IMD Ember World - Report11 evidence-based narrow source-closure assessment

QUESTION

Does this exact candidate close all six Audit10/Report10 source blockers (1 Low + 5 Info/test-reliability issues) while preserving prior Auth, ownership, artifact and Member M1 invariants? Explain any remaining source defect or bounded limitation. Assess SOURCE-CLOSURE separately from RELEASE-READINESS; do not turn TEAM test counts into an external PASS.

PERIOD

Latest findings: Audit10/Report10 finalized 2026-10-05. Remediation candidate: frozen 2026-10-06 Asia/Taipei. Use the exact submitted pin and current evidence timestamps. Compare against the tenth candidate and latest official reports; older namespaces are historical context.

SOURCES

Candidate: https://github.com/tungweb3/imd-ember-world-review/tree/35ace952824ebf711fd9fa6cb7ea1cc83b75cd6a

Audit10: https://github.com/Identity-md/research/blob/d2bbc2713f0c15d7542bc8afa09bafc4bf12ef12/jobs/e817a62e-1b9f-4469-90d7-7a761579af81/files/AUDIT.md

Report10: https://github.com/Identity-md/research/blob/7701ce0c6d860ba50616629d0a3a60e644135fe4/jobs/a3ec7191-f1ab-400e-bb5f-dfa858c6da65/files/artifacts/report.md

Start with README and Submission11/REVIEW_INPUTS.md. Current evidence is Submission11/FinalClosure/{CLOSURE_MATRIX.md,TEST_RESULTS.json,ARTIFACT_CLOSURE.json,REVIEWER_EVIDENCE.json,LATEST_AUDIT_IDENTITY.md,FINAL_AUDIT_MAPPING.md}, manifests/submission11-published-source.json and root SHA256SUMS. Cross-check source bytes and actual changed functions. Prior Audit10/Report10 disagreements must remain visible; an earlier Report pass cannot overrule a later reproduced finding.

SCOPE AND METHOD

Unofficial TypeScript Cloudflare Worker / React SIWE World + persistent Member M1 public profiles; no Solidity. World is not wholly read-only. This report covers the six source mechanisms below and directly affected prior boundaries. Exclude new features, 3D/scene/media/avatar/selfie/full UI, Genesis/Mint, Ember Coin, Fren Pet, private credentials/databases/backups. Withheld full frontend inputs mean full-site build evidence is unavailable, not passed.

Use offline/local synthetic fixtures with locked real viem, the actual AuthClient/Worker and migration-backed SQLite. Public source/report reads and locked dependency downloads are allowed. No production endpoint tests/writes, real wallets/signatures, asset actions, approvals, claims, bridges, payment, deployment or new jobs. Do not request private data.

REQUIRED SIX-ROW ASSESSMENT

A10-L1 (Low): passive discovery overwrote retained revoking cleanup. Verify current-life filtering and monotonic cancellation reasons using held B verify, failed first nonce logout, stop/restart, provider discovery C and late verify. Cover other-context A, same-life genuine switch, actual current C-to-D cleanup and lock-to-stop promotion. Same-invariant neighbor: repeated transport/503 failure must retain original nonce ownership without an immediate loop; later existing lifecycle trigger retries; only 2xx or causally post-fence nonce 409 concludes responsibility. 409 is refusal, not successful revocation. Preserve A's row/cookie and delayed cookie-clear distinctions. Current-life canonical PRESENT can coexist with pending cleanup; old callbacks cannot install identity. Preserve legitimate newer same-address sessions and no duplicate original nonce dispatch while its request is still pending.

A10-I1 (Info): candidate-cap ranking clock must be sampled once after sightings await. Reproduce 257 seats where 1..256 expire and 257 remains eligible; verify 257 inclusion, eligible=1, size=s and honest partial result. Index/proof producer timestamps, tie-breaks, 256 cap and RPC/index/budget caps must remain unchanged.

A10-I2 (Info): public assets display clock must follow final relevant awaits, including character I/O. Verify 0/1/2/5000ms delay and inclusive 24h boundary controls against first/next responses. Preserve presence/fetchedAt producer data, with no new index/budget/RPC traffic. Public roster status must not become ownership proof.

A10-I3 (Info): persisted spaced route-prefix filenames must be masked: '/api/auth/session private.log', '/api/auth/session dir/file.ts', '/api/auth/session (private)/x.ts'. Read back nested/quoted/bare artifact bytes. Preserve exact route/query/subroute tokens, network URLs, relative test IDs and replay nonce/action/event structure. Recheck earlier artifact containment and actual symlink/junction controls; synthetic paths are not evidence of production leakage.

R10-N1 (Info): nonfinite live clocks must not poison lanes/probes. Test NaN/Infinity/-Infinity, invalid clock after awaits, finite and rollback controls. Inspect index_lanes/index_lane_probes and reservation/upstream counts. No nonfinite durable values or stuck lane. An existing finite probe keeps bounded 30-second backoff, with no refund or timestamp refresh; finite requests recover at +10m/+60m. Preserve producer timestamps and honest incomplete authority.

R10-N2 (Info/test reliability): LOW2 genuine B-to-A regression must await completed logout and notification, preserving every original assertion. Verify recorded 50 targeted / 10 full stability runs. Repeat independently where feasible; report actual repeats and inability to run any requirement. Fixed flush counts, extra sleeps, dropped failures and altered reference-oracle expectations are not acceptable substitutes.

REPRODUCTION AND EVIDENCE

Fresh exact public checkout with Node24.x; in source/ run:

npm ci --ignore-scripts

node scripts/review-tests.mjs --check

npm run test:review

node scripts/verify-artifact-closure.mjs

Use all supported files and current totals, without private-source replacement, shims, global dependency substitution, copied node_modules or hidden skips. Reproduce exact counterexamples and reverse controls; examine same-evaluator vulnerable baseline calibration. Separate source assertion failures from environment/setup failures, including Windows file-symlink EPERM. Neither an unavailable check nor a TEAM claim is an independent pass. Report commands/exits/totals/fail/cancel/skip/todo and retry reasons. Check old R5/R8/v1.1 current-life canonical-session invariants and independent reference scheduler; tests/oracle cannot be weakened to make a fix pass.

LENGTH AND FORMAT

Write in Traditional Chinese, 1200-2000 Chinese characters excluding the matrix/evidence appendix. Give a concise conclusion, six-row matrix (ID/severity, exact source location, reproduction, fix/reverse controls, CLOSED/PARTIAL/OPEN/UNKNOWN with rationale), and compact evidence appendix. Cite exact-pin source/line links beside claims and official reports beside prior findings. Separate independent facts, TEAM claims, history, inference and unknowns; include SQLite effects and auth/index/budget/RPC counts.

Return separate SOURCE-CLOSURE and RELEASE-READINESS verdicts, each PASS/BLOCKED/UNKNOWN. Explain what bounds a source PASS and what would block it. Production Cloudflare/browser/provider/cookies/ERC-1271/M1 writes/D1/WAF/limiter/upstream/process-death/cross-isolate behavior, full frontend build and deployed identity require separate release evidence. The candidate was prepared for source review; infer no deployment or production certification. Completed/accepted, large passing counts or Low/Info labels do not establish endorsement, zero vulnerabilities or fund safety.