PR target correction — owner instruction

This child is implemented from and merged into codex/epic-200-git-backed-harness, NOT main. Keep one issue branch / one PR, independent exact-SHA review and required head + resulting epic-branch CI. Record acceptance as integrated into the epic, not released. The full branch goes to main only through the single final #200 PR after all #201–#207 and integrated gates are complete. See #200 delivery-contract comment; this supersedes the original child main-merge wording, leaving title/description fixed.

G5 implementation contract (base green epic merge 6c606783970d3ee34867c19e0bb53d832b91ab80, dependency #204 complete). PR targets ONLY codex/epic-200-git-backed-harness per comment193838699; original title/body remain fixed.

Inspected gap: G4 local catalog has no search/index action; current repository-docs retriever/indexer already provide exact-blob lexical ranking, chunk digests, immutable revision sets, vector reuse and fallback, but their Git reader normally discovers a checkout and its committed corpus policy. Reuse these engines through a small in-process pinned-corpus adapter supplied by the existing restricted LocalGit snapshot, NOT a new index engine/protocol.

Flow: project selector -> shared LocalProjects service -> validated/pinned LocalGit snapshot -> existing repositorydocs Retriever/Indexer -> existing metadata/vector tables. Only validated active issue/comment/wiki files enter the fixed issues/** + wiki/** corpus. Tombstones and .harness/**/receipts/counters never enter it. Corpus identity includes project/store, exact commit, fixed policy and chunk/model namespace; each hit additionally carries the authoritative project/kind/entity citation. Hydration remains pinned Git bytes with digest verification.

Surfaces: CLI project search and project index, MCP local_project_search and local_project_index, same private IPC and shared behavior. Default search is fulltext and opens no cache/provider; explicit hybrid additionally requires a non-disabled registered pre-provisioned profile. Missing/stale/failed derived state returns visible requested/effective mode and finite lexical fallback. Queries never create/migrate/repair an index, start a daemon/provider or install/download/probe setup. Optional provider must have explicit local_process/local_network boundary; remote/unknown rejects before transfer.

Indexing is an explicit bounded foreground call to the existing Indexer (local intent, maximum128new chunks, existing10s request ceiling), not another job/lifecycle framework. It may safely resume through the engine's existing immutable-set/vector reuse; interruption/partial coverage is not reported ready. The selected existing cache is disposable metadata/vector storage only and opens writable only for index; no project authority/Markdown/chunk copies. Ordinary GitCode mode remains unchanged.

Bounds/tests: <=8MiB corpus bytes, existing entity/tree ceilings; bounded query/results/snippets and strict CLI/MCP/IPC shapes; provider requests/responses/deadlines bounded. Real temporary Git demo: issue/comment/wiki matches; same query before/after edit, tombstone, stale/failed/missing RAG, deleted derived cache and rebuild; exact citations, alias/project isolation, no private paths/receipts/text sentinels in SQLite. Actual CLI/MCP service paths, poison credentials/zero default-provider counters, explicit fake/loopback embedding ready/failure cases, read policy/cancellation and existing remote regression suite. Full Go + affected race/vet/docs/diff; exact-SHA independent review/head CI/resulting epic CI before closure.

UX cohort: search/effective mode/coverage/index outcomes shared with CLI/MCP now; explicit protected Admin cohort remains required #206 (depends on G5), whole-feature gate #207. No UI source/assets in G5; no silently omitted Admin rollout. Risks: corpus-policy/reader bypass, stale-set or project identity confusion, provider data boundary and content persistence; tests must target these rather than only happy-path ranking.

Implementation checkpoint: PR !197, head 1416a85e8e60a0a0a4b1125533c6fc4d0035f61d, tree dd12b3595ee286bf2592f33c6f91351db45c9214, base green epic merge 6c606783970d3ee34867c19e0bb53d832b91ab80; epic-only target. Title/body fixed; no scope/new dependency change.

CLI/MCP search/index share bounded pinned LocalGit corpus and EXISTING retriever/indexer. Real Git + private Unix service + CLI/MCP/loopback provider demonstrate default zero provider calls, explicit document indexing, query-only hybrid embedding, exact project citations, edit/tombstone invalidation, reuse, partial/failed/provider-failure fallback, deleted derived cache/rebuild, alias/read-only/independent scope isolation, forged derived citation fallback, writer contention, closed IPC fields and transfer/redirect bounds. DB/WAL sentinels prove no persistent entity/chunk bytes.

