docs(readme): reflect Phase 1c completion + recent merges

[thewrz]

Summary

Bring README.md up to date with the work landed between 2026-05-16 and 2026-05-18.

• Status table: Phase 1c now fully checked off (1c-iii through 1c-viii + two security sub-phases). Subtitle updated from "Phase 2b complete, Phase 2c next" to "Phase 1c + 2b complete, Phase 2c next".
• What Works Today → Parsing: add bullets for the three new parser features:
  • Plaintext signal hardening (PR fix(parser): text signal hardening — noise-prefix strip + joined-prefix lookahead #70)
  • Parse-anomaly warnings — meta.warnings on CsiTree (PR feat(parser): text anomaly warnings — meta.warnings on CsiTree #75)
  • DOCX resilience suite — LibreOffice fixture coverage (PR test(parser): DOCX resilience — LibreOffice fixture + integration tests #72)
• MCP Server: note rate limiting on POST /mcp (PR security(mcp): rate limit POST /mcp — parse_document and generate_docx DoS hardening #69).
• Not Yet Built: strike the items that just landed:
  • DOCX cross-reference extraction (now in PR feat(parser): DOCX cross-reference extraction — format-agnostic refs module #76)
  • Parse worker concurrency cap (now in PR feat(lib): parse worker concurrency cap — piscina worker pool #71)
  • Add new known gap: REST persistTree ignores extracted refs — follow-up to issue refactor(db): extract persistSpec to db layer — eliminate mcp/parse.ts duplication #53.

Test plan

• CI green (Lint / Build / Test)
• CodeRabbit review pass
• Visual diff of README.md reads cleanly on GitHub

Summary by CodeRabbit

Documentation

• Updated project roadmap: Phase 1c and 2b are now complete, with Phase 2c in progress
• Documented new capabilities including plaintext parsing improvements, anomaly detection warnings, and enhanced DOCX resilience
• Added security enhancement: rate limiting implemented for the JSON-RPC endpoint

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 061d5554-4630-496b-9ddf-6b542f7597a4

📥 Commits

Reviewing files that changed from the base of the PR and between 3e738b7 and 0836cca.

📒 Files selected for processing (1)

• README.md

---

📝 Walkthrough

Walkthrough

This PR updates the SpecR README to document completion of Phase 1c and Phase 2b work, with expanded details on parsing improvements, robustness work, and newly documented working features such as plaintext signal hardening, parse-anomaly warnings, and DOCX resilience testing. Rate-limiting for the MCP endpoint is now documented, and future roadmap items are clarified.

Changes

Roadmap and Status Documentation

Layer / File(s)	Summary
Status and Phase Completion Details README.md	Top-level status updated to Phase 1c + 2b complete with Phase 2c next. Roadmap table expanded with Phase 1c sub-items: cross-reference extraction, plaintext parsing hardening, parse warnings, DOCX resilience testing, shared-DB deflaking, and MCP/worker concurrency plus rate-limiting.
Working Features and Security Controls README.md	"What Works Today" section documents plaintext heading signal hardening (noise-prefix stripping + lookahead), parse-anomaly warnings (ParseWarning[] emission, capabilities enrichment, non-persistence), and DOCX resilience suite. MCP /mcp endpoint rate-limiting via express-rate-limit is documented for DoS hardening.
Future Items and Follow-up Notes README.md	"Not Yet Built" section clarified with explicit upcoming MCP features (write tools, stateful sessions, prompts). Follow-up note added on persistTree/persistSpec consolidation and impact on REST POST /parse versus MCP/file-loader paths.

Possibly Related PRs

• wrzonance/SpecR#18: Both PRs update README.md roadmap/status and "What Works Today"/"Not Yet Built" sections with overlapping DOCX/parsing-related documentation.

Poem

🐰 A roadmap marches forward true,
With phases one and two complete,
What works today shines bright and new—
Hardened parsing, warnings sweet,
And soon Phase 2c's feat! ✨

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'docs(readme): reflect Phase 1c completion + recent merges' directly and accurately summarizes the main change—updating the README to document Phase 1c completion and recently merged work.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/readme-roadmap-sync

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}