doc: update and cleanup

TODO.md

@@ -1,7 +1,7 @@
 # Charybdis - TODO List
 
-**Last Updated**: 2026-05-06
-**Status**: Phase 0 done. Phase 1 (Security Core) in progress — assessment & gates remaining.
+**Last Updated**: 2026-06-09
+**Status**: Phase 0 done. Phase 1 (Security Core) in progress — ingestion + reconciliation shipped; assessment & gates remaining.
 
 > Aligned with [VISION.md](VISION.md) roadmap.
 
@@ -12,12 +12,21 @@
 > **Goal**: Native vulnerability management and scan ingestion. Replace DefectDojo for finding lifecycle management.
 > **Architecture**: Core features (reconciliation, dedup, dry-run) in `src/`. Parsers extensible via `ScannerParser` trait. Plugins contribute parsers via `contributed_parsers()`.
 
+### Done
+
+- [x] `Finding` entity kind (proto + storage)
+- [x] `IngestionService` gRPC endpoint (`ImportScan` + `DryRunScan`)
+- [x] `ScannerParser` trait + `ParserRegistry`
+- [x] SARIF parser (built-in)
+- [x] Fingerprint-based deduplication (scanner-provided when present, sha256 fallback)
+- [x] Reconciliation engine (new / unchanged / resolved / reopened buckets, scoped to `(component, lifecycle)`)
+
 ### Remaining
 
 - [ ] CycloneDX VEX parser (vulnerability data from SBOMs)
 - [ ] `Plugin::contributed_parsers()` default impl on base trait
-- [ ] Publish events: FindingCreated, FindingResolved, FindingReopened (for downstream plugins)
-- [ ] Assessment workflow (triage, accept risk, remediate)
+- [ ] Publish events: `FindingCreated`, `FindingResolved`, `FindingReopened` (for downstream plugins)
+- [ ] Assessment workflow (triage, accept risk, remediate — the `ACCEPTED` / `FALSE_POSITIVE` state values exist but no API sets them)
 - [ ] Rules engine for auto-assessment
 - [ ] Security gates (severity thresholds per product)
 - [ ] License tracking and policy engine