Implementation clarification: existing SQLite schema lives in a separate disposable <selected-cache>.local-project-index.db, not the remote-binding cache, so internal FK scope anchors have no remote owner/endpoint/sync scopes. Existing vector-only checkpoints/retention reused. CLI setup gains explicit --rag-profile; no setup/download/start. Strict-local config ignores cwd-owned runtime settings; deterministic repository-provider/cache retarget test was RED before the fence and PASS afterwards, with ordinary-mode control unchanged.

Final-source PASSED: full go test ./... (native qualifier98.061s); full affected nine-package go test -race -p 4 ... -count=1 (service101.465s/servicectl123.940s); vet; product docs; staged diff-check. Earlier local broad tests caught normal namespace/safety classification regressions, fixed in product without relaxing those tests. G3 fixture readiness preserves total3s budget but gives the real Git probe its remaining budget instead of repeated100ms cancellation. An unchanged old cancellation2s wall-clock test exceeded its threshold under simultaneous full Go+race load; isolated count3 and the FINAL full bounded-parallel race passed unchanged. No failing test deletion/threshold increase.

Independent exact-SHA review and new-head CI are now pending; mirror requested once for this head. No merge until clear review/exact CI/final canonical head-base-discussions check; resulting epic CI before closure. Protected Admin #206 and full backup/acceptance #207 remain required. No UI source/assets, main merge, release or install.

Independent review of candidate 1416a85e8e60a0a0a4b1125533c6fc4d0035f61d reproduced four P2 correctness/contract gaps through real Git + Unix IPC: (1) selected ready index followed by semantic failure retained ready coverage, so lexical fallback was rejected by IPC; (2) missing derived vectors could still claim ready hybrid; (3) derived line locators were not checked against pinned Git bytes; (4) impossible index counters could overflow their conservation check. Author independently reproduced (1) with a provider that serves model identity but fails query embedding. No merge: fixing all four with retained deterministic regressions, then new exact-SHA review and CI. Original issue inputs and epic scope remain unchanged.

Review completed with six P2 findings (candidate 1416a85). Additional findings: same-dimension model revision drift on batch/query/per-item embedding, and a valid resume result containing one replayed checkpoint plus 128 newly requested chunks was incorrectly rejected by the wire cap. Fixes retain the existing engine and admission budget: verify response model/revision/dimensions before scoring/persistence; recompute line ranges from verified Git bytes; enforce complete candidate/vector coverage; return effective lexical coverage on fallback; bound all counter operands before sums; validate returned counters against eligible corpus size rather than confusing replay totals with the 128-new-chunk limit. All reviewer counterexamples are retained as deterministic regression tests. Focused race regressions now PASS, including the actual 129-result checkpoint handoff and loopback model drift. Old exact-head CI passed but does not qualify the revised source; full local gates, new exact-SHA independent review and new CI are still required. No merge.

Corrective head 41b366b2393b33d0474f5f506a4027929150a313, tree 975632eac2a414a28f040f48797004ec161f70fb, pushed to !197 (epic branch only). All six original reviewer counterexamples retained and PASS under race; real CLI/MCP query-only embedding failure was RED before the fix and now PASS. Final go test ./... PASS (native97.343s, repositorydocs17.064s, service21.588s, servicectl64.653s); full nine affected package race-p4-count1 PASS (repositorydocs23.609s, service108.812s, servicectl137.388s, main32.241s); affected vet, product docs and staged diff check PASS. Independent exact-SHA re-review dispatched; mirror3349 triggered once for NEW head CI. Prior head CI38637432048 passed but is NOT revised-head evidence. No merge until new review and CI clear; resulting epic merge CI required before closure. Main unchanged.

Exact-SHA re-review of41b366b independently confirms the original six fixes, but found one remaining P2 in the same malformed-derived-state contract: shape-valid corrupt stored vectors (zero/nonfinite, foreign dtype, wrong hash) and invalid query vectors could still claim ready hybrid. No merge. Corrective qualification reuses existing RAG normalization, verifies stored dtype/SHA256 before scoring, rejects zero/nonfinite query/stored vectors and preserves verified lexical fallback. Original actual-provider/Git/IPC regressions are retained; additional hash-consistent numeric-corruption tests ensure numeric checks cannot be bypassed merely by updating the digest. Full local gates, another exact-SHA review and CI remain required for the final source.

