v0.15.0

Added

• /codesage-review gains --deep (multi-lens reviewers on high-risk slices), --no-verify, --model, and --verify-model; new findings pass an adversarial verification stage (new codesage-finding-verifier agent) by default.
• CODESAGE_HF_DOWNLOAD_TIMEOUT_SECS bounds Hugging Face artifact downloads during model load.

Changed

• Upgrade the rmcp MCP SDK to 2.x (MCP 2025-11-25 spec model types).
• /codesage-review / /codesage-revalidate drop findings whose quoted evidence doesn't match the cited file, compute finding_ids orchestrator-side with fuzzy prior-matching (IDs survive model/wording changes and small code motion), repair unparseable reviewer JSON before erroring a feature, and pass a last-reviewed base SHA so re-reviews focus on the diff.
• codesage-feature-reviewer agent: explicit review procedure (trust-boundary tracing, error-path walks, self-audit), contract lookups via find_symbol outside the slice, risk-scaled read depth, lens mode, and severity calibration anchors.
• assess_risk returns found: false for paths absent from both the structural and git-history indexes; assess_risk_diff returns empty_input: true with a note for empty file lists.
• MCP tools cap large limits, depth, and file-path lists instead of accepting unbounded request sizes.
• MCP session_start returns a compact summary plus snapshot_path; the full file list remains persisted in .codesage/sessions/<session_id>.json.
• find-symbol --kind and find-references --kind reject unknown values instead of running unfiltered.

Fixed

• The filesystem watcher retries structural/semantic reindexes and removals on a transient busy/locked database instead of dropping the edit, gives up on removals after repeated hard failures so it can still idle out, removes stale rows for empty files, and no longer deletes semantic chunks before a replacement embedding succeeds.
• review_rehearsal includes high-risk files preserved inside assess_risk_diff.clustered_directories[].top_files.
• list_dependencies reports found: false with a note for paths absent from the structural index.
• find_similar MCP params accept min_jaccard as a JSON string number, rejecting non-finite values (nan/inf) that would silently zero results.
• assess_risk_diff, assess_risk_batch, and recommend_tests MCP calls reject empty file_paths instead of returning successful empty payloads.
• search no longer creates a table on the query path when the BM25 FTS sidecar is missing, so it works against a read-only index.
• impact_analysis deduplicates traversal by file, qualified name, and line instead of qualified name alone.
• search applies every requested language filter to BM25-fused rows.
• Feature mapping and upserts no longer leave partial feature, route-handler, or trust-boundary state when a run fails mid-pass.
• A failed vec-table drop or schema migration rolls back cleanly instead of leaving a half-migrated database.

Security

• .codesage directories and index.db sidecars are created with private Unix permissions; MCP stale-file checks refuse indexed paths that escape the project root.
• File discovery skips paths that cannot be made project-relative instead of storing absolute/out-of-root paths.
• Allowlisted embedding and reranker model artifacts are pinned by Hugging Face revision and sha256 before loading tokenizer or ONNX bytes.
• Embedding batch size is capped at 256 from config, environment, and CLI overrides.
• Bump crossbeam-epoch to 0.9.20, clearing RUSTSEC-2026-0204 (invalid pointer dereference in fmt::Pointer).