Blame · Line-by-line history
TODO.md
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| 58267aa | 1 | # Gluecron Master To-Do List |
| 2 | ||
| d3a4be7 | 3 | Last updated: 2026-06-06 (rev 3 — full expanded list) |
| 58267aa | 4 | |
| d3a4be7 | 5 | Tick off items as they ship. Add date + commit ref next to each completed item. |
| 6 | Work top-to-bottom within each priority section. | |
| 58267aa | 7 | |
| 8 | --- | |
| 9 | ||
| d3a4be7 | 10 | ## 🔴 PRIORITY 1 — Revenue (Money In, Do First) |
| 58267aa | 11 | |
| d3a4be7 | 12 | - [ ] **Stripe Checkout flow** — no user can self-serve upgrade today. Stripe webhook handler exists, plan tables exist, billing UI exists, zero checkout session. Wire `stripe.checkout.sessions.create`, handle `checkout.session.completed` to flip plan. Without this: zero revenue. |
| 13 | - [ ] **Stripe customer portal** — let paying users manage/cancel their subscription without emailing support. One Stripe API call (`stripe.billingPortal.sessions.create`), redirect from `/settings/billing`. | |
| 14 | - [ ] **Sponsors payment rails** — `sponsorship_tiers` and `sponsorships` tables exist, UI exists, payment deferred. Wire Stripe Payment Links or Checkout for recurring sponsorships. Maintainers need to actually receive money. | |
| 15 | - [ ] **Pricing page conversion** — `/pricing` exists but copy is not conversion-optimised. Lead with the 90-second spec-to-PR number. Add a comparison table that makes Free look good (drives signups) and Pro look obvious (drives upgrades). Remove all "sleep/wake up" language. | |
| 16 | - [ ] **API usage dashboard** — `/settings/usage` page wiring `aiCostEvents` table. Paid users have no visibility into token spend, rate limit history, or quota usage. Required before charging per-AI-call. | |
| 17 | - [ ] **AI budget enforcement** — `aiBudgets` table exists with monthly spend caps. Verify enforcement is actually wired: when cap is hit, AI features degrade gracefully (return fallback, notify user) rather than silently continuing and racking up cost. | |
| 18 | - [ ] **Free tier viral loop** — make every free user a growth channel. After each AI action, surface a shareable card: "AI just merged my PR in 90 seconds on @gluecron". `/api/v2/me/ai-savings/share` OG-image endpoint. Twitter/LinkedIn share buttons on the AI hours-saved dashboard widget. | |
| 58267aa | 19 | |
| 20 | --- | |
| 21 | ||
| d3a4be7 | 22 | ## 🟠 PRIORITY 2 — Messaging (Affects Every Page, Fix Fast) |
| 58267aa | 23 | |
| d3a4be7 | 24 | The current pitch ("label an issue, walk away, wake up to a merged PR") positions Gluecron as slow and async. Developers sit at their computer and want it done NOW. Every page needs to lead with speed. |
| 25 | ||
| 26 | - [ ] **Landing hero rewrite** (`src/views/landing.tsx`) — new headline: "Write the spec. Gluecron ships it." Subhead: "Spec to PR in 90 seconds. Push to live in 25. AI review, gates, merge — all automatic." Remove async framing. Add live counter showing specs-to-PRs fired today. | |
| 27 | - [ ] **Landing "what just happened" rail** — replace any async/overnight copy with real-time event examples: "PR #47 auto-merged 12 seconds ago", "AI flagged a secret in push 3 minutes ago", "Spec shipped to PR in 1m 43s". Makes it feel alive and instant. | |
| 28 | - [ ] **vs-github AI rows rewrite** (`src/routes/vs-github.tsx`) — reframe the 10 AI-native rows around latency not capability. GitHub Copilot waits for you to type. Gluecron acts in seconds. Add actual timing numbers to each row. | |
| 29 | - [ ] **Demo page rewrite** (`src/routes/demo.tsx`) — replace "watch autopilot work" framing with a live ticker of things happening right now: PRs merging, AI reviews posting, specs being built. Make it feel like a stock ticker for developer productivity. | |
