I found no material security or liveness defect in the imported source, so nothing here blocks deployment. Two non-blocking findings are in .imd-findings.json. I changed no repository files: everything I ran used copies in /tmp, and I removed the out/ and cache/ folders my test run created.

What I read: src/StepsBranch.sol (every state-changing function), src/MockToken.sol (test-only), both test files, the SDK, launch.json, README.md, the local validation evidence, the committed ABI and build files, and the protected checks. On Ethereum mainnet I also read the live Intake (0xa43e…de82) and IMD token (0xd34a…63b7), but only their bytecode and public read functions. I could not reach the Intake's source code.

Reproduced:

• Tests: all 57 Solidity tests pass, including the 256-run sibling-order fuzz test. All 16 SDK tests pass.
• Cold callbacks (isolated local chain): all 17 cases ran in separate transactions. The heaviest is the first checkpoint from a nonzero proposal with a 2048-byte URI, at 192,259 gas (including the test intake's overhead), the same figure as the evidence file. Late success, refusal and failure while newer work is pending did not change the branch.
• Fresh build: the source fingerprint matches the evidence file, and the build, deployed code and ABI exactly match the committed files. The deployed code is 11,460 bytes, with no DELEGATECALL, CALLCODE or SELFDESTRUCT.
• Mainnet bindings: the Intake has requestWithFailure with the official callback tuple. Its price for job.open@job-1 in IMD is 0.5 IMD, and its callbackGas() is 200000. Both callback selectors match the official shapes.
• Mainnet-fork rehearsal against the real Intake and IMD:
  • Deployment with owner 0x0bced6bf…7352 reads back the correct owner, intake, asset and price.
  • Funding pulled exactly 0.5 IMD and left the ledger with no balance and no remaining approval.
  • A first-checkpoint success callback with a 2048-byte URI, sent as if from the Intake, used about 165,000 gas of execution.
• Logic checked against the brief:
  • The maximum-payment limit holds.
  • Each branch allows only one pending request.
  • Expiry changes only local waiting.
  • A late outcome is recorded once in lateReceiptOf and never moves a branch.
  • Foreign, unknown, duplicate and zero-hash callbacks are rejected.
  • The 2048-byte URI cap and the 4 KiB snapshot hash check work.
  • Ownership uses two steps, and the owner can only change the price.

Findings:

1. Low (design property, needs your decision): anyone can propose and fund on any branch. For 0.5 IMD, an attacker can hold a branch busy and add their own result as its next step, which makes other people's drafts on that branch permanently stale. Forked branches can be taken over the same way. Victims lose no funds, because their funding transaction reverts before any token moves. I reproduced this in a scratch test. Fixing it would mean adding branch ownership, which the brief forbids, so the adapter should not change it without your approval.
2. Info: the live Intake's 200000 callback gas is a setting IMD can change, not a fixed value. The heaviest callback fits today with roughly 8,000–35,000 gas to spare. If IMD lowered the setting below about 195,000, first checkpoints would fail and the branch would wait 7 days for expiry. The action id and Intake address can't change after deployment, so if IMD retires them, funding stops working. No funds are at risk, because the transaction reverts.

These local checks are not an external audit or proof that it works on mainnet. Deployment evidence (launch ID, contract address, transaction) doesn't exist yet, and paid live tests remain NOT_RUN.

The review is complete. The findings file is written, all four snippets match the tree, and no repository file was changed (only .imd-findings.json and my scratch tests under test/scratch/, which are not kept).

Outcome: no critical, high or medium defect in the economics area. The supplied suite passes 59 of 59, and a stateful fuzz I wrote (64 runs, 2,560 calls over propose, fund, deliver, fail, expire and fork) kept three invariants: the ledger never holds IMD or a residual approval, every pending slot points at exactly one consistent Pending proposal, and every first callback under the 200k stipend is delivered.

Findings recorded in .imd-findings.json:

1. Low. Payment is not bound to the live Intake price, and the action is a constant. The ledger pays its own owner-set price for the constant action job.open@job-1 and never reads the Intake's live price. If the Intake lowers its price, every funder overpays the difference to the IMD treasury and maxPayment cannot stop it. If the Intake raises it or retires the job-1 version, funding reverts forever and the lineage freezes. Reproduced with a priced Intake model in test/scratch/Economics.t.sol. The fix needs a scope decision since the brief restricts management to price only.

