[betterthanclay]

Qualify the separate oh-my-pi.rpc route through 18.13.2 on its existing oh-my-pi.rpc-v2-v18.0.0 behavior revision (Research 461). The frozen published hops after 18.12.6 are 18.13.0, 18.13.1 and 18.13.2. 18.13.3 remains UnverifiedNewer with an owned follow-up.

The claim, AllowUnverified posture, deprecated 17.x segment, explicit gaps and frozen 17.2.9 decoder corpus are preserved. Selected fourteen commands, tool schemas, frame caps, resource schemes and startup fields remain unchanged; the five new RPC commands are unselected, optional input.secret and cost_cap stay unmapped. Pi RPC and SDK-sidecar axes remain separate.

The final canonical-main integration preserves the accepted Oh My Pi package, fixture, guide and Research 461 bytes. Shared CHANGELOG/research-index conflicts were resolved additively without dropping canonical records. Owner revision recording and independent review use the normal Queue path; historical approval was not substituted for this new head.

Independent final-head review 5695116608 passes all four subjects at d24e79a03a18bba287879399bc9890d6312606bd. Covering Effigy proof passes: 74/74 package tests including the new identity module, clippy, compile, format, docs/routes, retired-concepts and routing. Exact-head hosted CI 40844289798 passes ten jobs. The PR-skipped MSRV tests are not release proof. The maintained family selector coverage observation is tracked in existing follow-up aa1a75f6-b394-47d4-adff-2cbb41bf3d2e.

No downloaded vendor executable, provider turn, credentials, installation, consumer change or release/tag is included.

[inflatable-tester]

Independent review — exact head c856a06

All four requested verdicts pass. Findings: none blocking; observations below.

Artifact provenance (verified myself, not the author's booleans)

I retrieved the official npm metadata and tarballs for 18.12.6, 18.13.0, 18.13.1, 18.13.2 into a fresh mktemp dir. No install and no execution of any vendor artifact.

• Tarball sha256/size: 8088b050…/15233742, 7bf2a37a…/15360451, 186ffca3…/15371443, 0a2e716d…/15513557 — all match identity.json.
• Registry per version: dist.integrity, shasum, unpackedSize (49180942/49567275/49599489/50022292), fileCount (3342/3352/3352/3366), gitHead null, dist-tag latest, engines bun >=1.3.14, bin omp→dist/cli.js, main ./src/index.ts, type module, 11 version-locked @oh-my-pi/* deps — all match.
• Recomputed the tree digest (sorted path, NUL, lowercase file sha256, LF) over every extracted file: 13057a74…, 54e8b4c0…, 38b009f9…, ffd81f9f… — equal to fixture tree_sha256, and 18.12.6 equals Research 447's digest.
• Recomputed per-hop deltas: 18.12.6→18.13.0 added 14 / removed 4 / changed 297; 18.13.0→18.13.1 3/3/30; 18.13.1→18.13.2 15/1/214 — identical to every tree_delta.
• All 73 classified entries check out against the real trees (change kind plus before/after digests). The 49-path classified union equals selected_source_file_union, and every path in the Research 447 union that changed in this window is classified — no dropped selected path.
• dist/cli.js (sha256 and byte size) and package.json sha256 match per hop. GitHub tag commits match (v18.13.0 011ab732…, v18.13.1 0838d2ab…, v18.13.2 e996e1c7…). The fixture sha256 constants in the test equal the actual fixture bytes.

Selected behaviour (vendor source read, never executed)