| 30 | - [ ] **Sleep Mode demoted** (`src/routes/sleep-mode.tsx`) — move sleep mode marketing to the bottom of feature pages only. It's a useful secondary feature, never the headline. Primary pitch everywhere = instant results. | |
| 31 | - [ ] **All OG/meta descriptions** — audit every `<meta description>` and OG tag across the app. Strip "wake up to" and replace with speed language. | |
| 32 | - [ ] **Email templates** — the transactional emails (notifications, digests) likely echo the async pitch. Update to celebrate what just happened instantly, not what built up overnight. | |
| 58267aa | 33 | |
| 34 | --- | |
| 35 | ||
| d3a4be7 | 36 | ## 🟡 PRIORITY 3 — Product: Verify What's Built (Routes Exist, Status Unknown) |
| 37 | ||
| 38 | The codebase has many routes that aren't in the BUILD_BIBLE scorecard. Each needs to be opened in a browser, tested end-to-end, and confirmed working or flagged as broken/stub. | |
| 39 | ||
| 40 | - [ ] **Voice-to-PR** (`src/routes/voice-to-pr.tsx`, 1072 lines) — record voice, get a draft PR. Huge UX differentiator. Is this actually working? Test the full flow: record → transcribe → spec → PR. If broken, fix or remove the route. | |
| 41 | - [ ] **Per-repo AI chat** (`src/routes/repo-chat.tsx`) — chat with Claude about a specific repo. Distinct from the global `/ask`. Test: open a repo, go to chat, ask a code question, verify context is scoped to that repo. | |
| 42 | - [ ] **Personal cross-repo chat** (`src/routes/personal-chat.tsx`) — chat with Claude across all your repos. Test the context window and repo-switching. | |
| 43 | - [ ] **Standup reports** (`src/routes/standups.tsx`) — auto-generated standup from recent activity. What does it generate? Is it useful? Test for a real repo with recent commits/PRs. | |
| 44 | - [ ] **Multi-repo refactoring** (`src/routes/refactors.tsx`) — AI-driven refactor that opens PRs across multiple repos simultaneously. Verify `multiRepoRefactors` + `multiRepoRefactorPrs` tables are wired. Test the full flow. | |
| 45 | - [ ] **Build agent spec** (`src/routes/build-agent-spec.tsx`) — AI spec builder UI. Is this the same as spec-to-PR or a different flow? Clarify and document. | |
| 46 | - [ ] **Migration assistant** (`src/routes/migration-assistant.tsx`) — AI-assisted migration tool. What does it migrate? Code patterns, framework versions? Test and document. | |
| 47 | - [ ] **Comment moderation** (`src/routes/comment-moderation.tsx`) — spam/abuse filtering queue. Test: post a spam comment, verify it enters the moderation queue, approve/reject works. | |
| 48 | - [ ] **Interactive playground** (`src/routes/playground.tsx`) — what is this? Test it. If it's a Claude Code sandbox, make it prominent. If it's broken, fix or remove. | |
| 49 | - [ ] **PR live co-editing** (`src/routes/pr-live.ts`) — `prLiveSessions` table exists. Real-time cursor sharing on PRs? Test with two browsers simultaneously. | |
| 50 | - [ ] **Hosted Claude loops** (`src/routes/claude-deploy.tsx`, `hostedClaudeLoops` table) — Claude agents running as persistent loops on user repos. Verify the UI, test creating a loop, verify it runs, verify cost is tracked in `aiCostEvents`. | |
| 51 | - [ ] **Cloud dev environments** (`src/routes/dev-env.tsx`, `devEnvs` table) — Codespaces equivalent. Massive feature if working. Test: create a dev env for a repo, verify it spins up (or that it's a stub that needs implementation). | |
| 52 | - [ ] **Branch preview URLs** (`src/routes/previews.tsx`, `branchPreviews` table) — per-branch preview deployments. Verify this is wired to the workflow runner and actually generates live URLs. | |
| 53 | - [ ] **PR sandbox** (`src/routes/pr-sandbox.ts`, `prSandboxes` table) — runnable PR environment. Test: open a PR, create sandbox, verify it runs. | |
| 54 | - [ ] **Slack/Discord/Teams integration** (`src/routes/integrations-chat.ts`, `chatIntegrations` table) — notifications into chat channels. Test connecting a Slack workspace, push an event, verify message arrives. | |
