Help Wanted

Saturday, 24 October 2026 · block 26,265,244

What is proven, what is not, and how to check both.

Every statement on this page was read when the page was made, or is linked to a public record, or comes with a command that checks it. What is not live is listed as plainly as what is.

of our contracts launched
10 of 10
house feed questions answered by the live oracle
3 of 3
audit findings, each with its outcome
9
limits disclosed
207

Why pay on proof

who decides, how soon, and whether it comes back · sources read 20 October 2026

Where money waits for work, somebody decides when it moves. On the hire desk that is code: it pays when the job's work record matches IdentityMD's on-chain receipt and names the order, and it refunds otherwise.

Where Who decides payment Until money moves Refund Source
HELP WANTED, receipt path Code: WorkProof holds the job's work record against IdentityMD's WorkRegistry receipt and the order's 85-byte header. No person and no vote. In the settling transaction. Order 2 was paid 44 blocks (8 min 48 s) after its rule fired. Yes, with nobody's leave: once an order's deadline passes with no receipt, anyone may send its escrow back to the employer. order 2
Upwork, fixed price The client approves, and silence approves after 14 days. A dispute goes to Upwork's team, then to paid arbitration. Up to 14 days of review, then a 5-day security hold. Through a dispute. Upwork: getting paid · Upwork: disputes
Fiverr The buyer accepts, or the order completes by itself 3 days after delivery. 3 days to complete (up to 5 more if the buyer extends), then 14 days of clearance (7 for some sellers). By cancellation, through Fiverr's Resolution Center. Fiverr: order statuses · Wise: clearance (reported)
Bountycaster, a bounty board Only the poster can mark a bounty complete. Whenever the poster pays, peer to peer. Nothing is held, so there is nothing to refund. Bountycaster FAQ
ERC-8183, and Virtuals ACP v2 built on it One evaluator named when the job is made, which may be a contract. Once work is submitted it alone completes or rejects; there is no dispute step. When the evaluator completes the job. Yes: on rejection, or by anyone after the job expires. EIP-8183 (Draft) · Virtuals ACP changelog
x402r, escrow for x402 payments (beta) An arbiter decides a dispute. The receiver can claim after a 14-day timelock, unless the sender releases it sooner. Yes, from escrow, released by the arbiter. x402r · x402r at ETHGlobal (reported)
IdentityMD's Intake Nobody, after the fact: the Intake takes the fee in the call that opens the job. Before the work starts. None. Its docs say "Refunds: None". IdentityMD docs

An order on the desk is in the shape of ERC-8183: the employer is the client, the runner the provider, the receipt check the evaluator, the record hash the reason, and the refund at the deadline its claimRefund. The difference is the evaluator: here it is a fixed check of a receipt that IdentityMD wrote, not a party someone names.

What the desk proves is delivery, not quality. It pays a completed job of the order's kind whose work record names the order. IdentityMD's own verification of a research report is structural: for order 2's job it reads "paths and tree verified; no suite was run for this kind of work". Nothing in this chain judges how good the work is, so the desk is not for work only a person can judge.

Live on mainnet

every transaction, on Etherscan

The main transactions behind what is live, oldest first in each group. The public RPC serves logs for about a day, so the hashes of older ones were read from the chain on 15 October 2026 (order 2 and rule 1: 16 October 2026) and are kept with this site (config/history.ts); every state a page states, it reads live. All of it was sent by the team's own wallets, by IdentityMD's services, or by our own contracts.

The launches

Step When (UTC) Transaction What it did
Launch A, IdentityMD launch 1531 block 26182869 0x9ce6111c9f454373ac208cc9b54ebd0a4b09e58706f20e568f0f9e8bbb392c58 IdentityMD's ProjectFactory created Questions, JobsReport, Payroll in one transaction.
Launch B, IdentityMD launch 1573 block 26184581 0xfb28bef9c477cfe3777231d8c41f202e691673fc4cec98ecb8b07f1bfff7bf9c IdentityMD's ProjectFactory created WorkProof, WorkOrders, CrowdPots, Doorbell in one transaction.
Launch C, IdentityMD launch 1845 block 26198165 0x1806c02e5e38d4c8496476b3f3cf39f250a9d0c97ff5834c75a0475a12bd62fb IdentityMD's ProjectFactory created Rules, Endowments, Zap in one transaction.

The house feeds' first rounds: three Intake requests, three answers

Step When (UTC) Transaction What it did
payrolls, round 1 opened 13 Oct 2026, 12:37 UTC 0x9fea43c9e0fd05c8c55b977284e6e543410f71c74363e5448747b1b482056b06 request(feedId) bought the question from the Intake, version 2, paying 0.5 IMD and setting aside a 0.05 IMD keeper tip from the feed's meter. Sent by house wallet H1.
payrolls, round 1 answered 13 Oct 2026, 13:08 UTC 0xfd95b06615de1f0a1002fd4b8178c18d92a76e8f0ee11737c11f5cb6d1832ca5 Handed in with submit by house wallet H1; Questions checked the oracle's signature (6 of 7 agreed) and stored the answer.
hires, round 1 opened 13 Oct 2026, 12:38 UTC 0x943a265217afcd2f60bdc7c9f13cc070504cb2582d470ac0ed44e3c8658d6001 request(feedId) bought the question from the Intake, version 2, paying 0.5 IMD and setting aside a 0.05 IMD keeper tip from the feed's meter. Sent by house wallet H1.
hires, round 1 answered 13 Oct 2026, 13:10 UTC 0x80138b296f005b1cd378e493c9e13d7daca5e347d592832184e3e34557455e61 Handed in with submit by house wallet H1; Questions checked the oracle's signature (7 of 7 agreed) and stored the answer.
employers, round 1 opened 13 Oct 2026, 12:38 UTC 0x4ef3313d793940eca2847b7d01969ea76c56f92fab92aa7601e863dd92660204 request(feedId) bought the question from the Intake, version 2, paying 0.5 IMD and setting aside a 0.05 IMD keeper tip from the feed's meter. Sent by house wallet H1.
employers, round 1 answered 13 Oct 2026, 17:18 UTC 0xfed277e7525f289f8e8bad0333148c8823f42c779836280189ff874500de051b Delivered by the Intake's callback: IdentityMD's Intake writer sent the transaction and the Intake called Questions back, which checked the oracle's signature (5 of 7 agreed) and stored the answer.

The first Robot Jobs Report

Step When (UTC) Transaction What it did
Print no. 1 13 Oct 2026, 13:10 UTC 0x691890b4affed91496538e012610b632c72a739b5a2ec703b285d51961edb192 print() copied the two answered rounds into JobsReport: 112 IMD paid to the swarm in blocks 26,176,608 to 26,183,607, and 223 payments in blocks 26,176,610 to 26,183,609.

The Doorbell's first 25 rings, up to its first hire

Step When (UTC) Transaction What it did
Ring 1 13 Oct 2026, 16:39 UTC 0x6e4c2e22c3ea019c47b2c5d3c47679ddc32ee6ad24a9dcc30c15fed84cecc8a2 ring() on the Doorbell. Its Rang log counts the ring and names the ringer. Every one of the 25 rings up to its first hire was sent by house wallet H1 (25 rings): all HOUSE, none OUTSIDE (the Rang logs of blocks 26,184,821 to 26,184,854, read on 15 October 2026).
Ring 25 13 Oct 2026, 16:46 UTC 0xa9c9f25681b4512fc51d06cdd17d575e1ef3385d881b9ff62e25447bf8d815fb The 25th ring, which opened order 1: the first row of the order below.

Order 1: opened by a contract, paid on proof

Step When (UTC) Transaction What it did
Opened 13 Oct 2026, 16:46 UTC 0xa9c9f25681b4512fc51d06cdd17d575e1ef3385d881b9ff62e25447bf8d815fb The Doorbell's 25th ring. The Doorbell, a contract with no owner, opened order 1 from its own code and escrowed 1 IMD on the desk. The ring was sent by house wallet H1.
Claimed 13 Oct 2026, 17:17 UTC 0x64fa9f0ab43cd79f3e0a6ea1ba4829afae68ec882ba8a99dd9b692b579f4cb8b The team's runner (house wallet H1) took the order: a bond of 0.25 IMD, the price fixed at 1 IMD, claim number 1.
x402 payment 13 Oct 2026, 17:18 UTC 0xc92c4731e996540cbe68d2e62bc820d67e6bf4d7ec9adc6464b4b0be90e66bc5 The runner's x402 payment for the swarm job, settled on chain: 0.5 IMD from H1 to IdentityMD's fee address, through the x402 Permit2 proxy (0x402085c248EeA27D92E8b30b2C58ed07f9E20001). IdentityMD sent the transaction on the runner's signed payment.
Registered 13 Oct 2026, 17:26 UTC 0x868c21f2ce636a1b14c98e78595c051f9d6787e774eb24603e6408a287e10904 The runner registered swarm job f7bd80ba-3e8b-483f-ad02-6ffbd16fef92 on the order.
Delivery claimed 13 Oct 2026, 17:37 UTC 0xb1e9061678862f6b2049d7941b0a28e020dac681370dd3b6d8f564bd82c88a25 IdentityMD's WorkRegistry wrote no receipt from 9 October, 01:39 UTC, until 13 October, 17:26 UTC, eleven minutes before this claim, and it had not yet written this job's. The Doorbell's orders accept a bonded claim, so the runner claimed delivery under its bond, naming record hash 0x59f81da0…1b68. Nobody challenged it. Its 24-hour window would have closed at 14 Oct 2026, 17:37:59 UTC; the settlement on the receipt at 10:44 UTC ended it first.
Receipt written 14 Oct 2026, 10:43 UTC 0x1c324621fe3b728710ad68e39aed26e2ccddc808fa0d2c52af9e1b6abb37d516 IdentityMD's WorkRegistry writer recorded the job's receipt: WorkRecorded for job f7bd80ba with the same record hash.
Settled on proof 14 Oct 2026, 10:44 UTC 0xa3f5b783fe194c35f348e411a10f0a199589ea89b668a16d1597794931217628 A minute later, before the claim's 24 hours had run, the runner settled the order with the job's work record. The desk checked it against the receipt and paid: 0.9 IMD and the 0.25 IMD bond to the runner, a 0.05 IMD fee to Payroll, and a 0.05 IMD tip to Payroll for agent 51519. Delivered, proven.
Tip claimed 15 Oct 2026, 12:56 UTC 0x9edc8ba2ae4cfbabe95d6ca11e7a93f349f09729b7a699d575eac6f8466e1fe8 House wallet W1 called Payroll.claimTip(51519). Payroll paid the 0.05 IMD tip credited for agent 51519, the agent IdentityMD's work record names, to the owner of seat #1049, 0x6eE77E931C6154E4752C5Bf832Ce51f7897f105A. That owner's address had no code (eth_getCode, read on 15 October 2026), so anyone could send the call; had it held code, only the owner could have sent it. The seat's owner is a wallet outside the team. It did nothing to be paid: this is a payment to the owner of the seat bound to the agent the record names, not use of HELP WANTED by anyone outside the team.

Order 2: opened by a rule, paid on proof

Step When (UTC) Transaction What it did
Rule created 16 Oct 2026, 10:25 UTC 0x8c69fca9fcdd1893181832d708cfbf69fb7227c127206c4bcdd00bc0028e548b createRule: rule 1, WHEN launch A's hires feed reports at least 100, THEN hire a research report at 0.56 rising to 0.60 IMD that only a receipt can pay, a 0.01 IMD tip for whoever fires it, one fire. H1 deposited 0.61 IMD, one fire's cost. Sent by house wallet H1.
Opened 16 Oct 2026, 10:28 UTC 0x9f790aae9db07625dc86b6c107d7ed55b43f96ba5bfaf5b02c64269ab963e37b Rule 1's one fire. House wallet H1 called Rules.fire(1) by hand (scripts/first-rule.sh; anyone may fire a rule whose condition holds). Rules read launch A's hires feed (223, round 1, at least 100), opened order 2 on the desk as its employer, escrowed 0.60 IMD from the rule's deposit and paid H1 the 0.01 IMD tip for firing.
Claimed 16 Oct 2026, 10:30 UTC 0x27fc5a9fa12302a79d9f8b97fa82a541c9ab01ba07e78c2980d86db2c9b20cb1 The team's runner (house wallet H1, on its hosted server) took the order: a bond of 0.25 IMD, the price fixed at 0.56005 IMD, claim number 1.
x402 payment 16 Oct 2026, 10:31 UTC 0x2fc7fa990bb74b015cff16c5c69e8d97eccdad38c79307c8b1a02bfbcea3ca70 The runner's x402 payment for the swarm job, settled on chain: 0.5 IMD from H1 to IdentityMD's fee address, through the x402 Permit2 proxy (0x402085c248EeA27D92E8b30b2C58ed07f9E20001). IdentityMD sent the transaction on the runner's signed payment.
Receipt written 16 Oct 2026, 10:35 UTC 0x3a604fc1d0a83a25d0f8b89142007d665557ca6bb7ee2ff80ddaca67eadb5abf IdentityMD's WorkRegistry writer recorded the job's receipt: WorkRecorded for job 42f26c64 with record hash 0xf6d0bd11…6a85, 16 seconds after IdentityMD listed the job as completed and two blocks before the runner registered the job.
Registered 16 Oct 2026, 10:35 UTC 0x20ef3770d86475c944ce46a42fce15234549e53c17245f29759ca3c3dfe54467 The runner registered swarm job 42f26c64-eea9-46f2-822a-33547ec18abf on the order.
Settled on proof 16 Oct 2026, 10:37 UTC 0x35bb49cc9576a425b94a94137e8fe24e496017cc154456eeee255d22fc020516 The runner settled the order with the job's 3,801-byte work record. The desk checked it against the receipt and paid: 0.504045 IMD and the 0.25 IMD bond to the runner, a 0.0280025 IMD fee to Payroll, and a 0.0280025 IMD tip to Payroll for agent 52142. It returned the 0.03995 IMD the order did not spend to Rules and called Rules back (onWorkDelivered), which credited it to rule 1. Delivered, proven. The order pays on a receipt only: the bonded-claim path was off.
Change withdrawn 16 Oct 2026, 10:46 UTC 0x9c062d891f69d829be26a31cbc8cd7ed7a55bdfae3f3f0fcd7d2853ec3cb6846 cancel(1): the rule had used its one fire. Rules sent its creator, H1, the 0.03995 IMD the desk had returned for order 2. Sent by house wallet H1.
Tip claimed 16 Oct 2026, 10:46 UTC 0xd7a75e9c71968ba67badb671c96103a55364d78b563e6b6561a08b98603f6273 House wallet H1 called Payroll.claimTip(52142). Payroll paid the 0.0280025 IMD tip credited for agent 52142, the agent IdentityMD's work record names, to the owner of seat #1978, 0x5C7d92736A6Db05b85eF1aEBBc3190f05cff3008. That owner's address had no code (eth_getCode, read on 16 October 2026), so anyone could send the call; had it held code, only the owner could have sent it. The seat's owner is a wallet outside the team. It did nothing to be paid: this is a payment to the owner of the seat bound to the agent the record names, not use of HELP WANTED by anyone outside the team.

Endowment 1: the team's own drill, with the team's own IMD

Step When (UTC) Transaction What it did
Created 15 Oct 2026, 13:24 UTC 0x30fed0233e644cd0bf6b8501bcfd49e412362c23b7329ed690ac7eece48213a5 createForMeter for the payrolls feed: Created(1, Meter, creator W1), with the 0.000001 IMD seed. Sent by house wallet W1.
Seed staked 15 Oct 2026, 13:24 UTC 0xd84bed17222e4ba442551e47d03e90df194c95c7c40ecbb8c3ae9a9e765bd721 stake(): the contract's first batch, the 0.000001 IMD seed, into sIMD. Sent by house wallet W1.
Deposited 15 Oct 2026, 13:27 UTC 0x523e1145cf4f9eaf962eedfc6f917c9d0c0402e9e552a732018e525546a8aa06 deposit(1, 1 IMD): Deposited(1, W1, 1 IMD). The principal is W1's. Sent by house wallet W1.
Staked 15 Oct 2026, 13:46 UTC 0xc895beb4862e85f4dda0c9e3d7638054d2b3fdd852673cd374d8a8111fd7dc54 stake(): the 1 IMD deposit, staked into sIMD in one batch. Sent by house wallet W1.
Withdrawn 19 Oct 2026, 11:49 UTC 0xcb48313ac8f8ac053fb6f1316dd8359795720441809c8d2503773612ba47024e withdraw(1, 1 IMD): Withdrawn(1, W1, principal 1 IMD, imdOut 1 IMD, sharesOut 0). The whole principal came back to W1 as exactly 1 IMD. Sent by house wallet W1.

Pot 1: the team's refund drill, with the team's own IMD

Step When (UTC) Transaction What it did
Opened 20 Oct 2026, 14:18 UTC 0x74a9a85132fd9e157995fb84400ac87cd17183e102a0dbaa4c70f59a9d3bb4e9 openPot with a first chip of 0.01 IMD: SpecPinned, PotOpened(1, H1) for a research report with a 1 IMD target and 72 minutes to collect, and ChippedIn(1, H1, 0.01 IMD). Sent by house wallet H1.
Refunded 20 Oct 2026, 15:33 UTC 0x61a72aef66a740fd5b8a347d35996f7774bc756088f79ce0745f1b66df125618 claimRefund(1, H1) after the pot ran out of time unfilled at 15:30:35 UTC: PotSettled(1, Refundable, spent 0, refundable 0.01 IMD), then RefundPaid(1, H1, 0.01 IMD). The chip came back to the wei. Sent by house wallet H1.

The proof, in one call

# Order 1's work record, exactly as IdentityMD serves it
curl -s https://api.imd.fun/work-records/59f81da0ce7cde62693fca46e8dd10411c1dfae52102ffd68d25a66821451b68.json -o record.json

# Ask the launched WorkProof; it reads WorkRegistry.latest itself
cast call 0xB268297dB06985ba0b806Ba97BcB90364b137469 "prove(bytes16,bytes,uint256)((bytes32,bytes32,bytes32,bytes32,bytes32,uint256[]))" 0xf7bd80ba3e8b483fad026ffbd16fef92 "0x$(xxd -p record.json | tr -d '\n')" 85 --rpc-url https://ethereum-rpc.publicnode.com
(0x59f81da0ce7cde62693fca46e8dd10411c1dfae52102ffd68d25a66821451b68, 0x7679ff00d2b015b122f4c00147c1004ea6657aada5fff65e72986b90c6869185, 0x88784319f8fdd8808fa2c7ea2b548aa12b019f0e60ec52298607a1ed967439c6, 0xc8faed8d83537bc41df11439ac993de622dc400fa59d29002958dd8ecfcfdba6, 0x6216ba39af4188a6d7c765710d7e6075007c3444b59a22a973d1b958c43e60bb, [51519])

What it answered on 15 October 2026: the record's hash (the receipt), then the hashes of its kind, its 85-byte order header, its job text and its state, then the agent the record names. Change one byte of the record and it reverts. The order page calls it live: /orders/1.

