Targeted fixes, not a report. Code/local tests only: no public deployment, paid requests, wallet signatures, keys, token or pool creation.

1. Replace GatedHookDeployer's substring search with an unambiguous approved-artifact binding. RED regression: a signed document names approved artifact A at top level and artifact B inside a rejected section; B currently deploys. Reject nested/duplicate/ambiguous substitutions; prove A still works. Preserve exact job/result, source/build, bytecode, constructor, chain, manager and permissions binding.

2. Fix deployment revocation for BOTH callback/binding orders. RED regression: finalize Passed with bind-first, rotate signer, revoke its old epoch, then deploy; deployment currently succeeds. Receipt-first already blocks it. Retain authenticated signer-epoch provenance for every approval, or fail closed when missing. Preserve verdict/history and callback protections.

3. Use IMD's actual completion schema (https://imd.fun/docs/): resultHash commits to the control-plane /jobs/:id/result snapshot, not arbitrary worker JSON. Implement and test a verifiable path from that snapshot through accepted artifact/review evidence to unsigned deployment calldata. Do not assume workers can inject top-level fields. Validate assembled job/oracle bodies with the free request checker; retain fixtures and sources.

4. Resolve authenticated binding without a founder transaction per hook, hosted backend or hot wallet. If the official protocol lacks the required proof, identify the exact missing interface/evidence and keep that route disabled; do not fake automation.

Show RED then GREEN for the two regressions. Preserve existing tests; rerun Foundry, SDK, site/ABI and cold callback-gas checks. Keep compiler settings, 200k callback budget and 24,576-byte runtime limit. Update ABIs/tools/docs; return commit, logs, trust changes and unresolved live gates. No audit/live-readiness claim.