| 55 | - [ ] **Google OAuth login** (`src/routes/google-oauth.tsx`) — sign in with Google. Test the full OAuth flow: click → Google → callback → logged in. | |
| 56 | - [ ] **Connect Claude** (`src/routes/connect-claude.tsx`) — distinct from `/connect/claude-guide`. What does this do? Clarify. | |
| 57 | - [ ] **Import secrets** (`src/routes/import-secrets.tsx`) — import secrets from GitHub/Vault/env file into workflow secrets. Test the full flow. | |
| 58 | - [ ] **Agent settings** (`src/routes/settings-agents.tsx`) — per-user agent configuration. What settings exist? Verify UI is complete. | |
| 59 | - [ ] **Integration settings** (`src/routes/settings-integrations.tsx`) — user-level integrations (Slack, Linear, etc.). Verify complete. | |
| 60 | - [ ] **Activity feed** (`src/routes/activity.tsx`) — distinct from the dashboard feed. Test and verify it's showing meaningful data. | |
| 61 | - [ ] **Message inbox** (`src/routes/inbox.tsx`) — distinct from notifications. What goes here? Verify it's working. | |
| 62 | - [ ] **Admin > Diagnose** (`src/routes/admin-diagnose.tsx`, 1337 lines) — stale issue/PR detection, suspicious pattern detection. Test each diagnostic and verify results are accurate. | |
| 63 | - [ ] **Admin > Self-host wizard** (`src/routes/admin-self-host.tsx`, 1240 lines) — bootstrap automation for self-hosting. Test the full setup flow. | |
| 64 | - [ ] **Admin > Server targets** (`src/routes/admin-server-targets.tsx`) — SSH deploy targets UI. Verify admin can add a target and trigger a deploy. | |
| 65 | - [ ] **Admin > Advancement flags** (`src/routes/admin-advancement.tsx`) — per-block feature gating. Verify all flags are wired to their features. | |
| 66 | - [ ] **Admin > Integration secrets** (`src/routes/admin-integrations.tsx`) — admin sets Anthropic API key, Resend key, GitHub OAuth keys from the UI. Verify each saves correctly and the feature it powers activates. | |
| 67 | - [ ] **2030 landing page** (`src/views/landing-2030.tsx`) — future landing page in the codebase. What is this? Is it a planned redesign? Decide: ship it or delete it. | |
| 68 | - [ ] **Legal pages** — terms, privacy, DMCA, acceptable-use exist as routes. Verify: (1) actual legal text is there (not placeholder), (2) linked from footer, (3) accessible to logged-out users. | |
| 69 | ||
| 70 | --- | |
| 58267aa | 71 | |
| d3a4be7 | 72 | ## 🟢 PRIORITY 4 — Product: Known Gaps (Confirmed Not Built) |
| 73 | ||
| 74 | ### Core Infrastructure | |
| 75 | - [ ] **SSH git push** — SSH keys stored in DB, Smart HTTP documented, but `git clone git@gluecron.com:user/repo.git` may not work. Test from a clean machine. If broken: implement SSH server (ssh2 library, key lookup, `git-upload-pack`/`git-receive-pack` subprocess). Many devs refuse HTTPS for git. | |
| 76 | - [ ] **Container registry (Docker/OCI)** — npm registry shipped, schema ready for containers, OCI protocol not implemented. Wire: `GET /v2/`, blob upload/download, manifest push/pull. Without this, Docker users cannot fully leave GitHub. | |
| 77 | - [ ] **Server targets — customer rollout** — SSH deploy targets (Block ST) are admin-only. Expose `/settings/deploy-targets` for all users: add target (host, user, private key, deploy script), push-to-deploy from any branch. The "push and it's live in 25 seconds" story needs this for customer repos, not just Gluecron.com itself. | |
| 78 | - [ ] **Redis SSE** — live comment updates, PR live view, push watch use single-process in-memory broadcaster. Multi-instance deploys break it. Replace with Redis pub/sub behind the same `sse.ts` interface. | |
| 79 | - [ ] **Workflow cache SAVE** — CI caching only does LOAD. Save-on-job-success unimplemented. Every CI run after the first is cold. Wire the SAVE half of the cache action. | |
