chore(deps): bump @os-eco/mulch-cli from 0.6.5 to 0.8.0

[dependabot]

Bumps @os-eco/mulch-cli from 0.6.5 to 0.8.0.

Release notes

Sourced from @​os-eco/mulch-cli's releases.

v0.8.0

Per-domain governance, lifecycle hooks, soft-archive prune, and pluggable provider recipes — Mulch grows up from "shared shelf" to "shared shelf with rules and lifecycle". Custom types now inherit from built-ins, records can anchor to directories, prune demotes superseded/decayed records before archiving, and a new ml rank surfaces top confirmation-frequency records without a query. 1120 tests across 58 files (up from 840 / 41 in 0.7.0).

Added

ml rank — top records by confirmation score (mulch-cky)

• New read-only command: ml rank [domain] returns records sorted by confirmation-frequency score (highest first). Unlike ml search --sort-by-score, no text query is required and output is a flat cross-domain ranking instead of per-domain groups, so context-constrained consumers can grab the top-N battle-tested records directly.
• Filters: --type <type> to scope to a single record type, --limit <n> (default 10) to cap the result set, --min-score <n> (default 0) to exclude records below a confirmation threshold (e.g. --min-score 1 keeps only records with at least one confirmed application).
• --json emits { success, command, count, records[] } with domain, id, type, score, summary, and the full record per entry, sorted by score desc.
• Joins the prime, query, search, status, validate, learn, ready tier of fully-safe (read-only) commands.

Provider Recipe Discovery (R-04, mulch-6deb)

• ml setup <name> now resolves recipes via discovery instead of a closed list. Resolution order: filesystem (.mulch/recipes/<name>.ts or .sh) → npm (mulch-recipe-<name>) → built-in. Filesystem wins so orgs can override built-ins. Adding a 7th provider no longer requires patching core.
• TypeScript recipes are loaded directly by Bun (no build step). The default export must implement the existing ProviderRecipe shape (install / check / remove returning { success, message }). Shape is validated at load time; bad exports throw with a pointer to the offending file.
• Shell recipes are invoked as <script> install|check|remove with cwd set to the project root and MULCH_RECIPE_NAME / MULCH_RECIPE_ACTION in the environment. Stdout becomes the success message; non-zero exit signals failure (stderr surfaced).
• npm recipes resolve via require.resolve('mulch-recipe-<name>') from the project root, so normal package.json dependencies resolution applies.
• ml setup --list (and --list --json) surfaces every discovered provider with its source, plus shadow flags on built-ins overridden by a filesystem recipe of the same name.
• Unknown-provider hint now points at --list, .mulch/recipes/<name>.{ts,sh}, and mulch-recipe-<name> instead of repeating the hard-coded built-in list.
• Examples under examples/recipes/ cover both a TypeScript and a shell recipe.

Anchor-Validity Decay (R-05f, mulch-2551)

• ml prune --check-anchors: opt-in flag that demotes a record one classification tier when its file/dir anchors stop resolving. For each record we count valid vs. broken anchors across files[] (PatternRecord/ReferenceRecord), dir_anchors[], and evidence.file; if the resulting valid_fraction is below the configured threshold AND the record was recorded more than grace_days ago, the record walks foundational → tactical → observational → archived (or is hard-deleted with --hard). Each demotion stamps anchor_decay_demoted_at: <iso-date> so the signal is auditable across passes.
• Records with zero anchors are exempt — the absence of anchors means "applies globally," not "100% broken."
• Staleness still wins when both apply — the record archives for staleness without an intermediate anchor-decay stamp.
• Co-existence with supersession — a record that is both superseded and anchor-decayed still demotes only one tier per pass, but both supersession_demoted_at and anchor_decay_demoted_at get stamped.
• --explain flag: prints per-record reasons for each demotion, listing the broken anchors (kind + path) and the tier transition. Works for both supersession and anchor decay.
• Configurable knobs under decay.anchor_validity in mulch.config.yaml:

  decay:
    anchor_validity:
      threshold: 0.5    # demote if valid_fraction < this
      grace_days: 7     # don't punish records younger than this
      weight: 1.0       # reserved for the future R-05g fitness blend

• JSON output adds totalAnchorDemoted, totalSupersessionDemoted, plus per-domain anchor_demoted / supersession_demoted breakdowns alongside existing pruned / demoted counts. With --explain, the payload includes an explanations[] array.