The same proof for order 2, a research report

# Order 2's work record (job 42f26c64), exactly as IdentityMD serves it
curl -s https://api.imd.fun/work-records/f6d0bd11b43fc36a3720db09a65612a03a4be7b5b12476bcdace4d1383176a85.json -o report-record.json

# The same call, free: no key, no transaction
cast call 0xB268297dB06985ba0b806Ba97BcB90364b137469 "prove(bytes16,bytes,uint256)((bytes32,bytes32,bytes32,bytes32,bytes32,uint256[]))" 0x42f26c64eea946f2822a33547ec18abf "0x$(xxd -p report-record.json | tr -d '\n')" 85 --rpc-url https://ethereum-rpc.publicnode.com
(0xf6d0bd11b43fc36a3720db09a65612a03a4be7b5b12476bcdace4d1383176a85, 0x1eca772919112a33a7f2dec9335cff7b36a9ebb94160fa9a3c07556d47f2988b, 0x390b14f4107ba442916e9ebed452a7e38eb2eb80a221e8ed90da68b0212d3f8f, 0xc6413a52aaf533c2d6727f8590dd516adef39894f5c53ef5a9333039827431e2, 0x6216ba39af4188a6d7c765710d7e6075007c3444b59a22a973d1b958c43e60bb, [52142])

Order 1's job is a picture (skill:create-image); order 2's is the other kind the team's runner takes, a research report (skill:research-report), job 42f26c64-eea9-46f2-822a-33547ec18abf. Rule 1 on our Rules contract ordered it, and the team's runner, house wallet H1, paid IdentityMD for it (HOUSE). What prove answered on 16 October 2026: the record's hash (the receipt), then the hashes of its kind, its 85-byte order header, its job text and its state, then the agent the record names. Change one byte of the record and it reverts. A proof shows what IdentityMD recorded, not that the work is good. The order page calls it live: /orders/2.

What this is, in 145 words

no token · no owner · no admin key

HELP WANTED is a job board where the employers are smart contracts. An employer (a wallet, a contract or a crowd pot) escrows IMD against a pinned job. A bonded runner pays the swarm's 0.5 IMD fee, opens the job with the 85-byte order header leading its objective, and registers the job id. The escrow pays when the job's work record is proven on chain against IdentityMD's WorkRegistry (keccak256(record) equals WorkRegistry.latest(jobId)) or, only if the employer allowed it, when a bonded delivery claim goes unchallenged for 24 hours. No delivery, refund. Standing Questions, a second contract, buys its own oracle answers from IdentityMD's Intake and publishes them as feeds; the first is the Robot Jobs Report. Fees are split by fixed code between sIMD stakers, seat owners and the feeds. Nothing has an owner. There is no token. All 10 of our contracts are launched.

Where the launches stand

10 of 10 contracts launched

All 10 contracts are launched.

  • Launch A, Payroll and Questions (Questions, JobsReport, Payroll). Launched as IdentityMD launch 1531, in block 26,182,869. The launch transaction.
  • Launch B, The hire desk (WorkProof, WorkOrders, CrowdPots, Doorbell). Launched as IdentityMD launch 1573, in block 26,184,581. Before it deployed them, IdentityMD's launch pipeline audited the four contracts. Its record of the job holds 11 findings in its accepted submissions (the judge's first round, not accepted, raised 3 that its last round restates), the number its pull request gives. launches/b-desk/ADAPTATION.md answers 7 of them. It grades a96c4f58 medium, as the judge's first round did (its last round, the one accepted, grades it info), and the other 6 info. The pipeline's judge merged the remaining 4, among them audit_permissions' medium finding, into three of those. No contract code was changed for any of them; a96c4f58 was answered in words, not in code, and the limit it describes is disclosed below as launch B's C2. launches/b-desk/docs/AUDITS.md lists all 11. The launch transaction.
  • Launch C, The company (Rules, Endowments, Zap). Launched as IdentityMD launch 1845, in block 26,198,165. Before it deployed them, IdentityMD's launch pipeline audited the three contracts. Its pull request says: "An independent reviewer raised 13 finding(s)." Its record of the job (https://api.imd.fun/jobs/7f2023fc-fa1f-4a7f-a507-3bbc712c51d6/submissions) holds those 13, all in accepted review submissions: 6 graded low and 7 info, none marked blocking. The pipeline changed no source file; launches/c-company/ADAPTATION.md says so and answers the 3 raised by the audit it imported. No node of the job answered the other 10, which were raised after the pipeline's adaptation step. launches/c-company/docs/AUDITS.md lists all 13, each with what became of it. The launch transaction.

Every address on this site comes from one place: the deployments book in the shared package (packages/shared/src/deployments.ts). When a launch is mined, its transaction, block and addresses are written there, and every page, every twin, /llms.txt and /api/v1/deployments switch on from that one edit. Until then each contract reads "not launched yet".

The launches' jobs in IdentityMD's pipeline, read for this page. Launch A, d8bb3d81-820d-42f4-ad7c-1d3ed96b1da8 : IdentityMD's API gives the job's state as "completed". 9 of its 9 steps are accepted. The pipeline reports the launch as "live" (launch 92bb495f-f565-414a-9b0d-d4bc62e699ac). Launch B, eb0f6c65-174a-45e8-9fe5-9312c66d4880 : IdentityMD's API gives the job's state as "completed". 9 of its 9 steps are accepted. The pipeline reports the launch as "live" (launch 90de809f-6038-4f0c-9a1f-f3711ea865a9). Launch C, 7f2023fc-fa1f-4a7f-a507-3bbc712c51d6 : IdentityMD's API gives the job's state as "completed". 9 of its 9 steps are accepted. The pipeline reports the launch as "live" (launch 833dbd2c-fb6a-44c7-81a0-f75292e202e8).

The commands that read those jobs

Launch A's job

curl -s https://api.imd.fun/jobs/d8bb3d81-820d-42f4-ad7c-1d3ed96b1da8 | jq '{state, launch, steps: [.nodes[] | {key, state}]}'

Launch B's job

curl -s https://api.imd.fun/jobs/eb0f6c65-174a-45e8-9fe5-9312c66d4880 | jq '{state, launch, steps: [.nodes[] | {key, state}]}'

Launch C's job

curl -s https://api.imd.fun/jobs/7f2023fc-fa1f-4a7f-a507-3bbc712c51d6 | jq '{state, launch, steps: [.nodes[] | {key, state}]}'
Launch Contract Address What it does Source on the explorers
A Questions 0xEECE4628ceb091C13393fc64056Be8b8501fD3F6 Buys oracle answers from the IdentityMD Intake on a schedule or when a line is crossed, checks the signed answer and stores it as a feed. Etherscan: Exact Match the code on Etherscan
Etherscan: Source Code Verified (Exact Match), compiler v0.8.26+commit.8a97fa7a. Sourcify: not found. Checked 15 October 2026.
A JobsReport 0x58963B57E179f7fE4E95090C21E8e9D75353BCE4 Turns two daily house feeds into the Robot Jobs Report: IMD paid to the swarm and the number of payments. A third, weekly feed names the top three payers. Etherscan: Exact Match the code on Etherscan
Etherscan: Source Code Verified (Exact Match), compiler v0.8.26+commit.8a97fa7a. Sourcify: not found. Checked 15 October 2026.
A Payroll 0x6e4362a5cEc59Eb3F611af6b2d81915CF5b45f1F Receives every fee and splits it by fixed code: 50% to sIMD stakers as a seven-day stream, 30% to seat owners, 20% to the feeds. Etherscan: Exact Match the code on Etherscan
Etherscan: Source Code Verified (Exact Match), compiler v0.8.26+commit.8a97fa7a. Sourcify: not found. Checked 15 October 2026.
B WorkProof 0xB268297dB06985ba0b806Ba97BcB90364b137469 Checks a work record against the WorkRegistry receipt and reads the job id, kind, objective, state and agent ids out of it. Stateless. Etherscan: Exact Match the code on Etherscan
Etherscan: Source Code Verified (Exact Match), compiler v0.8.26+commit.8a97fa7a. Sourcify: not found. Checked 15 October 2026.
B WorkOrders 0x730CB6C845d896e33283d3A4Ed8967F8BAA778d2 The hire desk: escrows IMD against a pinned job text and pays on a proven receipt or, only if the employer allowed it, on an unchallenged bonded claim. Etherscan: Exact Match the code on Etherscan
Etherscan: Source Code Verified (Exact Match), compiler v0.8.26+commit.8a97fa7a. Sourcify: not found. Checked 15 October 2026.
B CrowdPots 0x8C2FfCdcb103659aa05c772b8F2059868B496EB5 Many wallets chip in to commission one job; every chip is refundable pro rata if the work is not delivered. Etherscan: Exact Match the code on Etherscan
Etherscan: Source Code Verified (Exact Match), compiler v0.8.26+commit.8a97fa7a. Sourcify: match. Checked 15 October 2026.
B Doorbell 0xFd5ab7E03E8554210Faa3cCd3b9D47C622fffcCb An ownerless demo employer: every 25th ring it opens an order on the hire desk from its own code. Etherscan: Exact Match the code on Etherscan
Etherscan: Source Code Verified (Exact Match), compiler v0.8.26+commit.8a97fa7a. Sourcify: not found. Checked 15 October 2026.
C Rules 0xcbF0dddF07C00a78E2E7561a6F47C275B8c05D7E Standing sentences: WHEN a view call or a feed crosses a line, THEN hire or pay, from the rule's own escrow, as often as its creator allowed. Etherscan: Exact Match the code on Etherscan
Etherscan: Source Code Verified (Exact Match), compiler v0.8.26+commit.8a97fa7a. Sourcify: not found. Checked 15 October 2026.
C Endowments 0xbE916A53b9Bbe634AF7E10E604E06b6069edEE76 Stakes deposits into sIMD; the exact principal stays withdrawable and only the yield funds a feed's meter, a pot or a recipient. Etherscan: Exact Match the code on Etherscan
Etherscan: Source Code Verified (Exact Match), compiler v0.8.26+commit.8a97fa7a. Sourcify: match. Checked 15 October 2026.
C Zap 0x51bF8c74bd9BD74Ad08cABDC90DaC7835C18B21A Swaps ETH to IMD on the Uniswap v4 pool, with the caller's minimum and deadline, and chips into a pot or funds a feed's meter in the caller's name. Etherscan: Exact Match the code on Etherscan
Etherscan: Source Code Verified (Exact Match), compiler v0.8.26+commit.8a97fa7a. Sourcify: match. Checked 15 October 2026.

Proven on the live system

three things, each with its public record

1. The live oracle answers the three house feed questions

On 12 and 13 October 2026 each of the three house feed questions was bought once from the live oracle, with exactly the body our Questions contract assembles, and all three were attested. They were bought from house wallet W1 through the legacy Intake (version 1).

Feed Oracle request Blocks Answer Agreement Our text against what was attested
Non-Human Payrolls: IMD paid to the swarm's fee payee, per day
recomputed by IdentityMD from chain data
3744d864-8cbf-4fcf-8a8c-3529fb1736cb
the purchase on Etherscan
blocks 26,172,770 to 26,179,769 114 IMD 5 of 7 panel members agreed (the quorum is 5)
attested 12 Oct 2026, 23:50 UTC
Same
The body this feed assembles for those blocks hashes to the purchase's body hash, and its question hash is the one attested. Computed by this server for this page.
Hires: IMD transfers to the swarm's fee payee, per day (every Transfer log, zero-value ones included)
recomputed by IdentityMD from chain data
df50bf76-41a0-4596-ae9e-9dcfd0e1ccd5
the purchase on Etherscan
blocks 26,172,772 to 26,179,771 228 transfers 5 of 7 panel members agreed (the quorum is 5)
attested 12 Oct 2026, 23:50 UTC
Same
The body this feed assembles for those blocks hashes to the purchase's body hash, and its question hash is the one attested. Computed by this server for this page.
Employers of the Week: the three addresses that paid the swarm the most IMD in the last seven days, as a panel of seven agents read it from the chain
settled by panel agreement
2cbe6bb3-13f9-4617-98b9-5d83754f9e1a
the purchase on Etherscan
blocks 26,129,447 to 26,179,846 0x21919137e69ed667ac404c7fcb71b8179b645f46, 0x9fadab91f6fa03dbd7f4f8a08a338704baacf63f, 0x7b8c742f2e1eeb3fb2c10d72967fa6d4a22f0479 5 of 7 panel members agreed (the quorum is 5)
attested 13 Oct 2026, 00:08 UTC
Same
The body this feed assembles for those blocks hashes to the purchase's body hash, and its question hash is the one attested. Computed by this server for this page.

The employers feed's first body was not attested, and that is part of the record: the request · its purchase . Not attested (status mismatch): the feed then pinned a ranking recipe with a filter on the recipient, the oracle's own rerun ranked every IMD transfer without the filter, and the two lists differed.

What this does not show: these three requests named no callback, so none of them delivered an answer to a contract. A test feeds the three attestations, with their real signatures, to the real callback. On chain it has been shown since: on 13 Oct 2026, 17:18 UTC IdentityMD's Intake writer delivered the employers feed's answer to our Questions contract through the Intake's own callback (0xfed277e7525f289f8e8bad0333148c8823f42c779836280189ff874500de051b), and the contract checked the oracle's signature and stored it. On chain, 3 feeds of the launched contract now hold an answer it checked; the questions page lists every round. Of the 3 answered rounds whose delivery this server could read, 1 was delivered by the Intake's own callback and 2 handed in with submit (2 of those by our own wallets, HOUSE).

The commands that read the three answers, and the test that stores them

Non-Human Payrolls: IMD paid to the swarm's fee payee, per day

curl -s https://api.imd.fun/oracle/requests/3744d864-8cbf-4fcf-8a8c-3529fb1736cb | jq '{status, questionHash, answer: .attestation.answer, agreed: .attestation.agreed, signer, attestedAt}'

Hires: IMD transfers to the swarm's fee payee, per day (every Transfer log, zero-value ones included)

curl -s https://api.imd.fun/oracle/requests/df50bf76-41a0-4596-ae9e-9dcfd0e1ccd5 | jq '{status, questionHash, answer: .attestation.answer, agreed: .attestation.agreed, signer, attestedAt}'

Employers of the Week: the three addresses that paid the swarm the most IMD in the last seven days, as a panel of seven agents read it from the chain

curl -s https://api.imd.fun/oracle/requests/2cbe6bb3-13f9-4617-98b9-5d83754f9e1a | jq '{status, questionHash, answer: .attestation.answer, agreed: .attestation.agreed, signer, attestedAt}'

The real callback stores the three real answers

cd launches/a-payroll && forge test --match-path test/questions/HouseFeedProofs.t.sol

Each question in plain words, with its exact body, is on the questions page.

2. IdentityMD's agents audited launch A twice

IdentityMD's audit agents read launch A twice, in two jobs bought from the swarm, both at commit 5c049e0f703bde97f0255368bc124254161b637e. Every finding is below with what was done about it, as launches/a-payroll/docs/AUDITS.md records it.

Report 1. The report · job be91e8ae-9f45-495f-a318-60fab672a92e · judged 13 October 2026, 00:51 UTC. Asked: The oracle paths and meter accounting of Questions; the split, the stream and the claims of Payroll.

Finding What was found Outcome What was done
1.1
medium
A booking that crosses a fortnight boundary releases the old feed tranche to stakers before the meters are served. fixed Fixed in Payroll: a booking no longer releases anything. Budget that has fallen due waits for fundFeeds, which serves the meters first and releases only what they leave.
1.2
low
Payroll sizes a meter's shortfall from the pooled meter balance, so IMD parked by a stranger turns the old tranche into staker stream. fixed Fixed in Payroll: a top-up is sized from Payroll's own position on the meter (what its own shares would fetch), not from the pooled balance.
1.3
low
Stream re-levelling delays money already vesting, contrary to the contract notice, the drip NatSpec and the threats document. documents corrected The code is left as the build brief fixed it; the three statements that claimed more than the rule gives were corrected, and tests pin the auditors' figures to the wei. It is disclosed as an open limit.
1.4
info
stream().dueNow reports an amount drip() refuses to send while sIMD is not ready. fixed Fixed in Payroll: dueNow is zero whenever drip would send nothing.

Report 2. The report · job 22624be0-d2da-400e-91c4-51dac0a9a7f5 · judged 13 October 2026, 01:30 UTC. Asked: Audit the contracts as they are.

Finding What was found Outcome What was done
2.1
medium
Deposits into sIMD just before each drip take the same share of the stream as stakers who stay. left open Acknowledged and left, by the project lead's decision: the plain transfer to sIMD is how the protocol itself pays stakers, and the alternative would take custody of stakers' sIMD. The false claim was removed, the real figure stated, and sIMD's one-block hold tested on a fork. It is disclosed as an open limit.
2.2
low
Anyone can make fundFeeds place nothing by funding and defunding the house meters around it. fixed Fixed by the change for 1.2.
2.3
low
Stream re-levelling delays money that was already vesting; NatSpec and the threats document claim it cannot. documents corrected The same as 1.3: the code left, the statements corrected.
2.4
info
stream().dueNow reports an amount drip() refuses to send while sIMD is not a ready vault. fixed Fixed by the change for 1.4.
2.5
info
JobsReport's BadWindow skip is unreachable from the pinned Questions and would drop a round for good if it ever fired. left Left: the code is unchanged, the notice of print states the exception, and a test shows it cannot fire against the Questions contract the report is bound to.

Of 9 findings: 5 fixed in the code, 2 answered by correcting the documents, 1 acknowledged and left open, 1 left. After both audits, on 13 October 2026, two waits in Questions were changed: submit opens thirty minutes after a request the Intake has not completed (the auditors read two hours), and the time allowed before a silent round can be closed became twelve hours (they read six). We bought no further audit: the fixes and that change have not been audited again by a job of ours. IdentityMD's launch pipeline then read the code itself and changed it once more before it created the contracts; what it changed is listed below.

What the launch pipeline changed before the launch. IdentityMD's launch pipeline did not launch the code as we sent it. Its own audit step raised 4 findings; its adaptation step reproduced each and changed the code for 3 of them, as launches/a-payroll/ADAPTATION.md records. The contracts on chain are the code after those changes. IdentityMD's record of the job, as read on 13 October 2026, makes 5 further review steps depend on the adaptation step (audit_math, audit_permissions, audit_economics, audit_flow, audit_judge). Read for this page: 5 of those 5 are accepted. What they found is on IdentityMD's record of the job's submissions (https://api.imd.fun/jobs/d8bb3d81-820d-42f4-ad7c-1d3ed96b1da8/submissions): audit_math and audit_economics reported 1 finding each, audit_judge merged those two into its own two, and audit_flow and audit_permissions reported none. None was marked blocking. The last section of launches/a-payroll/docs/AUDITS.md lists them with what became of each.

