v0.2.1

Security

• Path jail (resolve_under_root) now lives in ragfs-core and is enforced by SafetyManager (soft_delete / restore / undo), so Python RagfsSafetyManager and MCP ragfs_delete_to_trash cannot escape the source root.
• Documented the advisory-response ladder, ignore: ownership, and §1.2 review cadence (next review by 2026-12-31) in SECURITY.md.

Removed

• BREAKING: Optional pdf_oxide extractor feature. PDF text and images continue to use PdfExtractor (pdf-extract + lopdf). --features pdf_oxide is no longer valid.

Changed

• Agent docs (CLAUDE.md, AGENTS.md) list all 10 Cargo workspace crates plus ragfs-mcp. docs/PERFORMANCE.md documents [embedding].model, CLI-only --force, and --hybrid vs [query].hybrid.
• Embedding dimension and model id for LanceStore come from Embedder::dimension() / model_name(). Opening an index whose vector width differs from the embedder fails with StoreError::Schema.
• Split ragfs-fuse FUSE handler filesystem.rs into filesystem/ modules by virtual-directory family (query, ops, safety, semantic, passthrough). Issue #52.
• CI: Swatinem/rust-cache uses a shared key across Check/Clippy/Test/Docs/Python; pull requests run Python 3.12 only (3.10–3.13 stays on main); coverage and Python integration run on main only. Dependabot ignores 0.x minor bumps of criterion, notify-debouncer-full, and tokenizers; auto-merge skips Cargo 0.x minors.
• CI cost: deps compile at opt-level=0 on runners; PRs drop --all-features (keep ragfs/test-backends); Python jobs skip when Python paths are unchanged; Coverage is weekly; docs.yml uses cargo +nightly so rust-toolchain.toml cannot pin it to stable. A CI aggregator treats skipped rust jobs as success on docs-only PRs.
• Project hygiene: MSRV docs 1.91, Makefile / rust-toolchain.toml, CODEOWNERS, GitHub private advisory as the security channel, contents: read on CI/coverage, pinned ruff==0.15.9.
• docs/AUDIT.md: RUSTSEC-2025-0119 (number_prefix) is resolved. hf-hub 0.5 pulls indicatif 0.18, which uses unit-prefix (issue #79). Three unmaintained rows remain (paste #80, core2 #77, ttf-parser #82). paste also stays via gemm, rav1e, and lance-bitpacking, so a tokenizers bump alone does not clear it.
• Drop core2 (RUSTSEC-2026-0105, issue #77): bitstream-io 4.10 uses no_std_io2. image no longer enables avif (the unused ravif/rav1e encoder); PNG and JPEG writes are unchanged. paste (#80) and ttf-parser (#82) stay.

Added

• CLI integration tests (assert_cmd) for config/--force/--hybrid/max_file_size and unsupported models, using RAGFS_TEST_EMBEDDER=noop.
• Repo social card (docs/assets/social.svg source, docs/assets/social.png 1280×640) as the README header. README is a front page (quick start, feature matrix, grouped docs); the CLI manpage stays in docs/USER_GUIDE.md.

Fixed

• Revert Dependabot lancedb 0.39.0 (#72): Error::Http is cfg(feature = "remote") while job.rs uses it with default features. Pin stays 0.37.1; cargo Dependabot ignores lancedb >=0.38 and Arrow 59+.
• MCP ragfs_batch_operations serializes a failed atomic batch: BatchResult.rollback_id aliases the batch id (the previous attribute miss turned a jail reject into {"error": "... no attribute 'rollback_id'"}).
• Align candle-core and candle-nn with candle-transformers 0.11 so ragfs-embed compiles (one Tensor type, not 0.9 + 0.11).
• Pin the MSRV job to rustc 1.91 via dtolnay/rust-toolchain@stable + toolchain: "1.91" (Dependabot #67 had moved the action tag to 1.120).