Supersession-Based Auto-Demotion (R-05e, mulch-4426)

• ml prune demotes superseded records by one tier per pass: when record B has supersedes: [A], A walks down the classification ladder (foundational → tactical → observational → archived). Each demotion stamps supersession_demoted_at: <iso-date> on A so the event is auditable. The signal was already in the schema — supersession is now a first-class decay axis.
• Cross-domain by design: a record in domain X can supersede a record in domain Y. Supersession is content-relational, not domain-bound.
• Staleness wins on overlap: a record that is both stale and superseded gets archived for staleness in one shot, no intermediate demotion stamp.
• --aggressive flag on ml prune: collapses every superseded record straight to archived (or hard-deleted with --hard) in a single pass instead of walking the ladder.
• Self-supersession is a no-op: a record listing its own id under supersedes is treated as a typo and ignored.
• JSON output adds totalDemoted and per-domain demoted counts alongside the existing totalPruned / pruned. The pre-prune hook payload now carries both stale and demote arrays per candidate domain.

Soft Archive on Prune (R-05a, mulch-7876)

• ml prune defaults to soft-archive: stale records move to .mulch/archive/<domain>.jsonl (with status: "archived" and archived_at: <iso-date> fields) instead of being deleted. A single bad classification at record-time stops being destructive — recoverable with one command.
• --hard opt-in for true deletion (legacy behavior).
• Archive file format: each .jsonl starts with a banner comment line (# ARCHIVED — not for active use. Run \ml restore ` to revive.). readExpertiseFilenow skips#`-prefixed lines so banners don't break reads.
• ml restore <id>: new command. Searches archives across all domains, removes the record from the archive, strips lifecycle fields, and appends back to the live expertise file. Errors on cross-domain ambiguity.
• ml search --archived: opt-in flag includes archived records in search output, rendered in a dedicated ## <domain> (archived, N records) section with [ARCHIVED <date>] mx-id [type] summary lines per record. Excluded by default. JSON mode adds an archived array per domain.

... (truncated)

Changelog

Sourced from @​os-eco/mulch-cli's changelog.

[0.8.0] - 2026-05-06

Per-domain governance, lifecycle hooks, soft-archive prune, and pluggable provider recipes — Mulch grows up from "shared shelf" to "shared shelf with rules and lifecycle". Custom types now inherit from built-ins, records can anchor to directories, prune demotes superseded/decayed records before archiving, and a new ml rank surfaces top confirmation-frequency records without a query. 1120 tests across 58 files (up from 840 / 41 in 0.7.0).

Added

ml rank — top records by confirmation score (mulch-cky)

• New read-only command: ml rank [domain] returns records sorted by confirmation-frequency score (highest first). Unlike ml search --sort-by-score, no text query is required and output is a flat cross-domain ranking instead of per-domain groups, so context-constrained consumers can grab the top-N battle-tested records directly.
• Filters: --type <type> to scope to a single record type, --limit <n> (default 10) to cap the result set, --min-score <n> (default 0) to exclude records below a confirmation threshold (e.g. --min-score 1 keeps only records with at least one confirmed application).
• --json emits { success, command, count, records[] } with domain, id, type, score, summary, and the full record per entry, sorted by score desc.
• Joins the prime, query, search, status, validate, learn, ready tier of fully-safe (read-only) commands.

Provider Recipe Discovery (R-04, mulch-6deb)

• ml setup <name> now resolves recipes via discovery instead of a closed list. Resolution order: filesystem (.mulch/recipes/<name>.ts or .sh) → npm (mulch-recipe-<name>) → built-in. Filesystem wins so orgs can override built-ins. Adding a 7th provider no longer requires patching core.
• TypeScript recipes are loaded directly by Bun (no build step). The default export must implement the existing ProviderRecipe shape (install / check / remove returning { success, message }). Shape is validated at load time; bad exports throw with a pointer to the offending file.
• Shell recipes are invoked as <script> install|check|remove with cwd set to the project root and MULCH_RECIPE_NAME / MULCH_RECIPE_ACTION in the environment. Stdout becomes the success message; non-zero exit signals failure (stderr surfaced).
• npm recipes resolve via require.resolve('mulch-recipe-<name>') from the project root, so normal package.json dependencies resolution applies.
• ml setup --list (and --list --json) surfaces every discovered provider with its source, plus shadow flags on built-ins overridden by a filesystem recipe of the same name.
• Unknown-provider hint now points at --list, .mulch/recipes/<name>.{ts,sh}, and mulch-recipe-<name> instead of repeating the hard-coded built-in list.
• Examples under examples/recipes/ cover both a TypeScript and a shell recipe.

