cce v2.8.0

Added

• Usage visibility (v2.8): cce usage + the opt-in MCP result footer (#35).
  cce usage [--workspace] [--since 24h|7d|<ISO>] [--source mcp|cli|all] [--json]
  is the one-shot, CI-friendly terminal counterpart to the dashboard's
  agent-vs-human panel: the mcp (agent) vs cli (human) split — searches,
  tokens saved, savings ratio, quality, latency — the recent queries, and a
  by_package mini-table in workspace mode. Pure projection, zero new
  accounting: it reuses the exact aggregate() / federated aggregation the
  dashboard serves (including the #28 workspace-root-log rule), so its numbers
  are always identical to cce dashboard's for the same log and window (proven
  by tests that run both paths over one fixture). --json emits the versioned,
  byte-pinned cce.usage/v1 projection (stable field names, the same shapes as
  /api/metrics where they overlap); the human block is byte-pinned too.
  Deterministic, offline, read-only; now is injected below the CLI edge.
  Second surface: a per-project .cce/config key mcp.result_footer: off (default) | on | session appends ONE byte-pinned line to context_search
  results — cce: 5 results from 38,628 chunks · served ~1,204 tok vs ~9,880 baseline · saved ~8,676 (88%) (session adds a running per-session clause).
  Rendered after all measurement from values already on the recorded search
  event: toggling it never changes a recorded metric (same query, footer off vs
  on ⇒ an identical recorded event, test-proven), and with the footer off the
  MCP tool-result bytes, conformance.json, and every MCP golden are untouched.
  Config-only by design — no runtime tool, so the agent cannot toggle its own
  observability. Additive /api/metrics fields feed the new surfaces:
  by_source.*.mean_latency_ms and recent_searches[].source. Spec committed
  as SPEC-USAGE-VISIBILITY.md; docs in docs/mcp.md, docs/dashboard.md,
  and docs/how-to.md.
• cce relevance — the retrieval-relevance evaluation harness (#63). The
  missing third leg of the measurement story: cce conformance proves output
  stability and cce bench/cce eval measure latency and token savings — this
  measures ranking quality. Labeled query→expected-result fixture sets
  (cce.relevance/v1 NDJSON: {query, expected: [file or file#kind anchors], k}
  per line — a documented contract like the knowledge feed) run through the REAL
  retrieval pipeline at a named backend (bm25 = the issue-#30 keyword-only
  mode, vector = pure cosine order, hybrid = the full SPEC §6 pipeline
  cce search serves) and are scored with standard IR metrics — precision@k,
  recall, MRR, F1 — per query and macro-averaged per backend.
  --compare A,B prints per-query deltas so a proposed ranking change shows
  exactly which queries it helps or hurts before it merges. Two starter fixture
  sets ship in eval/relevance/ (code over the conformance sample corpus;
  knowledge-style queries over a small markdown corpus); the hash-path --json
  report (cce.relevance.report/v1) is byte-pinned in CI against
  test/fixture/relevance/code.golden.json, conformance-style. Measurement
  only: zero ranking-behavior changes. See docs/relevance.md.
• Build fingerprint + cce doctor — detect config drift before it degrades
  retrieval (#62). Every store write (cce index, workspace indexing, the
  cce init local index, and every cce sync pull install) now stamps a small
  cce.fingerprint/v1 block into fingerprint.json beside the store: engine
  version, embedder id + dimensions, the chunker identity (language-pack set,
  markdown split budget, nesting limit), the tokenizer rule id, and the redaction
  flag — plus a SHA-256 self-checksum over the canonical serialization and a
  SHA-256 binding to the exact store bytes it describes (a store rebuilt by an
  older binary is detected as stale, never trusted). Additive by construction:
  the fingerprint is a separate file old readers never open — the store bytes,
  the sync artifact, conformance.json, and every byte-pinned golden are
  untouched, and all recorded values derive from pinned constants so the
  fingerprint itself is deterministic. cce doctor [--dir|--store] is the
  read-only report over it: fingerprint fields vs the running binary's pinned
  equivalents, with every mismatch explained ("chunker changed: chunk_ids may
  not be reproducible; re-index to realign"; embedder/dimension drift = the #30
  meaningless-cosine failure mode); store parse health with the #30
  empty-embedding tripwire; the #55 installed-bytes corruption re-hash for
  pulled stores (reusing the verify --checksum-only machinery verbatim); the
  knowledge store's contract version, snapshot id, and data as-of; and a
  workspace mode that checks every member (StoreOnly consumers included) and
  summarizes. Doctor never mutates; it exits non-zero ONLY on definite
  corruption/mismatch — soft findings are distinct advisory lines, and a
  pre-fingerprint store is a graceful re-index notice with exit 0. Hermetic
  tests only (no network, no Ollama).