Code Index

### Changed

- Reuse the approved launch-film hero and three panels on the marketplace card.
- Rewrite listing copy around finding existing code, indexed Python callers and commit freshness.
- Keep the existing launch film. No skill, API or permission change.

The marketplace listing shows the launch film. No skill change.

### Added

- `getFidelity` (`GET /{project_id}/fidelity`) — per directory, how many
  symbols were fully parsed and how many were only regex-matched, counted over
  the directory and everything beneath it. Optional `branch`. JSON only.
- `listIndexJobs` (`GET /{project_id}/jobs`) — the project's index jobs,
  newest first, with `status`, `reason_class` and `detail`, plus the
  `precondition` that stops a new job being queued. `limit` (1–100, default
  25), `offset`, `format=yaml|md`. Read-only: agents cannot start, claim or
  finish a job.

Both use the same `code.index.read` entitlement and `code:read` PAT scope as
every other method; no route changed (SP-46).

### Added

- `testsFor` (`POST /{project_id}/tests-for`) — list the test files that can
  reach up to 200 repo-relative files through stored `import` and `reads`
  edges, nearest first, with `hops` and `edge_kinds` per test. Same
  `code.index.read` entitlement and `code:read` PAT scope as every other
  method. Body: `paths` (1–200, each at most 1024 chars), `depth` (1–6,
  default 4), `limit` (1–500 per path, default 200); `format=yaml|md` is a
  query parameter. The route fails open: with no ready index it answers 200,
  every path `known: false`, and the reason in `degraded`.

### Fixed

- `listFiles` now exposes the API's `order=symbols|path` selection and
  repo-relative `after` cursor. Use `order=path` and pass the last returned
  path as `after` to page through large directories.

### Added

- `getGraphFolders` (`GET /{project_id}/graph/folders`) — read the folder-level
  import map beneath a repo-relative directory: which folders import which,
  which files are hubs, and which import each other. Joins the skill under the same
  `code.index.read` entitlement and the same `code:read` PAT scope (D52).
  Parameters: `dir` (the route's wire name, exposed via `Query(alias="dir")`;
  a dot is the repository root; max 1024 chars), `depth` (1–10, default 2),
  `limit` (positive; the server clamps it), `branch` (max 255 chars), and
  optional `format=yaml|md`. The response reports `truncated`,
  `limit_clamped`, and `effective_limit`. Edges are imports only (Python and
  TS/JS, D43): no Go edges and no call edges; `indexed: false` means "no
  ready index", never "no imports".
- `SKILL.md` adds a short section on what to do when OPVS cannot answer: if a
  call 5xxs, times out, or cannot connect, the agent carries on WITHOUT the
  index (reading the repository or using the handbook), does NOT retry in a
  loop, and says ONCE in its reply that the code index was unavailable. A 4xx
  is not this case — a 4xx is a wrong call, and the agent fixes the call.

### Added

- `listNodeChanges` accepts `order=asc|desc` (default `asc`, unchanged) and a `before` cursor for newest-first
  paging; `after` stays valid only with `order=asc`. Reuse `next_after` as `after` for ascending pages or as `before`
  for descending pages. The API side shipped in TCI-153 (#2885); this release makes it visible to agents.

### Added

- `listFiles` and `listSymbols` accept `format=yaml|md`, matching the API's text renderings while JSON remains the
  default when `format` is omitted. Both renderings preserve the selected commit and branch, every returned row,
  and any truncation reason.

### Added

- `getGraph` accepts `format=yaml|md` for a text rendering of the import neighbourhood. JSON stays the default when
  `format` is omitted. The yaml and md renderings carry every field the JSON does, including each neighbour's edge
  `kind`, `truncated` and `limit_clamped`.

### Added

- `getGraph` (`GET /{project_id}/graph`) — read the depth-1 or depth-2
  IMPORT neighbourhood of one stable node (`direction` is `in`, `out`, or the
  default `both`; `depth` is 1 or 2). Joins the skill under the same
  `code.index.read` entitlement and the same `code:read` PAT scope (D46).
  Edges are imports only (Python and TS/JS, D43): there are no Go edges and
  no call edges. Each neighbour carries `state` (`live`, `removed`,
  `moved`), `kind: "import"`, and `derivation` (`parsed` or `regex`). The
  route does not render `format=yaml|md`, so the schema declares no `format`
  parameter (per the format-dial test). `limit` is positive and the API
  clamps it; the response reports `truncated`, `limit_clamped`, and
  `effective_limit`.

### Added

- `resolveNodes` (`POST /{project_id}/nodes/resolve`) — batch-resolve stable
  code anchors against the ledger; one `live | removed | moved | unknown`
  verdict per anchor, with `moved_to_anchor` and `fallback: "file"`
  follow-on fields. `format` is declared `in: query` so the runtime does not
  forward it as a body field that `CodeNodesResolveRequest` (extra="forbid")
  would reject as a 422.
- `listNodeChanges` (`GET /{project_id}/nodes/changes`) — page the attached
  branch's appended node events, oldest first, with `after` as the cursor
  and `history_skipped_reason` exposed when history is not being recorded.
  Adds `node_id` (a list of up to 100 stable node UUIDs) and `path_prefix`
  (a repo-relative path, max 1024 chars) as filters, mirroring TCI-122.

### Added

- Initial read-only marketplace skill with tree, summary, files, symbols, and
  context-search methods.