feat: stabilize 2.1 alpha MCP change-control and onboarding surfaces

.github/actions/codeclone/README.md

@@ -39,7 +39,7 @@ source under test. Remote consumers still install from PyPI.
 For strict reproducibility, pin the full release tag:
 
 ```yaml
-- uses: orenlab/codeclone/.github/actions/codeclone@v2.0.2
+- uses: orenlab/codeclone/.github/actions/codeclone@v2.1.0a1
 ```
 
 For long-lived workflows, `@v2` follows the latest compatible 2.x action
@@ -81,7 +81,7 @@ jobs:
 | Input                   | Default                         | Purpose                                                                                                           |
 |-------------------------|---------------------------------|-------------------------------------------------------------------------------------------------------------------|
 | `python-version`        | `3.14`                          | Python version used to run the action                                                                             |
-| `package-version`       | `2.0.2`                         | CodeClone version from PyPI for remote installs; ignored when the action runs from the checked-out CodeClone repo |
+| `package-version`       | `2.1.0a1`                       | CodeClone version from PyPI for remote installs; ignored when the action runs from the checked-out CodeClone repo |
 | `path`                  | `.`                             | Project root to analyze                                                                                           |
 | `json-path`             | `.codeclone/report.json`  | JSON report output path                                                                                           |
 | `sarif`                 | `true`                          | Generate SARIF and try to upload it                                                                               |
@@ -146,7 +146,7 @@ Notes:
 ## Install policy
 
 Released action tags pin the PyPI package version in action metadata. For
-example, `@v2.0.2` installs `codeclone==2.0.2` unless you override
+example, `@v2.1.0a1` installs `codeclone==2.1.0a1` unless you override
 `package-version`.
 
 Explicit prerelease or smoke-test override:

.github/actions/codeclone/_action_impl.py

@@ -22,7 +22,7 @@
 import subprocess
 from dataclasses import dataclass
 from pathlib import Path
-from typing import Literal
+from typing import Literal, TypeGuard
 
 COMMENT_MARKER = "<!-- codeclone-report -->"
 DEFAULT_CODECLONE_PACKAGE_VERSION = "2.1.0a1"
@@ -340,10 +340,16 @@ def _run_result_from_paths(*, exit_code: int, inputs: ActionInputs) -> RunResult
     )
 
 
+def _is_json_object(value: object) -> TypeGuard[dict[str, object]]:
+    """Return true for JSON object values decoded from report payloads."""
+
+    return isinstance(value, dict)
+
+
 def _mapping(value: object) -> dict[str, object]:
     """Return ``value`` when it is a JSON object, otherwise an empty mapping."""
 
-    return value if isinstance(value, dict) else {}
+    return value if _is_json_object(value) else {}
 
 
 def _int(value: object, default: int = 0) -> int:

.pre-commit-config.yaml

@@ -7,7 +7,6 @@ repos:
       - id: check-merge-conflict
       - id: end-of-file-fixer
       - id: trailing-whitespace
-      - id: check-added-large-files
       - id: check-toml
       - id: check-yaml
       - id: check-json
@@ -69,3 +68,11 @@ repos:
         pass_filenames: false
         files: ^docs/.*\.md$
         stages: [ pre-commit ]
+
+      - id: ty-prod-scope
+        name: Ty check production scope
+        entry: bash -c 'uv run ty check codeclone .github/actions benchmarks'
+        language: system
+        pass_filenames: false
+        always_run: true
+        stages: [ pre-commit ]

CHANGELOG.md

@@ -27,22 +27,34 @@ evidence, platform self-observability, and broader IDE/agent integration.
   tracking, and reviewed-state persistence.
 - **Native agent and IDE integrations** for VS Code, Claude Desktop, Claude Code, Codex, and Cursor, including
   governance, audit, memory, trajectory, and structural-review workflows.
+- **`codeclone setup`** — lazy-loaded CLI readiness surface (`status`, `doctor`, `plan`, `apply`, `wizard`) with
+  capability-aware snapshots, read-only diff preview, and bounded `pyproject.toml` / `.gitignore` merges (no MCP
+  intent, no baseline or report writes).
 - Expanded controller, memory, trajectory, analytics, semantic-search, observability, blast-radius, patch-verification,
-  and diagnostic CLI/MCP surfaces.
+  and diagnostic CLI/MCP surfaces. The default MCP server surface is now **38 tools** (**40** when VS Code enables the
+  IDE governance channel).
 - Reorganized documentation into a contract-focused 00–26 book with unified integration guidance and explicit edition
   tiers.
 - MCP schemas now include parameter descriptions, deterministic `next_tool` guidance, token-budget tracking, workspace
   hygiene warnings, and documentation-contract linting.
+- MCP response governance now advertises `context_governance` metadata for bounded agent replies. Workflow, memory, and
+  implementation-context responses preserve mandatory control facts inline, compact recoverable evidence under
+  `partial_enforce`, disclose omitted lanes, and expose exact drill-down through durable receipt, Patch Trail, blast
+  artifact, memory continuation, and implementation-context page retrieval.
 
 ### Contract changes
 
 - Cache schema advanced to **2.9** for the rebuildable per-function relationship-fact projection and to **2.10** for
   intra-module, class-method, and receiver-aware call resolution.
 - Engineering Memory schema advanced to **1.7** for trajectory and Patch Trail evidence.
+- Semantic index format advanced to **3** for LanceDB rows with `source_revision`; existing semantic sidecars should be
+  rebuilt.
 - Corpus Analytics store schema advanced to **1.2**.
 - Corpus Analytics JSON export schema advanced through **1.2** and **1.3**.
 - Corpus Analytics representation contract advanced to **3**.
 - Corpus Analytics control-plane contract introduced at **1.0**.
+- MCP response governance contract introduced at **1.0** with deterministic `utf8_bytes_div_4_v1` context-unit
+  estimation and explicit `observe` / `partial_enforce` modes.
 - `derived.module_map` and `derived.review_queue` remain report-only projections excluded from the integrity digest;
   they add no analysis pass, metrics family, or report schema bump.
 - Live Implementation Context relationship facts remain off the canonical report and do not change canonical report