docs: rewrite TODO.md workflow for the branch-per-issue model on next (closes #191)

The Workflow section still described branching from `main` and merging
straight to it. It now describes what the repo actually does: one branch
and one PR per issue cut from and based on `next`, squash-merged into
`next` on a passed independent review, with `main` reached only by the
per-milestone PR from `next` and releases tagged from `main`.

Status and Next Step were stale (they named a branch that landed as
`23aeae4`). Status now points at the 1.0.0 milestone in flight and the
tracker as the authoritative backlog; Next Step names a real open item.
Future Steps keeps only work that has no issue of its own.

TODO.md

@@ -1,33 +1,57 @@
 # Workflow
 
-- branch (from `main`)
+- `git pull` `next` and cut a branch from it — one branch per issue, named
-- do the work in Next Step
+  `issue-<N>-<slug>`. Never branch from `main`.
-- move Next Step to the top of Completed Steps
+- Do the work as one commit whose title ends with ` (closes #N)`, with the
-- move the top item of Future Steps into Next Step
+  `TODO.md` update in that same commit.
-- commit (`TODO.md` changes in the same commit as the work)
+- Move Next Step to the top of Completed Steps; move the top item of Future
-- merge to `main` if the branch is not protected, otherwise open a PR
+  Steps into Next Step.
-- push
+- Run `make fmt`, then `make check`. A feature branch may be red; `next` and
+  `main` may not.
+- Rebase onto current `next` immediately before pushing — other branches land on
+  `next` continuously — and re-run `make check` after resolving, because a clean
+  textual merge can still break the build.
+- Push the branch and open one PR per issue with base `next`. Never base `main`.
+- An independent reviewer who did not write the change gates the merge. On a
+  passed review the PR is squash-merged into `next`.
+- `next` is the branch for the next milestone. It is kept green and mergeable to
+  `main` at any moment, without notice.
+- `main` receives exactly one PR per milestone, from `next`. Releases are tagged
+  from `main`.
 
 # Status
 
-pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. No
+pre-1.0, working towards the 1.0.0 milestone. Tagged v0.1.0 on 2026-02-27. The
-other branch is in flight: the settings About well landed as #145 on 2026-07-26
+milestone is in flight on `next`; its `next` -> `main` PR is
-and scripts-to-rule-them-all landed as #148, so the `scripts/` directory
+[#190](https://git.eeqj.de/sneak/AutistMask/pulls/190). `make check` verified
-question is resolved. Full policy file set present. `make check` verified
+green on `next` at `e9fa8be` on 2026-08-10, and `make build` produces
-passing on `main` at `23aeae4` on 2026-08-09. The 1.0.0 backlog is filed as
+`dist/chrome/` and `dist/firefox/` with every bundle verified to have `DEBUG`
-#149-#168. A real-browser end-to-end suite (`make test-e2e`) now sits alongside
+compiled off.
-`make check`, which cannot see a runtime `ReferenceError` in a popup view.
+
+The backlog lives on the
+[Gitea tracker](https://git.eeqj.de/sneak/AutistMask/issues), which is
+authoritative; this file does not duplicate it. Full policy file set present. A
+real-browser end-to-end suite (`make test-e2e`) now sits alongside `make check`,
+which cannot see a runtime `ReferenceError` in a popup view.
 
 # Next Step
 
-Land #149: make `DEBUG` a build-time constant that defaults to off, injected as
+Land [#152](https://git.eeqj.de/sneak/AutistMask/issues/152): add ESLint to
-the `__BUILD_DEBUG__` esbuild define from `AUTISTMASK_DEBUG=1`, so a plain
+`script/lint`. `make check` is `prettier --check` only today and cannot catch
-`make build` stops handing every newly created wallet the publicly committed
+undefined identifiers, which is how
-test recovery phrase. Branch `fix/issue-149-debug-build-flag`; PR open, awaiting
+[#150](https://git.eeqj.de/sneak/AutistMask/issues/150) and
-review.
+[#151](https://git.eeqj.de/sneak/AutistMask/issues/151) shipped.
 
