Update TODO and roadmap with prioritized work queue

TODO.md

@@ -1,3 +1,34 @@
 # TODO
 
-See [docs/roadmap.md](docs/roadmap.md) for the full feature roadmap.
+Prioritized work queue. See [docs/roadmap.md](docs/roadmap.md) for full context and credits.
+
+## Up next
+
+1. **Fix A1 notation bugs** — `_parse_a1_notation` returns wrong `endRowIndex` for open-ended ranges (e.g. `B2:D`) and silently returns `{}` for empty string instead of raising. [Issue #11](https://github.com/khuisman/mcp-gee-sweet/issues/11)
+2. **SQLite cache migration** — replace `/tmp/*.json` file-backed caches with SQLite; unblocks cache unit tests
+3. **Cache unit tests** — after SQLite migration
+4. **PyPI publish** — set up trusted publishing (OIDC) on PyPI, do a test release; CI workflow already written
+
+## Tier 1 features
+
+5. `clear_values` — clear cell content in a range without touching formatting
+6. `delete_sheet` — delete a tab by name or sheetId
+7. `delete_rows` / `delete_columns` — remove rows or columns by index range
+8. `update_sheet_properties` — set tab color, freeze rows/cols, hide/show gridlines
+9. Drive file ops — `rename_file`, `move_file`, `copy_file`, `delete_file`
+
+## Tier 2 features
+
+10. Cell formatting — `format_cells`, `update_borders`, `merge_cells` / `unmerge_cells`
+11. Data validation — `add_data_validation`, `get_data_validation`
+12. Row/column sizing — `resize_rows` / `resize_columns`, `hide_rows` / `hide_columns`
+
+## Tier 3+ features
+
+13. Conditional formatting, named/protected ranges, permissions, filters _(see roadmap for details)_
+
+## Testing
+
+14. **Formatting integration spike** — explore what `get_sheet_data(include_grid_data=True)` returns for formatted cells; determine fixture strategy (dedicated test sheet vs. ephemeral); assess whether API-level assertions cover formatting without a browser
+15. **Integration tests** — API-level smoke tests against a dedicated test Drive folder using service account credentials; one test per tool
+16. **OAuth integration tests** — verify auth fallback chain and tool behavior under user credentials; required for `create_doc`/`create_spreadsheet` in personal Drive

docs/roadmap.md

@@ -58,17 +58,20 @@ Features are grouped by category and ordered by practical priority within each t
 
 ## Testing
 
-- [ ] Add `pytest` and `pytest-cov` as dev dependencies
+- [x] Add `pytest` and `pytest-cov` as dev dependencies
 - [ ] Unit tests for cache logic — TTL expiry, dirty flag, file persistence, partial invalidation (`SheetStructureCache`, `SheetDataCache`, `DriveFolderCache`, `DocContentCache`) _(after SQLite migration — see Infrastructure)_
-- [ ] Unit tests for A1 notation helpers — `_parse_a1_notation`, `_column_index_to_letter`, `_letter_to_column_index`
-- [ ] Unit tests for HTML↔Doc conversion (`_html_to_text`, `_html_to_doc_requests`)
-- [ ] Unit tests for tool filtering — tools excluded when not in `ENABLED_TOOLS`
-- [ ] Integration tests (optional, requires live credentials + test spreadsheet/doc) — smoke tests for each tool against a dedicated test Drive folder
+- [x] Unit tests for A1 notation helpers — `_parse_a1_notation`, `_column_index_to_letter`, `_letter_to_column_index`
+- [x] Unit tests for HTML↔Doc conversion (`_html_to_text`, `_html_to_doc_requests`)
+- [x] Unit tests for tool filtering — tools excluded when not in `ENABLED_TOOLS`
+- [ ] Formatting integration spike — explore `effectiveFormat` API response shape; determine fixture strategy; assess whether API-level assertions cover formatting without a browser
+- [ ] Integration tests — API-level smoke tests against a dedicated test Drive folder (service account)
+- [ ] OAuth integration tests — verify auth fallback chain and tool behavior under user credentials; needed for `create_doc`/`create_spreadsheet` in personal Drive
 
 ## Infrastructure / internal
 
 - [ ] Revisit cache persistence — all caches write JSON to `/tmp/*.json`; evaluate whether SQLite would be more appropriate as the number of cached entries grows
-- [ ] Open PR to xing5 from `upstream-observability` branch (structured logging, per-tool timing, `cache_discovery=False`) before fully cutting loose
+- [ ] PyPI publish — set up trusted publishing (OIDC), create package on PyPI, do a test release; CI workflow already written
+- [x] Open PR to xing5 from `upstream-observability` branch (structured logging, per-tool timing, `cache_discovery=False`) — [PR #79](https://github.com/xing5/mcp-google-sheets/pull/79)
 - [x] Fork repo and rename to `mcp-gee-sweet`; README credits xing5, freema, and piotr-agier
 
 ## Inspiration and credits