roadmapsmith 0.9.10 → 0.9.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "roadmapsmith",
-  "version": "0.9.10",
+  "version": "0.9.12",
   "description": "Evidence-backed ROADMAP.md generator and sync tool for AI coding agents.",
   "main": "src/index.js",
   "bin": {

package/src/parser/index.js

@@ -86,6 +86,11 @@ function parseWarningLine(content) {
   return content.slice(WARNING_PREFIX.length).trim();
 }
 
+function parseBlockedByLine(content) {
+  if (!/^blocked\s+by:/i.test(content)) return null;
+  return content.replace(/^blocked\s+by:\s*/i, '').trim();
+}
+
 function parseRoadmap(content) {
   const lines = String(content || '').split(/\r?\n/);
   const managedRange = findManagedRange(lines);
@@ -111,6 +116,7 @@ function parseRoadmap(content) {
     let warningLineIndex = null;
     let warningText = null;
     const evidenceLines = [];
+    const blockedByIds = [];
     let lastChildLineIndex = index;
     for (let childIndex = index + 1; childIndex < lines.length; childIndex += 1) {
       const childLine = lines[childIndex];
@@ -145,6 +151,12 @@ function parseRoadmap(content) {
         warningLineIndex = childIndex;
         warningText = warningTextValue;
       }
+
+      const blockedByText = parseBlockedByLine(childBullet.content);
+      if (blockedByText !== null) {
+        const ids = blockedByText.split(/[\s,]+/).map((s) => s.trim()).filter(Boolean);
+        blockedByIds.push(...ids);
+      }
     }
 
     const id = markerId || slugify(text);
@@ -157,6 +169,7 @@ function parseRoadmap(content) {
       warningLineIndex,
       warningText,
       evidenceLines,
+      blockedByIds,
       markerId,
       noTest,
       indent,

package/src/validator/index.js

@@ -50,6 +50,25 @@ const GENERIC_TASK_TOKENS = new Set([
   'phrases', 'conceptual',
 ]);
 
+// Patterns that indicate the task describes work still to be done, not completed work.
+// Regex form catches verb and noun forms ("Manejo") and two-word constructions ("Recovery path")
+// that an exact-match Set would miss. When a task matches, code token overlap alone cannot pass
+// it — either an Evidence line or high-confidence evidence (code + test) is required.
+const CHANGE_VERB_PATTERNS = [
+  // Spanish — verb and noun forms of pending-work descriptions
+  /^(agregar|añadir|implementar|configurar|reemplazar|cambiar|corregir|manejar|manejo|proteger|sanitizar|validar|deshabilitar|mostrar|generar|expandir|reducir|completar|crear|eliminar|migrar|refactorizar|recovery\s+path)\b/i,
+  // English
+  /^(add|implement|configure|replace|change|fix|handle|protect|sanitize|validate|disable|show|generate|expand|reduce|complete|create|remove|migrate|refactor|recovery\s+path)\b/i,
+];
+
+function taskDescribesChange(taskText) {
+  const normalized = String(taskText)
+    .replace(/^\*\*\[.*?\]\*\*\s*/, '')
+    .replace(/^\[.*?\]\s*/, '')
+    .trim();
+  return CHANGE_VERB_PATTERNS.some((p) => p.test(normalized));
+}
+
 const CANONICAL_FILES = {
   security: 'SECURITY.md',
   readme: 'README.md',
@@ -179,6 +198,7 @@ function hasFileExtension(token) {
 
 function isLikelyPath(token) {
   if (token.includes('*') || token.includes('?')) return false; // glob/wildcard
+  if (/^\/api\//i.test(token)) return false; // HTTP API route paths are not file paths
   if (/^\.{1,2}\/|^\//.test(token)) {
     // Bare "/" or "./" with nothing after is not a real path (e.g. "API / ESC-POS" → "/")
     return /[A-Za-z0-9_]/.test(token);
@@ -1173,9 +1193,11 @@ function validateTask(task, context, config, plugins) {
   let confidence = 'low';
   if (authoritativeEvidence.passed) {
     confidence = authoritativeEvidence.confidence || 'medium';
-  } else if (meetsStrongThreshold) {
+  } else if (meetsStrongThreshold && evidence.test) {
+    // 'high' requires code + test — code + feature-surface alone is 'medium'
+    // so that action-verb tasks (path hint exists but no test) stay gated.
     confidence = 'high';
-  } else if (strongEvidenceCount === 1 || hasDirectReferencePass || hasArtifactTaskPass || hasTrustedRuleEvidencePass) {
+  } else if (meetsStrongThreshold || strongEvidenceCount === 1 || hasDirectReferencePass || hasArtifactTaskPass || hasTrustedRuleEvidencePass) {
     confidence = 'medium';
   }
 
