Applied the pinned release-correction revision exactly, limited to its allowed SDK/config/docs/test files.

Key changes include:

• Restored generic strict JSON’s 256-token cap while retaining manifest capacity at 1024.
• Documented the 8 * segmentFlushes work charge.
• Updated the 50-input release inventory and correction evidence bundle.
• Added generic-parser regression and compiled-Solidity differential test scripts.
• Preserved all Solidity, ABI, compiler, Foundry, and remapping bytes.

Validation passed:

• node --test test-sdk/*.test.mjs — 89 passed.
• All 50 configured Solidity Keccak fingerprints match current sources.
• Imported files match the pinned correction byte-for-byte.
• Evidence archive SHA-256 matches its index.
• No prohibited paths changed.

Built the connected STEPS export. Contracts remain unchanged; payments stay disabled and live profiles remain NOT_RUN.

Passed: 180 contract, 89 SDK, 100 unit, 111 browser tests, and 19 public RPC checks.

Report · Asset hashes · Complete diff

Hosting remains unconfirmed: IMD has not returned the final website commit, public URL, or CID.

That background grep was the slow context search I replaced with the Python scan. Its output covers the same strings I already examined, so nothing changes. The review stands as reported: four advisory findings in .imd-findings.json, no critical or high content, and the export can be hosted.

I found five problems in the site: one high, two medium and two low. They are written to .imd-findings.json. The site reads the right live contracts, keeps payments disabled, and passed all 16 checks of the design probe. I could only test in Chromium, because WebKit is missing system libraries on this machine.

Requirements

• "Connect … against the verified Ethereum contracts": met. dist/imd-deployment.json and config/production-gate.json hold the factory 0xff15…0abc, encoder 0xae9a…6886 and verifier 0x52a4…ec4, the same as deployment.json. The page reads chain 1.
• "Preserve the platform design and six operations": met. Same layout, the actions are there but disabled, and the fixture demo still has all six.
• "Sequence/history and current output remain primary": met. The Projects list is the main route, not the demo.
• "Identity: STEPS / Stepstoke, https://x.com/stepstoke": met. Header and footer link in App.tsx:26.
• "All content/documents English": met.
• "Apply the exact local correction …": met. Recorded in docs/validation/live-connection-v1/correction-import.json.
• "Every Solidity input and ABI remains unchanged": met. The last commit touched no src/ files.
• "Verify anonymous public HTTPS and browser CORS for ALL methods …": met. In my own run, the page fetched the receipt, the block, debug_traceTransaction and code at past blocks.
  • PublicNode refuses code at past blocks (HTTP 403) and has no trace method, so those reads come only from dRPC. This is disclosed in the validation README at line 44.
• "Fail closed …": met. chainAdapter.ts stops the read when the transaction history is incomplete or a contract check fails.
• "Unperformed profile checks remain NOT_RUN; paid controls stay disabled": met. The gate file has liveCompatibility: NOT_RUN and productionReady: false, and the "Create project" button is disabled.
• "A connected hosted site with disabled payments must be described exactly that way": met. The banner says "Live contracts. Payments disabled".
• "Update stale pending-deployment wording in the final website/docs": missing. docs/AGENT-GUIDE.md:3 still says "This undeployed development candidate". High finding.
• "Do not import any local test deployment or rehearsal addresses": met. local-config.json was moved out of the public folder into the test fixtures.
• "Retain safe previews, exact approvals, no automatic purchase/retry, no implicit signing and existing desktop/mobile layout": met. No horizontal scroll at 320, 390 or 1440.
• Final regressions and build, importing the handoff after the build, hashing every asset: met per the builder's records (final-assets.json, checks-index.json). I did not rerun them.
• Deliver through IMD GitHub and IPFS, and report the website commit, URL, CID and publication claims: after review (7 items).
• Live profile checks: needs the requester, who has to buy and authorise those tests.

The idea in one sentence: STEPS is a quiet, sequence-first workshop that lists public projects, and one red accent (the Create button and the active tab underline) carries it. There are no competing visual effects.

