diff --git a/TODO.md b/TODO.md
index 86e6fa3..df114b9 100644
--- a/TODO.md
+++ b/TODO.md
@@ -24,20 +24,20 @@ A single linear checklist of tasks to implement the complete pixa caching image
 - [x] Implement HMAC-SHA256 signature generation
 - [x] Implement HMAC-SHA256 signature verification
 - [x] Implement signature expiration checking
-- [ ] Implement upstream fetch with timeout and size limits
-- [ ] Implement Content-Type validation (whitelist MIME types)
-- [ ] Implement magic byte verification
+- [x] Implement upstream fetch with timeout and size limits
+- [x] Implement Content-Type validation (whitelist MIME types)
+- [x] Implement magic byte verification
 
 ## Caching Layer
-- [ ] Design and create SQLite schema for cache metadata
-- [ ] Implement source content storage (`cache/src-content/<hash>`)
-- [ ] Implement source metadata storage (`cache/src-metadata/<host>/<hash>.json`)
-- [ ] Implement output content storage (`cache/dst-content/<hash>`)
-- [ ] Implement cache key generation
-- [ ] Implement cache lookup (in-memory hot path)
-- [ ] Implement cache write
-- [ ] Implement negative caching (404s)
-- [ ] Implement cache TTL and expiration
+- [x] Design and create SQLite schema for cache metadata
+- [x] Implement source content storage (`cache/src-content/<hash>`)
+- [x] Implement source metadata storage (`cache/src-metadata/<host>/<hash>.json`)
+- [x] Implement output content storage (`cache/dst-content/<hash>`)
+- [x] Implement cache key generation
+- [x] Implement cache lookup (in-memory hot path)
+- [x] Implement cache write
+- [x] Implement negative caching (404s)
+- [x] Implement cache TTL and expiration
 - [ ] Implement cache size management/eviction
 
 ## Image Processing