feat(semantic): native SymbolView/RelationView + unified symbol-neighborhood query

[2233admin]

Problem

#264 supplies a snapshot-bound, dependency-keyed multi-view index, but the built-in understanding path still stops at artifact catalog + lexical content. The Agent-facing gaps remain:

• native_code_evidence and Agent-map ranking are heuristic; known ceilings are tracked in Agent 地图排序：test/example 文件霸榜，entrypoint 误判文件名前缀 #128, bug(evidence): Rust mod / #[path] 声明边零覆盖 — 抽了名字边,没抽文件边 #221, bug(evidence): group use 未展开 + 跨行 use 静默丢失(连 unresolved 都不计) #223 and model: 第二类语言(名字空间与文件解耦)整体失配 — Rust/Java/C#/Go 同一个根因 #225.
• Symbol, call/reference/import relationships and their confidence are not available as shared views behind ProjectContext; each tool/provider still exposes its own graph/query vocabulary.
• Graft is materially smarter than the current heuristics, but upstream 0.11.0 has no stable complete-graph export API. graft build writes the private/local cache file graft/.graph/wiring.json; adopting that file layout or the Node/npm runtime as a production boundary would make Graft the center by accident.

The product needs Graft-level semantic capability built in, while Pipeline remains the authority, identity, cache, budget and Agent-query center.

Decision

Add one native Rust semantic producer after #264:

source snapshot
  -> NativeSemanticProducer
  -> SymbolView + RelationView Artifact Refs
  -> QueryIndex materialized views
  -> ProjectContext::query(SymbolNeighborhood intent)
  -> same CLI/MCP domain answer

Borrow these semantics from Graft pinned at d834ca227d765b2736cfeafb97b0e71e2ea21d50, not its product/runtime:

• deterministic symbol records with path/span/kind/qualified name/signature/exported/body hash;
• closed relations: contains|calls|references|imports|implements|extends;
• confidence classes: lsp_resolved|lsp_dispatch|ast_extracted|name_inferred|heuristic;
• ambiguous cross-file names are dropped, never guessed;
• unknown receiver member calls never fall back to any same-named method;
• contains is structural and never participates in dependency walks;
• optional LSP enrichment is best-effort: missing/timeout/error preserves the AST view and records the unavailable enrichment.

Upstream evidence:

• GraphV1 nodes/edges/confidence: https://github.com/NanoNets/Graft/blob/d834ca227d765b2736cfeafb97b0e71e2ea21d50/src/graph/types.ts#L33-L130
• ambiguity/member-call resolution: https://github.com/NanoNets/Graft/blob/d834ca227d765b2736cfeafb97b0e71e2ea21d50/src/graph/resolve.ts#L1-L14 and https://github.com/NanoNets/Graft/blob/d834ca227d765b2736cfeafb97b0e71e2ea21d50/src/graph/resolve.ts#L171-L201
• relation walk boundary: https://github.com/NanoNets/Graft/blob/d834ca227d765b2736cfeafb97b0e71e2ea21d50/src/graph/relations.ts#L1-L20
• current graph output is a build side-effect, not a stable export API: https://github.com/NanoNets/Graft/blob/d834ca227d765b2736cfeafb97b0e71e2ea21d50/src/graph/write.ts#L1-L45

First vertical slice

1. Define closed, versioned SymbolView and RelationView artifact contracts. Every record carries producer, producerVersion, consumedSnapshotIdentity, evidence location/hash, and a non-numeric confidence class.
2. Implement the native extractor for Rust plus one second-language fixture that exercises owner-qualified member calls. Keep grammar/extractor registration behind a provider boundary; do not add Graft/Node/npm as a production dependency.
3. Add ViewKind::SymbolCatalog and ViewKind::Relations to the feat(index): add snapshot-bound multi-view query index #264 index. Reuse its view keys, retained-byte budget, corruption rebuild and freshness separation.
4. Add typed SymbolNeighborhood intent behind ProjectContext. CLI and MCP construct the same intent and decode to the same domain answer; existing evidence-query JSON remains unchanged.
5. Query precedence is explicit: compiler/native exact facts > LSP resolved > AST extracted > unique-name inferred > existing heuristics. A weaker producer never overwrites stronger evidence.
6. Emit an internal query receipt with chosen producer/view key, rejected/fallback reasons, snapshot/freshness, confidence basis, bytes/items/time and budget/truncation state. It is audit evidence, not authority.
7. Add a fixed benchmark comparing symbol localization, relation precision/recall, context bytes and warm/cold latency against the current heuristic path.