• case "..." set in src/modes/rpc/rpc-mode.ts: 67/67/67/72. Additions are exactly abort_branch_summary, dictation_start, dictation_stop, navigate_tree, set_label; no removals; the selected 14 handlers keep id/command/success/data.
• Selected tool input schemas unchanged in source: readSchema, searchSchema (grep), findSchema (glob), askSchema + QuestionItem; src/tools/todo.ts is byte-identical 18.12.6→18.13.2.
• get_state: isRpcSessionSettled → isSessionSettled; predicate bodies are identical (streaming, admitted, queued, pending async work, scheduledTurn); startup fields unchanged.
• 18.13.2 reads stdin before initializeExtensions, holds non-dialog frames (dialog answers and set_ask_dialog answered immediately), emits ready (protocolVersion 1, supported [1,2], 1 MiB / 64 MiB caps) before the hold, then dispatches held frames in order. The adapter has no command timeout and waits on ready, so this cannot produce a spurious startup failure.
• Decoder tolerance: adapter decode paths read only mapped fields; unknown records fall through bounded_namespace to Unknown; PromptError.code and input.secret are ignored (ui.rs keeps Text{secret:false}). The new optional vendor fields cannot break the qualified decode.
• Cost cap: session.maxCost defaults undefined and --max-cost is unselected; a host-settings default could still trip cost_cap, which arrives on the already-mapped generic prompt-error path, so no mapping change is needed.
• ask: noteOption appears only in model-facing result text; QuestionItem/askSchema unchanged.
• --approval-mode value list is identical, still accepting always-ask (selected) with always-ask-cached as an extra. The internal-url scheme registry is byte-identical: same 20 names, mr→MrProtocolHandler, mcp is the resource fallback. enableMCP = !restrictToolNames && (enableMCP ?? true); --no-extensions maps to disableExtensionDiscovery and --tools to toolNames only, so MCP stays enabled and /mcp reauth remains reachable-unmapped.
• Adapter launch argv and frame caps equal the fixture (--tools read,grep,glob,todo,ask, --no-extensions, --approval-mode always-ask; 1 MiB / 64 MiB).

Prepared boundary

Only the exported ceiling in src/selection.rs changed. No adapter mapping, descriptor, prepared profile, public operation, capability, resource, or lifecycle edit. The binding helper, the retained 17.2.9..=17.4.2 segment, the four GitHub-only gaps, 17.4.3/17.4.4 incompatibles, AllowUnverified, and the frozen 17.2.9 decoder corpus are unchanged and asserted; Pi axes are untouched.

Claim and docs surface

CHANGELOG Unreleased, prepared guide, route matrix (route and lifecycle rows), feature-matrix CSV, architecture, Research 461, and the research index all state 18.0.0..=18.13.2 with 18.13.3 UnverifiedNewer consistently. No stale 18.12.6 ceiling remains outside historical research and the 18.12.6 fixture.

Covering checks (once each, foreground, Effigy selectors)

• effigy validate:focused swallowtail-adapter-oh-my-pi — exit 0. nextest: 74 tests run, 74 passed, 0 skipped across 13 binaries (601 s), then clippy --all-targets -D warnings clean. The count reconciles exactly (lib 11 + 12 non-feature test binaries; live_installed_probe needs live-probes), so the new oh_my_pi_18_13_2_identity module executed its one test.
• effigy check:current-oh-my-pi-rpc — exit 0.
• effigy format:package swallowtail-adapter-oh-my-pi — exit 0; git status --porcelain empty afterwards.
• effigy qa:docs — exit 0.
• effigy qa:routes — exit 0 (42 solution rows, 39 features, 740 unavailable cells, 6 producer gaps; 89 operations / 51 production routes; v0.5.4 and v0.6.0 ledger boundaries).
• effigy skill run northstar/retired-concepts — exit 0 (4 retired concepts).
• validate:oxide-routing not required: effigy.toml and selectors are unchanged at this head.

No vendor artifact was executed. omp and bun are installed on this review host (the fixture records them absent on the authoring host at 09:40Z); I did not run them.

