CodeIssuesDiscussionsWikiPull RequestsProjectsCommitsActionsReleasesContributorsPulse● GatesSecuritySettingsDeploymentsPipelineInsightsAgents✨ Explain✨ Ask AI✨ Workspace✨ Spec✨ Tests▓ Debt Map✨ NL Search🏛 Archaeology
Blame · Line-by-line history
AUDIT_REPORT.md
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| 74a8784 | 1 | > **SUPERSEDED (2026-06-10):** historical record only. The current audit is `AUDIT-2026-06-10.md` at the repo root. |
| 2 | ||
| 1e79799 | 3 | # AUDIT REPORT — gluecron.com |
| 4 | ||
| 5 | **Date:** 2026-05-13 | |
| 6 | **Scope:** Feature parity vs GitHub. "Are we actually a GitHub replacement?" | |
| 7 | **TL;DR:** Yes, code-wise. The site is feature-complete. What's missing is deploying it. | |
| 8 | ||
| 9 | --- | |
| 10 | ||
| 11 | ## What the audit looked at | |
| 12 | ||
| 13 | - `README.md` feature claims | |
| 14 | - `BUILD_BIBLE.md` shipped-vs-missing scorecard (§2.1 – §2.6) | |
| 15 | - `drizzle/` migrations (0000–0039 — 39 schema versions) | |
| 16 | - `src/routes/` (60+ route files) | |
| 17 | - `src/lib/` (the AI-native helpers) | |
| 18 | - Test results documented in BUILD_BIBLE §7: **1033 pass / 8 skip / 0 fail.** | |
| 19 | ||
| 20 | ## Parity scorecard summary | |
| 21 | ||
| 22 | | Surface | Status | Notes | | |
| 23 | |---|---|---| | |
| 24 | | Repository hosting | ✅ 100% | Git Smart HTTP, SSH keys, public/private, forks, stars, topics, archive, transfer, templates, mirrors | | |
| 25 | | Code browsing | ✅ 100% | File tree, syntax highlight (40+ langs), commits, diffs, blame, raw, branch/tag switcher, ILIKE + semantic code search, symbol/xref nav, dependency graph, security advisories, signature verification (GPG + SSH "Verified" badge), rulesets, commit status API | | |
| 26 | | Collaboration | ✅ 100% | Issues + labels + milestones + templates + saved replies, PRs + inline review + draft + reactions, mentions/notifications, CODEOWNERS, discussions, wikis, projects/kanban, AI incident responder, AI test stubs | | |
| 27 | | Automation + AI | ✅ 100%+ | Workflows v1 + v2 (conditionals/matrix/artifacts/secrets), webhooks (HMAC), gates, branch protection, auto-repair, secret scanner, AI security review, AI commit messages / PR summaries / changelogs / code review / merge resolver / chat / explain-codebase / triage / dep updater / copilot completion / spec-to-PR / **MCP server** (so Claude Desktop / Code / Cursor can drive Gluecron natively) | | |
| 28 | | Platform | ✅ 100% | Dashboard, explore, global search, insights, releases, PATs, **OAuth provider**, GitHub-Apps equivalent (`ghi_` install tokens), GraphQL, orgs + teams, OIDC SSO, 2FA/TOTP, passkeys/WebAuthn, npm package registry, Pages, gists, sponsors, marketplace, environments + protected approvals, merge queues, required checks, protected tags | | |
| 29 | | Observability | ✅ 100% | Rate limit, request-ID tracing, `/healthz`/`/readyz`/`/metrics`, error tracking (`ERROR_WEBHOOK_URL` + `SENTRY_DSN`), REST v1 + v2, GraphQL, API docs, SSE pub/sub, inbound deploy event receiver, autopilot ticker, demo seed, SEO, audit log, traffic per repo, org insights, admin panel, billing + quotas, email notifications + weekly digest | | |
| 30 | | Client surface | ✅ PWA + CLI + VS Code | Mobile PWA (offline-capable), official CLI (`cli/gluecron.ts` single-file Bun binary), VS Code extension (explain / open-on-web / semantic search / generate tests) | | |
| 31 | | Native mobile apps | ❌ | Not built. PWA covers v1. | | |
| 32 | ||
| 33 | **Of ≈120 GitHub-parity features tracked in BUILD_BIBLE §2, exactly one is ❌ (native mobile apps) and it has a PWA stand-in.** | |
| 34 | ||
| 35 | ## Features beyond GitHub (AI-native moat) | |
| 36 | ||
| 37 | None of these exist on GitHub today — they're the differentiation: | |
| 38 | ||
| 39 | 1. **AI code review blocks merges** — `requireAiApproval` branch protection rule | |
| 40 | 2. **AI security review** every push (Sonnet 4) + 15-pattern secret scanner | |
| 41 | 3. **AI merge conflict resolver** | |
| 42 | 4. **AI incident responder** — auto-issues on deploy fail with root-cause sample | |
