind of work","evaluation":"structural","profile":"none","status":"accepted","submissionHash":"7e82d414361b91cdd217f729f6e3c6b3eff165b2fe85259357e1a2169aafd1d9","verifiedTreeHash":"11cb6607ec83f21fc6f7033ebed5c6fb0871410e","verifierVersion":"0.1.0+ead9012e"}]}