| 80 | - [ ] **Pack-content ruleset enforcement** — `commit_message_pattern`, `blocked_file_paths`, `max_file_size` in rulesets need actual git pack inspection. Currently advisory for those types. Implement in `src/lib/push-policy.ts`. | |
| 58267aa | 81 | |
| 82 | ### AI & Automation | |
| d3a4be7 | 83 | - [ ] **Spec-to-Live full pipeline** — currently Spec→PR. Wire the rest: PR opens → AI review fires → gates run → auto-merge → deploy → real-time browser notification showing elapsed time "merged in 1m 52s". Make the whole loop visible in the browser while it happens. |
| 84 | - [ ] **L7 skill files build step** — `scripts/install.sh` writes skill file bodies via heredocs that drift from canonical `.claude/skills/` files. Add a release step that materialises heredocs from actual files. | |
| 85 | - [ ] **Skill bundle on import** — when a user imports a GitHub repo, the Claude Code skills should be bundled into the imported repo's `.claude/settings.json` automatically. | |
| 86 | - [ ] **GitHub Actions → Gluecron YAML translator** — auto-translate `.github/workflows/*.yml` to `.gluecron/workflows/*.yml` at import time. Removes the biggest migration blocker. | |
| 58267aa | 87 | |
| 88 | ### Developer Experience | |
| d3a4be7 | 89 | - [ ] **Spec-to-PR real-time progress UI** — the spec form submits and... what does the user see? Wire a live progress view: "Analysing repo → Writing code → Creating branch → Opening PR → Done." This makes the 90-second wait feel fast, not slow. |
| 90 | - [ ] **Bulk issue operations polish** — bulk close/reopen is in-flight per the BUILD_BIBLE. Verify the floating action bar and checkboxes are complete and working. | |
| 91 | - [ ] **K3 tasks on `/admin/autopilot`** — `auto-merge-sweep` and `ai-build-from-issues` run every tick but aren't in the admin UI. Add them with last-run time and count stats. | |
| 92 | - [ ] **System/autopilot user** — K3 posts marker comments credited to the PR/issue author. Create a synthetic `gluecron[bot]` user row so autopilot actions show a bot avatar, not a human's name. | |
| 93 | - [ ] **@mention autocomplete on commit messages** — mention-autocomplete wires textareas. Extend to the web editor commit message field. | |
| 94 | - [ ] **Workflow artifact retention policy** — artifacts accumulate forever. Add 90-day default with per-repo override and autopilot cleanup task. | |
| 95 | - [ ] **L1 sleep-mode column** — sleep-mode digest and weekly digest share `last_digest_sent_at`. Split to `last_sleep_digest_sent_at` to avoid starving one feed. | |
| 96 | - [ ] **GitHub unlink route** — `/settings/sso/unlink` removes any SSO link. Add `/settings/github/unlink` for GitHub OAuth users specifically. | |
| 97 | - [ ] **AI commit message audit events** — `audit()` call missing from `generateCommitMessage`. Adds the L9 hours-saved counter line item for commit message generation. | |
| 58267aa | 98 | |
| 99 | --- | |
| 100 | ||
| d3a4be7 | 101 | ## 🔵 PRIORITY 5 — Customer-Facing Sections (Must Look Complete and Polished) |
| 102 | ||
| 103 | ### The "Now" Dashboard Experience | |
| 104 | - [ ] **Dashboard "AI just did this" widget** — top of dashboard, shows what autopilot did in the last hour: PRs auto-merged, specs shipped, secrets repaired, AI reviews posted. Real-time feel. Not "last 7 days" — "last hour." | |
| 105 | - [ ] **Push Watch → make it prominent** (`/:owner/:repo/push/:sha`) — the page exists. Add a "Live" link directly on the repo header that lights up after every push and shows the push-to-live progress bar. This is the "wow" moment new users need to see. | |
| 106 | - [ ] **Repo overview: health badge + AI stats** — health score badge top-right of repo header. Below the file tree: "AI merged 3 PRs this week · Saved ~4.5 hrs · 0 open security alerts." Makes AI value visible at a glance. | |
