AOCI-CODE v0.1.0-rc20

AOCI-CODE v0.1.0-rc20 is built from 45990a1dcfc4415efdc6fbfa13bc159a415f127c.

Five user reports and two contributed pull requests: an E scale audit,
submodule boundaries, refusals that name the working path, root-anchored
artifact names for new repositories, and a benchmark.

• verify and check audit each Code Entry's E scale letter against the
  source line count under the Meta's bands and report the mismatches, as
  information that never changes the exit code (e_scale in --json);
  aoci_maintain with intent=cognition_optimization ranks such Entries for
  review after high-importance Entries without an S, with selection reason
  e_scale_mismatch (#103, reported by @Rosenls). Through rc19 the letter was
  checked only in the Legacy layout.
• A git submodule is reported as a git_submodule boundary instead of an
  unsafe_filesystem_object: scan says how many submodules it left alone,
  and scope explain on a path beneath one names the boundary (#107, reported
  by @zsjlfb). Indexing a submodule's code still means initializing the
  submodule itself.
• The refusals a stale Managed Scope Baseline meets now name the path that
  works: scan --force points at aoci_maintain, aoci_remove_entry, and
  aoci scope activate, and baseline scope plan/preview say they are the
  Legacy refresh (#102, reported by @Lixiang9716).
• Docs: the index format contract states that an Entry's leading name is the
  bare file name within its directory section (#103); the README's execution
  mode table marks endpoint-native drafting as Legacy-only and says what the
  ai configuration block serves in a Volumes v1 repository.
• New repositories get exclude_root_dirs (#104, PR #105 by @dayebishouji):
  init persists backup, backups, build, cache, coverage, dist,
  target, tmp, uploads, artifacts, and vendor there instead of in
  exclude_dirs, so those names exclude a directory at the repository root
  or wherever git ignores it, while a tracked nested src/build/tool.go or
  views/monitor/cache/index.vue is source. A git-ignored nested directory of
  such a name stays one inventory line (#97). Existing repositories keep
  their any-depth exclude_dirs and their identity; opting in is a config
  change plus aoci scope activate. config get/set, doctor, and
  scope explain know the field; the upgrade axis gains a legacydirs shape
  and publishes 72 checks per released version over nine shapes. A repository
  that carries the field needs rc20 or later on every machine: an older
  binary demands a Scope Change over it and drops the field when it saves the
  team configuration. The Baseline reads Entry paths through the same lists
  as the inventory, so an Entry under a root-excluded directory is skipped
  rather than reported as an orphan; config set on either directory list
  takes build/ as build, drops duplicates, and refuses app/build, which
  could never match.
• Toolchain: Go 1.26.9. govulncheck reports nine standard-library advisories
  against 1.26.6 (GO-2026-6603, 6605, 6607, 6608, 6610, 6611, 6612, 6613,
  6617 in net/http, net/textproto, and crypto/tls, which the status
  page and the database drivers link), all fixed in 1.26.9; release binaries
  are built with it and go.mod requires it.
• Tests: the 1,000-object governance timing moved from a five-second
  wall-clock assertion to a benchmark that full-confidence runs (PR #108 by
  @dayebishouji).

See docs/install.md and docs/supply-chain.md for asset verification.