Codex live projector: a workspaces turn-metadata header preempts the rollout session_meta.cwd, turning a correct .hypignore drop into a record

[philcunliffe]

Codex live projector: a workspaces turn-metadata header preempts the rollout session_meta.cwd, so adding one turns a correct .hypignore drop into a record

Found in PR #477's round-1 review (finding F1, decision D1) and re-confirmed by
execution in round 2. Pre-existing on master: PR #477 neither creates nor
widens it. Filed so it does not live only in an LLP paragraph.

The defect

hypaware-core/plugins-workspace/codex/src/exchange-projector.js:130-131:

const cwd = firstString(codexContext?.cwd, readRecordedCwd(reqBody))
  ?? (codexContext?.session_id ? rolloutCwd?.resolve(codexContext.session_id) : undefined)

resolveCodexContext folds the selected workspaces key into
codexContext.cwd (:723) before this expression runs, so a present
workspace key satisfies the left side of the ?? and the rollout is never
consulted. When no key matches the request's cwd, selectCodexWorkspace
(:797) substitutes workspacePaths[0], a guess. So on the
ChatGPT-subscription route, the exact route LLP 0083's rollout fallback exists
for, a first-key guess outranks the authoritative session_meta.cwd that Codex
itself wrote at session start.

Verified by execution

Real projector, real shared matcher, one governing .hypignore of class
ignore at /work/ignored, an injected rolloutCwd whose resolve counts its
calls, session_id present so the fallback is genuinely eligible:

#	workspaces	in-band cwd	rollout session_meta.cwd	verdict	rollout consulted
1	{/work/clean/proj}	none	/work/ignored/real	RECORDED cwd=/work/clean/proj	false
2	none	none	/work/ignored/real	DROP	true

Rows 1 and 2 differ in nothing but the presence of a workspaces header.
Adding one to an otherwise correctly-dropped exchange turns the drop into a
record, and stamps the row with a directory from an unrelated tree.

Byte-identical on origin/master (1555f13), on PR #477's head (0db67e1), and
on the two merged. That is the confirmation that it is pre-existing: PR #477
fixes the case where the request states an explicit cwd, and this is the one
remaining door, where it states none.

The fix, as far as round 1 worked it out

Rank the guess below the rollout, so the order becomes in-band, rollout,
key:

• :723 becomes cwd: inBandCwd (drop the firstString(..., workspace?.path)).
• Add a sibling workspace_cwd: workspace?.path so the key is still carried.
• Add a third ?? codexContext?.workspace_cwd term to the gate expression.

The workspace key must keep supplying a cwd when there is no rollout either,
or the subscription route loses .hypignore coverage outright: the existing test
"the workspace key still supplies the gate cwd when the request states none
(#476)" pins that and must stay green.

Sequencing

The defect is on master and fixable there, so this is not blocked. But
:723 and :130-131 are the exact lines PR #477 rewrites, PR #474 also
rewrites, and PR #462 touches, so whoever takes this should sequence after those
land rather than open a fourth concurrent edit of the same expression. Also
relevant: #479 (the matcher never canonicalizes) is why pathsEqual misses
symlinked spellings in the first place.

Recorded as a stated limit in
llp/0083-codex-live-cwd-from-rollout.decision.md (PR #477, commit 0db67e1);
that paragraph should be trimmed if this is fixed.

[philcunliffe]

🤖 neutral: stuck on sequencing, not on the finding

The finding is real, reproduced, and on master. Neutral is declining to open a PR for it right now and recording why, rather than adding a fifth concurrent PR to a file that already has three pending.

The contention

The fix belongs in hypaware-core/plugins-workspace/codex/src/exchange-projector.js. That file is currently modified by three open PRs:

PR	State	Touches this file
#474	triage, mergeable, awaiting a human	yes, the usableInBandCwd seam
#477	triage, mergeable, awaiting a human	yes, the workspace-key/gate seam, which is exactly where this fix goes
#462	neutral:stuck, awaiting a human decision	yes

#477 in particular has been deliberately kept to a 32-line projector diff across four hunks, twice, specifically so that merging it would not force conflict resolutions that strip the other PRs' reviewed state. Opening a fourth PR into the same seam would undo that care: every conflict moves a head SHA, which strips neutral:approved by design (LLP 0030) and re-opens merge-base, CI, two review rounds and triage on the PR that lost it. This tick alone, #474 and #477 each had to be re-driven after merges knocked them down.

Trading that for a narrow pre-existing leak is the wrong order of operations, so neutral is not making the trade unilaterally.

The finding, so it is not lost

With no in-band cwd, adding a workspaces turn-metadata header to an exchange that would otherwise be correctly dropped turns the drop into a record, because the workspace key preempts the rollout's session_meta.cwd. Verified with a call-counting rolloutCwd stub: rollout_consulted=false, byte-identically on origin/master, on 0db67e18, and on the merge, so it is pre-existing and not a regression from #477.

This is the widest remaining case of the family issue #476 opened, and per PR #477's review it is the ChatGPT-subscription route that LLP 0083 exists to serve. The exact patch is written out in #477's round-1 review record as decision D1.

How this unsticks

Merge or dispose of #474 and #477. Then drop the neutral:stuck label here, or reply, and neutral will open the fix against a quiet file on its next tick. If you would rather have it now and accept the churn, say so and it will go ahead.

Related

• Codex live projector: the workspace-key substitution can feed the .hypignore gate a directory the session never ran in #476 (the parent finding), Usage-policy matcher never canonicalizes: a symlinked spelling of an ignored directory escapes its .hypignore (all adapters, hyp purge, query visibility) #479 (the shared-matcher canonicalization leak, being fixed now against master in a different file), PR Codex live projector: an explicit cwd outranks a substituted workspace key at the .hypignore gate #477 (review record D1), PR Codex live projector: an unusable in-band cwd is a miss, not a path (#471) #474, PR Codex rollout cwd keys on the thread, not the session container (#459) #462

[philcunliffe]

#474 and #477 are both merged now, so the contention you were waiting on is cleared. Go ahead and open the fix on your next tick, per the patch worked out in #477's round-1 review (D1): rank the workspace-key guess below the rollout, order in-band > rollout > key, keeping the key as the gate cwd when there is no rollout so the subscription route keeps .hypignore coverage. I accept the possible rebase churn on #462; do not wait for it. Trim the stated-limit paragraph in LLP 0083 as part of the fix.