Session Analysis

Treat session data as sensitive by default. It can contain user prompts, model responses, tool inputs and outputs, workspace paths, source snippets, identifiers, secrets, personal data, and client-confidential material.

Read report pairs

Expect a JSON and a text report in the same output directory. Read both before drawing conclusions.

• Treat JSON as the structured source for counts, session records, score distributions, response states, indicator categories, parsing coverage, and report content-policy fields.
• Treat the text report as the human-readable companion. Use it to confirm report scope, collection context, headings, and narrative explanations.
• Reconcile material differences between the two outputs. Prefer the JSON for exact metrics, identify a report-generation inconsistency when the text conflicts with it, and do not silently combine mismatched runs.
• Avoid reproducing raw paths, titles, matched values, hashes, prompts, responses, or credential-like material from either format unless explicitly necessary and permitted.

Choose the source

Use an exported report whenever it answers the question. For example, Blacklight reports under a directory such as .../codex/ can provide session-level metadata and indicators without opening raw session data.

Inspect an actual .codex root only when the user explicitly authorizes that path and raw detail is necessary. Treat it as a higher-risk source: enumerate narrowly, inspect the minimum files needed, and avoid recursively reading or copying the root by default.