feat(mcp): load verified repository context artifacts

[fishmingyu]

Problem

The Pages workflow can now publish a portable repository-context artifact, but MCP clients cannot yet resolve and reuse it. Loading a downloaded artifact through the current manifest path would also be unsafe: portable vector documents are still pickle-encoded, artifact hashes are self-describing rather than a trust boundary, and artifact-relative paths have not been rebound to an exact checkout.

Scope

• Convert portable vector document metadata to a non-executable JSON format while preserving local legacy pickle compatibility.
• Verify the artifact schema, normalized inventory, SHA-256 hashes, byte sizes, absence of unlisted files/symlinks, repository slug, commit, source fingerprint, and supported capabilities before opening an index.
• Bind artifact-relative view paths and repository-relative source locations to an exact local checkout without mutating the downloaded artifact.
• Resolve a non-expired GitHub Actions artifact by owner/repository and full commit using an explicit token environment variable; extract archives with traversal, symlink, file-count, and size limits.
• Add codenib mcp --artifact ... --repo ... plus generated configuration for supported stdio MCP hosts.
• Surface loaded and unavailable views explicitly; never rebuild from the artifact-backed serving path.

Out of Scope

• Portable graph or Zoekt artifacts.
• Treating arbitrary URLs or a matching self-reported hash as trusted code.
• Patch generation, hosted query execution, or automatic repository checkout.

Acceptance

• A BM25 artifact built on one checkout serves the same ranked MCP result after download and binding at the exact commit.
• A semantic artifact loads safe JSON documents and performs a query with the configured embedding route; no portable pickle is present.
• Commit, source, repository, schema, inventory, archive-path, extra-file, and digest mismatches fail before any index parser or deserializer runs.
• A generated MCP configuration launches the verified artifact path and exact checkout.
• Focused tests, the full unit tier, pre-commit, package build, and an installed-wheel stdio smoke pass locally.

Part of #415; follows #423.

[fishmingyu]

H4 implementation is available in draft PR #425, stacked on #423.

Verified locally:

• full unit tier: 2651 passed, 10 skipped, 183 deselected
• artifact tests: 36 passed
• pre-commit and strict documentation build passed
• final wheel smoke built a fresh BM25 index, packaged and verified a portable artifact, bound it to the exact Git checkout, started stdio MCP from the installed wheel, exposed 9 tools, and returned the expected source file

Security boundaries include inert portable vector documents, exact repository/commit/source binding, inventory and payload verification, bounded safe ZIP extraction, symlink-escape rejection, and GitHub token isolation from signed download URLs.

[fishmingyu]

Triage: type/feature, scope/agent + scope/compiler (MCP artifact loading, tied to codenib/artifacts/ verification and compiler/manifest.py/RepoManifest binding), priority/P1 (component of the P1 #415 RFC; draft PR #425 already reports full unit tier + artifact tests + wheel smoke passing). @fishmingyu for scope/agent + scope/compiler.

---

Generated by Claude Code