diff --git a/plans/2026-07-11-nomos-agent-code-review.md b/plans/2026-07-11-nomos-agent-code-review.md
index a8335b0..dbf619e 100644
--- a/plans/2026-07-11-nomos-agent-code-review.md
+++ b/plans/2026-07-11-nomos-agent-code-review.md
@@ -1,6 +1,19 @@
 # 2026-07-11 — Nomos agent code review: gaps and improvement plan
 
-**Status:** Planned
+**Status:** In Progress — 2026-07-11. Every finding except C1 (A1-A3, B1-B3,
+D1-D3, E, F1) is fixed, tested, and verified live against the running stack.
+C1 (unauthenticated nomos gateway) is explicitly deferred per operator
+instruction ("leave auth out for these round of fixes") — the one item
+keeping this out of `done/`.
+
+- A1 `3919ec3`, B1+B2 `c5ffaec`, A3 `926969a`, D1-D3 `76f7630`,
+  A2 `c390164`, B3 `6d4f6de`, F1 `11c18e8`.
+- New `internal/safego` package (B1) and `cmd/nomos/store_test.go` (A2, plus
+  a regression test for the earlier plan-append fix) are the first automated
+  tests for any of this package's core logic — closing part of finding E,
+  though full coverage of agent.go/main.go remains future work.
+- C1 remains open — nomos's gateway (port 8092) still has no authentication.
+  Revisit separately.
 
 ## Scope
 
diff --git a/plans/index.md b/plans/index.md
index 7baad0c..d871e9e 100644
--- a/plans/index.md
+++ b/plans/index.md
@@ -13,7 +13,7 @@ went sideways, open an investigation.
 | 2026-07-08 | [Control room web UI](2026-07-08-control-room-webui.md) | In Progress |
 | 2026-07-08 | [Liveness, drift, and UX cohesion](2026-07-08-liveness-drift-and-ux-cohesion.md) | In Progress — Phase 5 deferred |
 | 2026-07-10 | [General gated execution: unlimited actions, gated by risk](2026-07-10-general-gated-execution.md) | In Progress — enum retirement + auto-act revival still open |
-| 2026-07-11 | [Nomos agent code review: gaps and improvement plan](2026-07-11-nomos-agent-code-review.md) | Planned |
+| 2026-07-11 | [Nomos agent code review: gaps and improvement plan](2026-07-11-nomos-agent-code-review.md) | In Progress — only C1 (unauthenticated nomos gateway) still open, deferred |
 
 ## Done