2. Low. Permissionless expiry can be ordered ahead of the Intake's delivery at the seven-day boundary. A third party front-runs the writer's complete with expirePending, so the paid success becomes a late receipt with no path to ever become a checkpoint, and the griefer takes the freed slot. Loss is bounded to one request and the precondition is narrow, so low.

3. Info. The shared-branch pending-slot griefing already recorded as 2ba0657b, restated with its economics so the judge sees it is covered.

4. Info. IMD sent straight to the ledger is stranded, by design, and does not break the funding delta checks.

Coverage: all 14 listed entry points have rows, plus three invariant rows and a manifest row. Two items are marked unreached: the 16 SDK tests, because viem is not installed and the network is blocked here, and the live mainnet readbacks of price, callback gas and token symbol, because public RPCs were unreachable from this machine. The evidence file's claimed values are therefore the requester's word, not something I confirmed.

I added two test files. forge build succeeds and forge test passes 82 of 82 with the verifier's fuzz seed: the 59 existing tests, 22 new unit tests and one invariant suite. I found no material defect in src/StepsBranch.sol. I changed nothing outside test/ except .imd-findings.json.

test/StepsBranchInvariant.t.sol drives the ledger with random call sequences (256 runs × 100 calls, no reverts). The calls are: propose (current or stale anchor), fund, success and failure callbacks through a mock Intake that calls back once with the real 200,000-gas limit, a time jump of up to 8 days, expiry, all three fork types, a price change by the owner or a stranger, callbacks from a stranger, and Intake callbacks with an unknown id, a zero result hash or failure status 0. After every sequence these must hold:

• Payment: the ledger holds no tokens and leaves no approval behind. The Intake received exactly what was paid, total supply is unchanged, and no funder pays more than their stated maximum or is charged when funding fails.
• Callbacks: every real callback is delivered within the gas limit, and no fake or invalid one is ever accepted.
• Consistency: each branch's single pending slot points to its one Pending proposal. Checkpoints match Succeeded proposals one to one, every branch head matches its checkpoint, and late receipts exist only on Expired proposals.
• Nothing finished changes: a finished proposal, a checkpoint or a late receipt never changes once it exists. A stale anchor is never accepted.
• Authority: the owner, the Intake and token addresses never change, and the price is never zero.

To show the suite isn't vacuous, I temporarily made it fail on first reaching a checkpoint or a late delivery. Both were reached with the verifier seed.

test/StepsBranchEdges.t.sol pins edge and failure cases not already tested:

• Setup: Status numbers 0..5, the constants and both callback selectors; the constructor rejects each zero argument and never makes the deployer the owner.
• Owner powers: a stranger can't set the price, zero is refused, and every failure path of the two-step ownership transfer is covered.
• Payment protection: a fuzzed test of the maximum-payment limit (512 runs). Funding is rolled back when the Intake pulls less or nothing, when the token takes a fee, or when the Intake tries to call back during the request itself. A stranger can't spend the proposer's approval.
• Expiry: the boundary is exact at 7 days minus 1 second; expiry can't run twice, refunds nothing and creates no checkpoint. A missing receipt (received=false, status 0) is not success, and on-time outcomes never write a late receipt.
• Late outcomes: a late success with a 2048-byte URI fits the gas limit while newer work waits, and the newer request then becomes the first checkpoint from a nonzero proposal. Late refusal and failure leave the newer pending request alone, and invalid late outcomes are rejected.
• Forks and snapshots: a 32 KiB URI is still delivered. All fork and snapshot failure paths are covered, including a 4097-byte snapshot that matches the hash but is still rejected while a reference fork of it works. Forks advance independently with distinct digests.

Findings (.imd-findings.json, one info item): a success callback with a URI of about 96 KiB or more runs out of the 200,000 gas. Real Intake URIs are about 100 bytes, so this isn't reachable in normal use and needs no fix. The earlier contributor's two notes (ADAPTATION.md) still stand and I didn't repeat them: anyone can take a shared branch's single pending slot (low), and callbacks depend on the Intake keeping its callback gas at about 195,000 or more.