Observations (non-blocking)

1. effigy.toml:260 validate:current-oh-my-pi-rpc enumerates the family's identity test targets but omits the new --test oh_my_pi_18_13_2_identity; Research 447's identity was added there (commit 9884fad). This review's covering proof came from validate:focused autodiscovery, so this is a selector-maintenance papercut, not a blocker; a small follow-up should list the new target.
2. src/internal-urls/ssh-protocol.ts at 18.13.2 also adds a /~ HOME-relative path form and structured remote-directory traversal. It stays exec tier and is reachable only through ambient read; no new scheme or Swallowtail operation, so the fixture's authority claim holds. The hop-ledger note for that file could name the new form.
3. Pre-existing, not introduced here: Contract 029's "Oh My Pi Mapping" still says the window "currently extends through exact 17.4.0". It was already stale at the base commit; the current-truth surfaces are correct at this head.
4. Planner note (version-currentness, No Terminal Stop): npm latest and GitHub latest stable are now 18.13.3 (npm 2026-10-28T13:06:36.512Z, GitHub 12:49:52Z), published after this record's 09:40Z observation. Contract 029 In-Run Latest Movement keeps a post-identity-commit move as UnverifiedNewer, so 18.13.3 correctly stays unqualified here and the claim must not reopen in this PR; the next one-family run should qualify 18.13.3.
5. Integration state: hosted CI at this exact head is green on 10 checks; "Pinned MSRV floor tests" is skipped by policy and is not release proof. The PR is non-draft at the expected head, mergeable: CONFLICTING only on the shared CHANGELOG/research-index sections after PR #525 landed. Merge hold, serialized shared-file integration, and owner disposition remain.

Result: ready_to_merge with the owner merge hold in place.

Review verdicts

ID	Subject	Verdict	Evidence	Note
artifact-provenance	Exact official stable identities, published hops, complete tree inventories and mutation-sensitive per-file classification	pass	Re-derived from official npm tarballs for 18.12.6/18.13.0/18.13.1/18.13.2: tarball sha256 and sizes, registry integrity/shasum/fileCount/unpackedSize/gitHead/dist-tag, dist/cli.js and package.json digests, recomputed tree digests (13057a74…, 54e8b4c0…, 38b009f9…, ffd81f9f…) and exact per-hop added/removed/changed path sets; all match identity.json, complete-tree-inventory.json and hop-ledger.json; all 73 classified entries verified against real trees with no selected path omitted; GitHub tag commits match.
selected-behaviour	Selected 14 commands, tool schemas, frame caps, startup/ready semantics, stdin hold, unmapped additions bounded by reachability	pass	Vendor source read (not executed): rpc-mode case set 67/67/67/72 with exactly the five documented additions; read/grep/glob/ask schemas and byte-identical todo.ts unchanged; get_state predicate identical after the rename with unchanged startup fields; ready emitted before the extension-init stdin hold with held frames dispatched in order; adapter decoders ignore PromptError.code and input.secret and map unknown records to Unknown, so unmapped additions cannot break the qualified path; cost cap inert by default (settings default undefined, --max-cost unselected); approval-mode list, 20-scheme registry, enableMCP semantics and reachable-unmapped /mcp reauth unchanged.
prepared-boundary	Prepared/profile boundary, claim posture and public authority unchanged	pass	Only the exported ceiling constant changed in src/selection.rs; no mapping, descriptor, prepared profile, public operation, capability, resource or lifecycle edit. Retained 17.2.9..=17.4.2 segment, four GitHub-only gaps, 17.4.3/17.4.4 incompatibles, AllowUnverified, claim id and frozen 17.2.9 decoder corpus unchanged and asserted; prepared-facade test covers 18.13.2 preparation and 18.13.3 UnverifiedNewer; Pi axes untouched.
covering-checks	Brief-named covering Effigy selectors run once at this head, including execution of the new identity module	pass	validate:focused swallowtail-adapter-oh-my-pi exit 0 (74/74 nextest across 13 binaries, 0 skipped, clippy -D warnings clean; count reconciles to include the new 18.13.2 identity module); check:current-oh-my-pi-rpc exit 0; format:package exit 0 with clean tracked tree; qa:docs exit 0; qa:routes exit 0; northstar/retired-concepts exit 0; validate:oxide-routing not applicable (no selector change). Hosted CI green at this head on 10 checks.

[inflatable-tester]

Independent review — exact head 17246b1

Owner mechanical integration revision: merge of current main 3e5f1f84 into PR528. All four requested verdicts pass. No blocking findings; three non-blocking observations at the end.