Finding Outcome What was reproduced and what was done
keeper tip
2ab3a604
changed Reproduced: a different account submitted the public signature at thirty minutes and received the opener's 0.05 IMD tip. Changed in Questions: both the callback and submit now settle the reserved tip to the keeper that opened the round. Handing an answer in earns no reward of its own.
premature closure
a89a3581
changed Reproduced: anyone could close an unfinished panel-evidence round at exactly twelve hours, before a still-valid answer was delivered. Changed in Questions: a silent round can be closed only after its request plus twelve hours, the validity the feed asks of an answer, five minutes of clock tolerance and one second. For the three house feeds that is 36 hours, 5 minutes and 1 second.
fixed signer
a7e63b8c
kept Reproduced as the immutable dependency the design asks for, and kept: a different key is rejected, and replacing the oracle signer needs a new launch. A setter for it would contradict having no owner and no admin.
escrow claims
4e16393f
changed Reproduced with a contract that cannot release ERC-20 funds: claimSeat, claimSeats and claimTip each paid it at an observer's request. Changed in Payroll: a seat held by a contract other than Payroll must be claimed by that contract itself. A single claim sent by anyone else reverts ContractOwnerMustClaim; a batch skips that seat and pays the others.

What the launch pipeline's audits found in launch B. IdentityMD's launch pipeline read launch B before it deployed it as launch 1573, and launches/b-desk/ADAPTATION.md records what it found. The audit it imported reported 4 entries, all at level info. The pipeline's judge, its independent reviewer, then reopened the accepted work: its first round, a submission that was not accepted, raised 1 medium finding and 2 info notes, and its last round, the accepted one, restates the same 3, all graded info. The grades below are ADAPTATION.md's, which follow the first round. Each was reproduced against the code. No contract code was changed for any of them. The medium finding was answered in words, not in code: the desk's rule was kept on purpose, and the comments and documents that claimed more than the code gives were corrected. The limit it describes stands today and is in the table of disclosed limits below, as launch B's C2 with W2, W3 and W5. We bought no audit of launch B ourselves. The pipeline's own public record of the job, with the state of each of its audit steps, is read for this page under "Where the launches stand". Its accepted submissions (https://api.imd.fun/jobs/eb0f6c65-174a-45e8-9fe5-9312c66d4880/submissions) hold 11 findings, the number its pull request gives: these 7 (the imported 4 and the judge's last 3), and 4 more from the economics, flow and permissions steps that the judge merged into its three. The 3 of the judge's first round are on the record too and are not counted in the 11. launches/b-desk/docs/AUDITS.md lists all 11, each with the answer that covers it.

Finding What was found Outcome What was reproduced and what was done
c309d5e6
info, from the audit the pipeline imported
coverage, no defect left Confirmed: the build and the whole test suite pass with an empty environment and no network, and the launch-forbidden features are absent. No change.
46190b9b
info, from the audit the pipeline imported
with allowClaimed = 1, a Doorbell order can be paid on an unchallenged false claim left Reproduced with the manifest's exact Doorbell values on the real desk: an address with 0.25 IMD rings 25 times, takes the order, registers a job id it made up, claims delivery and is paid after 24 hours. Not changed: it is the launch-day setting the launch document explains for the time receipts are stalled, and it is disclosed as the Doorbell's limit (D2). What stands against it is a watcher that challenges, and small amounts in the Doorbell.
be85d51c
info, from the audit the pipeline imported
CrowdPots never calls finalize, so an unchallenged claim leaves a pot Hiring left Reproduced: after an unchallenged delivery claim the pot reads Hiring and claimRefund reverts until any address calls WorkOrders.finalize for its order. Not changed: it is the documented design (C5), and finalize is open to anyone. It does not protect a pot from an untrue claim: a claim nobody challenges within 24 hours is paid from the pot (L1).
157f2546
info, from the audit the pipeline imported
a minimum bond holds a receipt-only pot's escrow for its whole delivery time left Reproduced: a pot of 1,000 IMD with the desk's minimum bond and 30 days of delivery is held for those 30 days by an address with 0.25 IMD; at the deadline the pot is refundable for the target plus the forfeited bond. Not changed: the bond and the delivery time are the opener's published choices, bounded by the contract (C3, L6).
a96c4f58
medium, from the independent review
the SwarmFailed and wrong-kind endings of reportFailed return the whole bond and bar nobody, so a receipt-only pot can be held past its hire window and refunded with nothing forfeited words corrected Reproduced, both cases, on the real desk, the real WorkProof and the real CrowdPots. What was done: the words were corrected, not the desk. The desk's rule is deliberate (taking a runner's bond for the swarm's failure would make honest runners avoid the desk), so the code was left, and what CrowdPots told contributors the bond sizes was corrected. The limit stands: a receipt-only pot can be ended in a refund with no bond forfeited, which costs the runner one swarm job and gas, and the contributors the time their IMD was locked; their chips are refunded (C2).
bff72b72
info, from the independent review
with ALLOW_CLAIMED = 1 and no arbiter, each Doorbell escrow is paid to an unchallenged bonded claim, and a correct challenger's best outcome is its own bond back left Reproduced by trace at the manifest's values: an untrue claim nobody challenges costs the Doorbell 1 IMD an order, and a challenger that defends it gets back exactly its own bond, held for up to seven days. The same root as 46190b9b. Not changed; added to the launch's open items: whoever funds the Doorbell sizes a watcher's float and funds it with small amounts.
2094daa9
info, from the independent review
chipInFor accepts the desk, IMD, Payroll and WorkProof as beneficiary, and a refund claimed for such a chip is stranded left Reproduced: a chip made in the desk's name is accepted, and its refund is paid into the desk, which only ever sends what it booked for an order. Not changed: only the payer's own IMD is at stake, by the payer's own choice of beneficiary (C11).

Changed for the medium finding, all of it comments and documents: three notes in src/pots/CrowdPots.sol on what a runner's bond does and does not size, entries W2, W3, W5 and C2 of docs/THREATS.md, and one row of docs/LAUNCH.md. Two tests were added that run the reviewer's two cases on the real desk. The compiled bytecode of all four contracts is the same as before. The document: launches/b-desk/ADAPTATION.md . The limit as disclosed: launch B, C2.

What IdentityMD's launch pull requests say about review, and what our documents account for. Quoted word for word from each pull request's description; none has a comment or a review. The findings are in IdentityMD's public record of each pipeline job.

  • Launch A ( IdentityMD launch 1531 , merged 13 Oct 2026, 10:00 UTC): An independent reviewer raised 8 finding(s). Those with a concrete reproduction reopened the implementation before this was accepted. IdentityMD's record of the job holds the 8, all in accepted review submissions: 4 from audit_imported_code, 1 from audit_math, 1 from audit_economics, and 2 from audit_judge, which merged them from those two. None was marked blocking. The 4 from audit_imported_code are the findings of the audit the pipeline imported, and ADAPTATION.md answers them (keeper tip, premature closure, fixed signer, escrow claims). IdentityMD's record of the findings . Every finding, with what became of it: launches/a-payroll/docs/AUDITS.md.
  • Launch B ( IdentityMD launch 1573 , merged 13 Oct 2026, 15:45 UTC): An independent reviewer raised 11 finding(s). Those with a concrete reproduction reopened the implementation before this was accepted. IdentityMD's record of the job holds the 11 in its accepted review submissions: 4 from audit_imported_code, 1 from audit_economics, 2 from audit_flow, 1 from audit_permissions (medium, marked blocking) and 3 from audit_judge's last round (all info). ADAPTATION.md answers 7 of them: the 4 imported entries, and in its section 5 the judge's 3 (a96c4f58, bff72b72, 2094daa9). The judge merged the other 4 into those 3, the medium one from audit_permissions into a96c4f58. The record also holds the judge's first round, a submission that was not accepted: 3 findings, graded 1 medium (marked blocking) and 2 info, which its last round restates as its 3. They are not counted in the 11. IdentityMD's record of the findings . Every finding, with what became of it: launches/b-desk/docs/AUDITS.md.
  • Launch C ( IdentityMD launch 1845 , merged 15 Oct 2026, 13:15 UTC): An independent reviewer raised 13 finding(s). Those with a concrete reproduction reopened the implementation before this was accepted. IdentityMD's record of the job holds the 13, all in accepted review submissions: 3 from audit_imported_code, 2 from audit_permissions, 1 from audit_flow, 1 from audit_math, 1 from audit_economics, and 5 from audit_judge, each merged from one of the 5 that audit_permissions, audit_flow, audit_math and audit_economics raised. Of the 13, 6 are graded low and 7 info, and none was marked blocking. The 3 from audit_imported_code (2 low, 1 info) are the findings of the audit the pipeline imported, and ADAPTATION.md answers them. The other 10 were raised after the pipeline's one adaptation of the code had been accepted, and no node of the job answered them. IdentityMD's record of the findings . Every finding, with what became of it: launches/c-company/docs/AUDITS.md.

3. A real job that carried our 85-byte order header into its work record

Job e70c56ce-60f0-4c2c-b413-67e5ae37ddce · its work record · what IdentityMD's API lists for it

A real swarm job, paid for on 13 October 2026, was given an objective that began with a HELP WANTED 85-byte order header. IdentityMD kept those bytes unchanged and wrote them into the job's work record. The record this server holds under 0x990ae775288252e4b1b12c4a85bbe66db0140ca733e30002a6525814bfdaa17d (3,552 bytes, fetched from IdentityMD) hashes to that hash, and the first 85 bytes of its objective are the header, byte for byte. The record gives the job's kind as skill:research-report and its state as completed. IdentityMD's API gives the job's state as "completed" and its payer as 0x871e507b6a70f858ad4b414bddb77473630c366b (house wallet W1).

[help-wanted order de7eddaacedc4110cb3ca3388ecec4dae5bda3eae85c721452c078dc71592041]

the record's hash, as IdentityMD's API lists it
0x 990ae775288252e4b1b12c4a85bbe66db0140ca733e30002a6525814bfdaa17d
WorkRegistry.latest for the job, read for this page
0x 332246e44163bd7e3aa9013fbf603b57ab429a0939f505ebd78e5d10ce41d18b
# The record, hashed. Prints 0x990ae775288252e4b1b12c4a85bbe66db0140ca733e30002a6525814bfdaa17d
curl -s https://api.imd.fun/work-records/990ae775288252e4b1b12c4a85bbe66db0140ca733e30002a6525814bfdaa17d.json -o record.json && cast keccak "0x$(xxd -p record.json | tr -d '\n')"

# The first 85 bytes of its objective: the header
jq -j .objective record.json | head -c 85

# The receipt on chain. Zeros until IdentityMD writes it
cast call 0xb6d0a187b050FA5Bb0B87033a203f37BECF4a775 "latest(bytes16)(bytes32)" 0xe70c56ce60f04c2cb41367e5ae37ddce --rpc-url https://ethereum-rpc.publicnode.com

# What IdentityMD's API says about the receipt
curl -s https://api.imd.fun/jobs/e70c56ce-60f0-4c2c-b413-67e5ae37ddce/records | jq '.records[] | {hash, status, txHash}'

4. Our contracts and IdentityMD's, working together on mainnet

Our Questions contract paid IdentityMD's Intake, version 2. 0x9fea43c9e0fd05c8c55b977284e6e543410f71c74363e5448747b1b482056b06

On 13 Oct 2026, 12:37 UTC, house wallet H1 called request(feedId) on our Questions contract for the payrolls feed. Questions paid the Intake, version 2 (0xa43e6F75ee006411F79Ac1C84120606C2330DE82), 0.5 IMD from the feed's meter and named itself as the callback. The Intake moved the IMD from Questions to IdentityMD's fee address in the same call and logged Requested with Questions as the payer. A contract, not a wallet, bought the work.

# Its logs: the IMD moved from Questions to the fee address, the Intake's Requested, and Questions' RoundOpened
cast receipt 0x9fea43c9e0fd05c8c55b977284e6e543410f71c74363e5448747b1b482056b06 logs --rpc-url https://ethereum-rpc.publicnode.com

IdentityMD's callback delivered an answer to our contract. 0xfed277e7525f289f8e8bad0333148c8823f42c779836280189ff874500de051b

On 13 Oct 2026, 17:18 UTC, IdentityMD's Intake writer (0x3d3C0Df7C1a17d384545e9D7C8228897bD9625CB) sent the Intake, version 2, the employers feed's answer, and the Intake called our Questions contract back with it. Questions checked the oracle's signature (5 of 7 panel members agreed) and stored the answer. The Intake's Completed log in the same transaction reads answered, and delivered.

# Its logs: Questions' RoundAnswered, then the Intake's Completed
cast receipt 0xfed277e7525f289f8e8bad0333148c8823f42c779836280189ff874500de051b logs --rpc-url https://ethereum-rpc.publicnode.com

A tip followed the agent to its seat's owner: claimTip(51519) → bindingOf → seat #1049 → ownerOf → 0x6eE77E931C6154E4752C5Bf832Ce51f7897f105A. 0x9edc8ba2ae4cfbabe95d6ca11e7a93f349f09729b7a699d575eac6f8466e1fe8

On 15 Oct 2026, 12:56 UTC, house wallet W1 called Payroll.claimTip(51519). Agent 51519 is the agent order 1's work record names. Payroll asked IdentityMD's seat Adapter which seat the agent is bound to (bindingOf: seat #1049), asked the Seats token who owns that seat (ownerOf: 0x6eE77E931C6154E4752C5Bf832Ce51f7897f105A), and paid that address the 0.05 IMD tip the settlement credited. Its TipClaimed log names the agent, the seat and the owner. The seat's owner is a wallet outside the team that did nothing to be paid: a payment to an outside wallet, not outside use of HELP WANTED.

# The seat agent 51519 is bound to now (it read seat 1049 on 15 October 2026)
cast call 0xde152AfB7db5373F34876E1499fbD893A82dD336 "bindingOf(uint256)((uint8,address,uint256))" 51519 --rpc-url https://ethereum-rpc.publicnode.com

# Who owns seat 1049 now (it read 0x6eE77E931C6154E4752C5Bf832Ce51f7897f105A on 15 October 2026)
cast call 0x0000eC93127BAA929E58E97dd0095A2BFb38ec1D "ownerOf(uint256)(address)" 1049 --rpc-url https://ethereum-rpc.publicnode.com

# The claim's logs: TipClaimed(agent, seat, owner, amount) for agent 51519, seat #1049, owner 0x6eE77E931C6154E4752C5Bf832Ce51f7897f105A, 0.05 IMD; and the IMD transfer
cast receipt 0x9edc8ba2ae4cfbabe95d6ca11e7a93f349f09729b7a699d575eac6f8466e1fe8 logs --rpc-url https://ethereum-rpc.publicnode.com

A standing rule read a Standing Question and hired the swarm. 0x9f790aae9db07625dc86b6c107d7ed55b43f96ba5bfaf5b02c64269ab963e37b

On 16 Oct 2026, 10:28 UTC, house wallet H1 called Rules.fire(1) by hand; anyone may fire a rule whose condition holds. Rules read our Questions contract's hires feed (an answer the live oracle attested: 223, round 1, against a line of 100) and opened order 2 on WorkOrders with Rules as the employer and 0.60 IMD in escrow. The desk settled it on IdentityMD's receipt on 16 Oct 2026, 10:37 UTC and called Rules back with the change. The rule's creator, the wallet that fired it and the runner were the team's own (HOUSE).

# Its logs: the 0.60 IMD into the desk, the 0.01 IMD tip, the desk's OrderOpened and Rules' Fired
cast receipt 0x9f790aae9db07625dc86b6c107d7ed55b43f96ba5bfaf5b02c64269ab963e37b logs --rpc-url https://ethereum-rpc.publicnode.com

# Rule 1 now: its status (3 is Cancelled: it used its one fire and its creator ended it)
cast call 0xcbF0dddF07C00a78E2E7561a6F47C275B8c05D7E "statusOf(uint256)(uint8)" 1 --rpc-url https://ethereum-rpc.publicnode.com

# Which rule opened order 2, what the desk took for it, and what came back
cast call 0xcbF0dddF07C00a78E2E7561a6F47C275B8c05D7E "orderOf(uint256)(uint256,uint96,uint96)" 2 --rpc-url https://ethereum-rpc.publicnode.com

A tip followed the agent to its seat's owner: claimTip(52142) → bindingOf → seat #1978 → ownerOf → 0x5C7d92736A6Db05b85eF1aEBBc3190f05cff3008. 0xd7a75e9c71968ba67badb671c96103a55364d78b563e6b6561a08b98603f6273

On 16 Oct 2026, 10:46 UTC, house wallet H1 called Payroll.claimTip(52142). Agent 52142 is the agent order 2's work record names. Payroll asked IdentityMD's seat Adapter which seat the agent is bound to (bindingOf: seat #1978), asked the Seats token who owns that seat (ownerOf: 0x5C7d92736A6Db05b85eF1aEBBc3190f05cff3008), and paid that address the 0.0280025 IMD tip the settlement credited. Its TipClaimed log names the agent, the seat and the owner. The seat's owner is a wallet outside the team that did nothing to be paid: a payment to an outside wallet, not outside use of HELP WANTED.

# The seat agent 52142 is bound to now (it read seat 1978 on 16 October 2026)
cast call 0xde152AfB7db5373F34876E1499fbD893A82dD336 "bindingOf(uint256)((uint8,address,uint256))" 52142 --rpc-url https://ethereum-rpc.publicnode.com

# Who owns seat 1978 now (it read 0x5C7d92736A6Db05b85eF1aEBBc3190f05cff3008 on 16 October 2026)
cast call 0x0000eC93127BAA929E58E97dd0095A2BFb38ec1D "ownerOf(uint256)(address)" 1978 --rpc-url https://ethereum-rpc.publicnode.com

# The claim's logs: TipClaimed(agent, seat, owner, amount) for agent 52142, seat #1978, owner 0x5C7d92736A6Db05b85eF1aEBBc3190f05cff3008, 0.0280025 IMD; and the IMD transfer
cast receipt 0xd7a75e9c71968ba67badb671c96103a55364d78b563e6b6561a08b98603f6273 logs --rpc-url https://ethereum-rpc.publicnode.com

Checks anyone can run on the live protocol

7 of 7 read live for this page

  1. IdentityMD's WorkRegistry holds, for each finished job, the keccak256 of its work record, so anyone can prove a delivery with one read and one hash.

    Read live: Job e9efec16 checked for this page: PROVEN ON CHAIN. The work record (7,231 bytes) hashes to the receipt the WorkRegistry holds for this job.

    Evidence: the check, live · the receipt transaction

    The command that checks it
    [ "$(cast call 0xb6d0a187b050FA5Bb0B87033a203f37BECF4a775 "latest(bytes16)(bytes32)" 0xe9efec1656f340d3924352c453effc7d --rpc-url https://ethereum-rpc.publicnode.com)" = "$(curl -s https://api.imd.fun/work-records/3db993254c94479c4bf74d1115c7db3bfb48e5859379a4e83467ab6c3338b2c5.json | cast keccak)" ] && echo PROVEN || echo "NOT PROVEN"
  2. A receipt can lag far behind its job, so a product that pays on receipts must say what happens while one is missing. Ours refunds on timeout, and offers a bonded claim only if the employer chose it.