 # Completed Steps
 
+- 2026-08-11: `TODO.md` Workflow rewritten to the branch-and-PR-per-issue model
+  on `next`, with Status and Next Step refreshed
+  ([#191](https://git.eeqj.de/sneak/AutistMask/issues/191)).
+- 2026-08-09: `DEBUG` became a build-time constant defaulting to off, injected
+  as the `__BUILD_DEBUG__` esbuild define and turned on with
+  `AUTISTMASK_DEBUG=1`, so a plain `make build` no longer hands every newly
+  created wallet the publicly committed test recovery phrase
+  ([#149](https://git.eeqj.de/sneak/AutistMask/issues/149)).
 - 2026-08-09: dApp approval signing moved into the popup — the password no
   longer crosses the extension messaging boundary; the background broadcasts and
   resolves approvals only, and verifies the signed artifact against the approval
@@ -69,39 +93,15 @@ review.
 
 # Future Steps
 
-- Add ESLint to `script/lint` (#152). `make check` is `prettier --check` only
+Only work that has no issue of its own belongs here; everything else is on the
-  and cannot catch undefined identifiers, which is how #150 and #151 shipped.
+tracker.
-- Decide the libsodium backend that actually ships (#182) and delete the single
+
-  allowlist entry it owns in `tests/e2e/harness.js`.
-- Extend the end-to-end suite to the dApp approval signing path (EIP-1193
-  through the real content script, background worker and approval popup). That
-  path needs a CDP-based route to background-worker console output first:
-  Playwright exposes no error event for service workers, so an uncaught
-  exception in the worker cannot fail the run today (worker network traffic is
-  already covered). Decide separately whether docker-in-docker makes
-  `make test-e2e` runnable in the Gitea workflow.
-- Make the Firefox target functional: Chrome callback APIs are used against the
-  promise-only `browser` namespace (#153).
-- Send and transaction-flow correctness: gas fee excluded from the
-  insufficient-balance check (#154), WaitTx 60s timeout overwriting a rendered
-  success screen (#155), last-wallet deletion leaving inconsistent state (#156).
-- Security: plaintext password crossing the extension messaging boundary during
-  dApp approvals (#157); MV3 service worker termination killing the background
-  refresh and the 24h phishing list update (#158).
-- Test the crypto core — `wallet.js` derivation and `vault.js` encryption (#159)
-  — and the address-poisoning defense in `transactions.js` (#160).
-- Wallet features for 1.0: show a wallet's recovery phrase behind the password
-  (#161), delete an address from an HD wallet (#162).
-- Docs: `docs/README.md` contradicts the code on external services and names
-  competitors (#163); README Screen Map omits three shipped screens (#164).
-- Owner decisions: Sepolia support versus "Non-Goals for 1.0", and `isMetaMask`
-  naming a competitor in shipped code (#165).
-- Repo policy compliance sweep: test rerun pattern, `yarn`/`npx`, frozen
-  lockfile, undocumented Makefile targets (#166).
-- Prune the 24 stale remote feature branches (#167).
-- Remove dead exports and de-duplicate copy-pasted view helpers (#168).
 - Pre-1.0 security review of the extension (key handling, DEBUG mode policy, RPC
-  input validation) before any 1.0rc tag; #149 and #157 are parts of it, but the
+  input validation) before any 1.0rc tag. Individual filed issues are parts of
-  review is broader than either.
+  it, but the review is broader than any of them.
+- Decide whether docker-in-docker makes `make test-e2e` runnable in the Gitea
+  workflow. Extending the suite itself is tracked as
+  [#183](https://git.eeqj.de/sneak/AutistMask/issues/183) and
+  [#184](https://git.eeqj.de/sneak/AutistMask/issues/184).
 - Cut 1.0.0 once the milestone is empty, then continue tagging as milestones
   land.