The files are left uncommitted. This was test work only: nothing was deployed, deployment evidence is still missing, paid live tests stay NOT_RUN and productionReady stays false.

All checks are complete and the working tree has no modified tracked files. Here is the report.

Outcome. The math, boundary and numerical-gap review of StepsBranch found one low-severity defect and one informational boundary. The findings and an 18-row coverage record are in .imd-findings.json. Baseline evidence was reproduced: 59 of 59 Foundry tests pass including the 256-run sibling-order fuzz, and the 16 SDK tests pass with viem installed outside the repository.

Finding 1, low: funding pays the stored price, not the Intake's live price. The ledger pulls its owner-set price and checks maxPayment against it. I probed the live Intake on chain 1 with eth_call: it reverts when the amount is below its priceOf, but accepts and keeps any amount at or above it. The two prices agree today at 0.5 IMD. If the Intake's price drops and the owner has not yet lowered the ledger's price, every funder overpays the difference with no refund. The proof test under test/scratch fails on the current code and passes once funding reads the live price with the stored price as a ceiling. That changes what the price field means, so it is a scope decision for the requester.

Finding 2, info: very long result URIs cannot be delivered. Measured cold with a 200000-gas mock Intake, a 64 KiB URI is recorded but a 96 KiB one runs out of gas and leaves the proposal Pending. The Intake's real locators are short, so this only bounds the hash-commitment promise.

What holds. All plus-one sentinels and uint64 casts are guarded so they cannot wrap. The body, event-URI and snapshot limits are inclusive at 16384, 2048 and 4096 bytes, and the body limit equals the live Intake's MAX_BODY_BYTES. Expiry is allowed at exactly seven days. The heaviest callback, a first checkpoint from a nonzero proposal with a 2048-byte URI, costs 188122 gas inside the callee under cold storage. Live readbacks match the manifest: priceOf is 0.5 IMD, callbackGas is 200000, the asset is IMD with 18 decimals.

Not reached. Nothing in the assigned area was left unexamined. Access control, economics and control flow outside the math seams belong to the other specialists.

Review complete. The control-flow area (Execution Trace, Periphery, First Principles) of StepsBranch holds, and the findings record is written to .imd-findings.json with one info-level note and 18 coverage rows.

What I checked

• Execution flow. Every state-changing path in src/StepsBranch.sol was traced from entry to final state. Funding reserves the branch slot before any external call, so each revert rolls the payment back. The balance delta is exact, the approval goes 0 → amount → 0, and the request id must be nonzero and unused. Callbacks require the immutable Intake as sender and a locally admitted request id. For a Pending proposal the branch consistency check can never fail, so a valid delivery cannot be lost. Late outcomes write only the receipt and late event.
• Periphery. Selector constants match the real onResult and onFailure signatures, and the action constant matches the documented bytes32. The ABI copies in deployment/ and sdk/ equal the compiled ABI, and the committed artifact's init and runtime bytes equal a fresh build with the required compiler settings. The source hash matches the adaptation notes.
• Live bindings. Read-only mainnet calls confirmed the Intake has code, prices job.open@job-1 at 0.5 IMD, and exposes a 200,000 callback gas. The asset reads as IMD with 18 decimals, and the request owner is an externally owned account.
• Reproduction. All 59 forge tests pass. The sibling-order fuzz ran 256 runs with the recorded seed. The 16 SDK tests pass with viem installed outside the repository. The heaviest cold callback measured 192,259 gas, matching the recorded evidence.
• Probes. Six scratch tests covered paths the suite leaves implicit: third-party funding of another's draft, expiry racing a late success, an older draft after a refusal, a child branch surviving parent advances, owner edge cases, and an empty-document snapshot. All behaved as designed. The scratch directory was removed afterward.

Finding recorded

• Info. Anyone can call expirePending at exactly seven days, ahead of the writer's completion. The funder's paid success is then archived and can never become a checkpoint. This is the specified design, so it is documented as a trust and liveness assumption with a concrete reproduction, not as a defect to fix.

Not reached

• The Anvil cold-callback integration script was not rerun. The in-forge gas measurement matches its recorded maximum.

The review is complete. The findings file is written, no tracked file changed, and the harness excludes .imd-findings.json and test/scratch/ from git by design.

