v1.4.0

Added

• vouch install-mcp <host> now bootstraps the KB when no .vouch/ is
  discoverable at or above the target, making install a one-command
  setup. previously it exited 0 with "0 failed" in a fresh project while
  every installed hook silently no-oped forever (|| true) and the mcp
  server exited 2 — with nothing ever telling the user to run
  vouch init. opt out with --no-init (a loud stderr warning then
  names the remedy); an ancestor KB is reported ("Using existing KB
  at …"), never shadowed by a second one; unknown hosts still fail
  cleanly without planting a KB. staging-dir hosts opt out via a new
  kb_bootstrap: false manifest key (claude-desktop does — its target
  is a paste-ready staging dir, and a KB planted at an arbitrary cwd
  would ambiently capture every child project). the preflight ignores
  a shell-exported VOUCH_KB_PATH (it answers "what does this tree
  resolve to", and notes the override on stderr instead). vouch init
  and the auto-init share one code path so they cannot drift.
• cli mirrors for the last five kb.* methods that had none —
  vouch propose-delete, vouch source list, vouch session list,
  vouch session transcript, vouch session summarize — and the
  capabilities test now enforces cli parity alongside the existing
  jsonl + mcp checks, so a new method cannot land without its cli
  command (#475).
• retrieval.recency: a half-life decay (default 90 days, whole-day
  quantized) blended into fused context-pack scores so fresher knowledge
  outranks equally-relevant stale knowledge. rescoring-only — an old
  artifact loses at most half its score and never vanishes. enabled in
  the starter config for new kbs; existing kbs keep byte-identical
  ordering until they add the key (#476).
• a retrieval block on kb.search and kb.context responses reports
  the configured vs actually-used backend, whether semantic search is
  available, and a degraded flag — a base install serving lexical hits
  under a semantic-capable backend name now says so instead of labelling
  them "hybrid" (#476).
• ai auto-merge bot: the owner arms auto-merge on a pr with the auto-merge
  label or by commenting /auto-merge; a non-core pr then merges once ci is
  green and CodeRabbit approves. core paths always require owner review via
  .github/CODEOWNERS; ui prs opened without before/after screenshots are
  auto-closed. review is the gate, not just advice: CodeRabbit
  (.coderabbit.yaml, free for this public repo) submits a formal review and
  the coderabbit-gate workflow turns its verdict into the required
  coderabbit-approved status check — so a fresh push voids a prior approval,
  and a pr CodeRabbit requests changes on 3 times is auto-closed (owner and
  bots exempt). a daily stale-pr-reaper also closes a pr whose author left a
  CodeRabbit change request unaddressed (no new commit) for 2 days. no paid
  model in the loop. deterministic decision logic lives in
  src/vouch/pr_bot.py (pure stdlib). repo guards (branch ruleset + labels)
  are configured by scripts/setup_repo_guards.sh. workflow security is linted
  in ci with zizmor + actionlint.

Changed

• kb.search is one implementation (context.search_kb) across mcp and
  jsonl instead of three drifting copies; auto now fuses embedding +
  fts5 via rrf with a substring fallback (it used to waterfall
  embedding-first), and an omitted backend defers to retrieval.backend
  in config.yaml (#476).

Fixed

• approve/reject/expire record the audit event before moving the
  proposal to decided/. a crash between the two used to leave a durable
  decision with no authoritative history; it now leaves a pending
  proposal with its decision event, which the approve retry path already
  guards (#475).
• demo image build: hatch_build.py (the build hook pyproject.toml
  declares for console bundling) is copied into the docker build context;
  the image had been unbuildable since the hook landed (#474).