feat(native): export commit-bound model and lossless human context (#346)

[Ancienttwo]

Refs #346. Implements the approved native-export design from #349 for repo-harness R6.

Repo-harness currently reads native YAML, translates registry anchors and slices generated Markdown itself. This change adds archctx export native --worktree and --ref <commit-ish>, returning archcontext.native-context-export/v1 with profile repo-harness/v1 and feature native-context-export-v1.

The fixed-ref reader uses checked, fixed Git objects with lazy fetch and replacement objects disabled. The worktree reader verifies the complete selected input closure twice, identities and HEAD, then refuses observed drift. It returns every canonical model record and status, declared capability metadata, explicit missing contracts and exact human UTF-8 regions/section ranges. Missing optional LSP/verification metadata remains null. The lock-free ABA limit is documented.

The shared parser only gains duplicate-key rejection; its accepted values are preserved. The document reader accepts current v6 plus the exact observed four-attribute historical v5 marker. Both retain pairing, duplicate/nesting, target and body-checksum guards. Historical v5 sourceDigest is syntax-checked metadata, never freshness evidence. The v6 producer and RPC v2/product-version metadata stay unchanged.

R6 consumer	Export coverage
Item 6: model/HEAD/capability/contract readers	Complete validated native graph, canonical kinds, declared budget/profile metadata, source paths and explicit contract presence
Item 7: registry include-anchor translation	Existing literal-prefix rule and display-only includeAnchors, retaining literal filenames
Item 8: section 3/backlog slicing	Lossless human regions plus missing/absent/empty/present section states, original text and byte/line ranges

Validation:

• Frozen Ancienttwo/repo-harness@902c4ed7866f2b7359b1553a8cd64934496ea3c7: 454/454 original-parser/consumer value parity; 40 exact v5 source documents preserve independently captured human-byte complements. Original strict-v6 rejection artifact remains unchanged as history.
• Actual fixed-ref export: 102 nodes / 299 relations / 52 flows / 37 profiles / 10 contracts / 40 documents; inputDigest sha256:6d03b7e581bd78bdfff655caf9eb214b47b63c2b03ddfa66a6cc6e02340f1d24.
• 434 focused/shared tests and 71 subsequent scanner/legacy delta tests passed; typecheck and package-boundary audit passed.
• Isolated Node bundle smoke passed for both selectors and dirty-source isolation with no CodeGraph, Bun, development compiler, Git index mutation or runtime state. Public contracts pack tests cover the new schemas, fixtures and source.
• Six independent read-only review passes completed; concrete findings were fixed and original reproductions rechecked, including Git replace refs, filesystem aliases, Markdown literal boundaries/legacy adapters, heading complexity and bounded failure responses.
• bun run verify exited 0 at 4f68c76a774fd74c5691c1a0745a0dfe0e5054aa (immutable execution vx-2212fb60798d4045856b). At current HEAD e7eafee1f2c5ed60e9e044a09cd98201dcbd1c44, bounded BOM, smoke-staging and manifest-stamp deltas passed typecheck, affected projection/reader/CLI tests, isolated Node smoke and semantic freshness assertions. Canonical verification accepted the passing full baseline plus two current exact checks (vx-1a54a0f2695b465b85fe, vx-7b842bac3c7544808990) with no snapshot drift; the full suite was not rerun locally at this HEAD.
• Hosted Windows Node 22/24/25 at prior HEAD ae1f84ec each completed 3092 passing tests / five skips / zero test failures, then failed loading @node-rs/jieba in the new Node bundle smoke. The smoke now resolves declared packages through the owning package, copies their files and explicit platform bindings into the temporary stage, excludes nested workspace modules and clears child-only ambient Node module/preload paths. Missing dependencies fail explicitly; no smoke assertion is removed. Current exact-HEAD OS/Node matrix is pending, including all three Windows lanes and the prior 20-minute-budget-cancelled Mac Node 22 lane. Workflow budgets are unchanged.
• Contracts/schema/packaging checks passed: 252 pass / 0 fail after correcting native invalid-fixture lookup registration and binding an isolated writable npm cache for verification. The earlier failed aggregate record remains retained.

Supported projection reconciliation is complete. Read-only check/plan classified six targets unchanged and one stamp-only, with every output/semantic/proof change false. Ordinary projection run apply updated only the existing manifest row's 13 sourceStamps: nine moved by U4 and four inherited from already merged D4/RPC changes, verified against frozen Git baselines. The byte audit preserved every other manifest field, all architecture document outputs, model files and agent contracts. Subsequent check is noop, with seven unchanged targets and freshness true.

Repository workflow complete returned semantic pass at exact current HEAD e7eafee1f2c5ed60e9e044a09cd98201dcbd1c44 under normal posture with the full local CodeGraph 1.6.1 index: zero errors/warnings/notices, empty findings/actionsRequired, dependency gate pass and no downgraded findings or waivers. Debt remains partial coverage, not a zero-debt proof. Draft for the current hosted OS/Node matrix and coordinator integration acceptance; publication and merge remain separate.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T14:45:57.861905Z	e7eafee	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e7eafee1f2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve legacy tracked-tree read timeouts

When an existing daemon workflow scans a large or slow repository whose git ls-tree or subsequent git cat-file takes more than 10 seconds, these calls now inherit readOnlyGit's native-export gitTimeoutMs default; the previous runGit/execFileSync implementations had no timeout. This can make refactor scans, dependency queries, recommendations, and developer-review preparation fail even though they are unrelated to native export, so pass a legacy timeout policy explicitly rather than leaking the native reader's bound into these shared APIs.

Useful? React with 👍 / 👎.