Integrate code intelligence v2 and runtime fixes

.gitignore

@@ -56,6 +56,7 @@ dmypy.json
 .cache/
 .worktrees/
 .coding-ethos/cache/
+.coding-ethos/code-intel-v2/
 .coding-ethos/code-intel.db
 .coding-ethos/code-intel.db-shm
 .coding-ethos/code-intel.db-wal
@@ -70,6 +71,7 @@ dmypy.json
 .coding-ethos/ci-artifact-*/
 .coding-ethos/tmp-ci-audit/
 **/.coding-ethos/cache/
+**/.coding-ethos/code-intel-v2/
 **/.coding-ethos/code-intel.db
 **/.coding-ethos/code-intel.db-shm
 **/.coding-ethos/code-intel.db-wal

Makefile

@@ -23,12 +23,16 @@ MANAGED_PREFIX_DIR := $(TOOLCHAIN_DIR)/prefix
 MANAGED_GITHUB_BIN_DIR := $(TOOLCHAIN_DIR)/github-bin
 MANAGED_TOOLCHAIN_SOURCE := $(PRECOMMIT_DIR)hooks/managed-toolchain.tsv
 MANAGED_TOOLCHAIN_MANIFEST := $(TOOLCHAIN_DIR)/manifest.tsv
+PURRDF_EXTRACTOR_DIR := $(LOCAL_REPO_ROOT)/rust/purrdf-code-intel-extractor
+PURRDF_EXTRACTOR_MANIFEST := $(PURRDF_EXTRACTOR_DIR)/Cargo.toml
+PURRDF_EXTRACTOR_BINARY := coding-ethos-purrdf-extractor
 
 GIT ?= /usr/bin/git
 UV ?= uv
 PYTHON ?= python
 GO ?= go
 GOFMT ?= gofmt
+CARGO ?= cargo
 GO_BUILD_FLAGS ?= -trimpath -buildvcs=false
 GO_BUILD_CACHE_DIR ?= $(LOCAL_REPO_ROOT)/.coding-ethos/cache/go-build
 UV_CACHE_DIR ?= $(LOCAL_REPO_ROOT)/.coding-ethos/cache/uv
@@ -245,6 +249,8 @@ endef
 	go-hook-runner-install \
 	policy-bundle-install \
 	go-tools-smoke \
+	purrdf-extractor-check \
+	purrdf-extractor-install \
 	go-tools-clean \
 	clean-cache \
 	sync-tool-configs \
@@ -446,7 +452,7 @@ python-coverage: ensure-uv ## Run Python tests with coverage enforcement.
 	@$(UV) run coverage report --fail-under="$(PYTHON_COVERAGE_MIN)"
 	@$(UV) run coverage xml -o "$(GO_COVERAGE_DIR)/coverage-python.xml"
 
-check: check-local-artifacts test check-tool-configs check-gemini-prompts check-agent-skills check-provider-matrix go-test go-e2e-test ## Run the repo's current verification gate.
+check: check-local-artifacts test check-tool-configs check-gemini-prompts check-agent-skills check-provider-matrix go-test go-e2e-test purrdf-extractor-check ## Run the repo's current verification gate.
 
 check-local-artifacts: ## Fail if local build artifacts escaped managed output dirs.
 	@$(call print_step,Checking for unmanaged local build artifacts)
@@ -588,7 +594,36 @@ check-provider-matrix: ensure-go go-tools-install ## Fail if the provider capabi
 	@"$(GO_TOOLS_BIN_DIR)/coding-ethos-agent-hooks" \
 		check-provider-matrix --root "$(LOCAL_REPO_ROOT)"
 
-build: sync-tool-configs sync-consumer-tool-configs sync-gemini-prompts _sync-agent-skills _sync-consumer-agent-skills sync-provider-matrix go-tools-install repair-repo-ignores _sync-git-hooks _sync-agent-hooks _sync-consumer-agent-hooks managed-toolchain-install go-hook-runner-install policy-bundle-install _sync-parent-hook-runtime ## Build checkout-local hook runtime artifacts.
+build: sync-tool-configs sync-consumer-tool-configs sync-gemini-prompts _sync-agent-skills _sync-consumer-agent-skills sync-provider-matrix go-tools-install purrdf-extractor-install repair-repo-ignores _sync-git-hooks _sync-agent-hooks _sync-consumer-agent-hooks managed-toolchain-install go-hook-runner-install policy-bundle-install _sync-parent-hook-runtime ## Build checkout-local hook runtime artifacts.
+
+purrdf-extractor-check: ## Test the optional PurRDF code-intel extractor when present.
+	@if [ -f "$(PURRDF_EXTRACTOR_MANIFEST)" ]; then \
+		command -v "$(CARGO)" >/dev/null 2>&1 || { \
+			printf '$(COLOR_WARN)cargo is required for the PurRDF extractor.$(COLOR_RESET)\n' >&2; \
+			exit 1; \
+		}; \
+		$(call print_step,Testing PurRDF code-intel extractor); \
+		"$(CARGO)" test --locked --manifest-path "$(PURRDF_EXTRACTOR_MANIFEST)"; \
+	else \
+		$(call print_info,PurRDF extractor subtree not present in this checkout); \
+	fi
+
+purrdf-extractor-install: ## Build and install the optional PurRDF extractor when present.
+	@if [ -f "$(PURRDF_EXTRACTOR_MANIFEST)" ]; then \
+		command -v "$(CARGO)" >/dev/null 2>&1 || { \
+			printf '$(COLOR_WARN)cargo is required for the PurRDF extractor.$(COLOR_RESET)\n' >&2; \
+			exit 1; \
+		}; \
+		$(call print_step,Building PurRDF code-intel extractor); \
+		"$(CARGO)" build --locked --release --manifest-path "$(PURRDF_EXTRACTOR_MANIFEST)"; \
+		mkdir -p "$(GO_TOOLS_BIN_DIR)"; \
+		install -m 0755 \
+			"$(PURRDF_EXTRACTOR_DIR)/target/release/$(PURRDF_EXTRACTOR_BINARY)" \
+			"$(GO_TOOLS_BIN_DIR)/$(PURRDF_EXTRACTOR_BINARY)"; \
+		$(call print_info,installed: $(GO_TOOLS_BIN_DIR)/$(PURRDF_EXTRACTOR_BINARY)); \
+	else \
+		$(call print_info,PurRDF extractor subtree not present in this checkout); \
+	fi
 