Integration-delta integrity (this re-review's actual subject)

Merge parents c856a06a9 (PR528 reviewed head) + 3e5f1f84 (main); merge base 72620fa48.

• git diff --name-only c856a06a9 17246b128 and git diff --name-only 72620fa48 3e5f1f84 are set-equal in both directions (30 files, all claude-agent.acp 0.98.0 work plus shared docs). Every main-owned artefact is therefore byte-identical to 3e5f1f84; nothing of main was altered by conflict resolution.
• The converse holds: git diff --name-only 3e5f1f84 17246b128 is exactly PR528's 20-file payload, all under crates/swallowtail-adapter-oh-my-pi, docs/research/461*, the oh-my-pi guide, or the shared docs.
• The reviewed Oh My Pi inputs are byte-identical, not merely "same version": adapter tree efc9d9c5b075d55d64216fa4c71f587efe6862b9, Research 461 blob 24925f6a92165626aa514038cc855309b7fa3c6e, prepared-integration guide blob b03553f7f03806f396e23fc98a384e69bd992d4b at both heads. Oh My Pi rows in provider-route-matrix.md, provider-solution-feature-matrix.csv, system-architecture.md and the CHANGELOG entry are identical text at both heads (line offsets only).
• Research index was resolved additively: 461 inserted above 460, one line added, no record lost. qa:docs passes, including the research number checks; the duplicate lines for 219/328/343 are identical at the merge base and are not introduced here.
• Shared-doc delta read in full. CHANGELOG.md (0.96.0→0.98.0 claude-agent entry), docs/releases/currentness-minor-compatibility.md, 015-acp-v1/session-management contract rows, system-architecture.md, route matrix and feature CSV all carry main's claude-agent.acp content unchanged and keep the Oh My Pi rows intact. effigy.toml's only change here is main's validate:current-claude-agent-acp 0.98.0 filter.

Artifact provenance

Reused the authentic immutable evidence rather than re-downloading, after proving the inputs equal (above). I re-checked the evidence is self-verifying, not a boolean ledger: official_18_13_2_identity_and_every_published_hop_are_frozen pins SHA-256 of all four fixture files (my computed digests match its constants: identity e6c6dbee…, protocol 80a47a3c…, inventory 85ee5a5d…, hop ledger 4579b94b…), recomputes each of the four tree digests from the path→SHA-256 inventory (13057a74…, 54e8b4c0…, 38b009f9…, ffd81f9f…), recomputes every added/removed/changed path per hop and asserts it against the ledger, checks 73 classified version/path records over 49 paths, and checks the case set 67/67/67/72 with exactly abort_branch_summary, dictation_start, dictation_stop, navigate_tree, set_label as the window additions. File counts 3342/3352/3352/3366, gitHead null on every hop (npm tarball is the authority, GitHub tags corroborate), claim_at_observation correctly records the pre-change 18.0.0..=18.12.6 ceiling. Gaps 18.0.2/18.1.7/18.4.7/18.6.2 and 17.4.3/17.4.4 assess Incompatible; 18.13.3 UnverifiedNewer; 18.13.3-rc.1/18.12.7-rc.1 not permitted; 18.12.7 falls inside the continuous range with the Research 461 rationale, not a silent gap fill.

Selected behaviour

Only the ceiling constant and its doc comment moved in src/selection.rs (18.12.6→18.13.2); claim id, AllowUnverified, both segments, behavior revisions and the four gaps are untouched. Source spot-checks at this head, not the author's prose: frame caps are MAXIMUM_RECORD_BYTES = 1 MiB / MAXIMUM_REASSEMBLED_BYTES = 64 MiB (protocol/wire.rs:10-11); protocol.json selected argv contains --no-extensions and no --max-cost; dialog decoding reads only id/title/message/placeholder/prefill/options/timeout and ignores unknown input.secret, which maps to HarnessUserInputQuestionKind::Text { secret: false } (turn/ui.rs:68); PromptError.code is not decoded, so cost_cap is inert; /mcp reauth has no mapping; startup fields are the ten documented ones. Static reconciliation of executed coverage: 76 #[test] attributes in the package minus the 2 #[ignore] live probes = 74, matching the run below; the new identity module contributes exactly 1.