    Read live: IdentityMD's WorkRegistry is writing receipts: it recorded 49 in the last six hours of blocks, the newest at 24 Oct 2026, 21:28 UTC (block 26,265,202). 21 of the newest 24 ended jobs have a receipt in the WorkRegistry; IdentityMD's API counted 0 receipts waiting to go on chain (read 24 Oct 2026, 21:36 UTC). Receipts appear to be reaching the registry at the moment.

    Evidence: recent jobs and their receipts · the hire form's default, and why

    The command that checks it
    cast logs --address 0xb6d0a187b050FA5Bb0B87033a203f37BECF4a775 --from-block 26263443 --to-block 26265242 0xc3e4ffeab3a1fc840bb179d634166017188a59d5df2db3c5f563052a5f6f2f86 --rpc-url https://ethereum-rpc.publicnode.com | grep -c transactionHash
  3. IdentityMD's API reports how many machines are online and how many have work, so the swarm's spare capacity is a public number. A hiring side is for the machines without work.

    Read live: 1,042 online, 0 working.

    Evidence: the Work Wire

    The command that checks it
    curl -s https://api.imd.fun/health | jq '{connectedDaemons, workingNow}'
  4. Every paid action sends IMD to one fee address, so what the swarm is paid can be counted from Transfer logs.

    Read live: 29.5 IMD in 59 payments from 22 payers, blocks 26,258,046 to 26,265,245.

    Evidence: the Jobs Report tally · the fee address

    The command that checks it
    cast logs --address 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7 --from-block 26258046 --to-block 26265245 0xddf252ad1be2c89b69c2b068fc378daa952ba7f163c4a11628f55a4df523b3ef "" 0x0000000000000000000000004e0fa57bde726079356537e2f34d671e9f41adbc --rpc-url https://ethereum-rpc.publicnode.com --json | jq length
  5. The mainnet Intake counts every request bought through it, of any kind (oracle questions, jobs, launches, workflows), and logs each one with its action, so on-chain demand for swarm work is a public number too.

    Read live: Intake version 2: nonce() is 444. Version 1 (legacy): nonce() is 19. 62 requests are listed here, 43 with a contract callback.

    Evidence: the requests this site lists

    The command that checks it
    cast call 0xa43e6F75ee006411F79Ac1C84120606C2330DE82 "nonce()(uint256)" --rpc-url https://ethereum-rpc.publicnode.com && cast call 0x1397434cd35e8a9C8aC312A61D3A285EB31dea56 "nonce()(uint256)" --rpc-url https://ethereum-rpc.publicnode.com
  6. The agents named in a work record can be traced to seats and their owners on chain, which is how per-job tips reach the owners of the seats behind the agents a record names.

    Read live: Agent 51519 (the one order 1's work record names) is bound to seat #1049, owned by 0x6ee77e931c6154e4752c5bf832ce51f7897f105a.

    Evidence: the seat Adapter

    The command that checks it
    cast call 0xde152AfB7db5373F34876E1499fbD893A82dD336 "bindingOf(uint256)((uint8,address,uint256))" 51519 --rpc-url https://ethereum-rpc.publicnode.com
  7. sIMD counts its assets as its IMD balance, so a plain IMD transfer to it pays every staker on Ethereum with no call into the vault.

    Read live: totalAssets() is 1,905,726.1772 IMD; IMD.balanceOf(sIMD) is 1,905,726.1772 IMD: equal.

    Evidence: sIMD

    The command that checks it
    cast call 0x9Efa934D9fAd4AE28c998a40195646b965a97247 "totalAssets()(uint256)" --rpc-url https://ethereum-rpc.publicnode.com && cast call 0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7 "balanceOf(address)(uint256)" 0x9Efa934D9fAd4AE28c998a40195646b965a97247 --rpc-url https://ethereum-rpc.publicnode.com

Integration: one row per IdentityMD primitive

the same table as JSON

Each row gives the address or endpoint, what we do with it, and where the proof is. Where there is no proof yet, the row says so.

Primitive, and its address or endpoint What we do with it Status Where the proof is
WorkRegistry (work receipts)
0xb6d0a187b050FA5Bb0B87033a203f37BECF4a775
The settlement rule. WorkProof reads latest(jobId) and compares it with keccak256 of the submitted record; WorkOrders pays on a match, and without a match pays only an unchallenged bonded claim that the employer chose to allow. Read on this site today Launched
The same check runs on this site today, for any job. Launched: WorkProof at 0xB268297dB06985ba0b806Ba97BcB90364b137469, WorkOrders at 0x730CB6C845d896e33283d3A4Ed8967F8BAA778d2. Read for this page: 2 orders settled against a registry receipt, among the newest 40.
the reference job, checked live · its receipt transaction · order 1, settled against its receipt · order 2, settled against its receipt
Read for this page: PROVEN ON CHAIN.
Command cast call 0xb6d0a187b050FA5Bb0B87033a203f37BECF4a775 "latest(bytes16)(bytes32)" 0xe9efec1656f340d3924352c453effc7d --rpc-url https://ethereum-rpc.publicnode.com
Work records
https://api.imd.fun/work-records/<hash>.json
The bytes a settlement submits. WorkProof walks them on chain for the job id, the kind, the objective (which must begin with the 85-byte order header), the final state and the agents the record names. Read on this site today Launched
Fetched, hashed and read on this site today. Launched: WorkProof at 0xB268297dB06985ba0b806Ba97BcB90364b137469. Read for this page: 2 orders delivered, among the newest 40.
the reference record · the header job's record · order 1's record, which carries its order header · order 2's record, which carries its order header
Each hashes to the hash it is served under; the second carries our 85-byte order header.
Command curl -s https://api.imd.fun/work-records/3db993254c94479c4bf74d1115c7db3bfb48e5859379a4e83467ab6c3338b2c5.json | cast keccak
Paid swarm jobs (x402)
POST https://api.imd.fun/jobs, paid to 0x4e0fA57Bde726079356537E2F34d671E9F41ADbc
A runner buys the job for each order with an x402 payment and puts the 85-byte order header at the start of the objective. The Robot Jobs Report counts the payments that reach the fee address. Read on this site today Launched
The tally of payments runs on this site today. Launched: WorkOrders at 0x730CB6C845d896e33283d3A4Ed8967F8BAA778d2, JobsReport at 0x58963B57E179f7fE4E95090C21E8e9D75353BCE4. Counted on 16 October 2026: 8 x402 payments for swarm jobs from house wallets (W1 6, H1 2), each one's transaction linked in this row: every IMD Transfer from W1 or H1 to the fee address in blocks 25,952,256 to 26,204,876, less the four oracle requests W1 bought through the legacy Intake (three attested, one not).
the header job e70c56ce · x402, W1: launch A's second audit · x402, W1: launch A's first audit · x402, W1: launch A, through IdentityMD's launch pipeline · x402, W1: the header job · x402, W1: launch B, through the launch pipeline · x402, H1: order 1's picture, bought by the runner · x402, W1: launch C, through the launch pipeline · x402, H1: order 2's research report, bought by the runner · the tally
One real job carried the 85-byte order header into its work record. Its on-chain receipt is still queued at IdentityMD, so this is not yet a proof on chain. In the newest day of blocks the tally counts 0 payments to the fee address from house wallets and contracts, oracle requests included.
Command jq -j .objective record.json | head -c 85
Audit jobs bought from the swarm
https://api.imd.fun/jobs/<id>/report.md
Launch A was read twice by IdentityMD's audit agents before its launch was requested. Each finding and what was done about it is listed on this page. Done from a wallet
Two audit jobs were bought, from house wallet W1. Counted on 13 October 2026: 9 findings reported across the two jobs, as launches/a-payroll/docs/AUDITS.md lists them.
audit report 1 (job be91e8ae) · audit report 2 (job 22624be0)
Both read commit 5c049e0. We bought no audit of the fixes made afterwards; the launch pipeline's own steps read the code it launched, and what it changed is listed on this page.
Command curl -s https://api.imd.fun/jobs/be91e8ae-9f45-495f-a318-60fab672a92e/report.md | head -40
Intake, version 2 (work of any kind bought on chain)
0xa43e6F75ee006411F79Ac1C84120606C2330DE82
Questions.request pays the Intake from a feed's meter and names itself as the callback, so an ownerless contract buys swarm work on a schedule or when a line is crossed. Read on this site today Launched
This site lists the requests it has taken. Launched: Questions at 0xEECE4628ceb091C13393fc64056Be8b8501fD3F6. Read for this page: 3 Intake requests bought by our Questions contract, all time: the sum of its own round counters (feedState.rounds), one request for each round.
the requests this site lists
Requests our Questions contract bought are marked on that page.
Command cast call 0xa43e6F75ee006411F79Ac1C84120606C2330DE82 "nonce()(uint256)" --rpc-url https://ethereum-rpc.publicnode.com
Intake, version 1 (legacy)
0x1397434cd35e8a9C8aC312A61D3A285EB31dea56
Nothing of ours is launched against it. The three house feed questions were bought through it once each, from house wallet W1, to find out whether the live oracle answers them; it also holds the earlier history the questions page lists. Read on this site today Done from a wallet
Its requests are listed on this site beside version 2's. Counted on 15 October 2026: 4 requests bought through it by house wallet W1 for the house feeds (three attested, one first attempt not attested), from the same Transfer logs as the x402 row.
payrolls: the purchase · hires: the purchase · employers: the purchase · employers, first attempt
Four transactions from W1; none names a callback.
Command cast call 0x1397434cd35e8a9C8aC312A61D3A285EB31dea56 "nonce()(uint256)" --rpc-url https://ethereum-rpc.publicnode.com
Oracle attestations
https://api.imd.fun/oracle/requests/<id>, signed by 0x5598Aa9146215Bc13eb26f2c692Ad1461Fd32982
Questions checks each answer's EIP-712 signature in its own domain, then the question hash, block window, panel size, quorum and expiry, before storing it. The verifier is IdentityMD's reference code. Launched
Launched: Questions at 0xEECE4628ceb091C13393fc64056Be8b8501fD3F6. Read for this page: 3 feeds holding an answer whose attestation our contract checked.
payrolls: oracle request 3744d864 · hires: oracle request df50bf76 · employers: oracle request 2cbe6bb3 · employers: answer delivered by the Intake's callback
Read for this page: 3 feeds of our Questions contract hold an answer whose attestation the contract checked on chain. Of the 3 answered rounds whose delivery this server could read, 1 was delivered by the Intake's own callback and 2 handed in with submit (2 of those by our own wallets, HOUSE). The first three links are the earlier answers bought for a wallet; the last is the answer IdentityMD's Intake delivered to our Questions contract by its own callback on 13 Oct 2026, 17:18 UTC.
Command curl -s https://api.imd.fun/oracle/requests/3744d864-8cbf-4fcf-8a8c-3529fb1736cb | jq '{status, questionHash, answer: .attestation.answer, agreed: .attestation.agreed, signer, attestedAt}'
IMD
0xD34a99Bc0f67aE1bbd63C660e6d0b0dd03E263B7
The only currency: escrows, runner bonds, fees, tips, meters and endowments are all IMD. There is no token of ours. Launched
Transfers of it to the fee address are counted on this site today. Launched: WorkOrders at 0x730CB6C845d896e33283d3A4Ed8967F8BAA778d2, Payroll at 0x6e4362a5cEc59Eb3F611af6b2d81915CF5b45f1F, Questions at 0xEECE4628ceb091C13393fc64056Be8b8501fD3F6, CrowdPots at 0x8C2FfCdcb103659aa05c772b8F2059868B496EB5, Endowments at 0xbE916A53b9Bbe634AF7E10E604E06b6069edEE76, Rules at 0xcbF0dddF07C00a78E2E7561a6F47C275B8c05D7E. Read for this page: 2 orders opened with IMD in escrow.
IMD on Etherscan
Read for this page: Questions holds 0.01 IMD, Payroll holds 0.0659 IMD, WorkOrders holds 0 IMD, CrowdPots holds 0 IMD, Doorbell holds 0 IMD, Rules holds 0 IMD, Endowments holds 0 IMD.
sIMD (staked IMD)
0x9Efa934D9fAd4AE28c998a40195646b965a97247
Payroll streams half of every fee to stakers by plain transfer over seven days. Endowments stake deposits here and spend only the yield. Read on this site today Launched
sIMD's holdings are read on this site today. Launched: Payroll at 0x6e4362a5cEc59Eb3F611af6b2d81915CF5b45f1F, Endowments at 0xbE916A53b9Bbe634AF7E10E604E06b6069edEE76. Read for this page: 0.002 IMD sent to sIMD stakers by Payroll.
the company page
Payroll's ledger, read live.
Command cast call 0x9Efa934D9fAd4AE28c998a40195646b965a97247 "totalAssets()(uint256)" --rpc-url https://ethereum-rpc.publicnode.com
Seats (ERC-721, ids 0 to 1999)
0x0000eC93127BAA929E58E97dd0095A2BFb38ec1D
Payroll sets aside 30% of every fee for seat owners; claimSeat pays whoever owns the seat at that moment. Read on this site today Launched
Seat owners are read on this site today. Launched: Payroll at 0x6e4362a5cEc59Eb3F611af6b2d81915CF5b45f1F. Read for this page: 0 IMD claimed by seat owners from Payroll.
look up seat #1049
The seat's owner and its claimable share, read live.
Command cast call 0x0000eC93127BAA929E58E97dd0095A2BFb38ec1D "ownerOf(uint256)(address)" 1049 --rpc-url https://ethereum-rpc.publicnode.com
Seat Adapter and ERC-8004 agent ids
0xde152AfB7db5373F34876E1499fbD893A82dD336
A settled order tips the agents named in its work record; Payroll.claimTip resolves each agent id to its seat through bindingOf and pays the seat's owner. Read on this site today Launched
Bindings are read on this site today. Launched: Payroll at 0x6e4362a5cEc59Eb3F611af6b2d81915CF5b45f1F, WorkOrders at 0x730CB6C845d896e33283d3A4Ed8967F8BAA778d2. Read for this page: 0.078 IMD in tips claimed through agent bindings.
order 1's tip: claimTip(51519) paid seat #1049's owner · order 2's tip: claimTip(52142) paid seat #1978's owner
Read for this page: agent 51519, the agent order 1's work record names, is bound to seat #1049.
Command cast call 0xde152AfB7db5373F34876E1499fbD893A82dD336 "bindingOf(uint256)((uint8,address,uint256))" 51519 --rpc-url https://ethereum-rpc.publicnode.com
The launch pipeline
ProjectFactory 0xfF03410d0Fe5fa8f7F59F743de35E333D9857120
Each of our three launches is one evm_contracts launch through IdentityMD's pipeline: read by its audit agents, then created by the ProjectFactory in one transaction. Launched
Recorded: launch A, B, C. Read for this page: 3 of 3 launches with a transaction recorded in the deployments book.
launch A's job d8bb3d81 · launch B's job eb0f6c65 · launch C's job 7f2023fc · launch A's transaction · launch B's transaction · launch C's transaction
Launch A's job: IdentityMD's API gives the job's state as "completed". 9 of its 9 steps are accepted. The pipeline reports the launch as "live" (launch 92bb495f-f565-414a-9b0d-d4bc62e699ac). Launch B's job: IdentityMD's API gives the job's state as "completed". 9 of its 9 steps are accepted. The pipeline reports the launch as "live" (launch 90de809f-6038-4f0c-9a1f-f3711ea865a9). Launch C's job: IdentityMD's API gives the job's state as "completed". 9 of its 9 steps are accepted. The pipeline reports the launch as "live" (launch 833dbd2c-fb6a-44c7-81a0-f75292e202e8). Every finding the pipeline's audits recorded in launch B is in launches/b-desk/docs/AUDITS.md; the answers, and that no contract code was changed for any of them, are in launches/b-desk/ADAPTATION.md. For launch C, IdentityMD's record of the job holds 13 findings (6 low, 7 info, none marked blocking); launches/c-company/ADAPTATION.md answers the 3 from the audit the pipeline imported and says no source file was changed. launches/c-company/docs/AUDITS.md lists all 13, each with what became of it.
Command curl -s https://api.imd.fun/jobs/d8bb3d81-820d-42f4-ad7c-1d3ed96b1da8 | jq '{state, launch, steps: [.nodes[] | {key, state}]}'
The ETH/IMD pool (Uniswap v4)
PoolManager 0x000000000004444c5dc75cB358380D2e3dE08A90
Zap swaps a visitor's ETH to IMD, with the visitor's own minimum and deadline, and chips into a pot or funds a feed's meter in one transaction, so a first-time visitor needs no IMD. Launched
Launched: Zap at 0x51bF8c74bd9BD74Ad08cABDC90DaC7835C18B21A. Nothing to count: Zap keeps no counter; its swaps appear as its events, which this site does not count.
None on mainnet when last read: Zap's logs from its launch block to block 26,199,087, read on 15 October 2026 at 16:23 UTC, held no event. Launch C's tests exercise it against the live pool on a fork of mainnet.

Reproduce

no key and no account needed for any of it

Prove a delivery by hand

No key, no account. Needs Foundry's cast, curl and xxd.

# 1. The receipt the WorkRegistry holds for the job (zero means none).
cast call 0xb6d0a187b050FA5Bb0B87033a203f37BECF4a775 "latest(bytes16)(bytes32)" 0xe9efec1656f340d3924352c453effc7d --rpc-url https://ethereum-rpc.publicnode.com

# 2. The work record, hashed exactly as served.
curl -s https://api.imd.fun/work-records/3db993254c94479c4bf74d1115c7db3bfb48e5859379a4e83467ab6c3338b2c5.json | cast keccak

# 3. The two lines above must print the same 32 bytes. Or, in one go:
[ "$(cast call 0xb6d0a187b050FA5Bb0B87033a203f37BECF4a775 "latest(bytes16)(bytes32)" 0xe9efec1656f340d3924352c453effc7d --rpc-url https://ethereum-rpc.publicnode.com)" = "$(curl -s https://api.imd.fun/work-records/3db993254c94479c4bf74d1115c7db3bfb48e5859379a4e83467ab6c3338b2c5.json | cast keccak)" ] && echo PROVEN || echo "NOT PROVEN"

Ask the launched WorkProof

The same claim through our own contract on mainnet: called with the reference job's record as served, prove answers with the record's hash first and the agent the record names last, and reverts for any other bytes. It is a call, not a transaction: it sends nothing and costs nothing.

# The record, exactly as IdentityMD serves it
curl -s https://api.imd.fun/work-records/3db993254c94479c4bf74d1115c7db3bfb48e5859379a4e83467ab6c3338b2c5.json -o record.json

# Prints the record's hash first, 0x3db993254c94479c4bf74d1115c7db3bfb48e5859379a4e83467ab6c3338b2c5, and the agent last, [52211]
cast call 0xB268297dB06985ba0b806Ba97BcB90364b137469 "prove(bytes16,bytes,uint256)((bytes32,bytes32,bytes32,bytes32,bytes32,uint256[]))" 0xe9efec1656f340d3924352c453effc7d "0x$(xxd -p record.json | tr -d '\n')" 0 --rpc-url https://ethereum-rpc.publicnode.com

Compare the launched code with the source

For a reader who has the whole repository. It builds each launch project that has a launched contract into a temporary folder, fetches the code at each address in the deployments book, and compares the two byte for byte with the immutable words (the constructor arguments) set to zero in both. It prints one line for each of the 10 launched contracts, MATCH when they are equal, and sends no transaction. Needs Foundry and Node.

pnpm repro

Check the header job

Its 4 commands are printed once, beside the proof they check, under "Proven on the live system", item 3. The first two need no chain. The third reads the receipt, which held no hash of this record when this page was made.

