feat(ai): establish layered code-intelligence stack

.codex/config.toml

@@ -1,3 +1,15 @@
+# Dev Plane code-intelligence policy:
+# - codebase-memory-mcp is the primary structural/impact-analysis backend.
+# - GitNexus remains configured but disabled during the migration bake-off.
+# - Use rg/Zoekt for exact text, ast-grep for structural rewrites, and LSP/SCIP
+#   for definition/reference/type truth before escalating to graph analysis.
+
+[mcp_servers.codebase-memory-mcp]
+command = "codebase-memory-mcp"
+args = []
+enabled = true
+
 [mcp_servers.gitnexus]
 command = "npx"
 args = ["-y", "gitnexus@1.6.12", "mcp"]
+enabled = false

.mcp.json

@@ -1,8 +1,8 @@
 {
   "mcpServers": {
-    "gitnexus": {
-      "command": "npx",
-      "args": ["-y", "gitnexus@1.6.12", "mcp"]
+    "codebase-memory-mcp": {
+      "command": "codebase-memory-mcp",
+      "args": []
     }
   }
 }

.woodpecker/code-intelligence-bakeoff.yaml

@@ -0,0 +1,55 @@
+labels:
+  platform: linux/amd64
+
+when:
+  - event: manual
+
+steps:
+  - name: live-bakeoff
+    image: node:24-bookworm
+    environment:
+      CODEINTEL_GITHUB_TOKEN:
+        from_secret: codeintel_github_token
+      CI: "1"
+      GITNEXUS_NO_UPDATE_NOTIFIER: "1"
+      GITNEXUS_SKIP_OPTIONAL_GRAMMARS: "1"
+      CODEINTEL_GITNEXUS_MCP_CMD: "gitnexus mcp"
+      CODEINTEL_GITNEXUS_ANALYZE_CMD: "gitnexus analyze --index-only"
+      CODEINTEL_GITNEXUS_VERSION_CMD: "gitnexus --version"
+      CODEINTEL_CODEBASE_MEMORY_CMD: "codebase-memory-mcp"
+      CODEINTEL_CODEBASE_MEMORY_VERSION_CMD: "codebase-memory-mcp --version"
+    commands:
+      - apt-get update && apt-get install -y --no-install-recommends ca-certificates curl git python3 && rm -rf /var/lib/apt/lists/*
+      - |
+        curl -fsSLo /tmp/go.tgz "https://go.dev/dl/go1.26.8.linux-amd64.tar.gz"
+        rm -rf /usr/local/go
+        tar -C /usr/local -xzf /tmp/go.tgz
+        export PATH="/usr/local/go/bin:$${PATH}"
+        go version
+      - npm install --global codebase-memory-mcp@0.11.0 gitnexus@1.6.12
+      - codebase-memory-mcp --version
+      - gitnexus --version
+      - |
+        export PATH="/usr/local/go/bin:$${PATH}"
+        export CBM_CACHE_DIR="$${PWD}/.codeintel-cbm"
+        export GITNEXUS_STORAGE_ROOT="$${PWD}/.codeintel-gitnexus"
+        export CODEINTEL_REPOS_ROOT="$${PWD}/.codeintel-repos"
+        mkdir -p "$${CBM_CACHE_DIR}" "$${GITNEXUS_STORAGE_ROOT}" "$${CODEINTEL_REPOS_ROOT}"
+        chmod 700 "$${CBM_CACHE_DIR}" "$${GITNEXUS_STORAGE_ROOT}"
+
+        git config --global credential.helper store
+        printf 'https://x-access-token:%s@github.com\n' "$${CODEINTEL_GITHUB_TOKEN}" > "$${HOME}/.git-credentials"
+        chmod 600 "$${HOME}/.git-credentials"
+
+        git clone --depth 1 https://github.com/dporkka/adacavo.git "$${CODEINTEL_REPOS_ROOT}/adacavo"
+        git clone --depth 1 https://github.com/nulang-org/nulang.git "$${CODEINTEL_REPOS_ROOT}/nulang"
+        git clone --depth 1 https://github.com/dporkka/nulang-cloud.git "$${CODEINTEL_REPOS_ROOT}/nulang-cloud"
+        git clone --depth 1 https://github.com/dporkka/dev-plane.git "$${CODEINTEL_REPOS_ROOT}/dev-plane"
+
+        rm -f "$${HOME}/.git-credentials"
+        git config --global --unset credential.helper || true
+        unset CODEINTEL_GITHUB_TOKEN
+
+        export CODEINTEL_RUN_LIVE=1
+        bash scripts/verify-codeintel.sh
+      - cat data/codeintel-bakeoff/suite.json

