diff --git a/TODO.md b/TODO.md
index 265c6ce..e253017 100644
--- a/TODO.md
+++ b/TODO.md
@@ -39,13 +39,16 @@ State: `.opencode/state/status.md`. Design: `docs/architecture.md`.
 
 - [x] 2.1 deep per-skill analysis → .opencode/state/classification.json + docs/skill-mapping.md
       (done in phase 0; generator must regenerate mapping doc from classification.json — keep in 1.3 scope)
-- [ ] 2.2 guardrails plugin hook (opt-in, tool.hook execute.before on shell) + tests
-- [ ] 2.3 pocock-reviewer: CONFIRMED by analysis (D8) — implement template + skill-permission scoping
-- [ ] 2.4 orchestrator V2 flow wiring (background-subagent status in V2? batch fallback; worktree
-      permission guidance; slash UX for user-invoked skills)
-- [ ] 2.5 per-skill regression checks + manual orchestration smoke (token-spending, documented)
-- [ ] 2.6 README usage guide + finalize skill-mapping
-- [ ] 2.7 one week of green nightlies → declare stable
+- [x] 2.2 guardrails plugin hook (opt-in, tool.hook execute.before on shell) + tests — shipped in
+      Phase 1.4 (src/guardrails.ts); pattern list faithful to upstream block-dangerous-git.sh
+- [x] 2.3 pocock-reviewer: CONFIRMED by analysis (D8) — implemented in 1.6 with read-only
+      permissions (edit/subagent/webfetch deny, git-read shell allow-list, skill allow code-review)
+- [x] 2.4 orchestrator V2 flow wiring — done in 1.6: agent text covers background AND batch
+      dispatch; slash UX + /tmp default documented in README from runtime findings
+- [ ] 2.5 per-skill regression checks (drift suite exists; add manual token-spending orchestration
+      run: fixture spec + 3 tickets like pocock-agents smoke) + record in docs/runtime-checks.md
+- [x] 2.6 README usage guide + finalize skill-mapping (matrix generated from classification.json)
+- [ ] 2.7 one week of green nightlies -> declare stable (BLOCKED on PACKAGE_TOKEN secret)
 
 ## Open questions