diff --git a/docs/TODO.md b/docs/TODO.md
index e45d12d..b05f0e9 100644
--- a/docs/TODO.md
+++ b/docs/TODO.md
@@ -7,8 +7,12 @@
    1. Choose and configure code-testing tooling (Molecule, etc.).
    2. Decide how the AI interprets Molecule output and performs live testing:
       API calls, curl pulls of web products, log reviews, and headless browsing.
-   3. Define a standard for generating test users and for instructing the user to
-      perform relevant manual tests.
+      — Headless browsing DECIDED (ADR-017): the `/verify-service` Level 4 harness.
+      The API/curl/log-review siblings remain open.
+   3. ~~Define a standard for generating test users and for instructing the user to
+      perform relevant manual tests.~~ DECIDED (ADR-017): test users in the staging
+      Authentik `test` group; manual tests handed off as a checklist in the
+      `/verify-service` report.
 
 3. **Building services**
    1. Decide how to manage logs.