| 107 | - [ ] **Notification preferences overhaul** — `/settings/notifications` is a flat list. Restructure into categories: AI activity, CI/CD, code review, mentions/assigns. Per-category email + push + in-app toggle. | |
| 108 | ||
| 109 | ### Admin Panel (Must Be Production-Grade) | |
| 110 | - [ ] **Admin > AI cost breakdown** — total AI spend this month, cost per feature type (review vs triage vs completion vs chat), top spenders. Unit economics tracking. | |
| 111 | - [ ] **Admin > Stripe sync view** — Stripe subscription status per user vs local plan. Flag mismatches. Allow manual sync. | |
| 112 | - [ ] **Admin > Autopilot health dashboard** — last tick time, tasks completed per tick, error rates, average tick duration. Time-series chart showing autopilot activity. | |
| 113 | - [ ] **Admin > Mirror status** — failed mirrors, sync lag, last successful sync. Alert column for repos that haven't synced in 24h. | |
| 114 | - [ ] **Admin > Email deliverability** — sent/bounced/failed counts from Resend. Currently fire-and-forget with zero visibility. | |
| 115 | - [ ] **Admin > User growth chart** — signups over time, activation rate (users who created a repo), conversion rate (free → paid). Business health at a glance. | |
| 116 | - [ ] **Admin > Revenue dashboard** — MRR, new subscribers this month, churn, plan distribution. Pull from Stripe API. | |
| 117 | ||
| 118 | ### Onboarding Flow | |
| 119 | - [ ] **Onboarding email sequence** — after signup, users should get: (1) welcome + quick start at T+0, (2) "try spec-to-PR" prompt at T+1 day, (3) "here's what AI did for repos like yours" at T+3 days. Resend sequences. | |
| 120 | - [ ] **Empty state for new repos** — new repo with no code should show: "Push your first commit" with exact git commands + "Or import from GitHub" + "Or try Spec-to-PR to let AI write your first feature." Not a blank page. | |
| 121 | - [ ] **Onboarding checklist widget on dashboard** — for users who haven't done: ☐ push a repo ☐ open a PR ☐ try spec-to-PR ☐ enable auto-merge. Disappears once complete. | |
| 122 | - [ ] **`curl | bash` install flow** — `curl -sSL gluecron.com/install | bash` (L2) exists. Test on a clean machine. Verify it: signs in, mints PAT, writes Claude Desktop config, imports a repo. Fix any broken steps. | |
| 123 | ||
| 124 | ### Help & Documentation | |
| 125 | - [ ] **Documentation site** — `/help` exists as a migration cheatsheet. Need a proper docs site: Getting Started, CLI reference, API reference, MCP server setup, workflow YAML syntax, migration guide. Could be `/docs` served from git or a separate subdomain. | |
| 126 | - [ ] **Changelog / what's new** — users have no way to know what shipped. Add `/changelog` showing recent releases with AI-generated notes. Feeds trust. | |
| 127 | - [ ] **In-app contextual help** — "?" icons next to non-obvious features (DORA metrics, rulesets, merge queues) that expand a tooltip or link to docs. | |
| 128 | - [ ] **Status page completeness** — `/status` and `/status.svg` exist. Verify: uptime history, incident history, subscribe-to-alerts link. Make it look like Atlassian Status Page quality. | |
| 58267aa | 129 | |
| d3a4be7 | 130 | --- |
| be18eee | 131 | |
| d3a4be7 | 132 | ## 🟣 PRIORITY 6 — Growth & Ecosystem |
| 58267aa | 133 | |
| d3a4be7 | 134 | ### Acquisition |
| 135 | - [ ] **60-second demo video** — screen record: type a spec → watch AI write code → PR opens → AI review posts → gates pass → merged. Show the elapsed time counter. No voiceover. Embed on landing, `/demo`, `/vs-github`. This is the single highest-ROI marketing asset. | |
| 136 | - [ ] **Zero-friction GitHub migration** — import page already exists but make it the primary CTA on landing for GitHub users. Add: "Migrate your entire GitHub org in 60 seconds" with a big button. The bulk import is built — just needs prominence. | |
