diff --git a/progress.md b/progress.md
index 9b6217f..cdfdb41 100644
--- a/progress.md
+++ b/progress.md
@@ -2,6 +2,30 @@
 
 Updated: 2026-07-26
 
+## Implementation review — 2026-07-26
+
+`go test ./...` passes, but the implementation is still a tested substrate/router prototype rather than a functioning unattended multi-harness orchestra. The following gaps were verified against `orchestra-spec (1).md` and the current code:
+
+- **Harness execution is not wired into routing.** The router records `TaskLeased`, but does not call a harness adapter to create a session, create/use a worktree, bootstrap the agent, or monitor lifecycle events.
+- **Rotation is not implemented.** There is no turn-boundary callback, herdr event subscription, occupancy-triggered rotation, milestone/thrash trigger, or split-then-close coordinator.
+- **Lifecycle API payloads are invalid.** The release, complete, and block endpoints all emit `{"source":"api"}`, while validation requires `handoff_ref` or `reason`, `report_ref`, and `blocker` respectively. The documented lifecycle endpoints therefore cannot complete successfully.
+- **Provider integrations are not wired into the server.** JSONL and Gitea adapters exist, but `main.go` has no webhook routes or polling loops; only generic task POST ingestion is exposed.
+- **CAS references are not content-verified at event append.** Lifecycle events check that referenced files exist, but do not verify that the file content hashes to the supplied reference.
+- **Replay bypasses event validation.** Startup replay unmarshals and applies events without validating the event envelope, payload schema, or sequence/version invariants.
+- **Snapshots are written but never loaded or used for replay acceleration.** Startup always replays the complete event log.
+- **Task creation projection is incomplete.** `parent`, `due`, `inherent_priority`, and `estimate` are defined in the domain model but are not projected from `TaskCreated` payloads.
+- **Occupancy support is incomplete relative to the spec.** Codex active-session discovery and opencode's server/SSE plus fallback path are not implemented.
+- **Authorization is only partially enforced.** HTTP method restrictions exist, but handlers do not consistently call `AuthorizeEvent`; an absent surface defaults to full-control Web.
+
+Recommended order:
+
+1. Fix lifecycle payloads and add endpoint tests.
+2. Add the orchestration coordinator: lease → worktree → harness session → bootstrap → lifecycle events.
+3. Implement rotation and turn-boundary monitoring.
+4. Wire provider webhook and polling integrations.
+5. Harden replay and CAS verification.
+6. Reconcile the status/checklist sections below with the actual implementation.
+
 ## Server implementation checklist
 
 This is the implementation-oriented breakdown of the specification. It is a project checklist, not a replacement for the binding spec.