Lighten WATCHLIST skill and validation

[dd3ok]

Summary

• make schema v2 the only supported interface and remove v1/compatibility paths
• reduce the installable runtime bundle from seven files to four
• make unscoped records private by default at .watchlist/WATCHLIST.md
• consolidate runtime policy in SKILL.md and simplify validator/tests/docs
• tighten routing so generic reminders and unrelated task lifecycle requests do not invoke the skill
• make an existing file's timezone authoritative for relative calendar terms, item dates, and review buckets
• prevent validator fields from crossing a ## section boundary

Why

Compatibility layers, repeated reference documents, archive/automation policy, and duplicated semantic corpora made the package larger and introduced conflicting storage, routing, and time semantics. This change keeps the effective file workflow while applying YAGNI to unused policy and keeping privacy, safety, and deterministic validation explicit.

Validation

• python -B -m unittest discover -s evals -p 'test_*.py' — 45 passed
• template CLI validation and skill quick validation passed
• git diff --check passed
• local Markdown link and stale live-reference scans passed
• Codex CLI 0.147.0 runtime smoke passed D/E/B/R for bundle feb95262949498689ab4d3e4baec255489858ed061bb118abbe187f08e917584
• corpus IDs run: add-private-default, existing-timezone-authoritative, review-read-only, complete-user-reported, cross-target-duplicate-stop, unsupported-schema-stops-before-side-effects, negative-generic-reminder, negative-generic-lifecycle
• ad hoc runtime checks: discovery and explicit $watchlist-md invocation
• changed files passed validation; the read-only review hash stayed unchanged; stop cases left files and Git metadata unchanged
• no sandbox bypass was used and all disposable test/dependency folders were removed

The manual runtime corpus now contains 20 cases. The remaining 12 cases are pending and are not presented as complete.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b955dbee58

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Reject access-token assignments

When a watchlist contains a credential written as access_token: <value> or access-token=<value>, the new assignment pattern does not match it, so the validator reports success even though the security contract forbids storing tokens. The previous API_KEY_ASSIGNMENT pattern explicitly covered access[_-]?token; retain that alternative in the consolidated pattern to avoid allowing these secrets into validated files.

Useful? React with 👍 / 👎.