| 137 | - [ ] **`/vs-github` ongoing maintenance** — living document. As GitHub ships, update the table. Set a monthly reminder to review it. | |
| 138 | - [ ] **HackerNews / dev community launch** — plan a Show HN post. The platform is substantial enough. Need: a live demo URL, the 60-second video, a clear "what's different" paragraph. Time it with the demo video completion. | |
| 139 | - [ ] **Developer program page** — `/developer-program`: register as a marketplace app builder, revenue share terms, `gluecron-partner` badge, dedicated support. Required before the marketplace can grow organically. | |
| 140 | - [ ] **Blog / devlog** — even a simple `/blog` with monthly updates. Developers follow platforms that ship visibly. Show the build. | |
| 58267aa | 141 | |
| d3a4be7 | 142 | ### Distribution |
| 143 | - [ ] **VS Code extension → publish to VS Code Marketplace** — `vscode-extension/` is built. Run `vsce package`, publish. Free discovery from millions of VS Code users. | |
| 144 | - [ ] **CLI → publish to npm** — `cli/gluecron.ts` is built. Publish as `gluecron` npm package. `npx gluecron login` as zero-install entry point. | |
| 145 | - [ ] **CLI → Homebrew formula** — add to homebrew-core or a tap. `brew install gluecron`. Mac developer standard. | |
| 146 | - [ ] **JetBrains plugin** — IntelliJ, WebStorm, GoLand users. Kotlin plugin, same four commands as VS Code extension. Covers the second-largest IDE population. | |
| 147 | ||
| 148 | ### Platform Expansion | |
| 149 | - [ ] **Agent marketplace — real listings** — currently 4 seed listings. Need 20+ real agents with real installs. Reach out to 10 developers to build and list agents. Create a "build an agent" tutorial. | |
| 150 | - [ ] **Dependency network graph UI** — `repositoriesDependingOn()` is implemented in `src/lib/deps.ts`. Wire `/:owner/:repo/dependencies/dependents` — "who depends on me?" page. Big for open source maintainers. | |
| 151 | - [ ] **Multi-agent pipeline UI** — `agentSessions` + `agentLeases` tables exist. Wire a UI to define pipelines: Agent A writes, Agent B reviews, Agent C deploys. The future of automated software teams. | |
| 152 | - [ ] **AI pair programmer (browser)** — real-time Claude session in the browser alongside the file editor. Think Cursor-in-a-tab. Uses web editor + AI completion endpoint + SSE for live edits. Biggest competitive moat against Cursor/Copilot. | |
| 58267aa | 153 | |
| 154 | --- | |
| 155 | ||
| d3a4be7 | 156 | ## ⚫ PRIORITY 7 — Strategic / Long-Term |
| 58267aa | 157 | |
| d3a4be7 | 158 | ### Enterprise |
| 159 | - [ ] **SOC 2 Type II** — engage an auditor, scope controls, begin evidence collection. 6–9 months to certification. Without it: no mid-market or enterprise deals close, regardless of features. | |
| 160 | - [ ] **EU data residency** — Neon postgres EU region + Fly.io EU region. "Data region" selector at org creation. Enterprise legal requirement in many EU companies. | |
| 161 | - [ ] **GDPR full deletion cascade** — verify: repo bare git dir deleted, issues/PRs/comments purged or anonymised, tokens revoked, audit log entries anonymised. Confirm grace period implementation is complete. | |
| 162 | - [ ] **Audit log SIEM export** — `GET /api/v2/audit?since=&format=json` for Splunk/Datadog/Elastic integration. Required by enterprise security teams. | |
| 163 | - [ ] **Enterprise sales page** — `/enterprise`: custom pricing, SSO/SAML, dedicated support SLA, audit log export, data residency. Contact form → Calendly. | |
| 164 | - [ ] **99.9% SLA commitment** — write it down, publish it. Enterprises need a contractual uptime commitment before signing. | |
| 58267aa | 165 | |
| d3a4be7 | 166 | ### Mobile |
