diff --git a/README.md b/README.md
index 474f5a1..dfc06f9 100644
--- a/README.md
+++ b/README.md
@@ -69,17 +69,18 @@ docs/        architecture, adr, api
 
 ## Roadmap
 
-### Phase 0 — Walking skeleton  *(M0)*
+### Phase 0 — Walking skeleton  *(M0)* ✓ shipped
 Goal: a single user signs in with Google, connects Todoist, and sees one random Todoist task on a black page. Deletion works.
-- [ ] Monorepo scaffold, CI skeleton, docker-compose dev env with `core`/`full` profiles
-- [ ] `auth` on Auth.js with Google provider; OIDC-shaped boundary (ADR-0004)
-- [ ] `integrations/todoist` OAuth2 flow + encrypted token vault + provider-side revocation
-- [ ] `recommender` with `RandomPolicy`; stable `POST /recommend` contract
-- [ ] `apps/web` — three pages (sign-in, connect, tip); PWA manifest; offline reaction queue
+- [x] Monorepo scaffold, docker-compose dev env
+- [x] `auth` — Google OAuth2/PKCE via openid-client v6; session cookie; Next.js middleware guard
+- [x] `integrations/todoist` — OAuth2 flow, token stored in DB, disconnect supported
+- [x] `recommender` with `RandomPolicy`; stable `POST /recommend` contract; 30s task cache
+- [x] `apps/web` — sign-in, connect, tip pages; PWA manifest + icons
+- [x] Feedback endpoint (done/dismiss/snooze); marks task complete in Todoist
+- [x] Deploy modular monolith to Agap VM via Caddy at `o.alogins.net`
 - [ ] ToS + Privacy Policy + consent capture on first sign-in
 - [ ] Account-deletion endpoint: revokes providers, purges credentials, soft-deletes profile
-- [ ] Metrics baseline: activation, first-tip reaction rate, dwell, retention (see `docs/architecture/metrics.md`)
-- [ ] Deploy modular monolith + `ml/serving` stub to a single VM via docker-compose + Caddy
+- [ ] Metrics baseline: activation, first-tip reaction rate, dwell, retention
 
 ### Phase 1 — Real signal + in-the-moment delivery  *(M1)*
 Goal: tips are picked, not drawn from a hat — and they arrive at the right moment on the web.