Final vector qualification pushed: 2ce25c5fe00b75c8e82a4dcb0e9aeafaa3864ee6, tree 9756e24ab4a67230ca35146561198ac35bebb1c6. Remaining vector/dtype/hash/query counterexamples and additional hash-consistent zero/Inf controls PASS under race. Full nine affected package race-p4-count1 PASS (repositorydocs19.915s/service103.673s/servicectl140.771s/main31.894s); vet/docs/whitespacePASS; final go test ./... PASS (native98.476s/servicectl64.289s). Honest intermediate failure: unchanged O5 actual stopped-worker retry-conservation test failed once in the preceding fullGoattempt. Exact unmodified isolated testPASS30.934s; private diagnostic-only overlay with unchanged assertions count3PASS91.865s; final fullGoPASS. Cause remains unestablished, no test/assertion/timeout weakened or omitted. Independent exact-SHA re-review and NEW headCI dispatched; prior41b CI is not finalhead evidence. Main and epicbase unchanged; no merge until final gates clear.

Independent final SOURCE CLEAR: no remaining P0–P2 for exact 2ce25c5fe00b75c8e82a4dcb0e9aeafaa3864ee6, tree 9756e24ab4a67230ca35146561198ac35bebb1c6; all33 cumulative files bound to immutable reviewed archive, patch SHA256 c3b73382cb72b9d584545fd0e71881117448759240a3c9eb66c3ffba1777855f. Reviewer independently reran ALL original raw regression files byte-for-byte under race (service4.828s/servicectl13.568s), plus retained/hash-consistent corrupt-vector/shared-engine/real CLI+MCP controls (repositorydocs2.843s/service4.523s/servicectl15.515s/main3.137s); vet/docs/diff/remotehead checks PASS. All seven reproduced P2 findings resolved; no new finding. Required final-head CI38640870904 and canonical PR/discussion gates remain separate and pending; no merge yet. Earlier unrelated O5 transient remains honestly undiagnosed, not claimed fixed.

G5 acceptance COMPLETE in the isolated epic branch only. PR !197 merged as 045898578bc55bfd9fdbfd49e6da35084e825e64, parents 6c606783970d3ee34867c19e0bb53d832b91ab80 + reviewed 2ce25c5fe00b75c8e82a4dcb0e9aeafaa3864ee6, identical reviewed tree 9756e24ab4a67230ca35146561198ac35bebb1c6. Main remains c7a0af638ccb4a7292a46e05143c9b82832c29d9; original issue title/body unchanged.

Independent exact-SHA SOURCE CLEAR/no P0–P2: comment193848058; all33 files and original raw counterexamples verified. Head CI https://github.com/urandon/gitcode-mcp/actions/runs/38640870904 attempt1/job116115724634 and resulting epic CI https://github.com/urandon/gitcode-mcp/actions/runs/38641719429 attempt1/job116118598295 terminal SUCCESS, all18steps each (docs/assets/UI/browser/semantic guard/Go/native user-systemd/release fixtures/whitespace/cleanup). Luna watched; root independently verified run/job metadata, exact SHA/branch/event/workflow, expected merge graph/tree, clean checkout and unchanged main.

Final local PASSED: go test ./...; go test -race -p 4 ./internal/localgit ./internal/repositorydocs ./internal/config ./internal/service ./internal/servicectl ./internal/mcp ./internal/cli ./cmd/gitcode-mcp ./internal/capability -count=1; affected vet; ./scripts/check-product-docs.sh; git diff --check. Real Git/Unix CLI+MCP/loopback-provider regressions prove issue/comment/wiki matches and pinned citations, fixed corpus exclusions, edits/tombstones and stale/partial/failed/missing/provider/corrupt-index lexical fallback, derived-cache loss/rebuild, project/alias/read-policy isolation, bounded explicit provider work and no default provider/cache dependency. Seven independent findings fixed with retained tests; query/stored vectors match selected model/dimensions and numeric/dtype/digest contracts; citations hydrate source bytes, not cached copies.

Earlier unchanged O5 retry-conservation test failed once locally; exact isolated and three diagnostic runs and final full gate passed. Cause remains unestablished, assertions/deadlines unchanged; carried visibly into G7 qualification, not claimed fixed. No live GitCode dependency/model installation was needed for this local feature; no native-sandbox claim.

Epic #200 checkpoint updated to5/7 BEFORE child closure. #206 protected Admin and #207 bundle/restore/docs/integrated acceptance remain required. No release/install or partial main merge.