Follow-up: deferred review findings from PR #518

[philcunliffe]

Deferred, non-blocking findings from the review/triage history on #518
(Codex cwd resolution: a rollout with no thread id must count toward ambiguity, not vanish before the count (#499)), head a37805b. Triage
re-verified the residual and classifies it non-blocking. Recording here so
it isn't lost. Backlink: #518.

1. codex/skills/hypaware-privacy/SKILL.md:72 still carries the pre-count filter - the divergence is real on merge, but it is #435's file

hypaware-core/plugins-workspace/codex/skills/hypaware-privacy/SKILL.md:72:

if payload.get('cwd') != cwd or not payload.get('id'):
    continue

still drops an id-less session_meta header before the script's own
len(matches) > 1 count. #518 fixes the identical bug on the CLI side
(readRolloutMeta no longer discards such a header before the cwd-scan
count), so on merge the two surfaces diverge on the two-rollout fixture:

SCRIPT: resolves and POSTs session_id = C2 (the survivor)
CLI:    {"ok":false,"error":"... 2 Codex rollouts record cwd /repo/here -
         no thread id (rollout-...-a.jsonl), THREAD-B (rollout-...-b.jsonl) ..."}

That is a privacy-relevant false confirmation on the script path: hyp session ignore's skill wrapper opts out one of two indistinguishable
sessions and reports success. It is not new behaviour introduced by #518 -
the script's filter is byte-identical to origin/master (git diff origin/master...a37805b --stat -- plugins-workspace/codex/skills/ is
empty, re-verified in this triage) - it is the previously-matching CLI bug
being fixed out from under it, which turns two surfaces that were wrong
together into one that is right and one that is not.

Already tracked and owned. #435 ("Collapse the session opt-out skills
onto hyp session and update LLP 0066/0067") owns this file and retires
the script onto the verb rather than repairing the filter in place; it is
OPEN and already carries a marker-signed <!-- neutral-cross-ref -->
comment (posted during #518's review) naming this exact fixture, both
surfaces' outputs, and the LLP 0067 doc fix (a6f0112) that records the
skill body as the rule's one exception. #518's own diff under
plugins-workspace/codex/skills/ is empty - two review rounds confirmed it

• so rewriting the filter was correctly treated as out of Codex cwd resolution: a rollout with no thread id must count toward ambiguity, not vanish before the count (#499) #518's scope; a
  reviewer doing so unilaterally on a privacy skill mid-retirement would have
  been a bigger scope excursion than the one Codex cwd resolution: a rollout with no thread id must count toward ambiguity, not vanish before the count (#499) #518 already asked a maintainer
  to bless.

No action requested on #435's scope or priority. This entry exists so the
gap this PR's merge makes live is on record from #518's own review trail
too, not only on #435.

[philcunliffe]

🤖 neutral: stuck - this one is actionable on master, and that is exactly why it needs you

Unlike its sibling follow-ups (#532, #533, #535, all blocked until their parent PRs merge), this issue's subject code IS on master: hypaware-core/plugins-workspace/codex/skills/hypaware-privacy/SKILL.md:72 carries if payload.get('cwd') != cwd or not payload.get('id'): today.

So a worker could change it. Neutral did not dispatch one, because changing it would override a decision you have already made twice.

The situation. PR #518 (held, approved) fixes a genuine fail-open in the CLI: readRolloutMeta conflated "not a session_meta header" with "a header stating cwd + container but no payload.id", so the cwd-scan count silently lost evidence and hyp session ignore could opt out one of two indistinguishable sessions while printing success. The skill script above carries the identical pre-count filter and is untouched by that PR (its diff under plugins-workspace/codex/skills/ is empty).

On merge, the two surfaces diverge: the CLI refuses as ambiguous, the script resolves and POSTs. That is a privacy-relevant false confirmation - the user is told the right session was opted out when it may not have been.

Why neutral will not just fix it:

• That filter has been declined twice, deliberately, per the review history on Codex session identity is the rollout's session container, not CODEX_THREAD_ID, and the ignore caveat names the fork (#452, #455) #456 and Follow-up: deferred review findings from PR #456 #499.
• Issue Collapse the session opt-out skills onto hyp session and update LLP 0066/0067 (blocked by #432) #435 owns this file and retires the script entirely by collapsing the opt-out skills onto hyp session. It is OPEN and already carries a marker-signed cross-reference to this exact divergence.
• The divergence is not introduced by Codex cwd resolution: a rollout with no thread id must count toward ambiguity, not vanish before the count (#499) #518's code. The script's behaviour is byte-identical to master before and after; Codex cwd resolution: a rollout with no thread id must count toward ambiguity, not vanish before the count (#499) #518 fixes the CLI out from under a script bug that predates it and survives either way. Blocking Codex cwd resolution: a rollout with no thread id must count toward ambiguity, not vanish before the count (#499) #518 on it would hold a correct fix hostage to an older, separately-owned one.

What it needs from you - pick one:

• (a) Land the script fix now, mirroring the CLI's new counting rule into SKILL.md:72, accepting that it contradicts the two prior declines and will be thrown away when Collapse the session opt-out skills onto hyp session and update LLP 0066/0067 (blocked by #432) #435 lands. Say so and neutral will do it on the next tick.
• (b) Prioritise Collapse the session opt-out skills onto hyp session and update LLP 0066/0067 (blocked by #432) #435 (currently marked blocked by Session opt-out fails open and cannot be checked: restart and session-resume both silently resume recording; add hyp session ignore/unignore/status #432), which removes the independent resolver and makes the divergence structurally impossible rather than patched.
• (c) Accept the window knowingly: merge Codex cwd resolution: a rollout with no thread id must count toward ambiguity, not vanish before the count (#499) #518, leave the script as-is, and let Collapse the session opt-out skills onto hyp session and update LLP 0066/0067 (blocked by #432) #435 close the gap on its own schedule - recording here that the divergence is understood and time-boxed.

Neutral's read is that (b) or (c) is more consistent with the decisions already on record, but the risk is a privacy-relevant false confirmation, so the trade-off is yours rather than a worker's.

How to unstick: reply on this thread; neutral monitors it and will re-engage with your guidance on its next tick.