.woodpecker/code-intelligence.yaml

@@ -0,0 +1,53 @@
+labels:
+  platform: linux/amd64
+
+when:
+  - event: pull_request
+    path:
+      include:
+        - packages/repo-intel/**
+        - scripts/codeintel_bakeoff.py
+        - scripts/test_codeintel_bakeoff.py
+        - scripts/test_codeintel_corpus.py
+        - scripts/codeintel_provenance.py
+        - scripts/test_codeintel_provenance.py
+        - scripts/verify-codeintel.sh
+        - benchmarks/code-intelligence/**
+        - docs/code-intelligence.md
+        - docs/code-intelligence-bakeoff-runbook.md
+        - tools/codeintel-benchmark/**
+        - docker-compose.code-intelligence-benchmark.yml
+        - .woodpecker/code-intelligence.yaml
+        - .woodpecker/code-intelligence-bakeoff.yaml
+  - event: push
+    branch: main
+    path:
+      include:
+        - packages/repo-intel/**
+        - scripts/codeintel_bakeoff.py
+        - scripts/test_codeintel_bakeoff.py
+        - scripts/test_codeintel_corpus.py
+        - scripts/codeintel_provenance.py
+        - scripts/test_codeintel_provenance.py
+        - scripts/verify-codeintel.sh
+        - benchmarks/code-intelligence/**
+        - docs/code-intelligence.md
+        - docs/code-intelligence-bakeoff-runbook.md
+        - tools/codeintel-benchmark/**
+        - docker-compose.code-intelligence-benchmark.yml
+        - .woodpecker/code-intelligence.yaml
+        - .woodpecker/code-intelligence-bakeoff.yaml
+
+steps:
+  - name: harness-tests
+    image: python:3.13-slim
+    commands:
+      - python3 scripts/test_codeintel_bakeoff.py
+      - python3 scripts/test_codeintel_corpus.py
+      - python3 scripts/test_codeintel_provenance.py
+
+  - name: repo-intel-tests
+    image: golang:1.26.8
+    commands:
+      - cd packages/repo-intel
+      - go test ./...

AGENTS.md

@@ -1,44 +1,24 @@
-<!-- gitnexus:start -->
-# GitNexus — Code Intelligence
+# Code Intelligence
 
-This project is indexed by GitNexus as **dev-plane** (5801 symbols, 16255 relationships, 300 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.
+Use `codebase-memory-mcp` as the primary structural code-intelligence backend for Dev Plane. On a fresh checkout, index the repository before relying on graph results. Prefer the cheapest precise tool for each question instead of routing every task through the graph.
 
-> Index stale? Run `node .gitnexus/run.cjs analyze` from the project root — it auto-selects an available runner. No `.gitnexus/run.cjs` yet? `npx gitnexus analyze` (npm 11 crash → `npm i -g gitnexus`; #1939).
+## Tool routing
 
-## Always Do
+- Exact identifier, string, filename, or regex lookup: use `rg` or Zoekt when available.
+- Structural syntax pattern or repeatable codemod: use `ast-grep`.
+- Definition, reference, implementation, rename, or type-resolution questions: prefer the language server / SCIP-quality semantic tooling.
+- Architecture, dependency, call-path, cross-file impact, or blast-radius questions: use `codebase-memory-mcp` (`get_architecture`, `search_graph`, `trace_path`, `detect_changes`, and `query_graph` as appropriate).
+- Conceptual search when names are unknown: use semantic graph search only after cheaper lexical/structural search is insufficient.
+- Security/data-flow analysis requiring source-to-sink reasoning: use Joern when available; do not use it for routine navigation.
+- Historical intent or ownership: use Git history.
+- Correctness: verify with the repository's tests, type checks, linters, and CI; static code intelligence is not proof that a change works.
 