Findings

1. High, fidelity: docs/AGENT-GUIDE.md, which another doc calls "the current reference", still describes an undeployed candidate and says not to host or publish it. The finding gives replacement wording that keeps the NOT_RUN status.
2. Medium, copy: the Projects screen says payments are disabled fou

All five review findings reproduced, and all five are fixed. I rebuilt the site, imported the real deployment record after the build, and every check passed. Each finding is answered in .imd-responses.json.

Fixes

• [high] Agent guide still said "undeployed" (f664c2db…): docs/AGENT-GUIDE.md lines 3 and 5 now use the wording the reviewer asked for. They say STEPS is live on Ethereum mainnet (chain 1, block 26248821, source 751f3901…) and the site is hosted with payments disabled. Live profile checks stay NOT_RUN and productionReady stays false. Seven other docs had the same out-of-date "not deployed, not hosted" wording, so I fixed them too: PLATFORM-AUTHORING, ACCEPTANCE, docs/DESIGN, FRONTEND, SDK-BROWSER, frontend-README and one sentence in PROTOCOL-OVERVIEW.
• Empty projects message (ccb5304b…): it now reads "No projects have been created on Ethereum yet." (frontend/src/ui/ProjectList.tsx:25). The banner, hint and footer are unchanged.
• "Open local contracts" link (3284d9ba…): it now shows only when the page runs on localhost, 127.0.0.1 or [::1], so hosted visitors no longer reach a dead end (frontend/src/App.tsx:37). The local test that clicks it still works on 127.0.0.1.
• Footer alignment (7c6a78f8…): I added align-items:center to the footer (styles.css:61). The reviewer said the phone layout was unaffected, but that rule would also have centred the stacked phone footer. So the phone rule (line 245) now sets align-items:stretch to keep the phone layout as it was.
• Projects tab marked current on the deployment page (56a6e9dc…): no tab is marked current on #/configuration now.

I also added the new behaviour to DESIGN.md and wrote a "Review revision" section in docs/validation/live-connection-v1/README.md.

Checks run, in order

• Typecheck passed; frontend unit tests 100/100; SDK tests 89/89.
• verify-live-connection passed against the live chain (50 sources, 3 contracts).
• Production build, then import-deployment after the build: passed.
• build-release then check-release: ABI and contracts match.
• observe-ethereum: deployment verified, NOT_RUN, productionReady false.
• check-connected-export: 13 files hashed, signing authority false. The hash inventories (final-assets.json, dist/imd-deployment.json) were regenerated.
• Browser suite in Chromium at 1440, 390 and 320: 111/111.
• Design probe: 16/16 at 320, 390 and 1440.
• Delivery size: 6.8 MB, under the 8 MiB limit.

Rendered check: I served the export in Chromium under a non-local host name (steps.test) and under 127.0.0.1.

• On steps.test the local-contracts link is gone; on 127.0.0.1 it is present.
• No nav tab is marked current on the deployment page.
• At 1440 the three footer items line up at the same height.
• At 390 the page finished its real public reads with no errors and showed the new empty-state message, with no horizontal overflow.

Limits

• The WebKit browser tests were not re-run.
• All reads came from this machine, not from the hosted site. I made no commit and published nothing: hosting, the website commit, the URL and the CID are left to IMD's pipeline.
• The older diff and change records from the previous round (changes.json, complete-diff.patch.xz) were not regenerated for this revision.
• Payments stay disabled and live profile checks stay NOT_RUN. I made no contract, ABI or launch-manifest changes.

The review is complete and .imd-findings.json holds one advisory finding. No critical or high findings exist, so nothing blocks hosting.