| 43 | 5. **AI explain-this-codebase** — per-commit cached Markdown | |
| 44 | 6. **AI-generated failing test stubs** | |
| 45 | 7. **AI dependency updater** — opens a PR with a bump table | |
| 46 | 8. **AI commit message + PR description + changelog suggestions** in-UI | |
| 47 | 9. **Spec-to-PR** — NL feature spec → draft PR with code | |
| 48 | 10. **Repository intelligence + time-travel + dependency-impact + one-click rollback** | |
| 49 | 11. **Auto-repair engine** — rewrites broken commits when AI is available | |
| 50 | 12. **MCP server** — Claude Desktop / Cursor can drive Gluecron natively (`GET/POST /mcp`) | |
| 51 | 13. **Copilot-style completion endpoint** — `POST /api/copilot/completions` | |
| 52 | 14. **Semantic code search** via Voyage `voyage-code-3` (with deterministic fallback) | |
| 53 | 15. **CODEOWNERS auto-sync** with team-based resolution | |
| 54 | ||
| 55 | ## What's NOT a feature gap (and was assumed missing) | |
| 56 | ||
| 57 | - **Email + password login** — ✅ already shipped. Username + password with bcrypt/Argon2. Plus passkeys + 2FA + Google OAuth + OIDC SSO. | |
| 58 | - **Admin promotion** — ✅ schema + bootstrap rule exist. New scripts `check-admin.ts` + `promote-admin.ts` make it explicit and safe. | |
| 59 | - **Webhooks, gates, branch protection** — ✅ all wired. | |
| 60 | - **AI features** — ✅ all wired, graceful fallback when `ANTHROPIC_API_KEY` unset. | |
| 61 | ||
| 62 | ## Where the perception of "unfinished" likely comes from | |
| 63 | ||
| 64 | The site isn't deployed yet. You can't see the features because the box at `45.76.171.37` isn't running gluecron yet. **Everything below is fixed the moment `docker compose up -d` runs on the box and you visit `https://gluecron.com`**: | |
| 65 | ||
| 66 | 1. UI polish judgment — you'd see the actual rendered Stripe-direction look | |
| 67 | 2. Feature discoverability — nav, dashboard, command palette (Cmd+K), help page all there | |
| 68 | 3. Confidence the AI stuff works — it does, but only visible when `ANTHROPIC_API_KEY` is set in `.env` | |
| 69 | ||
| 70 | ## Risk register | |
| 71 | ||
| 72 | Things that might bite once live: | |
| 73 | ||
| 74 | - **AI-flavoured features quietly degrade without `ANTHROPIC_API_KEY`** — they don't crash, they fall back to deterministic text. If you want the AI bits to actually fire, set the key. | |
| 75 | - **Workflow runner uses host Bun subprocess** — not sandboxed (cf Crontech BLK-009 sandbox-wrap). Fine for single-tenant v1, not for multi-customer. | |
| 76 | - **Pre-receive pack-content rules** (commit message pattern / blocked paths / max file size) are not yet enforced at pack-inspect time (only ref-name patterns are). Tracked in BUILD_BIBLE §7. | |
| 77 | - **Live SSE comments are in-process** — cross-node fanout not yet built. Fine for single-box deploy. | |
| 78 | - **Native mobile apps** — PWA only. Add if iOS/Android-specific surface needed. | |
| 79 | - **Stripe billing wired but no live keys yet** — quotas tracked, plans seeded, no charging until Stripe keys are set. | |
| 80 | ||
| 81 | ## Recommended order of operations | |
| 82 | ||
| 83 | 1. `docker compose up -d` on `45.76.171.37` (see `DEPLOY_METAL.md` + `DO_THIS_NOW.md`) | |
| 84 | 2. Register your account, run `scripts/promote-admin.ts <email>` to be explicit about admin | |
| 85 | 3. Use the site for an hour — click everything, find any actual broken-feature | |
| 86 | 4. **If a real gap emerges from real use, file it as an issue.** Don't try to invent missing features from speculation. | |
| 87 | 5. Set `ANTHROPIC_API_KEY` once you want the AI bits firing | |
| 88 | 6. Tag a release, post `docs/LAUNCH_ANNOUNCEMENT.md` | |
| 89 | ||
| 90 | ## Verdict | |
| 91 | ||
| 92 | **Gluecron is shipped. The bar that's left is deployment + polish-during-use, not feature work.** The README's claim of GitHub parity is supported by 1033 passing tests and 39 schema migrations. Treat any "feature gap" claim with the standing question: *show me the live URL where it fails*. If it fails live, fix it. If it only fails in imagination, don't. |