@@ -1207,7 +1229,10 @@ function validateTask(task, context, config, plugins) {
     }
   }
 
-  if (task.warningText && passed && !authoritativeEvidence.passed && !meetsStrongThreshold) {
+  // Unchecked tasks with an existing ⚠️ warning are preserved as failing unless an Evidence line
+  // explicitly confirms implementation. meetsStrongThreshold (token match) cannot override a
+  // human/agent judgment that the feature is incomplete.
+  if (task.warningText && !task.checked && passed && !authoritativeEvidence.passed) {
     passed = false;
     uniqueReasons.push(task.warningText);
     uniqueReasons = Array.from(new Set(uniqueReasons));
@@ -1216,6 +1241,27 @@ function validateTask(task, context, config, plugins) {
     passed = false;
   }
 
+  // Action-verb gate (Causa 3): unchecked tasks that describe a change to be made
+  // (Agregar, Configurar, Add, Fix, Manejo, Recovery path, …) cannot pass on code token overlap alone.
+  // Requires either: an Evidence line (authoritativeEvidence.passed), high-confidence evidence
+  // (code + test), grant-evidence from config (hasTrustedRuleEvidencePass), or canonical artifact
+  // evidence (hasArtifactTaskPass — e.g. "Add SECURITY.md").
+  if (
+    !task.checked &&
+    passed &&
+    taskDescribesChange(task.text) &&
+    !authoritativeEvidence.passed &&
+    !hasTrustedRuleEvidencePass &&
+    !hasArtifactTaskPass &&
+    confidence !== 'high'
+  ) {
+    passed = false;
+    const actionVerbReason = 'action task requires Evidence line or high-confidence evidence (code + test) to be marked complete';
+    if (!uniqueReasons.includes(actionVerbReason)) {
+      uniqueReasons.push(actionVerbReason);
+    }
+  }
+
   // Preserve already-checked tasks when the validator can't confirm implementation but also
   // can't find strong evidence against it. Two cases:
   //   1. No path/symbol hints at all — no machine-readable claims to evaluate.
@@ -1264,13 +1310,21 @@ function validateTasks(tasks, context, config, plugins) {
     result[task.id] = validateTask(task, context, config, plugins);
   }
 
-  // Post-pass: milestone tasks with "Blocked by: id-a, id-b" cannot pass
-  // while any listed dependency is still failing.
+  // Post-pass: tasks with "Blocked by: id-a, id-b" cannot pass while any listed dependency
+  // is still failing. The IDs may appear inline in task.text OR as child bullet lines
+  // (parsed by parser into task.blockedByIds).
   for (const task of tasks) {
+    const blockedIds = [];
     const m = BLOCKED_BY_RE.exec(task.text);
-    if (!m) continue;
-    const blockedIds = m[1].split(/[\s,]+/).map((s) => s.trim()).filter(Boolean);
-    const failingDeps = blockedIds.filter((id) => result[id] && !result[id].passed);
+    if (m) {
+      blockedIds.push(...m[1].split(/[\s,]+/).map((s) => s.trim()).filter(Boolean));
+    }
+    if (Array.isArray(task.blockedByIds) && task.blockedByIds.length > 0) {
+      blockedIds.push(...task.blockedByIds);
+    }
+    if (blockedIds.length === 0) continue;
+    const uniqueBlockedIds = Array.from(new Set(blockedIds));
+    const failingDeps = uniqueBlockedIds.filter((id) => result[id] && !result[id].passed);
     if (failingDeps.length > 0 && result[task.id] && result[task.id].passed) {
       result[task.id].passed = false;
       result[task.id].reasons = [`blocked by incomplete tasks: ${failingDeps.join(', ')}`];