-- **MUST run impact analysis before editing any symbol.** Before modifying a function, class, or method, run `impact({target: "symbolName", direction: "upstream"})` and report the blast radius (direct callers, affected processes, risk level) to the user.
-- **MUST run `detect_changes()` before committing** to verify your changes only affect expected symbols and execution flows. For regression review, compare against the default branch: `detect_changes({scope: "compare", base_ref: "main"})`.
-- **MUST warn the user** if impact analysis returns HIGH or CRITICAL risk before proceeding with edits.
-- When exploring unfamiliar code, use `query({search_query: "concept"})` to find execution flows instead of grepping. It returns process-grouped results ranked by relevance.
-- When you need full context on a specific symbol — callers, callees, which execution flows it participates in — use `context({name: "symbolName"})`.
-- For security review, `explain({target: "fileOrSymbol"})` lists taint findings (source→sink flows; needs `analyze --pdg`).
+## Change safety
 
-## Never Do
+Before changing a high-fan-in symbol, public API, persistence contract, scheduler path, capability boundary, or execution protocol, inspect upstream/downstream impact with the graph and semantic tooling. Before committing a non-trivial change, run `detect_changes` against the working tree or `main` and confirm the affected scope matches the intended change.
 
-- NEVER edit a function, class, or method without first running `impact` on it.
-- NEVER ignore HIGH or CRITICAL risk warnings from impact analysis.
-- NEVER rename symbols with find-and-replace — use `rename` which understands the call graph.
-- NEVER commit changes without running `detect_changes()` to check affected scope.
+If graph results conflict with compiler/LSP output or executable tests, treat compiler/LSP and runtime evidence as authoritative and refresh/re-index the graph.
 
-## Resources
+## Migration note
 
-| Resource | Use for |
-|----------|---------|
-| `gitnexus://repo/dev-plane/context` | Codebase overview, check index freshness |
-| `gitnexus://repo/dev-plane/clusters` | All functional areas |
-| `gitnexus://repo/dev-plane/processes` | All execution flows |
-| `gitnexus://repo/dev-plane/process/{name}` | Step-by-step execution trace |
-
-## CLI
-
-| Task | Read this skill file |
-|------|---------------------|
-| Understand architecture / "How does X work?" | `.claude/skills/gitnexus/gitnexus-exploring/SKILL.md` |
-| Blast radius / "What breaks if I change X?" | `.claude/skills/gitnexus/gitnexus-impact-analysis/SKILL.md` |
-| Trace bugs / "Why is X failing?" | `.claude/skills/gitnexus/gitnexus-debugging/SKILL.md` |
-| Rename / extract / split / refactor | `.claude/skills/gitnexus/gitnexus-refactoring/SKILL.md` |
-| Tools, resources, schema reference | `.claude/skills/gitnexus/gitnexus-guide/SKILL.md` |
-| Index, status, clean, wiki CLI commands | `.claude/skills/gitnexus/gitnexus-cli/SKILL.md` |
-
-<!-- gitnexus:end -->
+GitNexus remains a temporary fallback during the bake-off but is not the default code-intelligence path. Do not add new GitNexus-specific workflow dependencies unless a measured gap in codebase-memory requires it.

CLAUDE.md

@@ -1,44 +1,24 @@
-<!-- gitnexus:start -->
-# GitNexus — Code Intelligence
+# Code Intelligence
 
-This project is indexed by GitNexus as **dev-plane** (5801 symbols, 16255 relationships, 300 execution flows). Use the GitNexus MCP tools to understand code, assess impact, and navigate safely.
+Use `codebase-memory-mcp` as the primary structural code-intelligence backend for Dev Plane. On a fresh checkout, index the repository before relying on graph results. Prefer the cheapest precise tool for each question instead of routing every task through the graph.
 
