v0.8.0

⚠️ Behaviour change: strict phase ordering in next

If your .taskmd.yaml declares an ordered phases list, next now treats that order as strict. A high-priority task in a later phase no longer outranks actionable work in an earlier phase. Projects without phases are unaffected.

• Unphased tasks now join the current phase tier (the earliest phase with actionable tasks) and compete there on score. Previously they sorted after every phased task. Tasks whose phase isn't in the configured list still sort last.
• --strict-phases is deprecated. It still parses and prints a warning. Pass --strict-phases=false to go back to score-only phase ranking.

CLI Improvements

• New next.unphased setting: set next: { unphased: last } in .taskmd.yaml to rank unphased tasks after all phased work. The default is current. CLI next, next --all-projects, MCP next, web /api/next and the static export all honour it, and validate reports invalid values.
• The next config section is validated: a next value that isn't a mapping, or that has an unknown key (e.g. unphase:), is now a config error with a did-you-mean hint. Before, it was silently ignored.
• next --all-projects ranks each project by its own rules: each project uses its own phase order and effort scale. Results are merged in a way that keeps each project's ordering, so strict phase and priority tiers survive the merge, and --strict-priority now applies across projects. Previously --all-projects --strict-phases did nothing.

MCP & Web Dashboard

• MCP next, web /api/next and the static export now use the project's phase order. Their recommendations match the CLI; before, they ignored phases entirely.

Documentation

• The spec, CLI guide, configuration reference, best practices, and MCP/web guides now describe strict phase ordering, per-project next ranking, and next.unphased. Inaccurate notes about "phase proximity" and due-date scoring were removed.

Security & Dependencies

• Upgraded vitest to 4.1.11 to fix GHSA-82fw-gwwq-j7x9.
• Raised floors on vulnerable transitive dependencies, clearing 26 Dependabot alerts.