 sandbox-runtime-validate: ensure-go go-tools-install ## Validate required sandbox runtime.
 	@$(call print_step,Validating native sandbox runtime)

README.md

@@ -464,7 +464,9 @@ bin/coding-ethos-run code-intel decisions add --title 'Use explicit startup' --r
 bin/coding-ethos-run code-intel decisions import docs/decisions
 bin/coding-ethos-run code-intel decisions list --path pkg/app.py --query startup
 bin/coding-ethos-run code-intel decisions health --path pkg/app.py
-bin/coding-ethos-run code-intel rebuild-index
+bin/coding-ethos-run code-intel sync --root .
+bin/coding-ethos-run code-intel status --root .
+bin/coding-ethos-run code-intel rebuild-derived
 bin/coding-ethos-run code-intel hook-usage --risk-category bypass
 bin/coding-ethos-run code-intel record-hook-review --trace-id hook-1 --disposition false_positive
 bin/coding-ethos-run code-intel hook-reviews --disposition false_positive
@@ -474,6 +476,10 @@ bin/coding-ethos-run code-intel proxy-sessions --provider codex
 bin/coding-ethos-run code-intel proxy-events --session-id sess-1
 bin/coding-ethos-run code-intel session-snapshot --session-id sess-1 --format toon
 bin/coding-ethos-run code-intel context-advice --session-id sess-1 --format toon
+bin/coding-ethos-run code-intel token-economy ledger --provider codex --path /absolute/path/to/rollout.jsonl
+bin/coding-ethos-run code-intel token-economy benchmark validate --manifest /private/protocol/frozen.yaml
+bin/coding-ethos-run code-intel token-economy benchmark run --manifest /private/protocol/frozen.yaml --state-root /private/evidence --approved-max-runs 30
+bin/coding-ethos-run code-intel token-economy report --historical --db /private/lane-1/code-intel.duckdb --db /private/lane-2/code-intel.duckdb --from 2026-08-01T00:00:00Z --to 2026-09-01T00:00:00Z --output-prefix /private/reports/history
 bin/coding-ethos-run code-intel repeated-edits --path pkg/app.py
 bin/coding-ethos-run code-intel remediation-outcomes --outcome repeated
 bin/coding-ethos-run code-intel remediation-effectiveness --policy-id python.unused_imports
@@ -572,8 +578,12 @@ Use `--format json|toon|human` to choose between the stable automation payload,
 compact TOON handoff, or a short operator-readable summary. The compact output
 puts blocking friction, affected command families, repeated remediation loops,
 storage repair commands, and evidence gaps ahead of high-volume allowed events.
-`rebuild-index` refreshes the DuckDB analytical index from append-only events
-and retained event logs, then removes obsolete store files after rebuild.
+`sync` creates the exact immutable source generation for the current worktree.
+`status` compares that generation to current source bytes and reports source
+readiness independently from vector readiness. `rebuild-derived` refreshes the
+DuckDB analytical index from append-only events and retained event logs, then
+removes obsolete store files after rebuild. The old `rebuild-index` spelling is
+a deprecated compatibility alias.
 
 Inspect the repo-local disk output surface before pruning or deeper analysis:
 
@@ -683,8 +693,10 @@ detected repo paths, likely symbols, direct graph edges, repeated-failure
 evidence, risk flags, and exact MCP follow-up calls such as
 `code_intel_context_card {"path":"pkg/app.py"}`. Missing or stale code-intel
 does not block the tool result; the hook emits a concise refresh hint with
-`coding-ethos-code-intel rebuild-index`. Repositories can disable or cap this
-context with `proxy.code_intel_enrichment` in `repo_config.yaml`.
+`coding-ethos-code-intel sync --root .`. Hook and MCP metadata carry the
+additive exact-source receipt under `coding-ethos.code-intel/v2`.
+Repositories can disable or cap this context with `proxy.code_intel_enrichment`
+in `repo_config.yaml`.
 
 PreToolUse hooks also perform narrow semantic policy injection. Mutating Git
 intents such as `policy-git commit` inject the `safe-git-workflow` skill pointer
@@ -1586,6 +1598,11 @@ bin/coding-ethos-run agent-hooks verify
 bin/coding-ethos-run agent-hooks capabilities
 ```
 
+The versioned capability report includes an optional `code_intel` object with
+contract `coding-ethos.code-intel/v2` and the exact `sync` and `status` command
+templates. Orchestrators can feature-detect that object without changing the
+existing agent-hooks v1 discovery envelope.
+
 Agent hook generation is all-or-nothing. `sync` writes every supported
 repo-local surface. Provider support levels, native settings files, hook events,
 MCP setup, generated targets, memory behavior, response shapes, and unsupported