diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b759e181b..6b3a760f5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -103,46 +103,35 @@ jobs:
         run: |
           mysql -h 127.0.0.1 -P 3306 -u root -ppostgres codegraph < sql/mysql/001-initial-schema.sql
           mysql -h 127.0.0.1 -P 3306 -u root -ppostgres codegraph < sql/mysql/002-add-repos-registry.sql
-      - name: Install grcov
-        uses: taiki-e/install-action@grcov
-      - name: Run tests with coverage instrumentation
+      - name: Install cargo-llvm-cov
+        uses: taiki-e/install-action@cargo-llvm-cov
+      - name: Clean coverage data
+        run: cargo llvm-cov clean --workspace
+      - name: Run tests with coverage
         env:
           RUSTFLAGS: "-Cinstrument-coverage"
-          LLVM_PROFILE_FILE: "codegraph-%p-%m.profraw"
-        run: cargo test --workspace --no-fail-fast
+        run: cargo llvm-cov test --workspace --no-fail-fast --no-report
       - name: Storage integration tests (postgres)
         env:
           RUSTFLAGS: "-Cinstrument-coverage"
-          LLVM_PROFILE_FILE: "codegraph-%p-%m.profraw"
           TEST_RDBMS_DSN: "postgres://postgres:postgres@127.0.0.1:5432/codegraph"
           TEST_RDBMS_REPO_ID: "1"
-        run: cargo test -p codegraph-graph --features postgres --test rdbms -- --ignored --nocapture --test-threads=1
+        run: cargo llvm-cov test -p codegraph-graph --features postgres --test rdbms --no-report -- --ignored --nocapture --test-threads=1
       - name: Storage integration tests (mysql)
         env:
           RUSTFLAGS: "-Cinstrument-coverage"
-          LLVM_PROFILE_FILE: "codegraph-%p-%m.profraw"
           TEST_RDBMS_DSN: "mysql://root:postgres@127.0.0.1:3306/codegraph"
           TEST_RDBMS_REPO_ID: "1"
-        run: cargo test -p codegraph-graph --features mysql --test rdbms -- --ignored --nocapture --test-threads=1
+        run: cargo llvm-cov test -p codegraph-graph --features mysql --test rdbms --no-report -- --ignored --nocapture --test-threads=1
       - name: Storage integration tests (redis)
         env:
           RUSTFLAGS: "-Cinstrument-coverage"
-          LLVM_PROFILE_FILE: "codegraph-%p-%m.profraw"
           TEST_REDIS_DSN: "redis://127.0.0.1:6379"
-        run: cargo test -p codegraph-graph --features redis --test redis -- --ignored --nocapture
+        run: cargo llvm-cov test -p codegraph-graph --features redis --test redis --no-report -- --ignored --nocapture
       - name: Generate coverage report (lcov)
         run: |
           mkdir -p ./target/coverage
-          grcov . \
-            --binary-path ./target/debug/ \
-            --source-dir . \
-            --output-type lcov \
-            --branch \
-            --ignore-not-existing \
-            --ignore "/*" \
-            --ignore "*/tests/*" \
-            --ignore "*/benches/*" \
-            --output-path ./target/coverage/lcov.info
+          cargo llvm-cov report --lcov --output-path ./target/coverage/lcov.info
 
       - name: Upload to Codecov
         uses: codecov/codecov-action@v5
diff --git a/.github/workflows/release-sign.yml b/.github/workflows/release-sign.yml
index f037af426..78fa5674e 100644
--- a/.github/workflows/release-sign.yml
+++ b/.github/workflows/release-sign.yml
@@ -20,6 +20,14 @@ name: Sign & Verify Release
 on:
   release:
     types: [published]
+  # Allow manually signing an already-published release (e.g. v2.0.1) from the
+  # Actions tab — useful for backfilling signatures without a new release.
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Release tag to sign (e.g. v2.0.1)"
+        required: true
+        default: ""
 
 permissions:
   contents: write        # upload release assets (.sig / .crt / re-packed tarball)
@@ -33,7 +41,7 @@ jobs:
       - name: Poll until macOS tarballs exist
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ github.event.release.tag_name }}
+          TAG: ${{ github.event.release.tag_name || github.event.inputs.tag }}
         run: |
           set -euo pipefail
           for i in $(seq 1 60); do
@@ -56,7 +64,7 @@ jobs:
       - name: Re-codesign + re-upload macOS tarballs
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ github.event.release.tag_name }}
+          TAG: ${{ github.event.release.tag_name || github.event.inputs.tag }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
@@ -86,7 +94,7 @@ jobs:
       - name: Sign every binary archive
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          TAG: ${{ github.event.release.tag_name }}
+          TAG: ${{ github.event.release.tag_name || github.event.inputs.tag }}
           REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
diff --git a/Cargo.lock b/Cargo.lock
index b8918a9c5..b47cb31cd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -711,7 +711,7 @@ checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
 
 [[package]]
 name = "codegraph"
-version = "2.0.2"
+version = "2.0.3"
 dependencies = [
  "anyhow",
  "camino",
@@ -732,7 +732,7 @@ dependencies = [
 
 [[package]]
 name = "codegraph-api"
-version = "2.0.2"
+version = "2.0.3"
 dependencies = [
  "anyhow",
  "camino",
@@ -749,7 +749,7 @@ dependencies = [
 
 [[package]]
 name = "codegraph-bench"
-version = "2.0.2"
+version = "2.0.3"
 dependencies = [
  "anyhow",
  "camino",
@@ -767,7 +767,7 @@ dependencies = [
 
 [[package]]
 name = "codegraph-context"
-version = "2.0.2"
+version = "2.0.3"
 dependencies = [
  "codegraph-core",
  "codegraph-graph",
@@ -777,7 +777,7 @@ dependencies = [
 