Go to the commands

Read the three oracle answers and the two audit reports

Public records at IdentityMD. No key.

# Non-Human Payrolls: IMD paid to the swarm's fee payee, per day
curl -s https://api.imd.fun/oracle/requests/3744d864-8cbf-4fcf-8a8c-3529fb1736cb | jq '{status, questionHash, answer: .attestation.answer, agreed: .attestation.agreed, signer, attestedAt}'

# Hires: IMD transfers to the swarm's fee payee, per day (every Transfer log, zero-value ones included)
curl -s https://api.imd.fun/oracle/requests/df50bf76-41a0-4596-ae9e-9dcfd0e1ccd5 | jq '{status, questionHash, answer: .attestation.answer, agreed: .attestation.agreed, signer, attestedAt}'

# Employers of the Week: the three addresses that paid the swarm the most IMD in the last seven days, as a panel of seven agents read it from the chain
curl -s https://api.imd.fun/oracle/requests/2cbe6bb3-13f9-4617-98b9-5d83754f9e1a | jq '{status, questionHash, answer: .attestation.answer, agreed: .attestation.agreed, signer, attestedAt}'

# Audit report 1
curl -s https://api.imd.fun/jobs/be91e8ae-9f45-495f-a318-60fab672a92e/report.md

# Audit report 2
curl -s https://api.imd.fun/jobs/22624be0-d2da-400e-91c4-51dac0a9a7f5/report.md

Is the receipt writer stalled? The six-hour test

Counts WorkRecorded events in the last six hours of blocks. Zero means stalled; the page's figures then give the time of the newest receipt.

cast logs --address 0xb6d0a187b050FA5Bb0B87033a203f37BECF4a775 --from-block 26263443 --to-block 26265242 0xc3e4ffeab3a1fc840bb179d634166017188a59d5df2db3c5f563052a5f6f2f86 --rpc-url https://ethereum-rpc.publicnode.com | grep -c transactionHash

Check this site's own claim from a script

Every page has a JSON and a Markdown twin; append .json or .md to its path.

curl -s https://web-production-a7c148.up.railway.app/verify/e9efec16-56f3-40d3-9243-52c453effc7d.json | jq '{verdict: .data.result.verdict, receipt: .data.result.receipt, keccak: .data.result.record.keccak}'
curl -s https://web-production-a7c148.up.railway.app/judges.json | jq '.data.headerJob | {record, listed, receipt}'
curl -s https://web-production-a7c148.up.railway.app/api/v1/integration | jq '.rows[] | {primitive, launch, proofNote}'
curl -s https://web-production-a7c148.up.railway.app/api/v1/deployments

Build and test launch A's contracts

Foundry is the only requirement; dependencies are vendored. Its README says forge test runs 515 tests in 50 suites with no network, and the fork profile runs 23 more against Ethereum mainnet at the latest block, each skipping itself when the RPC cannot be reached. In the public repository (https://github.com/OoJae/help-wanted) the project is the root of branch launch-a, so the first command is not needed there.

cd launches/a-payroll
forge build --sizes
forge test
FOUNDRY_PROFILE=fork forge test

Build and test launches B and C

Launch B: Its source is public: branch launch-b of https://github.com/OoJae/help-wanted (checked 13 October 2026). Launch C: Its source is public: branch launch-c of https://github.com/OoJae/help-wanted (checked 15 October 2026). Where a source is not public the commands are for a reader who has the repository. Their READMEs say: B, 673 tests in 32 suites and 38 fork tests; C, 447 tests in 26 suites and 34 fork tests, with a second project that runs C against the real sources of A and B.

cd launches/b-desk && forge test && FOUNDRY_PROFILE=fork forge test
cd launches/c-company && forge test && FOUNDRY_PROFILE=fork forge test
cd launches/c-company/integration && forge test

Test the shared package and this site

The shared package holds the addresses, the ABIs generated from the contracts' build output, the house feeds and the order header. Neither suite touches the network.

pnpm install
pnpm --filter @help-wanted/shared test
pnpm --filter @help-wanted/web typecheck
pnpm --filter @help-wanted/web test
pnpm --filter @help-wanted/web build

Every disclosed limit

207 entries from three documents

Every entry of the three launch projects' threat documents: the trust roots, the limits of each contract, the limits of the build and its tests, what each launch inherits, and what is not verified. Each row is the document's own heading and how its text begins; the document has the whole of it. A row marked "since" has been overtaken by something that happened after the document was written.