Prepared boundary

No mapping, descriptor, prepared profile, public operation, capability, resource or lifecycle edit; prepared-facade and lifecycle tests are inside the run below. The 17.2.9..=17.4.2 segment, incompatibles, decoder corpus and Pi axes are unchanged and asserted; nothing in the merge widens public authority under the compatible-extension label.

Covering checks at this exact head (each run once, exit 0)

• effigy validate:focused swallowtail-adapter-oh-my-pi — 74 tests run / 74 passed / 0 skipped across 13 binaries, clippy --all-targets -D warnings clean.
• effigy test -- -p swallowtail-adapter-oh-my-pi --test oh_my_pi_18_13_2_identity --status-level pass --final-status-level all — PASS … oh_my_pi_18_13_2_identity official_18_13_2_identity_and_every_published_hop_are_frozen, 1 test, 0 skipped. This is the positive executed-count evidence for the newly added module (autodiscovered integration target, no manifest change).
• effigy check:current-oh-my-pi-rpc — 0 (all targets compile).
• effigy format:package swallowtail-adapter-oh-my-pi — 0; tracked tree remained clean afterwards.
• effigy qa:docs — 0.
• effigy qa:routes — 0 (route, feature, activity and ledger checks passed).
• effigy skill run northstar/retired-concepts — 0.
• effigy validate:oxide-routing — 0; run because the merge imports main's claude-agent selector edit into effigy.toml.
• Hosted CI at this exact head: format/lint, both nextest shards, process-spawning nextest, examples/metadata/routes, docs+semantic API, research numbers and the MSRV floor all SUCCESS. "Pinned MSRV floor tests" is SKIPPED by PR configuration, consistent with the standing note that PR-skipped MSRV tests are not release proof; no release is part of this task.

Verdict provenance

The earlier approval 5688045277 at c856a06a9 remains history, not approval of this head. No worker-published value cites that review id, so there is no cited-record equality row to check. The verdicts below are freshly judged from current-head evidence.

Non-blocking observations

1. validate:current-oh-my-pi-rpc still lists the 18.8.3/18.12.6/18.2.7/package identity binaries but not oh_my_pi_18_13_2_identity; PR447's equivalent module received a dedicated follow-up (9884fad). Coverage here is complete because the brief's covering selector is validate:focused (whole package, all targets) and hosted CI runs workspace nextest — so this is not requested as a change, but the one-line target+binary addition belongs in the 18.13.3 lane (lead aa1a75f6) so the family selector keeps exercising the frozen digests.
2. Unreleased CHANGELOG keeps the Research 447 (18.12.6) entry beside the new 461 entry, and inside the same unreleased section the older line still says "18.12.7 is UnverifiedNewer", now superseded. Historical milestone entry; the owner serialises CHANGELOG at release integration. Flagged so the 18.13.3 work does not read that sentence as current truth.
3. Merge state verified clean: no stash use, no worktree mutation, tracked tree clean at the reviewed head.

No provider, artifact, credential, install, live-session or host-mutation action was taken; all evidence above is source, fixture and local test execution.

