diff --git a/plans/README.md b/plans/README.md
new file mode 100644
index 00000000..3079951c
--- /dev/null
+++ b/plans/README.md
@@ -0,0 +1,51 @@
+# Advisory Plans
+
+Plans written against commit `0d31d46`.
+
+## Status
+
+| # | Plan | Catalog | Status | Dependency |
+|---|---|---|---|---|
+| 001 | Fix broken Go lint baseline | DX / Tooling | TODO | None |
+| 002 | Stop marking JSON attributes as trusted HTML | Security | TODO | None |
+| 003 | Gate or remove unauthenticated pprof routes | Security | TODO | None |
+| 004 | Validate playback proxy targets before signing/fetching | Security | TODO | None |
+| 005 | Limit home continue-watching carousel query | Performance | TODO | None |
+| 006 | Move top-picks recommendation expansion off request path | Performance | TODO | None |
+| 007 | Characterize the browser player flow | Tests | TODO | Before major player refactors |
+| 008 | Add data-fix runner characterization tests | Tests | TODO | None |
+| 009 | Add CI for the existing verification command | DX / Tooling | TODO | 001 |
+| 010 | Add watchlist import / restore | Direction | TODO | None |
+| 011 | Surface recommendation rationale | Direction | TODO | None |
+| 012 | Expose episode availability freshness / retry state | Direction | TODO | None |
+
+## Recommended Order
+
+1. `001-fix-broken-go-lint-baseline.md`
+2. `009-add-ci-for-existing-verification-command.md`
+3. `002-stop-marking-json-attributes-trusted-html.md`
+4. `003-gate-or-remove-unauthenticated-pprof-routes.md`
+5. `005-limit-home-continue-watching-carousel-query.md`
+6. `008-add-data-fix-runner-characterization-tests.md`
+7. `004-validate-playback-proxy-targets.md`
+8. `007-characterize-browser-player-flow.md`
+9. `006-move-top-picks-recommendation-expansion-off-request-path.md`
+10. Direction plans as product priorities: `010`, `011`, `012`.
+
+## Verification Baseline
+
+Known passing during audit:
+
+- `go test ./...`
+- `bun test`
+- `bunx tsc -p tsconfig.json --noEmit`
+- `bun run lint:ts`
+- `bun audit`
+
+Known failing during audit:
+
+- `bun run lint:go` fails on `internal/observability/fx.go:22` for `cyclop` complexity.
+
+Unavailable during audit:
+
+- `govulncheck ./...` because `govulncheck` was not installed.