feat: add fixmap verify and release v0.7.3

[aryamthecodebreaker]

fixmap verify — the second half of the job

plan answers where should I start. verify answers did I finish safely, by comparing a saved plan against the diff that followed it.

fixmap plan --issue "password reset emails fail" --format json --output plan.json
# ...make the change...
fixmap verify --report plan.json --diff main...HEAD

FixMap verified 3 changed files against the plan and raised 1 error and 2 warnings.

- **error** A file was edited in a generated or retired location. A build regenerates
  these, so the change will be lost. Edit the source they are produced from.
  - `dist/auth/reset-password.js`
- **warning** One file changed that the plan did not rank. Either the task grew beyond
  the original description, or the ranking missed them — worth checking which.
  - `src/billing/charge.ts`
- **warning** Code changed but no test did. The plan routed this test as most related.
  - `test/reset-password.test.ts`

Five checks, every one a comparison between two things the user already has — a recorded report and a real git diff. Nothing is executed, nothing is installed, no model is called:

Check	Catches
edit-in-generated-location	edits the next build discards
unmapped-change	files the change needed that the plan never ranked
leading-file-untouched	the plan's best guess never opened
no-test-changed	source moved, tests did not — names the routed test
new-risk-area	risk the change reached that the plan never flagged

Only the generated-location finding exits non-zero. That one is wrong regardless of what the task was. Everything else is advisory on purpose: a plan can be wrong and a change can still be right, and only a human or agent reading both can say which. The output reports the gap and leaves the judgement alone.

Verified end-to-end against a fixture reproducing the careless case — editing build output instead of source — with all five findings firing and exit 1.

CLI-only for now. MCP and Action support follow rather than being half-done across three surfaces in one release.

Also fixed: test routes claimed commands they could not run

findRelatedTests ran once and its result was assigned to every route, so a report stated npm --prefix packages/core run test would exercise packages/action/test/runner.test.ts. On this repository all three routes carried an identical eight files across three packages. Related files are now scoped to the route's package; a repository-root script keeps everything. The checked-in workspace example shows the correction.

Verification

218 tests across workspaces (127 core), npm run ci green, all three evaluation suites byte-identical, and 15 version checks pass at 0.7.3 — including apps/web, which broke the 0.7.2 release before the publish workflow started validating it.

🤖 Generated with Claude Code