Review verdicts

ID	Subject	Verdict	Evidence	Note
artifact-provenance	Exact official stable identities, published hops, complete tree inventories and mutation-sensitive per-file classification	pass	Reviewed inputs proven byte-identical to the previously verified head (adapter tree efc9d9c5…, Research 461 blob 24925f6a…), so the authentic npm tarball/tree evidence is reused rather than repeated. The evidence is self-verifying at this head: fixture SHA-256 self-pins match my computed digests, tree digests are recomputed from the four inventories (13057a74…/54e8b4c0…/38b009f9…/ffd81f9f…), every hop delta is recomputed against those trees, and 73 classified records over 49 paths are asserted. gitHead null on all hops, 67/67/67/72 case sets with the five documented additions, gaps and 17.4.3/17.4.4 incompatible, 18.13.3 UnverifiedNewer.
selected-behaviour	Selected 14 commands, tool schemas, frame caps, startup/ready semantics, stdin hold, unmapped additions bounded by reachability	pass	Adapter source unchanged versus the reviewed head. Independently spot-checked in current source: 1 MiB/64 MiB caps in protocol/wire.rs, selected argv with --no-extensions and no --max-cost, dialog decode ignoring input.secret and mapping text questions secret:false, PromptError.code undecoded so cost_cap stays inert, /mcp reauth unmapped, ten startup fields asserted. The single new-module test passes and the 74-test run reconciles to 76 #[test] attributes minus 2 ignored live probes.
prepared-boundary	Prepared/profile boundary, claim posture and public authority unchanged	pass	Only the OH_MY_PI_PACKAGE_LATEST_QUALIFIED_VERSION constant and its comment changed; claim id, AllowUnverified, both segments, both behavior revisions, the four unpublished gaps and the frozen decoder corpus are unchanged and asserted. No mapping, descriptor, prepared profile, public operation, capability, resource or lifecycle edit; prepared-facade and lifecycle suites ran in the covering selector; Pi axes untouched.
covering-checks	Brief-named covering Effigy selectors run once at this head, including execution of the new identity module	pass	validate:focused swallowtail-adapter-oh-my-pi exit 0 (74/74 tests, 0 skipped, 13 binaries, clippy -D warnings clean); dedicated execution of oh_my_pi_18_13_2_identity via effigy test showed PASS official_18_13_2_identity_and_every_published_hop_are_frozen 1/1; check:current-oh-my-pi-rpc 0; format:package 0 with clean tracked tree; qa:docs 0; qa:routes 0; northstar/retired-concepts 0; validate:oxide-routing 0 for the imported selector edit. Hosted CI green at this exact head.

[inflatable-tester]

Independent review — exact head d24e79a

Final additive canonical-main integration of PR528. I reviewed the exact current head, the complete 20-file proposal delta against canonical main 405b97cfa, its merge-conflict resolutions, the repository currentness contracts, and ran the brief's covering selectors myself at this head. No blocking findings. All four requested subjects pass.

Integration-delta integrity (verified myself)

• git diff 405b97cfa..HEAD (PR vs canonical main) is exactly 20 files, 798 insertions / 30 deletions — byte-for-byte the same stat as the already-accepted branch delta 3e5f1f84..17246b128. Every adapter source, test, fixture, guide and Research 461 blob at this head is identical (git blob SAME) to 17246b128; the merged tree is 513fccd4c8e626e2f8e24f4fe54570a186aabec6, matching the owner integration manifest.
• The five shared records that differ from 17246b128 (CHANGELOG.md, route matrix, feature CSV, system architecture, docs/research/README.md) differ only by canonical main's independent family entries. Every Oh-My-Pi line at this head is identical to 17246b128's line set (route matrix rows, feature-matrix row, architecture paragraph, Research 461 index entry), and the new Oh-My-Pi CHANGELOG entry hashes identically (sha256 ea25a29e…), appearing once. No main-side content was dropped.
• Owner proof directory …/pr528-final-integration-20261029/manifest.json records head, both parents, 20 proposal sha256 values, sourceEquality (adapter tree efc9d9c5… and Research 461 24925f6a… unchanged on both sides) and its four checks. I recomputed all 20 proposal-file sha256 values from HEAD: 20/20 match. The manifest is congruent with my own byte-equality proof; it is not treated as authority in place of it.
• This head authors no selector/guard change (effigy.toml at HEAD is canonical main's); validate:oxide-routing still passes.
• Worker-published values citing an earlier review ID: none. The PR body and manifest cite no review id, so the cited-record equality check has nothing to compare; my verdicts are fresh judgments at this head, reusing the authentic 5688846200 artifact evidence only where the reviewed identical bytes make that legitimate.

