diff --git a/README.md b/README.md
index 88a5e22..21a825e 100644
--- a/README.md
+++ b/README.md
@@ -350,6 +350,27 @@ The manifest file would do several important things:
 
 - **Manifest size:** Manifests must fit entirely in system memory during reading and writing.
 
+# TODO
+
+## High Priority
+
+- [ ] **Implement `fetch` command** - Currently panics with "not implemented". Should download a manifest and its referenced files from a URL.
+- [ ] **Fix import in fetch.go** - Uses `github.com/apex/log` directly instead of `internal/log`, violating codebase conventions.
+
+## Medium Priority
+
+- [ ] **Add `--force` flag for overwrites** - Currently silently overwrites existing manifest files. Should require `-f` to overwrite.
+- [ ] **Implement FollowSymLinks option** - The flag exists in CLI and Options structs but does nothing. Scanner should use `EvalSymlinks` or `Lstat`.
+- [ ] **Consolidate legacy manifest code** - `mfer/manifest.go` has old scanning code (`Scan()`, `addFile()`, `generateInner()`) that duplicates the new `internal/scanner` + `mfer/builder.go` pattern.
+- [ ] **Add context cancellation to legacy code** - The old `manifest.Scan()` doesn't support context cancellation; the new scanner does.
+
+## Lower Priority
+
+- [ ] **Add unit tests for `internal/checker`** - Currently has no test files; only tested indirectly via CLI tests.
+- [ ] **Add unit tests for `internal/scanner`** - Currently has no test files.
+- [ ] **Clean up FIXMEs in manifest.go** - Validate input paths exist, validate filesystem, avoid redundant stat calls.
+- [ ] **Validate input paths before scanning** - Should fail fast with a clear error if paths don't exist.
+
 # Open Questions
 
 - Should the manifest file include checksums of individual file chunks, or just for the whole assembled file?