Acceptance

• Same admitted snapshot + config + producer version yields byte-identical Symbol/Relation views and view keys.
• Editing one file invalidates only its extraction and dependent relation projection; freshness-only checkout changes do not mutate committed view keys.
• Duplicate cross-file names are not resolved; unknown receiver member calls do not resolve to bare same-named methods.
• contains never enters impact/dependency traversal.
• Missing LSP is a recorded no-op, not a core failure; heuristic fallback remains available and labeled.
• Staging, forged, non-completed or mismatched publications never enter committed semantic views; cache hits never bypass A07/A08/Artifact Ref verification.
• code-intel query --kind symbol and the MCP projection decode to the same bounded domain answer with explicit snapshot, freshness, confidence, coverage and truncation.
• Benchmark uses the same snapshot/query corpus for old and new paths, at least 3 repetitions, reports cold build separately from warm queries, and shows higher relation precision with no material symbol-recall regression. Enabling by default requires a measured Agent-context reduction or latency win, not architectural preference.
• Existing A08, evidence query, artifact query, MCP six-tool compatibility, primary run, install topology, repin, hardcoded-path and Sentrux gates remain green.

Non-goals

• vendoring/forking Graft or reading its local cache in production;
• importing Graft's hooks, markdown cards, statusline, auto-sync or LLM --deep layer;
• a general-purpose route planner or monolithic “tool fabric” in this issue;
• numeric confidence aggregation across heterogeneous producers;
• making semantic views gate/adoption authority;
• supporting every language in the first slice;
• public release promotion during the DR-0006 RC freeze.

Follow-up: tool fragmentation

After this slice proves two producers can answer one typed intent, open a separate issue for AgentIntent + QueryPolicy + CapabilityCatalog + RoutePlanner + QueryReceipt across at least two intents. Keep catalog declaration, route selection, execution, answer assembly and receipt recording in separate modules; do not combine them into one orchestration god object.

Depends on #264. Refs #58 #128 #188 #221 #223 #225 #263.

[2233admin]

Claimed on branch codex/issue-265-semantic-views. Approach: extend the verified #264 QueryIndex with native, provider-neutral symbol/relation views and one shared typed symbol-neighborhood path for CLI and MCP; keep Graft optional and non-authoritative.

[2233admin]

Implemented the practical 80% slice on codex/issue-265-semantic-views at acf83d8. Added provider-neutral symbol/relation Artifact contracts, native fail-closed Rust semantic extraction (Rust + JS/TS fixtures), snapshot-keyed SymbolCatalog/Relations views, and one shared symbol-neighborhood domain path for CLI and MCP with an internal receipt. Ambiguous names and unknown receiver calls are dropped; contains is non-walkable; no Graft/Node runtime dependency. Verification: 715 bin tests, 6 native integration tests, 5 MCP integration tests, hardcoded-path scan, and final Sentrux session_end pass. Deferred follow-on: parser-grade tree-sitter/LSP producers, deeper traversal, and corpus benchmark tuning.

[2233admin]

Corrective implementation completed on codex/issue-265-semantic-views at cdcf51c. The semantic contracts now carry producerVersion, consumedSnapshotIdentity, qualified/signature/export/body identity and source evidence hashes; line heuristics no longer claim AST confidence; unproven scopes and qualified receiver calls fail closed; TypeScript/JavaScript class members are emitted as qualified symbols; stronger producer evidence wins deterministically; semantic cache contents are integrity-checked and unchanged per-file records are reused; CLI accepts --kind symbol; MCP preserves the six-tool registry through get_facts(symbol); coverage, exact truncation, LSP-unavailable/fallback and budget receipts are explicit. Added a fixed 3-repetition cold/warm benchmark (legacy relation precision 0.3333 vs indexed 1.0 on the frozen qualified-call corpus, symbol recall unchanged at 1.0, answer bytes 131 vs source 208 in the latest run). Verification: full cargo test -p code-intel passed with CODE_INTEL_REPO_ROOT bound to this checkout; fmt, diff check, hardcoded-path scan, repin, and Sentrux session_end all pass with coupling restored to 64.77 and no structural degradation.