-> Index stale? Run `node .gitnexus/run.cjs analyze` from the project root — it auto-selects an available runner. No `.gitnexus/run.cjs` yet? `npx gitnexus analyze` (npm 11 crash → `npm i -g gitnexus`; #1939).
+## Tool routing
 
-## Always Do
+- Exact identifier, string, filename, or regex lookup: use `rg` or Zoekt when available.
+- Structural syntax pattern or repeatable codemod: use `ast-grep`.
+- Definition, reference, implementation, rename, or type-resolution questions: prefer the language server / SCIP-quality semantic tooling.
+- Architecture, dependency, call-path, cross-file impact, or blast-radius questions: use `codebase-memory-mcp` (`get_architecture`, `search_graph`, `trace_path`, `detect_changes`, and `query_graph` as appropriate).
+- Conceptual search when names are unknown: use semantic graph search only after cheaper lexical/structural search is insufficient.
+- Security/data-flow analysis requiring source-to-sink reasoning: use Joern when available; do not use it for routine navigation.
+- Historical intent or ownership: use Git history.
+- Correctness: verify with the repository's tests, type checks, linters, and CI; static code intelligence is not proof that a change works.
 
-- **MUST run impact analysis before editing any symbol.** Before modifying a function, class, or method, run `impact({target: "symbolName", direction: "upstream"})` and report the blast radius (direct callers, affected processes, risk level) to the user.
-- **MUST run `detect_changes()` before committing** to verify your changes only affect expected symbols and execution flows. For regression review, compare against the default branch: `detect_changes({scope: "compare", base_ref: "main"})`.
-- **MUST warn the user** if impact analysis returns HIGH or CRITICAL risk before proceeding with edits.
-- When exploring unfamiliar code, use `query({search_query: "concept"})` to find execution flows instead of grepping. It returns process-grouped results ranked by relevance.
-- When you need full context on a specific symbol — callers, callees, which execution flows it participates in — use `context({name: "symbolName"})`.
-- For security review, `explain({target: "fileOrSymbol"})` lists taint findings (source→sink flows; needs `analyze --pdg`).
+## Change safety
 
-## Never Do
+Before changing a high-fan-in symbol, public API, persistence contract, scheduler path, capability boundary, or execution protocol, inspect upstream/downstream impact with the graph and semantic tooling. Before committing a non-trivial change, run `detect_changes` against the working tree or `main` and confirm the affected scope matches the intended change.
 
-- NEVER edit a function, class, or method without first running `impact` on it.
-- NEVER ignore HIGH or CRITICAL risk warnings from impact analysis.
-- NEVER rename symbols with find-and-replace — use `rename` which understands the call graph.
-- NEVER commit changes without running `detect_changes()` to check affected scope.
+If graph results conflict with compiler/LSP output or executable tests, treat compiler/LSP and runtime evidence as authoritative and refresh/re-index the graph.
 
-## Resources
+## Migration note
 
-| Resource | Use for |
-|----------|---------|
-| `gitnexus://repo/dev-plane/context` | Codebase overview, check index freshness |
-| `gitnexus://repo/dev-plane/clusters` | All functional areas |
-| `gitnexus://repo/dev-plane/processes` | All execution flows |
-| `gitnexus://repo/dev-plane/process/{name}` | Step-by-step execution trace |
-
-## CLI
-
-| Task | Read this skill file |
-|------|---------------------|
-| Understand architecture / "How does X work?" | `.claude/skills/gitnexus/gitnexus-exploring/SKILL.md` |
-| Blast radius / "What breaks if I change X?" | `.claude/skills/gitnexus/gitnexus-impact-analysis/SKILL.md` |
-| Trace bugs / "Why is X failing?" | `.claude/skills/gitnexus/gitnexus-debugging/SKILL.md` |
-| Rename / extract / split / refactor | `.claude/skills/gitnexus/gitnexus-refactoring/SKILL.md` |
-| Tools, resources, schema reference | `.claude/skills/gitnexus/gitnexus-guide/SKILL.md` |
-| Index, status, clean, wiki CLI commands | `.claude/skills/gitnexus/gitnexus-cli/SKILL.md` |
-
-<!-- gitnexus:end -->
+GitNexus remains a temporary fallback during the bake-off but is not the default code-intelligence path. Do not add new GitNexus-specific workflow dependencies unless a measured gap in codebase-memory requires it.