diff --git a/TODO.md b/TODO.md
new file mode 100644
index 0000000..99f978d
--- /dev/null
+++ b/TODO.md
@@ -0,0 +1,105 @@
+# Workflow
+
+* branch (from `main`)
+* do the work in Next Step
+* move Next Step to the top of Completed Steps
+* move the top item of Future Steps into Next Step
+* commit (`TODO.md` changes in the same commit as the work)
+* merge to `main` if the branch is not protected, otherwise open a PR
+* push
+
+# Status
+
+pre-1.0. No git tags. README section "TODO: Remaining Work for 1.0" lists
+open design questions and implementation tasks; policy compliance work is
+in flight and unmerged.
+
+# Next Step
+
+Land the in-flight compliance branch chore/align-repo-policies: finish and
+commit the uncommitted work (32 modified Go files, new untracked
+.golangci.yml and TODO.md), confirm `make check` is green, merge the branch
+(one commit ahead of main as of 2026-07-03) to main, and push.
+
+# Completed Steps
+
+- 2026-07-03: aligned repo tooling, docs, and config with standardized
+  policies (7d9a138, on chore/align-repo-policies, unmerged)
+- 2026-06-28: moved to standardized repo policies (#56, on main)
+- 2026-04-07: added 1.0 roadmap as README TODO section, removed old
+  TODO.md (#54)
+- 2026-03-20: added Gitea Actions CI workflow (#53)
+- 2026-03-17: added REPO_POLICIES.md, renamed CLAUDE.md to AGENTS.md (#51);
+  removed committed .index.mf (#52)
+- 2026-03-15: split Dockerfile with pre-built golangci-lint stage for
+  faster CI (#45)
+- 2026-03-01: 1.0 quality polish: code review, tests, bug fixes, docs (#32)
+- 2026-02-20: deterministic file ordering in Builder.Build() (#28);
+  removed committed vendor/modcache archives (#35)
+- 2026-02-08: added --seed flag for deterministic manifest UUID
+
+# Future Steps
+
+- Compliance (fold of TODO.md audit 2026-07-02; verify which items the
+  in-flight branch already closes, then check off):
+    - Add .editorconfig (canonical copy from sneak/prompts)
+    - Add standardized .golangci.yml (present untracked on the branch;
+      user-owned, copy verbatim)
+    - Make .gitignore cover secrets (.env, *.key, *.pem), OS files
+      (.DS_Store), and editor files (*.swp, *~)
+    - Make fmt-check/lint verify with gofumpt, not gofmt -l, so
+      `make check` matches what `make fmt` writes
+    - Add README "Getting Started" section with copy-pasteable
+      install/usage block
+    - Move FORMAT.md from repo root to docs/ and update the AGENTS.md
+      reference
+    - Pin Makefile-installed Go tools (protoc-gen-go@v1.28.1,
+      golangci-lint@v2.0.2) by module hash, not mutable tag
+    - Set `make test` timeout to 30s (currently 10s)
+    - Add explicit README "Rationale" heading (content exists under other
+      names); name the author in the README Description first line
+    - Reconcile root-level AGENTS.md with directory-hygiene policy (keep
+      or relocate)
+    - Add a `make build` target
+    - Rewrite `make hooks` to use printf or a heredoc instead of
+      non-portable `echo '...\n...'`
+- Answer the 14 owner design questions in the README 1.0 roadmap:
+    - Format: simplify MFFileChecksum; store file mode; drop atime;
+      specify path normalization rules; version byte after magic;
+      length-prefix after magic
+    - Signatures: hash covers compressed or uncompressed data; sign raw
+      bytes vs hex canonical string; detached .mf.sig support; GPG
+      subprocess vs pure-Go crypto
+    - Implementation: deterministic manifests by default; consolidate
+      duplicate scanner/checker implementations; export the manifest
+      type; canonical Go module path for 1.0
+- Format and correctness:
+    - Resolve proto go_package vs go.mod module path inconsistency
+    - Specify and validate path invariants (UTF-8, forward-slash,
+      relative, no .., no leading /)
+    - Remove or deprecate atime; reserve mode field; add version byte
+      (all pending design answers)
+    - Write a standalone format specification document
+- Library:
+    - Delete internal/scanner and internal/checker; consolidate on the
+      mfer/ package versions (pending design answer)
+    - Add decompression size limit via io.LimitReader in
+      deserializeInner()
+    - Fix errors.Is dead code in checker; make AddFile verify
+      totalRead == size
+    - Export manifest type or define a public interface (pending)
+    - Replace GPG subprocess with pure-Go crypto (pending); add timeouts
+      to remaining subprocess calls
+- CLI:
+    - Kebab-case primary flag names; fix fetch URL construction with
+      url.JoinPath; add http.Client timeout and retry with backoff to
+      fetch; rate-limit Checker progress output; add --deterministic
+      flag or default; wire top-level --version properly
+- Testing:
+    - Fuzz NewManifestFromReader; end-to-end tests for freshen and fetch
+- Documentation:
+    - Promote docs/FORMAT.md as primary spec reference; audit error
+      messages; document the signature scheme fully
+- Release:
+    - Finalize module path, bump version constant, SemVer --version
+      output, tag v1.0.0