v1.5.0

What's new

Live metering from Reaper

New read_live_metrics MCP tool reads real-time loudness and peak metrics from
a running Reaper session, bringing the tool count to 20.

Tunable analysis

New AnalysisSettings layer: FFT and frame sizes, polarity and crest thresholds,
PHAT window, masking band splits, and problem-detection thresholds are now
tunable through PHANTOM_* environment variables. Analysis caching is scoped to
the active settings, so changing a knob never returns stale results. All 40
runtime variables are documented in the README, and phantom doctor prints its
environment table straight from the central registry so docs and code can't
drift.

Stem separation is its own package

The Demucs-based separation engine moved to a sibling PyPI package,
phantom-audio-separation (also 1.5.0). Installing phantom-audio[separation]
still works and now pulls it in; the core package stays lighter for everyone who
doesn't separate stems.

Safer Reaper setup

phantom setup-reaper is now transactional: it backs up existing configuration,
stages changes before applying them, and supports --dry-run and
--uninstall.

Changed

• Install telemetry (install.sh) now sends a single POST with a JSON body:
  install method, outcome, and one of six enumerated failure reason codes, plus
  a stable per-run id. Same endpoint, same opt-out (PHANTOM_NO_TELEMETRY=1),
  still fire-and-forget. The Windows installer also reports install outcomes;
  its payload moves to the same JSON shape in an upcoming release.
• Typed response models throughout: per-band maps, problem details, and
  dict-compatible flat maps replace loose dicts.
• Internal analysis facade: all analysis tools route through a single registry
  with generated wrappers, gated by a schema snapshot test so the MCP surface
  can't change silently.

Fixed

• Input hardening across the analysis pipeline: non-finite samples are rejected,
  sample magnitudes bounded, decoded array sizes capped, environment values
  validated, and error messages redact absolute paths (including UNC and spaced
  paths).
• phantom analyze --json output contract restored.
• 2026-07-05 audit findings and all Phase 0–3 code-review findings resolved.
• CLI tests no longer overwrite a real .mcp.json.

Security

• cryptography 49.0.0 → 50.0.0 (PYSEC-2026-3552).
• torch → 2.13.0, setuptools → 83.0.0, plus patched transitive dependencies.
• Semgrep SAST added to CI and pre-commit; gitleaks action updated to v3.

Docs

• All five plugin skills (mix, mastering, effects, diagnostician,
  session-architect) recalibrated against the actual analysis code — thresholds,
  knobs, and tool facts now match what ships.
• Full PHANTOM_* environment variable reference in the README, including the
  installer-only variables and telemetry disclosure.

Full Changelog: v1.3.1...v1.5.0