Outcome: no permission bypass found. The permission model of StepsBranch holds against the Access Control, Trust Gap and Asymmetry guides. I wrote one low finding and two info notes to .imd-findings.json, with an 18-row coverage record answering all 14 listed entry points plus four invariants.

Findings

• Low, fundWithPayment (src/StepsBranch.sol:181). The ledger forwards its owner-managed stored price to the Intake and never reads the live priceOf. I pulled the verified mainnet Intake source and confirmed by simulation that it reverts below its price but accepts and forwards any amount above it, whole, to the treasury. So if IMD lowers the live price, or the owner raises the stored one, every funder overpays irrecoverably while maxPayment only caps the stored figure. Reproduced in test/scratch/PriceGap.t.sol. The upward case loses nothing. Suggested fix keeps price-only management: compare against priceOf at funding time.
• Info, expirePending. Anyone may expire another funder's request at the seven-day boundary, converting an on-time-but-late success into an archived late receipt with the payment spent. This is the design the brief requires, so it is recorded as the trust assumption being accepted, not a defect.
• Info, launch.json. The owner is written as $owner although the brief states the owner address. Correct ownership depends on the service resolving $owner to that address. The constructor itself cannot hand control to the factory.

What I verified

• Every state-changing entry point, its guard, and its writes. The only privileged powers are setPrice and the two-step transfer. Callbacks require the Intake sender, a locally admitted request id, and Pending-with-consistent-branch or Expired-without-receipt. Late paths never touch heads, checkpoints or newer pending requests.
• The confused-deputy route the real Intake leaves open: any payer can name the ledger as a callback target with any selector. Request ids are keccak(chainid, intake, nonce), so they cannot collide, and the first argument word is always that id. A scratch test drives every ledger selector that way and shows nothing privileged or indexed is reachable, only a harmless extra origin branch.
• Mainnet bindings read-only: the Intake and IMD token have code, the live price is 0.5 IMD, callback gas is 200000, and IMD is a plain LayerZero OFT with no pause, blacklist or fee.
• Baseline reproduction: 59 of 59 Foundry tests including the 256-run fuzz, 16 of 16 SDK tests with viem installed outside the repository, and the committed ABI and bytecode match a fresh build.

Not reached: nothing in the assigned area. Gas-stipend margin, token periphery and economics beyond the price gap belong to the other specialists and were only checked as far as the mainnet source made it cheap.

All snippets match the tree at their stated lines, and the working tree holds no tracked changes. The review is complete.

Outcome: no blocking defect. The findings file holds one low and four info findings with a coverage row for all 14 entry points plus the constructor/manifest and test reproduction. The findings file is at .imd-findings.json.

What I verified

• Full suite is green: 82 Foundry tests including the 256-run invariant campaign, and the SDK suite passes 16 of 16 with viem installed outside the repository.
• Callback selectors, the action id, the committed ABI, the source hash in ADAPTATION.md, and creation/runtime sizes under the factory limits all check out. The constructor is static, nonpayable, makes no external call, and gives the factory no role.
• launch.json uses only schema keys, four string arguments in declaration order, and $owner, which the brief itself specifies for initialOwner. I dropped the specialist note asking for a static address since the brief wins over the reference here.

Findings kept, after merging duplicates across specialists

1. Low, with proof. fundWithPayment pays the owner-set stored price and never reads the Intake's live priceOf. A lowered Intake price is overpaid to the treasury with no refund, a raised price or retired job-1 action blocks funding until the owner reacts. The audit_math proof fails on this code for its stated reason, so it is attached. Three specialists reported this same root cause.
2. Info. Permissionless expirePending at the seven-day boundary can be ordered ahead of a late delivery, archiving a paid success. This is the behaviour the brief requires, recorded as an accepted asymmetry. Three specialists reported it.
3. Info. URIs above roughly 80 KiB exceed the 200000-gas stipend. Not reachable with real Intake URIs. Two specialists reported it.
4. Info. Shared-branch slot occupation, already documented in ADAPTATION.md.
5. Info. IMD sent directly to the ledger is stranded.

My own Pashov pass found nothing beyond these. The remaining open item for the requester is a scope decision on finding 1: accept the documented dependency on the Intake price, or let fundWithPayment read priceOf and treat the stored price as a ceiling.