Anchor-Validity Decay (R-05f, mulch-2551)

• ml prune --check-anchors: opt-in flag that demotes a record one classification tier when its file/dir anchors stop resolving. For each record we count valid vs. broken anchors across files[] (PatternRecord/ReferenceRecord), dir_anchors[], and evidence.file; if the resulting valid_fraction is below the configured threshold AND the record was recorded more than grace_days ago, the record walks foundational → tactical → observational → archived (or is hard-deleted with --hard). Each demotion stamps anchor_decay_demoted_at: <iso-date> so the signal is auditable across passes.
• Records with zero anchors are exempt — the absence of anchors means "applies globally," not "100% broken."
• Staleness still wins when both apply — the record archives for staleness without an intermediate anchor-decay stamp.
• Co-existence with supersession — a record that is both superseded and anchor-decayed still demotes only one tier per pass, but both supersession_demoted_at and anchor_decay_demoted_at get stamped.
• --explain flag: prints per-record reasons for each demotion, listing the broken anchors (kind + path) and the tier transition. Works for both supersession and anchor decay.
• Configurable knobs under decay.anchor_validity in mulch.config.yaml:

  decay:
    anchor_validity:
      threshold: 0.5    # demote if valid_fraction < this
      grace_days: 7     # don't punish records younger than this
      weight: 1.0       # reserved for the future R-05g fitness blend

• JSON output adds totalAnchorDemoted, totalSupersessionDemoted, plus per-domain anchor_demoted / supersession_demoted breakdowns alongside existing pruned / demoted counts. With --explain, the payload includes an explanations[] array.

Supersession-Based Auto-Demotion (R-05e, mulch-4426)

• ml prune demotes superseded records by one tier per pass: when record B has supersedes: [A], A walks down the classification ladder (foundational → tactical → observational → archived). Each demotion stamps supersession_demoted_at: <iso-date> on A so the event is auditable. The signal was already in the schema — supersession is now a first-class decay axis.
• Cross-domain by design: a record in domain X can supersede a record in domain Y. Supersession is content-relational, not domain-bound.
• Staleness wins on overlap: a record that is both stale and superseded gets archived for staleness in one shot, no intermediate demotion stamp.
• --aggressive flag on ml prune: collapses every superseded record straight to archived (or hard-deleted with --hard) in a single pass instead of walking the ladder.
• Self-supersession is a no-op: a record listing its own id under supersedes is treated as a typo and ignored.
• JSON output adds totalDemoted and per-domain demoted counts alongside the existing totalPruned / pruned. The pre-prune hook payload now carries both stale and demote arrays per candidate domain.

Soft Archive on Prune (R-05a, mulch-7876)

• ml prune defaults to soft-archive: stale records move to .mulch/archive/<domain>.jsonl (with status: "archived" and archived_at: <iso-date> fields) instead of being deleted. A single bad classification at record-time stops being destructive — recoverable with one command.
• --hard opt-in for true deletion (legacy behavior).
• Archive file format: each .jsonl starts with a banner comment line (# ARCHIVED — not for active use. Run \ml restore ` to revive.). readExpertiseFilenow skips#`-prefixed lines so banners don't break reads.
• ml restore <id>: new command. Searches archives across all domains, removes the record from the archive, strips lifecycle fields, and appends back to the live expertise file. Errors on cross-domain ambiguity.

... (truncated)

Commits

• d0329ba chore: release v0.8.0 (#21)
• b4016a6 Prepare v0.7.0 release: --format flag, manifest mode, search confirmation boost
• 7be7dda feat(cli): add global --format flag for record output
• 8b15ee1 seeds: sync 2026-04-29
• 5346ad9 mulch: update expertise
• 14f6974 feat(init): scaffold config with commented-out optional knobs
• 1cf4b42 seeds: sync 2026-04-29
• 4010387 mulch: update expertise
• 8767fb3 chore: track scripts/version-bump.ts referenced by version:bump npm script
• f9349f3 feat(prime): manifest mode for monolith projects; drop vestigial --mcp flag
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #151.