There are two TODO lists. This file (good for airplanes) and the online bug tracker:

     https://code.google.com/p/camlistore/issues/list

Offline list:

-- union storage target. sharder can be thought of a specialization
   of union. sharder already unions, but has a hard-coded policy
   of where to put new blobs. union could a library (used by sharder)
   with a pluggable policy on that.

-- remove all the "if !blob.HashMatches" stuff from the blobserver
   storage implementations' ReceiveBlob methods. Have the HTTP layer
   do it instead.  Can give them an io.Reader which does the
   verification before its final EOF, else returns an ErrCorruptBlob
   as the final Read call.

-- support for running cammount under camlistored. especially for OS X,
   where the lifetime of the background daemon will be the same as the
   user's login session.

-- remove all the blobhub stuff from the blobserver storage interface
   and move it elsewhere? nobody really implements it anyway, suggesting
   it's at the wrong level. in the process, also look into simplifying
   the EnumerateBlobs interface and its "wait" parameter. perhaps we need
   a new optional AwaitNewBlob method on a storage interface, and the
   HTTP layer would use that, instead of assuming that all EnumerateBlob
   impls can wait.

-- verify that the HTTP blob upload interface caps uploads at MaxBlobSize
   before giving it to storage impls

-- support syncing from a storage type that doesn't support
   QueueCreator by using local disk instead. writes go to both 1) that
   storage target not supporting QueueCreator and 2) local disk before
   being acknowledged. Then sync goes from local disk to wherever,
   deleting from local disk when done as normal (except in that case,
   the hardlink refcount would drop from 1 to 0, not 2 to 1)

-- website: remove the "Installation" heading for /cmd/*, since
   they're misleading and people should use "go run make.go" in the
   general case.

-- website: add godoc for /server/camlistored (also without a "go get"
   line)

-- tests for all cmd/* stuff, perhaps as part of some integration
   tests.

-- move most of camput into a library, not a package main.

-- server cron support: full syncs, camput file backups, integrity
   checks.

-- status in top right of UI: sync, crons. (in-progress, un-acked
   problems)

-- finish metadata compaction on the encryption blobserver.Storage wrapper.

-- get security review on encryption wrapper. (agl?)

-- peer-to-peer server and blobserver target to store encrypted blobs
   on stranger's hardrives.  server will be open source so groups of
   friends/family can run their own for small circles, or some company
   could run a huge instance.  spray encrypted backup chunks across
   friends' machines, and have central server(s) present challenges to
   the replicas to have them verify what they have and how big, and
   also occasionally say what the SHA-1("challenge" + blob-data) is.

-- sharing: make camget work with permanode sets too, not just
   "directory" and "file" things.

-- sharing: when hitting e.g. http://myserver/share/sha1-xxxxx, if
   a web browser and not a smart client (Accept header? User-Agent?)
   then redirect or render a cutesy gallery or file browser instead,
   still with machine-readable data for slurping.

-- rethink the directory schema so it can a) represent directories
   with millions of files (without making a >1MB or >16MB schema blob),
   probably forming a tree, similar to files. but rather than rolling checksum,
   just split lexically when nodes get too big.

-- delete mostly-obsolete camsigd.  see big TODO in camsigd.go.

-- we used to be able live-edit js/css files in server/camlistored/ui when
   running under the App Engine dev_appserver.py.  That's now broken with my
   latest efforts to revive it.  The place to start looking is:
        server/camlistored/ui/fileembed_appengine.go

-- should a "share" claim be not a claim but its own permanode, so it
   can be rescinded?  right now you can't really unshare a "haveref"
   claim.  or rather, TODO: verify we support "delete" claims to
   delete any claim, and verify the share system and indexer all
   support it.  I think the indexer might, but not the share system.
   Also TODO: "camput delete" or "rescind" subcommand.

-- make the -transitive flag for "camput share -transitive" be a tri-state:
   unset, true, false, and unset should then mean default to true for "file"
   and "directory" schema blobs, and "false" for other things.

-- index: static directory recursive sizes: search: ask to see biggest directories?

-- index: index dates in filenames ("yyyy-mm-dd-Foo-Trip", "yyyy-mm blah", etc).

-- get webdav server working again, for mounting on Windows.  This worked before Go 1
   but bitrot when we moved pkg/fs to use the rsc/fuse.

-- read/write fuse.  using search / camliMember, permanode per inode
   (https://github.com/hanwen/go-fuse + Go camlistore client == easy?)

-- work on runsit more, so I can start using this more often.  runsit should
   be able to reload itself, and also watch for binaries changing and restart
   when binaries change.  (or symlinks to binaries)

-- BUG: ./dev-server and hitting http://localhost:3179/ shouldn't mention
   the /setup handler.

-- add gofmt check to "make presubmit". also add "make fmt" target.

-- BUG: osutil paths.go on OS X: should use Library everywhere instead of mix of
   Library and ~/.camlistore?

-- camput: support for skipping common cache/temp files (most of the support is
   there now, just need to modify cmd/camput/files.go)

OLD:

-- add CROS support?
   http://hacks.mozilla.org/2009/07/cross-site-xmlhttprequest-with-cors/

-- brackup integration, perhaps sans GPG? (requires Perl client?)

-- blobserver test suite: flesh it out.  (bs-test.pl ... it's pretty good
   so far, but not done)

-- blobserver: clean up channel-closing consistency in blobserver interface
   (most close, one doesn't.  all should probably close)

Android:

[ ] Fix wake locks in UploadThread.  need to hold CPU + WiFi whenever
    something's enqueued at all and we're running.  Move out of the Thread
    that's uploading itself.
[ ] GPG signing of blobs (brad)
    http://code.google.com/p/android-privacy-guard/
    http://www.thialfihar.org/projects/apg/
    (supports signing in code, but not an Intent?)
    http://code.google.com/p/android-privacy-guard/wiki/UsingApgForDevelopment
    ... mailed the author.

Client libraries:

[X] Go
[X] JavaScript
[/] Python (Brett); but see https://github.com/tsileo/camlipy
[ ] Perl
[ ] Ruby
[ ] PHP