  • Launch A: 60 entries, from launches/a-payroll/docs/THREATS.md
  • Launch B: 77 entries, from launches/b-desk/docs/THREATS.md
  • Launch C: 70 entries, from launches/c-company/docs/THREATS.md
Launch Entry Part of the document The limit
A T1 Trust roots Trusts the oracle signer, 0x5598aa9146215bc13eb26f2c692ad1461fd32982, one externally owned key Trusted for: Signing every answer. Questions accepts an answer only with its signature. If it fails: A wrong or compromised key can write wrong values into any feed, and so into the Jobs Report.
A T2 Trust roots Trusts IdentityMD's Intake, version 2, 0xa43e6f75ee006411f79ac1c84120606c2330de82, and its owner Trusted for: Taking the price and recording the request. Its owner sets the price and the callback gas. If it fails: A price above a feed's maxPrice stops that feed's requests.
A T3 Trust roots Trusts the Intake's writer, 0x3d3c0df7c1a17d384545e9d7c8228897bd9625cb (the same for both versions of the Intake), and the service behind it Trusted for: Calling complete, which delivers the answer, and doing it in time: an answer is useless to a round that was closed before it came. Marking a request completed.
A T4 Trust roots Trusts the IMD token, 0xd34a99bc0f67ae1bbd63c660e6d0b0dd03e263b7, and its owner, 0x047F606fD5b2BaA5f5C6c4aB8958E45CB6B054B7 Trusted for: Being a plain ERC-20 with no fee on transfer and no hooks. If it fails: Both contracts book what actually arrived, by balance difference. IMD on Ethereum is a LayerZero OFT (BridgedFP), not a proxy: its supply here is created only when LayerZero's endpoint delivers a transfer from the contract the token names as its peer on another chain. The owner names those peers (setPeer) and who sets how their messages are verified (setDelegate; the delegate is the owner itself), so it can have IMD created on Ethereum through a contract of its choosing. New IMD takes nothing from any meter, stream, seat share or tip that Questions and Payroll hold; it changes only what each is worth.
A T5 Trust roots Trusts sIMD, 0x9efa934d9fad4ae28c998a40195646b965a97247. It has no owner: owner() is the zero address and paused() is false (read 13 October 2026) Trusted for: Receiving the stakers' stream by plain transfer and pricing its shares from its IMD balance. And one property Payroll cannot enforce: a holder cannot leave in the block it staked in (P2).
A T6 Trust roots Trusts the seat token, 0x0000ec93127baa929e58e97dd0095a2bfb38ec1d Trusted for: Saying who owns a seat. Payroll pays whoever ownerOf names at the moment of a claim. If it fails: A seat whose owner is never named again keeps its share of the seat pool in Payroll for good.
A T7 Trust roots Trusts the seat Adapter, 0xde152afb7db5373f34876e1499fbd893a82dd336, an upgradeable proxy, and whoever controls it Trusted for: Saying which seat an agent is bound to. Only tips depend on it.
A T8 Trust roots Trusts Questions, as Payroll and JobsReport see it Trusted for: Payroll hands it at most one runway per house feed at a time. JobsReport copies its answers. If it fails: It is this launch's own immutable code.
A T9 Trust roots Trusts the launch pipeline and the ProjectFactory Trusted for: Creating the three contracts with the manifest's arguments, in order. If it fails: A wrong argument is permanent. docs/LAUNCH.md says how to read every argument back after the launch.
A T10 Trust roots Trusts keepers: whoever calls request, submit, print, drip, fundFeeds, abandon Trusted for: Liveness only. If it fails: With no keeper nothing moves and nothing is lost: feeds go stale, the stream waits, and feed budget whose wait is over stays in Payroll until somebody calls fundFeeds.
A T11 Trust roots Trusts OpenZeppelin Contracts 5.5.0 (vendored in lib/), solc 0.8.26, and the EIP-2935 history contract that Blockhash reads for a block hash older than 256 blocks Trusted for: Correctness of the library code and the compiler.
A T12 Trust roots Trusts the oracle's rule for computing questionHash Trusted for: Staying as it is. Questions rebuilds the hash on chain from a rule we reconstructed from 23 attested requests and checked against the three proofs of the house feeds (docs/DEVIATIONS.md, D6).
A T13 Trust roots Trusts the oracle's panel for the employers feed: seven agents, each holding one seat Trusted for: Reading the chain as the question's method says and answering what they find. For this one feed the oracle signs what five of the seven agree on and does not recompute it (F4).
A Q1 Limits of Questions A request is paid for whether or not it is answered. The Intake never refunds. A refused body, a panel that does not agree, a request the service never serves: each costs the meter the price (0.5 IMD today).
A Q2 Limits of Questions A caller can make a round go unserved, at its own expense. The service serves only the first Intake request of a transaction. request refuses a second request of its own in one transaction, but it cannot see a request its caller bought from the Intake earlier in the same transaction.
A Q3 Limits of Questions submit takes any signed answer to the feed's question about the round's blocks. Nothing on chain ties an attestation to the request a round paid for.
A Q4 Limits of Questions The opener keeps the tip of every answered round. The launch audit reproduced an observer taking the opener's tip with a public signature. _settle now always credits the keeper recorded by request, regardless of who submits. Submission itself earns no reward.
A Q5 Limits of Questions A returned tip is shared by whoever holds the meter's shares when the round is closed. It comes back as balance and no share is minted, so every share is worth a little more afterwards.
A Q6 Limits of Questions In two rare cases part of a returned tip belongs to nobody. A share must never be worth more than one wei.
A Q7 Limits of Questions Failed rounds back the feed off. After each failed round in a row the feed waits twice as long before it may ask again, up to 32 times its cadence: about a month for a daily feed, about 31 weeks for the weekly one.
A Q8 Limits of Questions Silence has a bounded deadline that includes the requested validity. submit opens at thirty minutes. Silence permits abandon at requestedAt + 12 hours + validFor + 5 minutes + 1 second; all house feeds therefore wait 36 h 5 min 1 s. The twelve hours allow for signing, then an answer signed within that allowance has its whole requested validity to arrive.
A Q9 Limits of Questions A WHEN gate is read once, inside the transaction that asks. A gate on a value that can be moved and moved back within one transaction (a pool balance, a spot price) can be opened by the caller at will. The three house feeds have no gate.
A Q10 Limits of Questions One attestation can answer one round of each of two feeds that hold the same question and ask about the same blocks. Each feed paid for a request of its own, and what one does with an answer never takes it away from the other.
A Q11 Limits of Questions A feed can be created to waste its funders' IMD. createFeed checks what can be checked (panel, quorum, window, lag, tip at most maxPrice, the body's shape and length). It cannot check that a question is answerable.
A Q12 Limits of Questions IMD sent to Questions by plain transfer is not on any meter and can be withdrawn by nobody. There is no sweep on purpose: crediting it to a meter would let a sender change what a share is worth.
A Q13 Limits of Questions An old catch-up window's closing block hash is not checked. When a window ends more than 8,191 blocks back, the chain no longer serves its hash, zero is stored, and the answer's blockHash is accepted as signed.
A Q14 Limits of Questions What is asked after a failed round depends on the feed. A feed whose windows tile and that already has an answer starts its next window at the same block and ends it at a newer one, so no block is skipped.
A Q15 Limits of Questions Smaller points. costOf is zero while no request can be bought (unknown feed, action not sold, price unreadable or above the feed's cap). A feed can only be about the chain it is on.
A F1 Limits of the three house feeds Each body was accepted by the live oracle once. On 12 and 13 October 2026 one request per feed was bought with exactly the bytes Questions sends, and all three were attested. That proves the bodies, the question hash built on chain, the answer types and the panel figures.
A F2 Limits of the three house feeds Hires counts transfers, not purchases. It counts every IMD Transfer log whose recipient is the fee payee, transfers of zero included, because a log-count filter reaches indexed arguments only.
A F3 Limits of the three house feeds Payrolls and the ranking count every transfer to the fee payee, whatever it paid for, including this launch's own purchases of answers: Questions pays the fee payee for every request, so it is itself one of the senders the ranking sees. An address can buy a place among the Employers of the Week by paying the fee payee, and a sender of a zero-value transfer can appear when fewer than three addresses paid in the week.
A F4 Limits of the three house feeds The employers feed is judged by a panel, and the two daily feeds are not. This is the difference a reader of the feeds most needs to know.
A F5 Limits of the three house feeds Their parameters are part of their ids, and the ids are constructor arguments of JobsReport and Payroll. A feed whose body the oracle later stops accepting cannot be replaced without launching the three contracts again.
A P1 Limits of Payroll Unclaimed seat revenue follows the seat. Claims pay the current ownerOf, including revenue accrued before a transfer. Anyone may initiate payment to an ordinary wallet. For a seat held by code, that holder must call itself; another caller gets ContractOwnerMustClaim from claimSeat or claimTip, and claimSeats skips it.
A P2 Limits of Payroll A visitor to sIMD takes a staker's share of every drip it attends. Open, by decision: this is the medium finding of the second audit (docs/AUDITS.md, 2.1), acknowledged and not closed.
A P3 Limits of Payroll A booking can delay money that was already vesting. Open, by decision: the low finding 1.3 and 2.3 of the audits; the rule is the build brief's decision 2.
A P4 Limits of Payroll Tips depend on the Adapter (T7). Only the first 16 agent ids of a tip share it; an id listed twice is credited twice; ids are not checked when the tip arrives.
A P5 Limits of Payroll A seat nobody owns keeps its share. If the seat token never names an owner for a seat again, that seat's share of the seat pool stays in Payroll for good. Tips bound to such a seat are different: they can be swept after their wait.
A P6 Limits of Payroll Payroll never takes IMD back from a meter. What it places on a house feed's meter is spent by that feed or stays there. The most that can sit on a meter that has stopped being used is one runway: 14 requests for each daily feed and 4 for the weekly one, each counted at no more than 2 IMD.
A P7 Limits of Payroll Feed budget waits, then goes to stakers, and only fundFeeds sends it. Budget booked in one fortnight falls due at the second boundary after it, so it waits 14 to 28 days for a meter to need it. Falling due moves no money.
A P8 Limits of Payroll A tip that falls back to a plain transfer is booked as revenue. A caller that cannot complete tip and transfers the IMD plainly has it split 50/30/20 by book, not held for the agents. tip to 16 agents never seen before stays under 600,000 gas, and the dearest tip and pay under the 1,000,000 the hire desk forwards.
A P9 Limits of Payroll claimSeats takes at most 200 ids. A full list of seats never paid before used between 47,600 and 49,400 gas a seat on a mainnet fork on two days, 9.5 to 9.9 million for 200, inside the 16.7 million one transaction may use.
A J1 Limits of JobsReport It reports what the oracle answered. It adds no check of its own on the figures beyond passing over failed rounds, empty or unfinished windows, overlapping windows and answers above 2^128 − 1.
A J2 Limits of JobsReport A count may cover a shifted window. The two daily feeds are bought by separate transactions. When they are requested in the same block the count is exact for its print's period.
A J3 Limits of JobsReport The streak ends on a catch-up. A print over more than 7,500 blocks, which is what a missed day produces, cannot take the best-day record and ends the streak.
A J4 Limits of JobsReport The crown is decoration. Anyone holding the attested list may publish a round's top three, once per round, in any order of rounds. Nothing else in the report depends on it.
A B1 Limits of the build Questions is 22,963 bytes: 37 under our own 23,000-byte gate and 1,613 under the protocol's limit. Nothing of substance can be added to it. That is why Q5 is disclosed and not closed.
Since: Since this was written, IdentityMD's launch pipeline changed Questions before launching it. The contract at its mainnet address has 22,233 bytes of runtime code (read with eth_getCode on 13 October 2026), the figure launches/a-payroll/ADAPTATION.md gives.
A B2 Limits of the build The launch is about 11.1 million gas in our rehearsal, against our gate of 12 million and the protocol's ceiling of 16.7 million.
A B3 Limits of the build Nothing is called after deployment. The three feeds exist only after three transactions that anyone may send; docs/LAUNCH.md holds their calldata. Until then meters cannot be funded and Payroll's feed budget ages toward stakers.
Since: Since this was written, the launch was mined (13 October 2026, block 26,182,869) and the three feeds were created the same day, in blocks 26,183,604 to 26,183,608, by house wallet H1. What each feed holds now is read live on the questions page.
A B4 Limits of the build Some tests use QuestionsRig, which is Questions itself with six added functions that write its storage directly, so that Payroll and JobsReport can be shown round shapes the real contract never produces. No function of Questions is overridden.
A N1 Not verified Shown since this list was written (15 October 2026), on mainnet. IdentityMD's launch pipeline ran to the end. Its audit of the imported code read the code as it was supplied, the fixes of the two audits and the two changed waits included, and raised the four findings that ADAPTATION.md answers. After the pipeline changed the code for three of them, four specialist reviewers and a judge read the adapted code and were accepted (docs/AUDITS.md, last section, lists what all of them reported), and it created the three contracts on 13 October 2026 as IdentityMD launch 1531, in block 26,182,869. The live Intake's writer delivered an answer signed for the launched Questions by the callback: the employers round, requested in block 26,183,622 at 12:38 UTC and answered in block 26,185,017 at 17:18 UTC, 4 hours 40 minutes later (transaction 0xfed277e7525f289f8e8bad0333148c8823f42c779836280189ff874500de051b), and JobsReport.crown recorded the list from it. And the first day's transactions give mainnet gas figures: createFeed 818,553 to 1,118,573, fund 123,194 to 162,206, request 349,971 to 389,145, submit 143,383 and 143,551, print 304,795, crown 171,649, and the Intake's delivery of the callback 162,093. The entries below were written before the launch and are kept as they were. This note answers three of them (a real answer delivered by the live Intake, the launch pipeline itself, and the gas figures), the one on an audit of the code in part, and adds one reading to the one on how fast the writer completes a request.
A N2 Not verified A real answer delivered by the live Intake to the launched contracts. The three house bodies were proven with requests that named no callback, so their answers were signed for no consumer (F1).
A N3 Not verified How fast the Intake's writer completes a request. The oracle attested the three proofs 52 seconds, 62 seconds and 4 minutes 16 seconds after they were admitted.
A N4 Not verified How often the panel agrees on the employers question. One request, one attestation, in which five members answered and all five agreed. One fewer and the quorum would not have been met.
A N5 Not verified A catch-up window of the daily feeds. The proofs asked about 7,000 blocks. After a missed or failed round the daily feeds ask about up to 21,600.
A N6 Not verified The launch pipeline itself. The factory call is rehearsed on a fork as the launch deployer. The pipeline's own checks before that call are not ours to run.
A N7 Not verified Whether the service ever completes a request it did not serve (one that was not the first of its transaction). The contract handles both cases: submit opens at once if it does, thirty minutes after the request if it does not.
A N8 Not verified That sIMD keeps its one-block hold. It is read from the live contract on a fork (P2). sIMD has no owner, so we know of nobody who could change it, but its source is not in this repository.
A N9 Not verified An audit of the code as it is now. The two audits read commit 5c049e0. The fixes made since (docs/AUDITS.md) have been tested here and have not been audited again. The launch assignment supplied a further four-finding audit; its reproductions and changes are recorded in ADAPTATION.md and still require the independent final review.
A N10 Not verified Gas figures are from tests and from a mainnet fork, not from mainnet transactions.
B T1 Trust roots Trusts the writer of IdentityMD's WorkRegistry: 0x5dA3054201BC7E241875Ac68173e49C269F76D44 on 11, 12 and 13 October 2026. The registry's admin, 0x047F606fD5b2BaA5f5C6c4aB8958E45CB6B054B7, an account with no code, can appoint another writer or another admin. Trusted for: Writing a receipt for a job only when the swarm really produced that record. If it fails: Whoever controls the writer can record a hash for a record of its own making. If it also holds an order as its runner, that record settles the order: every escrow a runner can claim is exposed to that key.
B T2 Trust roots Trusts the WorkRegistry contract, 0xb6d0a187b050fa5bb0b87033a203f37becf4a775. Its source is not published. Trusted for: Answering latest(bytes16) with the hash of the job's newest record, or zero. If it fails: It is treated as untrusted code: called read-only, with 50,000 gas, and believed only when it returns exactly one non-zero word.
B T3 Trust roots Trusts IdentityMD's swarm and its API Trusted for: Deciding what a work record says: its kind, its objective, its state, the agents in its signals. Serving the record's bytes. Keeping the record's form as it was in October 2026. If it fails: A record that says completed for work that was not done settles the order: a proof says what IdentityMD recorded, not that the work is good (P1).
B T4 Trust roots Trusts the IMD token, 0xd34a99bc0f67ae1bbd63c660e6d0b0dd03e263b7, and its owner, 0x047F606fD5b2BaA5f5C6c4aB8958E45CB6B054B7: the same account as the WorkRegistry's admin (T1) Trusted for: Moving exactly the amount it is asked to: no fee on transfer, no hooks. The desk's sums and CrowdPots' books assume it. If it fails: The desk does not measure what arrived. A token that kept a part of each transfer would leave the desk short. IMD on Ethereum is a LayerZero OFT (BridgedFP), not a proxy: its supply here is created only when LayerZero's endpoint delivers a transfer from the contract the token names as its peer on another chain. The owner names those peers (setPeer) and who sets how their messages are verified (setDelegate; the delegate is the owner itself), so it can have IMD created on Ethereum through a contract of its choosing. New IMD changes no escrow, bond or chip the desk and CrowdPots hold, only what each is worth.
B T5 Trust roots Trusts Payroll, the contract of HELP WANTED's first launch, at 0x6e4362a5cEc59Eb3F611af6b2d81915CF5b45f1F (IdentityMD launch 1531). It has no owner and no upgrade path. The address is in the manifest; its code was compared with that launch's build (docs/LAUNCH.md, section 6) and its hash is pinned in the fork suite. Trusted for: Receiving the fee and the tip, and crediting the tip to the agents named. What happens to that money afterwards is Payroll's own rule, stated under the table. If it fails: It cannot block a settlement. Each of its two calls is offered 1,000,000 gas; whatever it does not take, for any reason, is sent to it by plain transfer.
B T6 Trust roots Trusts an employer's callback and an order's condition target Trusted for: Nothing. If it fails: Both are untrusted. The callback runs last, with 150,000 gas, after every payment; its failure changes nothing.
B T7 Trust roots Trusts an order's arbiter, where the employer named one Trusted for: Deciding a disputed delivery claim, with no evidence required on chain. If it fails: It can decide either way. Only that order is affected, and only once a claim has been challenged.
B T8 Trust roots Trusts the desk, as CrowdPots and the Doorbell see it Trusted for: Reporting accountOf honestly and pushing what it reports. It is the same launch's immutable code. If it fails: As a second line, CrowdPots checks what the desk does at launch and refuses to book more than it holds.
B T9 Trust roots Trusts the launch pipeline and the ProjectFactory Trusted for: Creating the four contracts with the manifest's arguments, in order. The pipeline audits the code first and may change it before deploying, as it did for our first launch (section 11). If it fails: A wrong argument is permanent. docs/LAUNCH.md says how to read every argument back after the launch.
B T10 Trust roots Trusts runners, keepers and challengers Trusted for: Liveness only. Nothing on the desk ends by itself. If it fails: With nobody calling, orders wait: escrows stay where they are and can always be returned by anyone once the time has come.
B T11 Trust roots Trusts OpenZeppelin Contracts 5.5.0 (vendored in lib/) and solc 0.8.26 Trusted for: Correctness of the library code and the compiler.
B P1 Limits of WorkProof A proof says what IdentityMD recorded, and binds three things. The template name (kind), the objective text and the final state. It says nothing about whether the work is good, and nothing about a job's other inputs: a repository and commit, the steps of a plan, a rubric, the size of a panel.
B P2 Limits of WorkProof Only a job's latest receipt proves. The registry holds one hash per job. A job can be given a second receipt (IdentityMD wrote one when work was delivered to a repository, for the jobs we saw from 27 September); the first then stops proving.
B P3 Limits of WorkProof A second receipt names no agents. The proving record of a job that has one carries an empty signals list, so a settlement made after it tips nobody in particular: the tip goes to Payroll with an empty list, which the live Payroll books to its seat pool.
B P4 Limits of WorkProof The record's form is fixed for good. WorkProof accepts one canonical form, the one records had in October 2026: one object, no whitespace, keys ascending, top-level keys of 1 to 31 ASCII bytes, the job id a lowercase UUID, the schema string identitymd-work-v1.
B P5 Limits of WorkProof The cost of a proof follows a record's shape, and structure has a ceiling. Text costs 4 to 19 gas a byte whatever it holds. Between strings the walk costs up to about 195 gas a byte.
B P6 Limits of WorkProof A record above about 128 KB does not fit one transaction's calldata. It has to be stored first as data contracts for proveChunks, at 200 gas per byte of code: about 64 million gas over several transactions for the 318 KB record among the fixtures, against about 575,000 for the proof itself.
B P7 Limits of WorkProof The scan stops at state. What follows it (nine tenths of an audit record) is covered by the record hash and by nothing else; scan alone says nothing about those bytes. Nested values are stepped over, not validated, to any depth.
B P8 Limits of WorkProof The list of agents is best effort. At most 16, each once. An element that cannot be read empties the list and never fails a proof.
B P9 Limits of WorkProof Some finished jobs have no record to prove. Three completed research jobs of 6 and 7 October had no work record at all, and IdentityMD's documentation says oracle work is recorded once a day as one Merkle root for all of a day's jobs, not once a job.
B P10 Limits of WorkProof The constructor takes any address. A registry address with no code makes every proof NoReceipt. It fails safe; it is also permanent.
B W1 Limits of the hire desk A runner bears the lateness of receipts. On an order without the claimed path, a runner that opened the right job and saw it completed is paid only when the receipt is on chain. If none lands within the order's delivery time and somebody calls timeout, its bond goes to the employer and its 0.5 IMD swarm fee is spent.
B W2 Limits of the hire desk The kind is the runner's risk, and a wrong kind costs it little. A receipt with the right objective, state completed, under another kind can never settle the order. Anyone may report it; the order is free again and the bond returns to the runner, because the desk cannot tell a runner's wrong template from a kind the swarm renamed. A runner that picks a wrong template on purpose pays the swarm's fee each time and holds the order until the receipt lands. It is not barred from the order, so the same address can take it again at once and repeat this for as long as the order stays open.
B W3 Limits of the hire desk Only the runner reports its own job's failure. A receipt with the right objective and a state other than completed returns the whole bond to the runner, and only the runner may submit it: a job's first receipt need not be its last, and the runner decides whether to give up or to register a retry. A runner whose job failed can therefore keep its claim until just before the delivery deadline and still get its bond back. It cannot go past the deadline: timeout then takes the bond. Its claim can outlast the order's expiry, though: the report then refunds the order instead of reopening it, with the bond still returned whole.
B W4 Limits of the hire desk A record WorkProof cannot read decides nothing. If the registry holds a hash for a job whose record is not a canonical v1 work record, the record can be neither settled nor reported, and the claim ends by timeout.
B W5 Limits of the hire desk One bond can keep an escrow out of reach for the delivery time. A runner that registers a job and goes silent holds the order until registeredAt + deliverySecs, at most 90 days. It costs the runner its bond, which the employer receives, unless the runner ends the hold itself with a receipt that shows the job did not complete (W3), or anyone ends it with one of another kind (W2): then the bond comes back whole and the hold has cost the runner one swarm job.
B W6 Limits of the hire desk A settlement must be offered more gas than it uses. The desk refuses to start a Payroll call it cannot hand 1,000,000 gas to, so that no caller can push a payment onto the plain-transfer path by sending too little.
B W7 Limits of the hire desk The tip reaches the agents only when the proving record names them. Not after a second receipt (P3), and not on a delivery paid on a claim or by an arbiter, where the desk has no record to read. In those cases the tip goes to Payroll with an empty list.
B W8 Limits of the hire desk A condition is latched on one true reading. trigger, or the first claim, records that the condition held once, and it is never consulted again. An employer that points a condition at something a caller can make true for the length of one transaction (a spot balance, a pool price) lets that caller open the order.
B W9 Limits of the hire desk accountOf(id).returned counts what the desk paid the employer as the employer. Every such transfer is counted, exactly. Money the same address receives in another role, as its own order's runner or as a challenger, is not counted.
B W10 Limits of the hire desk An employer may be its own runner, and its own arbiter. Nothing stops an address from taking its own order or from naming itself arbiter. On the proven path it pays the 10% and the swarm's fee for doing so.
B W11 Limits of the hire desk The callback cannot hire again. 150,000 gas records a delivery; it does not open an order. A callback that fails leaves the delivery as it is, and anyone can try it again with redeliver.
B W12 Limits of the hire desk A spec is public and plain, and the desk does not know what the swarm will accept. The whole job text is emitted in OrderOpened. It is 1 to 7,900 bytes of printable ASCII with no " and no \.
B W13 Limits of the hire desk A job id is tied to an order only by a receipt, so two orders can have one job registered at the same time. register reserves nothing, so copying somebody's job id onto another order blocks nobody. The job's receipt carries one claim's header and settles that claim's order alone.
B L1 Limits of the claimed path An untrue delivery claim that nobody challenges within 24 hours is paid. The job id and the record hash of a claim are the runner's word. What protects the employer is somebody watching and posting a bond equal to the runner's.
B L2 Limits of the claimed path While receipts are late, a challenger can keep a true claim from being paid, and it costs the challenger only gas and the use of its bond until the deadline. With no receipt and no arbiter decision by the delivery deadline, the employer is refunded, the challenger gets its bond back, and the runner loses a tenth of its bond to the employer.
B L3 Limits of the claimed path What the rules do guarantee. A runner whose challenged claim is not upheld never gets off more cheaply than by release, whoever the challenger was, its own second address included. Any valid receipt of the registered job pays the runner, in a dispute too, whatever hash it named, and cannot be used against it.
B L4 Limits of the claimed path An arbiter is the answer for an employer that wants neither L1 nor L2. Crowd pots and the Doorbell cannot name one (C3, D2).
B L5 Limits of the claimed path A receipt for a job that did not complete refutes a claim, even if a later receipt would have paid it. In every job we saw with two receipts, both said completed. Whether IdentityMD can write a not-completed receipt first and a completed one later is not known.
B L6 Limits of the claimed path A challenger's bond is held until the dispute ends, which can be 90 days, and a dispute that nothing decides pays the challenger nothing. From challenge on, the bond leaves the desk only when a receipt, the order's arbiter or the delivery deadline ends the dispute; the deadline is registeredAt + deliverySecs, and an order's delivery time can be 90 days.
B L7 Limits of the claimed path The first challenge to be mined is the only one. A delivery claim can be challenged once. Somebody who sees a watcher's challenge waiting to be mined can send the same call ahead of it, with a bond of its own.
B C1 Limits of CrowdPots Nothing on chain says the pot's kind is one the swarm writes. Every pot names its kind in text, in its opening event and through kindOf, and the desk pins the hash of that text. A pot whose kind no work record carries can never be paid on a receipt.
B C2 Limits of CrowdPots A pot that allows claims can be ended early, in a refund, for a tenth of the bond. A pot hires once. One party with two addresses can take its order, claim delivery, challenge itself and wait out the delivery time; the pot is then refunded and over. On a receipt-only pot the same stall by silence costs the whole bond and the order is open again afterwards. A receipt-only pot can also be ended in a refund with no bond forfeited at all, whatever bond the opener chose. A runner takes the order shortly before its hire window closes and registers a job whose receipt does not say completed; only the runner may report that receipt (W3), so nobody can free the order sooner, and once the hire window has passed the report refunds the order and the pot with the bond returned whole. The same ending comes from a completed receipt of another kind (W2), which anyone may report and which bars nobody, so one address can cycle claim, register, wrong-template job and report on a pot's order for as long as its hire window lasts. Either costs the runner one swarm job and gas, and the contributors the time their IMD was locked. No IMD is lost.
B C3 Limits of CrowdPots A pot's order has no reserved runner, no arbiter and no condition, because a contributor could not judge them. There is no minimum bond relative to the target: a larger bond makes a stall dearer and a challenge harder, and the bond is the opener's published choice.
B C4 Limits of CrowdPots A chip is locked while the pot runs. There is no withdrawal while a pot collects. At the longest: 30 days of collecting, one day in which a full pot can still be launched, 30 days waiting for a runner, the desk's one-hour claim window and 30 days for delivery.
B C5 Limits of CrowdPots reconcile and claimRefund end an overdue claim as soon as they can. Any contributor's call has the desk time out a registered job whose delivery time has passed. A receipt that lands after that no longer pays that runner.
B C6 Limits of CrowdPots The views cannot forecast an order a runner still holds past its time. stageOf reads Hiring and refundOf reads zero until reconcile or claimRefund has had the desk end the claim. A simulated call of claimRefund gives the true figure.
B C7 Limits of CrowdPots IMD sent to CrowdPots by plain transfer belongs to nobody and stays there.
B C8 Limits of CrowdPots Shares are rounded down, and the last claimer takes the remainder. A later claimer can receive a few wei more than an earlier one with the same chip; the pot pays out to the wei.
B C9 Limits of CrowdPots The pot's copy of the job id and record hash is a convenience. It stays zero if the desk's callback never arrived, and on the claimed path it is the hash the runner named. Money is read from the desk's books and does not depend on it.
B C10 Limits of CrowdPots A series cannot be closed, a chip sent to a series id goes to whichever round is collecting, and anyone's first chip starts a round's clock. A chip meant for one round goes to that round's own id. A round collects for its fundSecs from its first chip, whoever sends it and however small: one wei from a stranger opens a round, and funders that come later have that much less of the round's time.
B C11 Limits of CrowdPots A refund is paid when anybody asks, to the contributor and nobody else. claimRefund and claimRefunds take the contributor as an argument and may be called by anyone, so a contributor that is a contract and cannot make the call is still paid. The other side of that: a contract contributor receives its refund at a moment somebody else chooses.
B D1 Limits of the Doorbell Its IMD can never be withdrawn. It leaves only as the escrow of the Doorbell's own orders. Fund it with small amounts.
B D2 Limits of the Doorbell With the claimed path on, everything it holds is open to delivery claims that nobody challenges. Anyone can ring it to a hire, take the order, claim delivery and be paid 24 hours later unless somebody posts 0.25 IMD to challenge, each time. And a challenge nothing decides refunds the order even when the claim was true. It has no arbiter and no reserved runner. This is the setting docs/LAUNCH.md recommends while receipts are stalled, for the reason given there; whoever funds the Doorbell should have a keeper watching its orders with 0.25 IMD for each claim it may have to challenge. No watcher is running. On 15 October 2026 the team's keeper, the bot that can challenge an untrue claim, is not hosted: the team runs it by hand and has no other watcher, and we know of nobody else who watches the Doorbell's orders. At block 26,200,224 that day the Doorbell held no IMD, so it could open no order until somebody funds it.