Artifact provenance (pass)

Independently recomputed at this head, not read from the author's booleans:

• Fixture self-pins match my SHA-256: identity e6c6dbee…, protocol 80a47a3c…, inventory 85ee5a5d…, hop-ledger 4579b94b….
• All four complete npm trees recompute: 18.12.6 3342 files → 13057a74…, 18.13.0 3352 → 54e8b4c0…, 18.13.1 3352 → 38b009f9…, 18.13.2 3366 → ffd81f9f… (tree digest over sorted path/NUL/lowercase digest/LF).
• Every hop delta recomputes against those trees and matches the ledger: 18.12.6→18.13.0 +14/−4/297 changed, 18.13.0→18.13.1 +3/−3/30, 18.13.1→18.13.2 +15/−1/214; 73 classified records over 49 paths equal the selected-source union; the five documented command additions are the only case-set addition, 67→67→67→72.
• gitHead null on every hop, npm tarball is the artifact authority, GitHub tags are corroboration; tarball/dist-cli digests, file counts, sizes, dependency lock-step and SLSA attestation are pinned in identity.json; 18.0.2/18.1.7/18.4.7/18.6.2 gaps and 17.4.3/17.4.4 stay excluded; 18.13.3 stays UnverifiedNewer; evidence controls record no execution/install/prompt/credential use. The selected-source classifications are per-file mutation-sensitive with real notes for each changed feeding surface (cost gate, flag table, RPC mode/wire, session settle, ask/read/grep/glob/todo, internal URLs), and the unclassified remainder is non-selected UI/ACP/eval/browser/tooling surface. This is a compatible extension of behavior revision oh-my-pi.rpc-v2-v18.0.0.

Selected behaviour (pass)

Adapter production source is unchanged by this PR: crates/swallowtail-adapter-oh-my-pi/src differs only in selection.rs's ceiling constant and its comments; no mapping, decoder, launch, callback or prepared code changed. Spot-checked in current source: physical record cap 1 MiB and reassembled cap 64 MiB (protocol/wire.rs); selected argv carries --mode rpc, the five tools, --no-extensions, --no-skills, --no-rules, --no-prewalk, --approval-mode always-ask, and no --max-cost (driver/launch.rs); input.secret is not decoded and Input/Editor map to Text { secret: false } (turn/ui.rs); no cost_cap/PromptError mapping exists so the optional cost gate stays inert; no /mcp reauth, reconnect or dictation symbol is sent or mapped; startup still requires the ten get_state fields with restrictive values (driver/startup.rs). The five new RPC arms are host-invoked and unselected, dictation frames cannot appear because Swallowtail never sends dictation_start, and 18.13.2's rename to isSessionSettled keeps the same predicate. 18.12.7 now falls inside the continuous range and is explicitly asserted as supported by the selection test and explained in Research 461; that is a mathematical consequence of a continuous ordered range for a never-published number, not a filled gap, while the real GitHub-only gaps stay excluded.

Prepared boundary (pass)

Only the adapter-private latest-qualified constant and comments moved. Claim id oh-my-pi.rpc.package-window-2, AllowUnverified, both segments (17.2.9..=17.4.2 deprecated, 18.0.0..=18.13.2 maintained), behavior revisions, the four unpublished gaps and the frozen oh-my-pi-rpc-17.2.9 decoder corpus are unchanged and asserted. The prepared-facade support table adds 18.13.2 on oh-my-pi.rpc-v2-v18.0.0 and the unverified-newer fixture point moves to 18.13.3; no descriptor, public operation, capability, resource, lifecycle, API or packaging change, and pi.rpc/pi.sdk-sidecar are untouched. Prepared-facade and lifecycle suites ran inside the covering package selector.