Settled from the prior round

• Stale "undeployed" docs wording: fixed. docs/AGENT-GUIDE.md now states the Ethereum mainnet deployment with payments disabled and NOT_RUN profile status, and the "undeployed candidate" sentence in the protocol overview is gone. Dropped.
• Hostile demo fixtures in the bundle: unchanged and still inert. The fixtures, sanitizer and preview sandbox were not touched this round. They remain confined to the demo route. Dropped as informational.
• Local chain route in the export: improved. The "Open local contracts" link now renders only on loopback hostnames. The route is still reachable by URL but shows the missing-config message, and dist/local-config.json does not exist. Dropped.
• wagmi mainnet transport without a URL: not fixed. The revision notes do not mention it. The source line is unchanged and the rebuilt bundle still compiles in viem's default host ethereum.reth.rs, which is outside the two-endpoint public read policy. Verification reads use the SDK policy client, so contract identity is unaffected. Reported again as low with the new bundle filename.

Hosting checks this round

• All 12 asset digests in dist/imd-deployment.json match the files on disk, and the export checker reports ok with signing false and productionReady false.
• The three contract addresses, launch id, source commit, attestation hash and chain id in the hosted handoff match the pinned deployment read.
• No secrets, keyed RPC URLs or mock handoff are in the export. The private-key strings in the vendored chunk belong to the Coinbase wallet SDK and wallet connector code, and the 64-hex values in the main bundle are source and creation-code hashes.
• Pages describe the site as deployed with payments disabled and live profile checks NOT_RUN, not as a validated live service.

One note on process: the export checker rewrites a timestamp in docs/validation/live-connection-v1/final-assets.json when run. I restored that file with git so the tree is unchanged apart from the findings file.

All five findings from the last round are fixed, and I found nothing new I could reproduce. .imd-findings.json holds {"findings":[]} and the working tree is unchanged.

Last round's findings

• [high] fidelity: the agent guide called the release an undeployed candidate. Fixed. docs/AGENT-GUIDE.md lines 3 and 5 now say the contracts are on Ethereum mainnet (chain 1, block 26248821, source 751f3901…) and the site is hosted with payments disabled. They also say profile checks are NOT_RUN and productionReady is false. grep -ni undeployed docs/AGENT-GUIDE.md returns nothing. The same stale wording in the other current docs was corrected too. Old wording remains only in the history and validation records, which are kept on purpose. Two more files, docs/agent/sdk-cli-checks.md and docs/agent/SDK-CLI-A1.md, still say "no hosting", but no current document links to them, so I did not report them.
• [medium] copy: the empty Projects list said "read window" and repeated "payments disabled". Fixed. ProjectList.tsx:25 now reads "No projects have been created on Ethereum yet." The built bundle has the new text. The only "read window" left in it is the SDK's error for a log range that is too large, which is correct there.
• [medium] fidelity: "Open local contracts" showed on the hosted Deployment page. Fixed. App.tsx:37 shows the link only when the page is on localhost, 127.0.0.1 or [::1], and the built bundle has the same check.
• [low] bug: the footer link sat 12px low at 1440. Fixed. .site-footer now has align-items:center, and the phone layout sets stretch explicitly. In Chromium at 1440 the text of all three footer items starts at y=672.
• [low] accessibility: the nav marked Projects as current on the Deployment page. Fixed. In Chromium, #/configuration now reads Projects=null, Demo=null, Components=null.

Requirements

Earlier rounds checked these and I re-checked the ones this revision touched:

• Met: the existing English STEPS design and its six operations; the STEPS / Stepstoke name and the x.com/stepstoke link (App.tsx header and footer); the deployment handoff in dist/imd-deployment.json; paid controls stay disabled with NOT_RUN and productionReady:false (ProjectList.tsx:24, the Deployment page's status list); no local or demo route offered to hosted visitors (App.tsx:37); stale deployment wording updated in the docs.
• After review: IPFS and site hosting, the published site URL and CID, and the GitHub delivery.

The idea in one sentence: STEPS is a sober "Open Workshop" tool where the project's sequence and its current output carry the page, and status is stated plainly next to the controls it affects.

Limits of this review: I checked the browser in Chromium only, against dist/ served from 127.0.0.1. I did not repeat the live-chain and public-RPC checks this round, because the revision did not touch them.