docs(roadmap): mark Wave 1 shipped + capture interim work + version decision

[TexasCoding]

Summary

Post-Wave-1 roadmap update:

• Wave 1 ✅ shipped — table now lists the 5 merged PRs (infra(ci): SHA-pin Claude workflows + add Dependabot & pip-audit #108–fix: Order.type rename, BASE_URL validation, Retry-After NaN/negative guard #112) + the fix(ci): install pip into the uv venv so pip-audit can introspect it #120 CI hotfix with what each closes.
• Captured 4 learnings from Wave 1 review cycles for the next wave (bot iterates, breaking-rename decision, worktree CWD slips, pip-audit needs pip seeded into uv venv).
• Wave 2 ⏸ paused with an "Interim work" placeholder section to fill in as items get scoped.
• Follow-ups opened during Wave 1 review — Audit response models for consistent extra= policy #114 (model extra= audit, Wave 5 candidate); Spec-sync drift tracking #113 closed-as-superseded by security(spec-sync): harden against upstream compromise #109's per-drift pattern.
• Release-cut criteria rewritten: ✅/⏳ progress markers on HIGH items; added explicit v1.2.0 vs v2.0.0 decision block triggered by fix: Order.type rename, BASE_URL validation, Retry-After NaN/negative guard #112's Order.type → Order.order_type rename.

Test plan

• Docs-only change, no code touched

[claude]

Code Review — PR #121

Status: Merged | Docs-only change to ROADMAP.md

---

Overview

Post-Wave-1 housekeeping update: converts the Wave 1 plan table to an actuals table, captures learnings, introduces an "Interim work" buffer section, and rewrites the release-cut criteria with the v1.2.0 vs v2.0.0 decision block triggered by the Order.type → Order.order_type rename in #112.

---

What's Good

• Actuals table is well-formed. Swapping branch names for merged PR numbers with issue links makes auditing history straightforward. The ⚠️ Breaking callout on fix: Order.type rename, BASE_URL validation, Retry-After NaN/negative guard #112 is exactly the right prominence.
• Learnings section is concrete. The four bullet points are specific operational observations (bot review iteration count, worktree CWD slippage, pip-audit venv seeding) — far more useful than vague retrospectives.
• Version-decision block is honest. Laying out both options with their tradeoffs at tag time rather than picking prematurely is the right call. The risk sentence on v1.2.0 (AttributeError with no deprecation period on semver-strict ^1.x pins) is the key fact a future reviewer needs.
• Progress markers on release criteria (✅/⏳) make the checklist scannable without opening every linked issue.

---

Suggestions / Nits

1. "Interim work" section is empty. A TBD placeholder is fine for living docs, but if there's already at least one scoped item at merge time it would be worth seeding it now. Empty sections can get skipped in future updates. Low priority.

2. Wave 2 table still uses branch names, not PR numbers. Once Wave 2 lands, consider following the same convention used for Wave 1 (PR links + "Closes" column). Consistency helps future readers understand which items are planned vs. shipped without needing to decode branch naming conventions.

3. No decision owner or deadline on v1.2.0 vs v2.0.0. The block correctly defers to tag time, but it might be worth adding a one-liner like "Decide before tagging; default to v2.0.0 unless blast-radius analysis at that point shows zero downstream Order.type attribute usage." Right now the text describes the tradeoff but doesn't give a tiebreaker heuristic, which leaves the decision fully open-ended.

4. #113 closed-as-superseded note — helpful, but the ROADMAP.md doesn't link to what superseded it (security(spec-sync): harden against upstream compromise #109's pattern). The current text says "closed as superseded by security(spec-sync): harden against upstream compromise #109's per-drift fingerprint pattern" which is clear enough, but a reader unfamiliar with security(spec-sync): harden against upstream compromise #109 may lose context. Minor.

---

Correctness

No factual errors spotted. PR/issue links were spot-checked and match the referenced work. The claim that Wave 1 closed 10 issues across 5 PRs is consistent with the table (2+1+1+3+3 = 10). The CI hotfix (#120) is correctly excluded from the issue-close count.

---

Summary

Clean, accurate housekeeping. The version-decision block is the most consequential addition and is well-reasoned. Suggestions above are all minor polish; none block anything. ✅