internal/pkg/api/handleArtifacts.go (5 lines):
	- line 34: defaultMaxParallel = 8           // TODO: configurable
	- line 35: defaultThrottleTTL = time.Minute // TODO: configurable
	- line 141: // TODO: Pull the policy record for this agent and validate that the
	- line 151: span, _ := apm.StartSpan(ctx, "authorizeArtifacts", "auth") // TODO return and use span ctx if this is ever not a nop
	- line 209: // TODO: Design a mechanism to mitigate a DDOS attack on bogus hashes.


internal/pkg/smap/smap.go (3 lines):
	- line 7: // TODO this may be a good candidate for generics when we update to go 1.18+
	- line 64: // TODO Should we consider renaming this to MarshalJSON?
	- line 74: // TODO Should we refactor this to UnmarshalJSON?


internal/pkg/bulk/opBulk.go (2 lines):
	- line 74: // TODO if we can ever set span links after creation we can inject the flushQueue span into resp and link to the action span here.
	- line 240: // TODO: We're loosing information abut the errors, we should check a way


internal/pkg/api/metrics.go (2 lines):
	- line 56: // FIXME we have global metrics but an internal and external API; this may lead to some confusion.
	- line 60: zerolog.Ctx(context.TODO()).Error().Err(err).Msg("unable to initialize metrics") // TODO is used because this may logged during the package load


internal/pkg/api/handleCheckin.go (2 lines):
	- line 703: // TODO: There is a lot of repitition in this method we should try to clean up.
	- line 705: //nolint:nakedret // FIXME try to refactor this in the future


internal/pkg/api/api.go (2 lines):
	- line 79: // FIXME: Cleanup needed for: metrics endpoint (actually a separate listener?), endpoint auth
	- line 80: // FIXME: Should we use strict handler


internal/pkg/api/handleUpload.go (2 lines):
	- line 34: // TODO: move to a config
	- line 46: // FIXME Should we use the structs in openapi.gen.go instead of the generic ones? Will need to rework the uploader if we do


internal/pkg/bulk/engine.go (2 lines):
	- line 570: // TODO: index
	- line 592: // TODO: Fail on non-escaped line feeds


internal/pkg/danger/buf.go (1 line):
	- line 6: // TODO investigate replacing this with a bytes.Buffer


internal/pkg/bulk/opRead.go (1 line):
	- line 45: // TODO if we can ever set span links after creation we can inject the flushQueue span into resp and link to the action span here.


internal/pkg/bulk/opSearch.go (1 line):
	- line 53: // TODO if we can ever set span links after creation we can inject the flushQueue span into resp and link to the action span here.


internal/pkg/config/instrumentation.go (1 line):
	- line 85: // FIXME once we update elastic-agent-libs to go 1.20 we can return multiple errors directly with errors.Join()


internal/pkg/gcheckpt/checkpoint.go (1 line):
	- line 8: //nolint:nakedret // FIXME refactor without naked returns at a later date


internal/pkg/es/error.go (1 line):
	- line 21: // TODO: Why do we have both ErrElastic and ErrorT?  Very strange.


internal/pkg/api/handlePGPRequest.go (1 line):
	- line 121: if stat.Mode().Perm() != defaultKeyPermissions { // TODO determine what permission bits we want to check


internal/pkg/api/handleStatus.go (1 line):
	- line 91: Status: StatusResponseStatus(state.String()), // TODO try to make the oapi codegen less verbose here


internal/pkg/bulk/opMulti.go (1 line):
	- line 13: // TODO: Are multi requests used by anything? a quick grep shows no hits outside the bulk package.


internal/pkg/config/config.go (1 line):
	- line 251: zerolog.Ctx(context.TODO()).Warn().Msg(message) // TODO is used as this may be called before logger config is read.


internal/pkg/model/ext.go (1 line):
	- line 111: // TODO generics?


internal/pkg/policy/monitor.go (1 line):
	- line 167: case hits := <-s.Output(): // TODO would be nice to attach transaction IDs to hits, but would likely need a bigger refactor.


internal/pkg/config/pgp.go (1 line):
	- line 21: // By default it will be the [executable directory]/elastic-agent-upgrade-keys // TODO verify that this is a sane path for fleet-server in an elastic-agent container.


internal/pkg/api/router.go (1 line):
	- line 38: // TODO auth as middleware? - here it takes place after chi router adds scope annotations to the request ctx