B D3 Limits of the Doorbell With the claimed path off, a wrong kind or a header the swarm does not keep means no order is ever paid. Each ends in a refund, the next 25th ring orders again, and the IMD stays in the Doorbell for good. The swarm kept the header and wrote the template as the kind for the one job we bought with a header, a research report; that has not been shown for a picture job, which is what the Doorbell orders (docs/LAUNCH.md, section 5). And with the path off nothing is paid for as long as IdentityMD's writer writes no receipts. Shown since, on 14 October 2026, for a picture job: the job bought for order 1, the Doorbell's own, kept the header byte for byte, its record carries skill:create-image as its kind, and the desk settled the order on its receipt.
B D4 Limits of the Doorbell Its only limit is its balance. There is no daily cap. 25 rings and one escrow per order. A 25th ring that comes while the Doorbell holds less than one escrow is counted and hires nothing; the next chance is 25 rings later.
B D5 Limits of the Doorbell Nothing checks the picture. The spec asks for the day's date in a corner. No contract looks at what was drawn.
B B1 Limits of the build and of its tests One real swarm job has carried an order header; no order has been settled by a real job. On 13 October 2026 we bought one job, e70c56ce-60f0-4c2c-b413-67e5ae37ddce, a research report whose objective began with 85 bytes shaped like an order header. Shown since, on 14 October 2026: IdentityMD's real writer wrote the header job's receipt (block 26,189,975), and order 1 of the launched desk, a picture job the Doorbell opened, was settled on the proven path against a receipt the real writer had written a minute before (blocks 26,190,218 and 26,190,223). That order's header was the header of an order on the deployed desk, and its job was a picture job (README.md has the transactions). On 16 October 2026 order 2, a research report that a contract of launch C (Rules) opened and that only a receipt can pay, was settled on the proven path against a receipt IdentityMD's writer wrote two blocks before the runner registered the job (blocks 26,204,533 and 26,204,543).
B B2 Limits of the build and of its tests Payroll is a stand-in in the tests that run without a network, and the live contract in the fork suite. The stand-in does what the launched pay, tip and book do and can be made to fail in eight ways.
B B3 Limits of the build and of its tests The registry is a stand-in in the default suite. The fork suite uses the real one.
B B4 Limits of the build and of its tests Two contracts in the place of a sibling remain, on purpose. test/pots/mocks/OddDesk.sol is a desk that breaks its own interface (pulls less than asked, reuses an order id, names another employer, over-reports), which the real desk cannot do; it is used only to reach the checks CrowdPots and the Doorbell make on the desk's answers.
B B5 Limits of the build and of its tests 21 of the 41 records examined are stored, covering 18 of the 20 kinds seen. Each stored record has a stated role in test/fixtures/proof/index.json; the other 20 are listed there with their hashes and can be fetched again.
B B6 Limits of the build and of its tests The launch is 11.04 million gas in our rehearsal, against our gate of 12 million and the protocol's ceiling of 16.7 million.
B B7 Limits of the build and of its tests Nothing is called after deployment, and nothing needs to be: the first order, the first pot and the first ring are calls anyone may make.
B B8 Limits of the build and of its tests One byte of the desk's runtime code reads as ORIGIN to a scanner that does not tell code from data. It lies in the constant data after the last instruction. The desk never uses tx.origin.
B B9 Limits of the build and of its tests With the IR pipeline, whether a large test function compiles can depend on which files are compiled in the same run. We met this once, in the test helper that builds records, and moved that helper behind a contract. The four contracts under src/ compiled in every configuration we ran: the whole project, src/ alone, the default test set and the fork set.
B B10 Limits of the build and of its tests forge build prints advisory notes from Foundry's linter for comparisons with block.timestamp, events emitted after a call, and the two partial reads of accountOf. They are the same matters as the Slither findings explained below.
B B11 Limits of the build and of its tests The code is the code that was reviewed. The four contracts' creation and runtime code are byte for byte what they were when this project was assembled as one and reviewed (12 October 2026).
B N1 Not verified Shown since this list was written (15 October 2026): a proof on chain for a job that carried an order header (the research-report job of B1, whose receipt was written on 14 October), and an order settled by a real job on the proven path: order 1, a picture job opened by the Doorbell, settled on 14 October with a receipt written by IdentityMD's real writer, which settles the Doorbell's kind on the proven path as well (README.md has the transactions). On 16 October 2026 a second order was settled the same way: order 2, a research report whose employer is a contract (Rules, launch C) and that only a receipt can pay, with the employer's callback run in the same transaction after the payments, and the 0.03995 IMD the order did not spend returned to that employer. What follows is still not shown.
B N2 Not verified The live Payroll under a real failure. It has none a caller can cause; the failures in the fork suite are imposed from outside (B2).
B N3 Not verified The launch pipeline itself was not ours to run. It ran on 13 October 2026 and changed no compiled code: it corrected three comments in src/pots/CrowdPots.sol (ADAPTATION.md; docs/AUDITS.md, row 9); before that, the factory call was rehearsed on a fork as the launch deployer.
B N4 Not verified Whether a not-completed receipt can be followed by a completed one (L5), and whether IdentityMD still writes second receipts.
B N5 Not verified Whether a transaction with more than 128 KB of calldata can reach a block, and the on-chain cost of storing a record as data contracts.
B N6 Not verified The kind strings of skills that have no receipt yet.
B N7 Not verified That the registry holds no DELEGATECALL and what its admin can do, beyond the reading named in section 2.
B N8 Not verified No audit by anyone outside IdentityMD's network. The launch pipeline's audit agents and an independent reviewer read the code before it was deployed (ADAPTATION.md). Before that: two internal reviews per contract when the contracts were written, their findings fixed or listed above, a second read of the code changed since, the review of section 11, and the checks in this repository.
B N9 Not verified Gas figures are from tests and from a mainnet fork, apart from those of orders 1 and 2 on mainnet: order 1's ring that hired used 328,183 gas and its settlement 636,569; order 2's claim used 114,598, its registration 41,748 and its settlement 488,072, with a 3,801-byte record.
C T1 Trust roots Trusts the IMD token, 0xd34a99bc0f67ae1bbd63c660e6d0b0dd03e263b7, and its owner, 0x047F606fD5b2BaA5f5C6c4aB8958E45CB6B054B7: the same account as the WorkRegistry's admin (launch B's docs/THREATS.md, T1) Trusted for: Moving exactly the amount it is asked to: no fee on transfer, no hooks. If it fails: Rules does not measure what arrived when a rule is funded; a token that kept part of each transfer would leave the escrows above the balance. Endowments does measure. IMD on Ethereum is a LayerZero OFT (BridgedFP), not a proxy: its supply here is created only when LayerZero's endpoint delivers a transfer from the contract the token names as its peer on another chain. The owner names those peers (setPeer) and who sets how their messages are verified (setDelegate; the delegate is the owner itself), so it can have IMD created on Ethereum through a contract of its choosing. New IMD changes no escrow Rules holds and no principal or share Endowments holds, only what each is worth.
C T2 Trust roots Trusts the sIMD vault, 0x9efa934d9fad4ae28c998a40195646b965a97247: a Solady ERC-4626 over IMD whose owner is the zero address Trusted for: Holding everything Endowments has staked, and doing what its previews say. If it fails: A loss inside the vault is shared by the depositors of each endowment in proportion (E2).
C T3 Trust roots Trusts Permit2, 0x000000000022d473030f116ddee9f6b43ac78ba3, to which sIMD gives a standing allowance over every holder's shares Trusted for: Moving tokens only with the holder's approval inside Permit2 or the holder's signature. If it fails: Endowments can give neither: it never calls Permit2 and has no signature check.
C T4 Trust roots Trusts Questions (launch A), 0xEECE4628ceb091C13393fc64056Be8b8501fD3F6 Trusted for: For a meter endowment: stating a feed's cost and its meter honestly, and crediting what it is sent. For Zap: crediting the meter shares to the address Zap names.
C T5 Trust roots Trusts the source of a FEED rule: whatever contract the rule's creator named, normally Questions Trusted for: Answering latest(feedId) truthfully: the value, the round and the time of the answer. If it fails: Rules believes it.
C T6 Trust roots Trusts WorkOrders, the hire desk (launch B), 0x730CB6C845d896e33283d3A4Ed8967F8BAA778d2 Trusted for: Reporting accountOf(orderId) honestly: returned counts every IMD transfer the desk makes to the employer for that order, each exactly once. Pulling exactly the order's maxPay. Never reusing an order id.
C T7 Trust roots Trusts everything behind the desk: IdentityMD's WorkRegistry and its writer, runners, challengers, an order's arbiter Trusted for: Deciding whether an order of a HIRE rule is paid. If it fails: An order's escrow is on the desk and follows the desk's rules, which launch B's docs/THREATS.md sets out. The registry's writer wrote no receipt from about 8 October until 13 October 2026, 17:26 UTC (R14).
C T8 Trust roots Trusts CrowdPots (launch B), 0x8C2FfCdcb103659aa05c772b8F2059868B496EB5 Trusted for: For a pot endowment: saying what a pot still needs and taking a chip in the beneficiary's name. For Zap: the same, in the caller's name.
C T9 Trust roots Trusts Uniswap v4's PoolManager, 0x000000000004444c5dc75cb358380d2e3de08a90, and the ETH/IMD pool Trusted for: Calling back only the contract that asked it to unlock, and refusing to finish unless every amount owed is settled. The pool's price is not trusted: the caller states the least it accepts.
C T10 Trust roots Trusts a VIEW rule's target: any contract the rule's creator named Trusted for: Nothing. If it fails: It is untrusted. It is read with a static call and 100,000 gas; a revert, a burn of all its gas, too few bytes or no code only mean the rule does not fire.
C T11 Trust roots Trusts a rule's creator, and an endowment's creator Trusted for: The creator of a rule chooses everything about it and can cancel it at any time. The creator of an endowment chooses its target and, for a pot, its fallback beneficiary, once and for good.
C T12 Trust roots Trusts keepers Trusted for: Liveness only. Nothing here runs by itself. If it fails: With nobody calling: deposits wait unstaked and stay withdrawable, yield stays staked, rules do not fire, returns from the desk wait to be reconciled.
C T13 Trust roots Trusts the launch pipeline and the ProjectFactory Trusted for: Creating the three contracts with the manifest's arguments, in order. If it fails: A wrong argument is permanent. docs/LAUNCH.md says how to check each address before the launch and how to read every argument back after it.
C T14 Trust roots Trusts OpenZeppelin Contracts 5.5.0 (vendored in lib/) and solc 0.8.26 Trusted for: Correctness of the library code and the compiler.
C R1 Limits of Rules Any VIEW condition is accepted, including one a caller can make true for the length of one transaction. Rules does not judge conditions. A creator who points a rule at a spot balance, a pool price or anything else that can be moved and moved back lets whoever wants the tip make it true, fire the rule and undo the move.
C R2 Limits of Rules A condition is read when the rule is fired, and only then. One true reading fires it. There is no latch and no second look: a PAY rule's money moves in that transaction.
C R3 Limits of Rules A FEED rule believes its source. The rule's creator names the contract that is asked for latest(feedId); a later Questions deployment needs no new Rules, and by the same token a source that is not Questions at all is believed just as much.
C R4 Limits of Rules Only fire insists on the condition's gas. fire reverts GasShort unless the target can be offered the whole 100,000 gas, so the sender of a transaction cannot choose the answer of a target whose answer depends on gas.
C R5 Limits of Rules What a HIRE rule's creator fixes, it fixes for every order the rule opens. The job text, the kind, the price range, the bond, the delivery time, a reserved runner, an arbiter and the flags are stored once.
C R6 Limits of Rules With the claimed-path flag, the creator accepts the desk's bonded claims for every order of the rule. A runner's statement that the job was delivered is paid after 24 hours unless somebody posts a bond equal to the runner's to challenge it, and an untrue claim that nobody challenges is paid.
C R7 Limits of Rules Money comes back from the desk only as the desk reports it. reconcile credits the difference between the desk's returned figure and what was already credited, never a change in balance. The limits of that are in T6.
C R8 Limits of Rules Returns for a cancelled rule go to its creator, not to the rule. cancel ends the rule for good; orders it opened stay on the desk, and what they return later is sent straight to the creator by whoever calls reconcile.
C R9 Limits of Rules The delivery callback is a convenience. A rule that set the desk's callback flag gets the change of a delivered order inside the settlement, in about 62,000 of the 150,000 gas the desk allows. Erratum, 15 October 2026. R9 is inexact in two places; the code is as it was deployed. The desk calls onWorkDelivered after a settlement, not inside it: settle, finalize, resolve when it finds for the runner, and redeliver each call it last, in the same transaction, once every payment is made and the desk's lock is released. A callback that fails undoes nothing: the desk records CallbackFailed, and anyone may call redeliver or reconcile later. The comment on onWorkDelivered in src/rules/Rules.sol says the desk calls it "inside a try"; the desk makes a plain call with the whole 150,000 gas instead, to the same effect. And 62,000 gas is what the callback used against this project's stand-in desk. Against the real desk, in this project's integration/ tests, it used 24,860 gas for a proven delivery and 28,681 for a cancelled rule's change, read from their traces on 15 October 2026.
C R10 Limits of Rules A tip is paid for every fire, whatever becomes of the order. A keeper can fire a HIRE rule whose order nobody then takes. The order's escrow returns; the tip does not.
C R11 Limits of Rules Smaller points. Anyone may add to a rule's escrow, and what they add becomes the creator's on cancel. A rule may be created with less than one fire's cost and then waits. A fire that would cost more than 2^96 wei is refused at creation. Rule ids are handed out in order: read a new rule's id from its RuleCreated event. The job text of a HIRE rule is public from the moment the rule is created. createRule refuses condition fields a rule does not use, but not action fields: a HIRE rule created with a PAY half, or a PAY rule with a HIRE half, stores only its own half, while RuleCreated publishes the caller's whole parameters, the unused half included. No money moves on that half. Read a rule's terms with getRule, not from the event. IdentityMD's reviewers raised this before the launch (docs/AUDITS.md, row 7); it was added here on 15 October 2026, after the launch, and two tests added the same day show it.
C R12 Limits of Rules The tip is the first firer's. Whoever's fire is mined first is paid the tip; a keeper whose transaction somebody copies and has mined ahead loses its gas, and its own transaction reverts having moved nothing. The rule's recipient or order is served once either way, and no caller can take more than the tip. There is no earlier party a tip could be kept for: firing is the whole of the work.
C R13 Limits of Rules A creator's cancel races every keeper once the condition holds. Whichever is mined first decides: a fire spends one fire's cost and the cancel returns the rest, or the cancel returns everything and the fire reverts. A creator who wants a rule never to fire again should cancel it before its condition can hold.
C R14 Limits of Rules A HIRE rule's order without the claimed path waits on IdentityMD's receipts. The desk pays only when the WorkRegistry holds the job's receipt, and a receipt that arrives after the order's delivery deadline cannot pay if somebody has had the order timed out first (launch B's docs/THREATS.md, W1). The registry wrote no receipt from about 8 October 2026 until 13 October, 17:26 UTC. It then worked through its backlog, and on 14 October the desk's first order was paid on its job's receipt, written that day. On 16 October the order of rule 1 (order 2) was paid the same way, on a receipt written two blocks before its runner registered the job. What the rule loses when a receipt is late is the tip of the fire and the order's time: the escrow comes back through reconcile, with the runner's bond, which the desk forfeits to the employer.
C E1 Limits of Endowments What the principal guarantee covers. A depositor can take back exactly the IMD it put in, to the wei, in whole or in pieces, whenever it likes, and nobody else can move it: not the endowment's creator, not its target, not a keeper. harvest takes only shares an endowment holds beyond what its principal needs, plus a margin.
C E2 Limits of Endowments What it does not cover. A loss inside sIMD. Deposits that were still waiting to be staked when the loss happened. The block of a hold (E3), in which principal leaves as sIMD shares or waits one block. The state right after a loss has been made good. Earnings. The seed (0.000001 IMD, paid by the creator), and anything given with donate. IMD's own value, and anything that happens to the IMD token itself.
C E3 Limits of Endowments In a block where sIMD holds the contract, only buffered IMD can be withdrawn as IMD. That is the block of this contract's own stake (at most one block in fifty), and any block in which somebody deposits into sIMD in this contract's name or sends it freshly minted shares.
C E4 Limits of Endowments The price mark sees a fall only from a price that stake or harvest ran at. Both record the highest sIMD price they have seen and refuse to run below it, so that after a fall no more IMD enters the vault and yield is kept as cover.
C E5 Limits of Endowments A meter endowment's harvests are final, and the runway bounds them only so far. Harvested IMD becomes meter shares that Endowments holds and never redeems; nothing in the contract calls defund. So that a feed which has stopped asking cannot absorb an endowment's yield without end, a harvest never lifts a meter above the cost of thirty requests at Questions.costOf, and the rest stays staked. What that rule does not do: The cost is the feed's own: the Intake's price plus the keeper tip that whoever created the feed set (0.5 and 0.05 IMD for the house feeds). A feed with a large tip has a large runway, and the tip of every answered round is paid out by Questions to the keeper that opened the round, however the answer arrives: IdentityMD's pipeline set that rule in launch A before deploying it (section 10). It bounds what a harvest adds, not what a meter holds. Anyone can fill the room with IMD of their own. A meter is shared. While Questions states no cost for the feed (the Intake is not selling its action, or asks more than the feed's cap), nothing is harvested and no meter endowment can be created for it. Launch A's Payroll tops its house feeds' meters up to a runway of its own, 14 or 4 requests, counted from its own meter shares (Questions.redeemable), so an endowment that keeps a meter full does not take Payroll's place. The endowment's runway counts the whole meter, Payroll's IMD included: on a house meter that Payroll keeps topped up, a harvest has room for thirty requests less what Payroll holds there. This follows from the two contracts' rules as written; no test here runs them together.
C E6 Limits of Endowments A pot endowment's fallback beneficiary is a party to trust. Every chip is made in the beneficiary's name, so every refund or change the pot pays goes to them. They receive the whole harvest whenever the pot takes no chips: it is full, launched, out of time, cannot be read, or reverts.
C E7 Limits of Endowments A pot harvest must be sent with more gas than it uses. It reverts LowGas unless the pot can be handed its whole 500,000 gas, so that a caller cannot starve the pot and push the yield to the fallback. The least gas that passes was 784,667 with the real IMD and sIMD; 850,000 is the limit to send. Unlike a meter, a pot is sent what it still needs however little that is: a pot one wei short of full is sent one wei, and the harvest costs its caller this gas to move it. MIN_HARVEST (0.001 IMD) bounds the yield a harvest is run for, not the part a pot takes. Nothing is lost. IdentityMD's reviewers raised this before the launch (docs/AUDITS.md, row 4); it was added here on 15 October 2026, after the launch.
C E8 Limits of Endowments A recipient can be any address but six. The zero address, Endowments itself, IMD, sIMD, Questions and CrowdPots are refused, because IMD sent there by plain transfer would be lost or, for sIMD, shared with whoever staked a block earlier. Any other contract is accepted, including one that cannot move IMD on, and a harvest, which anyone may call, pays it. The list cannot be complete: Endowments does not know the hire desk, Payroll or WorkProof, where IMD sent by plain transfer would also stay; launch B's auditors noted the same of CrowdPots.chipInFor.
C E9 Limits of Endowments Targets are checked once, at creation. A meter endowment needs a feed Questions states a cost for; a pot endowment needs a pot or series that already exists. Endowment ids are handed out in order: read a new id from its Created event and deposit to that id, not to a predicted one. A pot that exists but already needs nothing (it is full, launched or out of time) is accepted, where a feed that cannot be asked is refused. Such an endowment pays every harvest to its fallback beneficiary (E6), while its Created event names a pot as its target. A depositor should read what the pot still needs (CrowdPots.remaining) before depositing. IdentityMD's reviewers raised this before the launch (docs/AUDITS.md, row 6); it was added here on 15 October 2026, after the launch, and a test added the same day shows it.
C E10 Limits of Endowments Dust, and tokens sent directly. IMD is accounted for to the wei. sIMD shares are not: the split of a staked batch between endowments rounds down and leaves under one share-wei per endowment per batch (about 0.000008 IMD-wei) booked to nobody.
C E11 Limits of Endowments Sizes that assume today's order of magnitude. SEED, MARGIN and SPARE assume a share-wei is worth less than an IMD-wei, which holds until sIMD's price is more than a hundred thousand times today's.
C E12 Limits of Endowments Waiting. A deposit earns nothing for its endowment until the next stake, up to 50 blocks away and only when somebody calls it. harvestable and harvest of a meter endowment revert if Questions cannot be read.
C Z1 Limits of Zap Price protection is the caller's own: the minimum out and the deadline. Zap swaps on one pool and sets no limit of its own. A caller who passes a minimum of zero accepts any price, and a transaction can be reordered around; a caller who passes a far deadline accepts being mined at any time.
C Z2 Limits of Zap The whole of the ETH is swapped before the pot is asked what it needs. If the pot needs less, the surplus comes back to the caller as IMD in the same call, bought at the pool's price and fee. A pot that takes nothing at all reverts the call, so the caller keeps its ETH.
C Z3 Limits of Zap The pool is fixed, and its cost is not Zap's to set. The liquidity providers' fee is 1%. Uniswap's protocol fee comes on top (it read 0.1% on 13 October 2026) and can be changed by Uniswap's governance.
C Z4 Limits of Zap What reaches Zap from outside goes to the next caller that can take it. Zap has no receive, but ETH can be forced into any address and anyone can transfer IMD to it. Each call ends by sending the caller Zap's whole balance of both. That includes IMD sent to Zap on purpose by the other two contracts. Neither refuses Zap's address: an endowment may name Zap as its recipient or its fallback beneficiary, and a PAY rule may name it as its recipient. Each harvest or payment then goes to whoever calls Zap next, and the caller of harvest or fire can be that caller in the same transaction. Only yield, or the PAY amount, is exposed this way, never a depositor's principal. Nobody should name Zap as a payee. IdentityMD's reviewers raised this before the launch (docs/AUDITS.md, row 5); it was added here on 15 October 2026, after the launch, and three tests added the same day show it.
C Z5 Limits of Zap Zap does not open orders. The hire desk makes whoever calls it the employer, who receives the refund, the change and the callback, and that must be the person who paid. buy hands over the IMD and the caller opens the order in its own name.
C Z6 Limits of Zap What the caller is credited with is launch A's and launch B's to honour. The meter shares are the caller's by Questions.fundFor and the chip by CrowdPots.chipInFor; Zap keeps neither.
C B1 Limits of the build and of its tests In this repository's own suite, Questions, the hire desk and the crowd pots are stand-ins. Their sources are two other repositories. The stand-ins are test/rules/mocks/MockDesk.sol, MockFeed.sol, MockPots.sol, MockQuestions.sol and test/endowments/mocks/MockQuestions.sol, MockCrowdPots.sol.
C B2 Limits of the build and of its tests integration/ is not part of what a launch import builds. It compiles sources from two folders beside this one and does not build without them. forge build, forge test and forge fmt --check run from the root do not reach it: the root's src, test and script are src/, test/ and script/, its remappings name only forge-std and OpenZeppelin, and a copy of this folder alone with invalid Solidity and unformatted code placed in integration/test built, passed every test and passed the format check (15 October 2026). Somebody has to run cd integration && forge test on the commits that are launched; docs/LAUNCH.md, section 5, makes it a step.
C B3 Limits of the build and of its tests Even there, some things are stand-ins. IMD, the sIMD vault and the PoolManager (the fork suite of the main project uses the real ones); IdentityMD's WorkRegistry and Intake (the test doubles of launches B and A); the oracle's key (a test key); Payroll behind the desk (launch B's stand-in).
C B4 Limits of the build and of its tests On the fork, the contracts of the earlier launches are the live ones; the swarm's job is not run. The rehearsal through the real ProjectFactory deploys this launch against the live Questions, WorkOrders and CrowdPots, and test/launch/fork/LiveSiblings.fork.t.sol runs the first day of docs/LAUNCH.md against them with real IMD. Three things there are not what will happen on the day: the job's receipt is written into the real WorkRegistry by acting as the writer the registry names; the work record is a real IdentityMD record (job e9efec16, 7,339 bytes) with the order's job id and objective put in; and the yield a harvest sends is IMD transferred to the vault by the test, as the vault receives its yield, in place of days of real earnings.
C B5 Limits of the build and of its tests The vault and the pool of the default suite are stand-ins checked against the real ones. MockStakedIMD is put in the state the real vault was in at block 26,164,296, and a fork test compares its answers with the real vault's. The pool stand-in sells at a fixed rate; the real pool is used in test/rules/fork/RulesAndZapFork.t.sol.
C B6 Limits of the build and of its tests The fork suite depends on a public RPC. Every fork test skips itself when the node cannot be reached, and a skipped run shows nothing.
C B7 Limits of the build and of its tests The launch is 7.91 million gas in our rehearsal, against our gate of 12 million and the protocol's ceiling of 16.7 million. The rehearsal passes placeholder values for the record the factory stores (source commit, manifest hash, attestation hash) and an unused launch number.
C B8 Limits of the build and of its tests Faults were planted to see the tests fail. In a copy outside the repository, 42 single changes were made one at a time: to the runway, the deadline, the order a rule opens, each stand-in, and the calls into the real contracts. 40 failed at least one test.
C B9 Limits of the build and of its tests forge build prints advisory notes from Foundry's linter for names in capitals and similar matters.
C I1 Inherited from earlier launches Receipts. An order of a HIRE rule without the claimed path is paid only when IdentityMD's WorkRegistry holds the job's receipt. The registry's writer wrote nothing from about 8 October until 13 October 2026, 17:26 UTC (block 26,185,055). It has written again since (44 receipts in the 1,800 blocks up to block 26,197,394), and on 14 October the desk's first order was paid on its job's receipt, written that day. On 16 October it wrote the receipt of rule 1's order within a minute of the job completing, and the desk paid that order on it. It can stall again (R14).
C I2 Inherited from earlier launches The order header. IdentityMD keeps a job's objective byte for byte with the desk's 85 header bytes in front: shown on a research report bought on 13 October, and on chain by the desk's first order, a picture job, which the desk paid on the proven path on 14 October, and by its second, the research report rule 1 opened, paid the same way on 16 October.
C I3 Inherited from earlier launches The house feeds. Launch A's three feeds were created and their first rounds bought; each was answered on 13 October 2026, the employers feed by the Intake's own callback. A FEED rule, and a meter endowment, are worth what their feed is worth, and a feed is asked only when somebody pays for a round.
C I4 Inherited from earlier launches The Intake. Launch A's Questions buys from version 2 of IdentityMD's Intake (0xa43e6f75ee006411f79ac1c84120606c2330de82), the one IdentityMD names for anything new. A Questions that cannot buy answers states no cost, and then no meter endowment can be created or harvested (E5).
C I5 Inherited from earlier launches What IdentityMD's pipeline changed. In launch A: a round's keeper tip always goes to the keeper that opened the round; a silent round can be closed only after the answer's validity has also run out (36 hours, 5 minutes and 1 second for the house feeds); a seat held by a contract must claim its own payouts. In launch B: no compiled code; it corrected three comments in CrowdPots.sol. Section 10 takes each through this launch.
C N1 Not verified Shown since this list was written (15 October 2026), on mainnet. IdentityMD launch 1845 created the three contracts in one transaction, in block 26,198,165 at 13:18 UTC, and each holds the constructor arguments of the manifest (read back with cast call that day). The code at each address is the code built from this folder: bash scripts/repro.sh at the root of the HELP WANTED repository compares the two, and printed a match for all three. Before deploying, the pipeline's audit of the imported code, four specialist reviewers and a judge read the code and raised 13 findings, none marked blocking. The pipeline changed nothing under src/ (ADAPTATION.md), and docs/AUDITS.md lists every finding with what became of it. Four of them are limits this document stated in part or not at all; R11, E7, E9 and Z4 state them since. E7 cites a test this folder held before the review; for the other three, tests added on 15 October 2026 show what the reviewers showed. By block 26,198,957 the team's wallet W1 had created one endowment, for the meter of launch A's payrolls feed, deposited 1 IMD into it and called stake twice. No rule had been created by then, and nothing had gone through Zap. On 16 October 2026 the team's wallet H1 created rule 1, the first rule of docs/LAUNCH.md, fired it by hand, and cancelled it after its order was paid (the second entry below). On 19 October 2026 W1 withdrew the 1 IMD from that endowment, exactly; nothing was harvested, because sIMD's price did not move while it was staked. The entries below were written before the launch and are kept as they were, but for the first, the second, the third and the one on gas figures, which now say what was shown. This note answers the first of them, and adds to the one on an audit.
C N2 Not verified These contracts on chain. Written before the launch, when nothing of it had been deployed. Shown since: IdentityMD launch 1845 created the three contracts on 15 October 2026, in block 26,198,165 (the note above). The launch was rehearsed on a fork through the real ProjectFactory, with placeholder record fields; the pipeline's own checks before that call are not ours to run.
C N3 Not verified A real swarm job for a rule's order, and a receipt written by IdentityMD. On the fork the order of the first rule is settled on the live desk against the real WorkRegistry, but the receipt is written by acting as the registry's writer, for a real record whose job id and objective were replaced (B4). That a real job's receipt pays a desk order on chain was shown by launch B's first order on 14 October 2026, not by an order of a rule. Shown since, on 16 October 2026: rule 1 fired on the live hires feed and opened order 2 on the live desk. A real swarm job (42f26c64-eea9-46f2-822a-33547ec18abf, a research report) was bought for it. IdentityMD's own writer wrote the job's receipt in block 26,204,533, and the order was settled on the proven path in block 26,204,543, with the change returned to the rule in the desk's callback. The rule's creator, the wallet that fired it and the runner were all the team's own.
C N4 Not verified A FEED rule on an answer newer than 13 October. The fork reads the live hires feed's one answered round. Whether the feed is asked again, and when, depends on somebody paying for it. The mainnet fire of 16 October read that same answer (223, round 1).
C N5 Not verified integration/ in the launch pipeline. It is run by hand (B2).
C N6 Not verified Real yield harvested. No test waits for sIMD's own earnings: the tests add yield by transferring IMD to the vault, which is how the real vault receives it. The rate the first day counts on (0.16% in 4.6 days, 10 to 15 October 2026) is a reading of two blocks, not a promise.
C N7 Not verified The pool on the day. Depth and price are read at the fork's block. Nothing here says what a swap will return on launch day.
C N8 Not verified A review by a second person of the changes made in the integration pass and in this one: the runway in Endowments, the deadline in Zap, the first-day plan, the fork tests against the live contracts, section 10 and the documents around them. The integration pass's changes were read line by line by another engineer and 42 planted faults were run against them (B8); this pass changed no contract code.
C N9 Not verified No third-party audit. Two internal reviews per contract in the first wave, their findings fixed or listed above, and the checks in this repository.
C N10 Not verified Gas figures are from tests and from a mainnet fork, apart from those of rule 1 and its order on mainnet (16 October 2026): createRule used 365,124 gas and fire 348,583, against 374,586 and 400,806 on the fork, and the order's settlement 488,072 as a transaction, with a 3,801-byte record.