Covering checks at this exact head (pass, run once, completed)

• effigy validate:focused swallowtail-adapter-oh-my-pi — exit 0: 74/74 tests, 0 skipped, 13 binaries, then all-targets clippy -D warnings clean. The new oh_my_pi_18_13_2_identity module is autodiscovered; 76 #[test] attributes minus the 2 ignored live-probe tests = the 74 executed, and the 13 binaries are the 12 non-live integration targets plus the lib target, so the new identity module executed in this run.
• effigy check:current-oh-my-pi-rpc — exit 0 (all-targets, locked).
• effigy format:package swallowtail-adapter-oh-my-pi — exit 0; tracked tree stayed clean (git status empty).
• effigy qa:docs — exit 0; effigy qa:routes — exit 0 (42 solution rows, 740 unavailable cells, 6 producer gaps; 51 routes); effigy skill run northstar/retired-concepts — exit 0; effigy validate:oxide-routing — exit 0.
• Hosted CI run 40844289798 is green at this exact head (headRefOid d24e79a…, state CLEAN): format/lint, both nextest shards, process-spawning nextest, examples/metadata/routes, docs/API, research-number uniqueness, MSRV compile and dependency checks all SUCCESS. The "Pinned MSRV floor tests" job is SKIPPED, so it is not release proof; the owner merge hold and disposition remain real.

Non-blocking observations

1. The curated family selector validate:current-oh-my-pi-rpc still enumerates test binaries and does not list --test oh_my_pi_18_13_2_identity (nor the older oh_my_pi_18_1_22_identity). Package-wide selectors, CI and validate:focused do execute the new module, so this head's covering proof is intact, but adding the newest identity binary to that selector would keep future family-scoped runs from silently skipping the newest evidence.
2. protocol.json's internal_read_resource_boundary carries both target_18_12_6_schemes and target_18_13_2_schemes with identical values; harmless naming redundancy, and the test asserts equality against the baseline scheme set.
3. The author's PR prose reports a package:verify-affected path-substring false failure under /workspace; I did not reproduce it and did not require that selector, because this change moves no package archive, public API or MSRV.

Review verdicts

ID	Subject	Verdict	Evidence	Note
artifact-provenance	Exact official stable identities, published hops, complete tree inventories and mutation-sensitive per-file classification	pass	20/20 proposal sha256 recomputed from HEAD match the owner manifest; every proposal blob is identical to accepted 17246b1. Fixture self-pins (e6c6dbee/80a47a3c/85ee5a5d/4579b94b) and all four tree digests (13057a74/54e8b4c0/38b009f9/ffd81f9f over 3342/3352/3352/3366 files) recompute; hop deltas (+14/-4/297, +3/-3/30, +15/-1/214) match; 73 classified records over 49 paths equal the selected-source union; command cases 67→72 with the five documented additions; gitHead null, gaps preserved, 18.13.3 UnverifiedNewer, no artifact execution.
selected-behaviour	Selected 14 commands, tool schemas, frame caps, startup/ready semantics, stdin hold, unmapped additions bounded by reachability	pass	Adapter production source unchanged except selection.rs ceiling constant/comments. Verified in current source: 1 MiB/64 MiB caps, selected argv with --no-extensions and no --max-cost, input.secret dropped and Input/Editor mapped secret:false, no cost_cap/PromptError decode, no /mcp reauth or dictation mapping, ten startup fields with restrictive values, five new arms host-invoked and unselected. 18.12.7 interior membership is documented and is a continuous-range consequence, not a filled gap.
prepared-boundary	Prepared/profile boundary, claim posture and public authority unchanged	pass	Only the private latest-qualified constant and comments changed; claim id, AllowUnverified, both segments and behavior revisions, four gaps and frozen decoder corpus unchanged and asserted; prepared support extends the same 18.x revision to 18.13.2 and 18.13.3 stays unverified; no descriptor/API/operation/capability/resource/lifecycle edit; pi.rpc and pi.sdk-sidecar untouched; prepared-facade and lifecycle suites passed.
covering-checks	Brief-named covering Effigy selectors run once at this head, including execution of the new identity module	pass	validate:focused exit 0 (74/74, 0 skipped, 13 binaries incl. autodiscovered oh_my_pi_18_13_2_identity; 76 #[test] − 2 ignored live probes; clippy -D warnings clean); check:current-oh-my-pi-rpc 0; format:package 0 with clean tracked tree; qa:docs 0; qa:routes 0; retired-concepts 0; validate:oxide-routing 0. Hosted CI 40844289798 green at d24e79a; MSRV floor tests skipped and not release proof.