Vesma 5.2.0 — native harnesses, on-board cortex, heartbeat in shadow

Vesma 5.2.0 extends the memory engine to four more harnesses natively, ships the first on-board decision model, and lays the awareness-heartbeat foundation — every new capability sits behind an explicit switch, and default behaviour stays byte-identical unless you opt in.

Highlights

• Native codex, cursor, claude-code and windsurf targets — vesma integration setup now wires the engine into all four natively: TOML-safe codex config splicing (~/.codex/config.toml), additive JSON merges for the rest, idempotent stamped deploys, evidence-checked uninstall. Any harness works with the vesma memory engine natively (ADR-0033 H-2).
• Cortex decisions on board — the vesma-cortex-v1 ONNX model (98 KB, ADOPT-calibrated) rides the wheel; opt in with decision_provider: vesma. The default stays deterministic; every cortex error degrades fail-open (CORTEX-E-* warns, ingest is never blocked); zero network imports, AST-pinned.
• Awareness heartbeat, wave 0 — shadow — awareness.native_heartbeat_mode: off | shadow | canary | on (default off, byte-identical engine behaviour, CI-pinned). Shadow composes and measures without rendering; events land in the new awareness_events sidecar table (90-day retention, zero peer content). Admin contour only (ADR-0035); waves 1–2 track on #453.
• Code-graph lifecycle — vesma graph repoint for moved roots (no more nuclear delete), root_missing in project listings, agent-side registration via vesma graph register / mnemos_register_project, and code_graph.secret_allowlist for known-fake secret fixtures (the PG4 issuance scan is never waived).
• Search & awareness quality — Cyrillic goals now get conflict hints (Unicode tokenizer); bare task slugs (my-task) find task:my-task rows; pre_flight renders one operational picture instead of three; graph coverage distinguishes missing from unindexed; aggregate surfaces name redacted_patterns.
• Update UX — vesma update asks before applying (-y skips), pip output collapses to one summary line per surface, and sessions served by an upgraded server see a one-time vesma server updated: X → Y notice.

Verification

Full suite on the release cut: 4978 passed / 4 skipped in 4m13s, with the single pre-merge failure being the version-guard VERSION drift (file left at 5.1.2 by an interrupted release session) — closed by the VERSION sync commit; tests/test_version_guard.py re-run green. ruff check . — all checks passed; ruff format --check . — 356 files formatted.

Compatibility & rollback

Additive minor: new behaviour ships behind default-off flags (decision_provider, awareness.native_heartbeat_mode) or as pure fixes; storage changes are additive sidecar tables (awareness_events, a composite (project, created_at) index) that legacy DBs pick up on their next open. Rollback: pip install vesma-memory-server==5.1.2 (or vesma update --to 5.1.2); the 5.1.x data layout is untouched.