| 167 | - [ ] **Native iOS app** — the only ❌ in the entire platform scorecard. Minimum viable: repo browser, notifications, PR approve/reject, AI chat. React Native for code share with Android. | |
| 168 | - [ ] **Native Android app** — same codebase as iOS via React Native. | |
| 169 | - [ ] **PWA push notification fix** — Web Push (M8) is implemented. Verify push notifications actually arrive on mobile browsers (iOS Safari is particularly finicky with Web Push standards). | |
| 170 | ||
| 171 | ### Reliability | |
| 172 | - [ ] **End-to-end test suite** — unit tests are 1491 passing. But is there a full E2E suite (Playwright/Puppeteer) covering: register → create repo → push code → open PR → AI review fires → merge? This is what catches regressions in the full flow. | |
| 173 | - [ ] **Load testing** — what happens at 1000 concurrent git pushes? At 10k concurrent web sessions? Run k6 or Artillery before any growth push. | |
| 174 | - [ ] **Database connection pooling** — Neon + Drizzle direct connection. Under load, connection limits become the bottleneck. Verify PgBouncer or Neon's built-in pooling is configured correctly. | |
| 175 | - [ ] **Backup and recovery verification** — Neon has backups. Test restoration. Document the RTO/RPO. Required for SOC 2 and for not losing customer code. | |
| 58267aa | 176 | |
| 177 | --- | |
| 178 | ||
| d3a4be7 | 179 | ## ✅ COMPLETED (Reference — Do Not Redo) |
| 180 | ||
| 181 | Everything in `BUILD_BIBLE.md §2` marked ✅ is shipped. Key capabilities: | |
| 182 | ||
| 183 | **Git hosting:** clone, push, fetch, SSH key storage, forking, stars, topics, archiving, templates, mirroring, repository transfer, public/private visibility | |
| 184 | ||
| 185 | **Code browsing:** file tree, syntax highlighting (40+ languages), blame, diff, raw, branch/tag switcher, commit history, semantic search, symbol navigation, dependency graph, security advisories, commit signature verification, repository rulesets | |
| 186 | ||
| 187 | **Collaboration:** issues, PRs, inline comments, draft PRs, reactions, mentions, notifications, discussions, wikis, gists, projects/kanban, milestones, code owners, issue/PR templates, saved replies, merge queues, required checks, protected tags | |
| 188 | ||
| 189 | **CI/CD:** workflow runner (GitHub Actions equivalent), workflow secrets, matrix builds, caching (LOAD), environments with approval gates, deployment tracking, branch protection, gate runs, auto-repair, secret scanner | |
| 190 | ||
| 191 | **AI (all wired, not stubs):** code review (blocks merges), PR/issue triage, changelogs, test generation, spec-to-PR, auto-merge (K2), AI build from issues (K3), codebase explanation, dependency updater, merge conflict resolver, commit message suggestion, PR description suggestion, copilot completions, sleep-mode digest (L1), AI hours saved (L9) | |
| 192 | ||
| 193 | **Platform:** organizations, teams, SSO/OIDC, 2FA/TOTP, WebAuthn/passkeys, OAuth 2.0 provider, GitHub sign-in (L6), MCP server (K1), Claude Code skills (L7), VS Code extension (G4), CLI (G3), GraphQL API, REST v2, package registry (npm), static hosting (Pages), marketplace, DORA metrics, velocity, health score, hot files, pulse, traffic analytics, admin panel, billing infrastructure, audit logs, rate limiting, observability, PWA, SEO | |
| 194 | ||
| 195 | **Marketing shipped:** landing hero (L10), vs-github page (L5), pricing page (L8), demo page (L3), public stats counters (L4), install script (L2), onboarding flow, help page, keyboard shortcuts, command palette | |
| 58267aa | 196 | |
| 197 | --- | |
| 198 | ||
| d3a4be7 | 199 | ## How to Use This File |
| 58267aa | 200 | |
| d3a4be7 | 201 | - `- [ ]` = not started |
| 202 | - `- [x] YYYY-MM-DD commit:abc1234` = done | |
| 203 | - Add new gaps here as they're discovered | |
| 204 | - When in doubt about priority, Revenue (P1) > Messaging (P2) > Verify existing (P3) > Build new (P4+) |