Local-only directory selection: enrollment picker + export-seam withholding (LLP 0069/0080/0081)

[philcunliffe]

Implements the local-only-dir-selection change set — LLP 0080 (design), LLP 0081 (plan); covers request LLP 0069 and decisions LLP 0070/0071/0072.

Lets a user mark directories as local-only — recorded locally but never forwarded to a central sink — via a login-time enrollment picker and a durable hyp ignore --local-only CLI, enforced at the export seam (drop-but-advance) so excluded rows stay locally queryable while never leaving the machine. Closes a real format-iceberg leak where captured directories could be forwarded before the user could withhold them.

Tasks (all merged, verified as real ancestors of the integration branch):

• T1 machine-local list store (src/core/usage-policy/local_only.js)
• T2 resolver gains the local-only list as a second source (most-restrictive wins)
• T3 export-seam enforcement — drop-but-advance (readRowsSince + sink/incremental consumers)
• T4 format-iceberg reroute off the filtered seam
• T5 enumeration + login-time picker (src/core/commands/local_only.js)
• T6 durable CLI authoring (hyp ignore/unignore --local-only, --check)
• T7 login wiring (picker before enrollCentralSink)
• T8hyp status surface (withholding count)
• T9 hermetic smoke local_only_export_withhold

Generated-by: neutral

Change-Set: local-only-dir-selection

[philcunliffe]

🔍 neutral review (Codex + 4 Claude lenses) — request_changes

Round 1, head 6fd00b1 (after the union-merge with #259). This is a thorough review of the whole 9-task change set — export-seam enforcement, resolver + list store, CLI/picker/login, and status/smoke/LLP — plus Codex as the independent family. The core holds: the privacy-critical drop-but-advance invariant was traced end-to-end (dropped payload never emitted; watermark advances past drops without re-send or stall; a failed forward chunk never checkpoints; a corrupt list fails the tick with the watermark untouched — fail-safe, not fail-open), the resolver's segment-aware matching is correct (/a/bc ≠ /a/b) with most-restrictive precedence and atomic list writes, the picker can't break enrollment (cancel persists nothing), the #259 union-merge is correct (deps seam fully unioned, order login → seed → picker → enroll → attach-wait, enrollCentralSink→enroll applied), and the hermetic smoke genuinely proves the invariant (not tautological). One substantive finding to fix before merge, plus one nit:

Major — readRowsSince({ columns }) can bypass the privacy filter (src/core/cache/storage.js)

The export seam decides withholding from row.cwd. If a caller passes a columns projection that omits cwd, the projected row has no cwd, the filter treats it as cwd-less, and a local-only row would be forwarded. No current in-repo export caller passes such a projection — central, incremental, and format-iceberg all omit columns, so cwd is present and withholding works (verified by all reviewers, so there's no active leak today). But readRowsSince's columns option is public, so the seam's privacy guarantee is conditional on every present and future caller (in-repo or external plugin) remembering to include cwd. For a control meant to be the guaranteed choke point (LLP 0070), that conditionality is a real robustness hole.
Fix: when a usagePolicyResolver is configured, force cwd into the internal scan projection regardless of the caller's columns, evaluate the policy before yielding, then omit cwd from the yielded row if the caller did not request it — so withholding is unconditional. Add a regression test: readRowsSince({ columns: ['id'] }) over a local-only row is still dropped.
(Codex rated this a blocker; downgraded to major here because no current caller triggers it — but it's a privacy seam, so it's fixed rather than deferred.)

Nit — inline import('...') type (test/core/local-only-command.test.js:151)

@param {import('node:stream').PassThrough} stdin violates CLAUDE.md's no-inline-import-types rule; the file already value-imports PassThrough (bare name in scope). CI won't catch it. Use @param {PassThrough}.

Verdict: request_changes — neutral is applying both fixes and will re-review the new head (round 2).

Automated neutral review (Codex = independent second family; 4 parallel Claude review lenses).

[philcunliffe]

🔍 neutral review round 2 — approve · ready for merge

Round-1 findings fixed and verified on head e463998:

• Major (a columns projection could bypass the privacy filter) ✓ — readRowsSince now forces cwd into the internal scan whenever a usage-policy resolver is configured, evaluates the policy, then strips cwd from the yielded row if the caller's columns didn't ask for it. Withholding is now unconditional — it no longer rides on callers remembering to include cwd. The default (no-columns) path is byte-unchanged; the drop branch and corrupt-list throw are preserved. New regression test: readRowsSince({ columns: ['id'] }) over a local-only row still drops.
• Nit ✓ — the inline import('...') type is now the bare name.

Also merged up to current master (which landed #256/#266/#271/#273): the only conflict was the clients.jsimport block, unioned so #271's manual-attach disk-probe and #270's local-only CLI coexist (independent functions). Both suites green — attach 5/5, local-only 73/73; full run 2086 pass / 0 fail. CI green, mergeable.

Verdict: approve. Review rounds complete (N=2). Flipping to ready and holding for a human to merge — neutral does not merge.

Automated neutral review.