 [[package]]
 name = "codegraph-core"
-version = "2.0.2"
+version = "2.0.3"
 dependencies = [
  "async-graphql",
  "camino",
@@ -788,7 +788,7 @@ dependencies = [
 
 [[package]]
 name = "codegraph-extract"
-version = "2.0.2"
+version = "2.0.3"
 dependencies = [
  "camino",
  "codegraph-core",
@@ -822,7 +822,7 @@ dependencies = [
 
 [[package]]
 name = "codegraph-graph"
-version = "2.0.2"
+version = "2.0.3"
 dependencies = [
  "async-trait",
  "bincode",
@@ -852,7 +852,7 @@ dependencies = [
 
 [[package]]
 name = "codegraph-graphql"
-version = "2.0.2"
+version = "2.0.3"
 dependencies = [
  "anyhow",
  "async-graphql",
@@ -874,7 +874,7 @@ dependencies = [
 
 [[package]]
 name = "codegraph-installer"
-version = "2.0.2"
+version = "2.0.3"
 dependencies = [
  "anyhow",
  "camino",
@@ -890,7 +890,7 @@ dependencies = [
 
 [[package]]
 name = "codegraph-mcp"
-version = "2.0.2"
+version = "2.0.3"
 dependencies = [
  "anyhow",
  "axum",
@@ -912,7 +912,7 @@ dependencies = [
 
 [[package]]
 name = "codegraph-sboxes"
-version = "2.0.2"
+version = "2.0.3"
 dependencies = [
  "camino",
  "codegraph-core",
diff --git a/Cargo.toml b/Cargo.toml
index e96b8d0e4..ac77d012d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -15,7 +15,7 @@ members = [
 ]
 
 [workspace.package]
-version = "2.0.2"
+version = "2.0.3"
 edition = "2021"
 rust-version = "1.80"
 license = "MIT"
diff --git a/codecov.yml b/codecov.yml
new file mode 100644
index 000000000..689c74b3a
--- /dev/null
+++ b/codecov.yml
@@ -0,0 +1,10 @@
+coverage:
+  status:
+    project:
+      default:
+        target: 70% # Tổng coverage toàn dự án phải đạt tối thiểu 70%
+        threshold: 10% # Cho phép sai lệch tối đa 10 điểm % (PR vẫn pass nếu coverage >= 60%)
+    patch:
+      default:
+        target: 100% # Các dòng code mới trong PR phải được test phủ 100%
+        threshold: 0% # Không chấp nhận bất kỳ dòng code mới nào thiếu test
diff --git a/packaging/aur/codegraph-rs-bin/PKGBUILD b/packaging/aur/codegraph-rs-bin/PKGBUILD
index 9c2df5dcf..64e82a364 100644
--- a/packaging/aur/codegraph-rs-bin/PKGBUILD
+++ b/packaging/aur/codegraph-rs-bin/PKGBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Hung Pham <hung0913208@icloud.com>
 pkgname=codegraph-rs-bin
-pkgver=2.0.2
+pkgver=2.0.3
 pkgrel=1
 pkgdesc="Local-first code intelligence: tree-sitter knowledge graph + MCP server (prebuilt binary)"
 arch=('x86_64' 'aarch64')
diff --git a/packaging/choco/codegraph.nuspec b/packaging/choco/codegraph.nuspec
index 4a3c9f578..bdaf61a89 100644
--- a/packaging/choco/codegraph.nuspec
+++ b/packaging/choco/codegraph.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>codegraph</id>
-    <version>2.0.2</version>
+    <version>2.0.3</version>
     <title>codegraph</title>
     <authors>Hung Pham</authors>
     <projectUrl>https://github.com/hungpham10/codegraph-rs</projectUrl>
diff --git a/packaging/winget/codegraph.yaml b/packaging/winget/codegraph.yaml
index 6b23ac9ba..e1eb23878 100644
--- a/packaging/winget/codegraph.yaml
+++ b/packaging/winget/codegraph.yaml
@@ -6,7 +6,7 @@
 # release time (or automate it in the release pipeline before submitting to
 # microsoft/winget-pkgs).
 PackageIdentifier: hungpham10.codegraph
-PackageVersion: 2.0.2
+PackageVersion: 2.0.3
 PackageName: codegraph
 Publisher: Hung Pham
 PublisherUrl: https://github.com/hungpham10/codegraph-rs
@@ -18,7 +18,7 @@ PackageUrl: https://github.com/hungpham10/codegraph-rs
 InstallerType: zip
 Installers:
   - Architecture: x64
-    InstallerUrl: https://github.com/hungpham10/codegraph-rs/releases/download/v2.0.2/codegraph-x86_64-pc-windows-msvc.zip
+    InstallerUrl: https://github.com/hungpham10/codegraph-rs/releases/download/v2.0.3/codegraph-x86_64-pc-windows-msvc.zip
     InstallerSha256: 0000000000000000000000000000000000000000000000000000000000000000
     InstallerType: zip
 ManifestType: singleton
diff --git a/scripts/install.ps1 b/scripts/install.ps1
index f3ad28102..d6531c1ad 100644
--- a/scripts/install.ps1
+++ b/scripts/install.ps1
@@ -5,11 +5,11 @@
 #
 # Usage (pin a version / download the script first):
 #   irm https://raw.githubusercontent.com/hungpham10/codegraph-rs/main/scripts/install.ps1 -OutFile install.ps1
-#   .\install.ps1 -Version 2.0.2
+#   .\install.ps1 -Version 2.0.3
 
 [CmdletBinding()]
 param(
-    # Pin a specific version, e.g. "2.0.2". Empty = latest release.
+    # Pin a specific version, e.g. "2.0.3". Empty = latest release.
     [string]$Version
 )