{
  "findings": [
    {
      "severity": "P1",
      "confidence": 0.99,
      "path_symbol": "adapter/omp-spt.toml `[env]`, `[history].fetcher`, `[digest].extractor`, `[session.echo_commune]`, `[session.psyche_init]`, `[session.psyche_resume]`; tools/omp-spt/src/digest_omp.rs `SessionEnv::sessions_root`; tools/omp-spt/src/{echo_commune_omp.rs,psyche_omp.rs} `run`; tools/omp-spt/src/launch_omp.rs `resolve_omp`",
      "impact": "The public spt-core contract does not preserve an endpoint's original ambient environment when history, digest, echo, or Psyche children spawn later. The manifest currently captures none of OMP_PROFILE, PI_PROFILE, PI_CONFIG_DIR, PI_CODING_AGENT_DIR, XDG_DATA_HOME, or OMP_SPT_OMP_BIN. Named/custom/XDG profile history and digest can locate-miss; echo/Psyche can start OMP with the daemon's default settings or credentials; an explicit executable override can disappear on daemon-driven turns.",
      "fix": "Declare the optional selectors as `[env.<VAR>] direction = \"read\"` using an unmistakable unset sentinel, pass captured fills through every later command, decode them without collapsing unset versus explicitly empty OMP_PROFILE, and explicitly set/remove them on nested OMP `Command`s. Include OMP_SPT_OMP_BIN. Test a nondefault/custom endpoint whose caller environment is cleared before history, digest, echo, and Psyche execution."
    },
    {
      "severity": "P1",
      "confidence": 0.99,
      "path_symbol": "tools/omp-spt/src/launch_omp.rs `is_oh_my_pi_version` / `probe_omp_binary`; README.md prerequisites/install; CHANGELOG.md 0.2.0 compatibility note",
      "impact": "No minimum compatible Oh My Pi release was ratified or accepted. The probe accepts any `omp/<digit…>` identity and README installation leaves any pre-existing OMP untouched, while the adapter depends on the extension lifecycle/API surface grounded only against OMP commit e8d0a93d. An older OMP can pass launch validation and then omit or change context replacement, cancellable switching, message delivery, or shutdown semantics.",
      "fix": "Establish the oldest tested OMP release containing the required public API, enforce that semantic-version floor in the shared executable probe for native and daemon-driven roles, document the upgrade/recovery command, and add below-floor, exact-floor, newer, and prerelease tests."
    },
    {
      "severity": "P1",
      "confidence": 1,
      "path_symbol": "adapter/strings/omp-spt.mjs `teardownSession`, `failPending`, and `pi.on(\"session_shutdown\", …)`",
      "impact": "Public OMP 16.5.2 hard-caps `session_shutdown` handlers at 2,000 ms and describes them as fire-and-forget. Current teardown can spend 250/1000/4000 ms outcome backoffs per accepted item plus 250/1000 ms session-end backoffs and unbounded CLI duration. OMP can proceed with process exit before correlated failures and session-end complete, losing accepted custody or leaving a stale perch.",
      "fix": "Give every spawned CLI operation a kill/reap deadline and enforce one shared shutdown budget strictly below OMP's 2-second cap; make shutdown retries/queue handling fit that budget and retain a bounded fallback when ordinary lifecycle work is already in flight. Add a test using the real 2-second cap with delayed/failing queued outcomes and assert handler completion, child reaping, and terminal session state."
    }
  ],
  "resolved_or_retracted": [
    "Retracted the untracked tools/omp-spt crate blocker after explicit release staging was confirmed.",
    "Cargo.toml/Cargo.lock 0.2.0 skew was fixed.",
    "OMP profile normalization and XDG session-root resolution were fixed with focused tests.",
    "Release acquisition tag/version preflight, platform archive validation, and gate documentation were being handled by ReleasePipelineFix and were not repeated as open findings."
  ]
}