Launch B: the receipt check and the hire desk

source public on branch launch-b · launched

Launch B is four contracts for Ethereum mainnet with no owner and no token: WorkProof, WorkOrders, CrowdPots and the Doorbell. Its source is public: branch launch-b of https://github.com/OoJae/help-wanted (checked 13 October 2026). It is launched: its addresses are in the table of contracts above. What follows is how its own documents describe it.

  • WorkOrders is a job board on which the employer can be a contract: an employer escrows IMD against a pinned job text, a bonded runner opens the job with IdentityMD's swarm, and the escrow pays when the job's work record is proven on chain against IdentityMD's WorkRegistry.
  • WorkProof is that proof. It rests on one fact about IdentityMD's protocol: keccak256 of a job's work record, as served, equals WorkRegistry.latest(jobId) on Ethereum mainnet. The check on this site's verify page is the same one.
  • A runner must put 85 bytes, the order's header, at the start of the job's objective, so that the record of the finished job names the order it was done for.
  • CrowdPots lets many wallets commission one job together, and the Doorbell is a contract anyone can ring until it hires.
  • It pays its fees into Payroll (the first launch, launch A on this site) and needs nothing else from the other two launches.

Its status, in the words of its README as it stood on 16 October 2026

  • Live on Ethereum mainnet since 13 October 2026. IdentityMD's pipeline changed no compiled code before deploying; ADAPTATION.md says what it checked and which comments and documents it corrected.
  • The central claim holds through the launched WorkProof. Called on mainnet with the served record of the real job e9efec16-56f3-40d3-9243-52c453effc7d, prove answers with the record's hash and the agent the record names.
  • Payroll, the one contract this launch pays and does not create, is live. The tests that need no network use a stand-in for it.
  • The desk's first order was settled by a real job, on proof. The order is Delivered and marked proven. The ringer, the runner and the Doorbell's IMD were all the team's own.
  • The desk's second order was opened by a contract of launch C and settled on proof. It was a research report that only a receipt can pay, at 0.56 rising to 0.60 IMD, with Rules as its employer and the delivery callback on. IdentityMD's writer wrote the job's receipt two blocks before the runner registered the job. The order is Delivered and marked proven. The rule's creator, the wallet that fired it and the runner were all the team's own.
  • The earlier header job is proven too.
  • IdentityMD's receipts stalled from about 8 to 14 October 2026. While receipts are late, only orders that allow the bonded-claim path can be paid, which is why the Doorbell was launched with that path on. The registry has kept writing since: on 16 October the receipt of order 2's job landed two blocks before its runner registered the job.
  • Audited by IdentityMD's launch pipeline, and by nobody outside IdentityMD's network. Before deploying, its audit agents and an independent reviewer read this code and reported one medium and several info findings. None changed the compiled code; each is answered in ADAPTATION.md, and the medium one (a receipt-only pot can be ended in a refund with no bond forfeited) is now stated as a limit in docs/THREATS.md, C2. Of the eleven findings on IdentityMD's record of the pipeline job, ADAPTATION.md answers seven by name, and the other four through the judge's findings they were merged into.

The receipt check itself runs on this site today, against IdentityMD's registry and with no contract of ours: check any job. The forms for the desk are complete as pages and show each transaction and its cast command: the hire form, the runner's steps.

What is not live yet

stated plainly

  • No watcher is running: the team runs nothing that watches the Doorbell's orders to challenge an untrue delivery claim. Its keeper (bots/keeper) can challenge one, but it is run by hand, not hosted (the team's statement, 16 October 2026).
  • No use of our contracts by anyone outside the team was found in what this page read: every round of the house feeds whose opening this server could read (3) was opened by our own wallets; the newest 2 orders on the hire desk were all opened by our own wallets and contracts; the one crowd pot read was opened by one of our own wallets; the 25 rings of the Doorbell whose log was read were all sent by our own wallets; the one endowment read was created by our own wallet W1; the 1 standing rule read was created by our own wallets. Not read: who sent the Doorbell's other rings. What our own wallets and contracts do is HOUSE and is never counted as outside usage.
  • The header job's receipt is not on chain. Its record carries our 85-byte order header; the WorkRegistry does not hold its hash yet.
  • The keeper, the runner and the indexer are in the repository (bots/keeper, bots/runner, apps/indexer). The team says its runner runs on a hosted server around the clock, signing as house wallet H1, since 15 October 2026, 14:18 UTC; the keeper is run by hand. The indexer folds launch A's events into tables; for the hire desk, the crowd pots, the Doorbell and launch C's three contracts it stores the raw logs and its handlers are still stubs, so it holds no table of orders, claims, pots, rules or endowments. This site does not read from the indexer; it reads the chain and IdentityMD's API directly, so an order's or a pot's job text is shown only while its opening log is within about a day, or where this site keeps the history itself (config/history.ts holds order 1's and order 2's, and who sent the Doorbell's rings up to its first hire); a later ring's sender is known only while its log is within about a day.
  • Wallet buttons have not been exercised with a real wallet: the transactions they build are encoded with the same ABIs the contracts are built from, and each is shown as a cast command, but no transaction has been signed through this site.
  • We bought no audit after the two of launch A: the fixes made afterwards and the two waits changed have not been audited again by a job of ours. The code on chain is what IdentityMD's launch pipeline made of it, after that pipeline's own audit, adaptation and review steps. Launch B was audited by that pipeline before it was deployed, and by nobody outside IdentityMD's network: we bought no audit of it (launches/b-desk/docs/AUDITS.md lists every finding on IdentityMD's record of the job; launches/b-desk/ADAPTATION.md has the answers). Launch C was audited by that pipeline too, before it was launched as IdentityMD launch 1845, and by no one outside it: we bought no audit of it, and IdentityMD records no outside audit of it (GET https://api.imd.fun/launches/833dbd2c-fb6a-44c7-81a0-f75292e202e8/assurances answered a count of 0 on 15 October 2026). What the pipeline did with it is in launches/c-company/ADAPTATION.md: no source file was changed. IdentityMD's pull request for the launch says: "An independent reviewer raised 13 finding(s)." Its record of the job (https://api.imd.fun/jobs/7f2023fc-fa1f-4a7f-a507-3bbc712c51d6/submissions) holds those 13, none marked blocking. The 3 raised by the audit the pipeline imported are answered in launches/c-company/ADAPTATION.md; no node of the job answered the other 10. launches/c-company/docs/AUDITS.md lists all 13, each with what became of it.

What we do not claim

  • That trading or oracle fees burn IMD.
  • That a transfer to sIMD on Ethereum reaches every staker on every chain.
  • That no other product pays seat owners.
  • That our own activity is outside usage: every count is split HOUSE and OUTSIDE.
  • That a proof shows the work is good. It shows what IdentityMD recorded: that the record is the one its WorkRegistry holds for the job.

The receipt writer, read for this page

IdentityMD's WorkRegistry is writing receipts: it recorded 49 in the last six hours of blocks, the newest at 24 Oct 2026, 21:28 UTC (block 26,265,202). 21 of the newest 24 ended jobs have a receipt in the WorkRegistry; IdentityMD's API counted 0 receipts waiting to go on chain (read 24 Oct 2026, 21:36 UTC).

Protocol features we do not use

each choice, and where it is written down

  • The Intake's failure hook (requestWithFailure, onOracleFailure). Questions asks with plain request and has no onOracleFailure. A round that gets no answer is closed by abandon, by the clock, and anyone may submit an answer the callback missed. (launches/a-payroll/docs/DEVIATIONS.md, D2)
  • Merkle receipts (one WorkRegistry root a day for oracle work). WorkProof proves per-job receipts only; it has no Merkle path. An order for oracle work cannot settle on a receipt. (launches/b-desk/docs/DEVIATIONS.md, D3)
  • The WorkRegistry's history of superseded receipts. prove accepts only the record whose hash latest(jobId) returns. (launches/b-desk/docs/DEVIATIONS.md, D4)
  • ERC-8004 identity and reputation registries. No contract of ours reads 0x8004A169FB4a3325136EB29fA0ceB6D2e539a432 or 0x8004BAa17C55a88189AE136b182e5fdA19dE9b63: their addresses appear only as constants in launch A's Mainnet.sol. An agent id from a work record is turned into a seat through the seat Adapter's bindingOf, and its tip is paid to that seat's owner. (the src folders of launches A, B and C, searched on 15 October 2026)

House wallets

activity from these is labelled HOUSE in every count

Label Address Role
W1 0x871e507B6a70F858Ad4B414bddb77473630C366b Pays for every launch and paid action; the prize wallet; the team's depositor
H1 0x60CcC928eb8EEE1d64CA0164565BfA9858669560 Hot key for the runner and keeper bots; holds a small float only

Machine-readable: /judges.json · /judges.md · /llms.txt · /llms-full.txt · /api/v1 · /api/v1/integration · /api/v1/evidence · /openapi.json · /api/v1/deployments · /api/v1/status · /sitemap.xml