cce v2.6.9

Added

• cce sync list [--remote <url>] [--json] — enumerate what a sync cache holds (#53).
  The discovery half of consumer mode: one row per repo_id with its latest sha (the
  refs/<branch> pointer pull --latest reads — -/null when a repo has no pointer yet),
  artifact count, and total artifact bytes (LFS-aware: an LFS pointer reports its
  recorded artifact size, not the ~130-byte pointer file). Wires up the previously
  CLI-unreachable SyncRemote::list (#37/#50), keeping its pinned graceful-skip of
  non-artifact cache entries. Read-only — it never mutates the cache or the local .cce/ —
  and repo-less: a bare directory plus --remote <url> is sufficient. Rows sort by repo_id;
  an empty cache is a friendly message (exit 0); an unreachable remote is a clear non-zero
  error. --json emits the stable, byte-pinned cce.synclist/v1 shape.
  SYNC_FORMAT_VERSION, conformance.json, and every existing golden are untouched.
• cce sync pull --all --into <dir> [--remote <url>] — the one-command repo-less consumer
  workspace (#54). From a bare directory: enumerates the cache (the #53 sync list
  machinery), pulls every repo_id's latest artifact into <dir>/<member>/.cce/, and
  synthesizes <dir>/.cce/workspace.yml plus the root and per-member .cce/config, so
  cce search --workspace <dir> and cce mcp --workspace --dir <dir> work immediately —
  zero source checkouts, each member federated at its own independent sha. Members are
  short-named from the repo_id's last __ segment (-2/-3 on collision); the full
  repo_id lives in the member's config so per-member pulls keep working. Repos without a
  latest pointer are warned and skipped, never fatal. Re-runs are idempotent refreshes:
  only members whose latest pointer moved are re-pulled, new repo_ids join the workspace,
  and vanished ones are warned about but never deleted. Synthesized manifests use the new
  neutral type: store-only member type (a member with no source to classify); detection
  never emits it and hand-written manifests stay byte-identical. Consumer mode (including
  the repo-less single-member --latest/--commit pull) is now documented in
  docs/sync.md. SYNC_FORMAT_VERSION, conformance.json, and every existing golden are
  untouched.
• The self-describing cache — published workspace metadata + cce sync verify --checksum-only (#55). Consumer mode 3/3. cce sync push --workspace now also publishes
  the canonical workspace.yml and the derived cross-member workspace-graph.json at
  well-known keys under the workspace's base repo_id
  (hash/<ver>/<base>/workspace.yml / …/workspace-graph.json) — additive by construction
  (neither an artifact nor a refs/ pointer; SPEC-SYNC §3 now states the additive-keys rule
  normatively). The pull paths consume it: pull --workspace installs the published graph,
  merges the real member types/packages into the local manifest (matched by name; the local
  path wins), and can bootstrap a repo-less consumer with no manifest at all; pull --all
  discovers every published manifest via the extended sync list machinery, enriches exactly
  the members each manifest covers, and installs the merged graphs rewritten to the consumer
  member names (member-name collisions across workspaces: first in repo_id order keeps the
  bare name, later ones stay at their -2/-3 names, warned). Result: a repo-less federated
  search regains cross-member graph expansion, byte-identical to the source-side
  workspace. cce sync verify --checksum-only gives consumers a real integrity check with
  zero source checkout: pull records the SHA-256 of the exact index.json bytes it
  installs (an additive installed_sha256 field in .cce/synced.json), and verify re-hashes
  the on-disk file against it — version-independent ("has this file changed since
  pull"), so artifacts pushed by older cce versions verify exactly like current ones
  (live-verified against a mixed-version cache; an export-based comparison would false-fail
  them). Failures are loud and name the member; a marker written by an older cce (no
  recorded hash) is an explicit exit-0 re-pull notice, never a false failure. Documented
  caveat: detects corruption, not a malicious build (true artifact == build(sha)
  verification stays with source-holders/CI). Also from live review: a pull --all refresh
  now re-adopts a member directory whose .cce/config went missing (matched by name,
  noted in the report) instead of duplicating it as <name>-2. Caches without
  published metadata, plain single-member pulls, SYNC_FORMAT_VERSION, conformance.json,
  and every existing golden are untouched.

Documentation

• Consumer-mode documentation sweep (pre-v2.6.9). The whole doc surface now tells the
  #53/#54/#55 story coherently: a "consume a team cache" recipe in docs/how-to.md (the
  flagship repo-less flow), consumer-mode/store-only coverage in docs/workspace.md, a
  repo-less agent-context note in docs/mcp.md, the list/pull --all CLI surface in
  SPEC-SYNC §5, a "consumer mode over a server" decision entry in docs/DECISIONS.md,
  refreshed module-map/llms.txt/README index rows, the Cargo.toml description, and
  current test counts (605) in README/AGENTS/CONTRIBUTING/getting-started/llms.txt.