Commit0b4d294unknown_key
docs(roadmap): add Holden Mercer addendum + 30 "2030 killer moves" with feasibility tags
docs(roadmap): add Holden Mercer addendum + 30 "2030 killer moves" with feasibility tags Two strategic docs landed today: - Addendum from Holden Mercer's team specifying the API surface an AI build agent needs (12 endpoints across contents / git plumbing / actions-workflows). 4 already shipped, 8 in flight tonight. - External "2030 killer moves" doc with 30 items spanning agent scoping, AI-native git layer, observability, enclave runtimes, and edge architecture. Triaged everything into [NOW]/[NEXT]/[FAR] tags so we can pick off the highest-ROI [NOW] items in upcoming sessions without losing the long- tail items to inbox-drift.
1 file changed+89−00b4d29415e06474c04ada5e1924e8388ef3625b8
1 changed file+89−0
ModifiedROADMAP.md+89−0View fileUnifiedSplit
@@ -261,6 +261,95 @@ Slotted into existing tiers above where overlapping, listed here when new.
261261
262262---
263263
264## 🛰️ Spec Review Addendum — 2026-05-20 (Holden Mercer / agent-build API)
265
266External addendum asked for the API surface an AI build agent needs to:
267read files, write multi-file atomic commits, dispatch background builds.
26812 endpoints across 3 groups. Status:
269
270### Group 1 — File contents
271- [x] `GET /api/v2/repos/:owner/:repo/contents/:path` (was already built)
272- [x] `PUT /api/v2/repos/:owner/:repo/contents/:path` (was already built)
273- [ ] `DELETE /api/v2/repos/:owner/:repo/contents/:path` (in flight tonight)
274
275### Group 2 — Git plumbing (atomic multi-file commits)
276- [x] `POST /api/v2/repos/:owner/:repo/git/refs` (creating branches — already built)
277- [ ] `GET /api/v2/repos/:owner/:repo/git/refs/heads/:branch` (in flight tonight)
278- [ ] `GET /api/v2/repos/:owner/:repo/git/commits/:sha` (in flight tonight)
279- [ ] `POST /api/v2/repos/:owner/:repo/git/blobs` (in flight tonight)
280- [ ] `POST /api/v2/repos/:owner/:repo/git/trees` (in flight tonight)
281- [ ] `POST /api/v2/repos/:owner/:repo/git/commits` (in flight tonight)
282- [ ] `PATCH /api/v2/repos/:owner/:repo/git/refs/heads/:branch` (in flight tonight)
283
284### Group 3 — Actions / workflows
285- [ ] `POST /api/v2/repos/:owner/:repo/actions/workflows/:filename/dispatches` (in flight tonight)
286- [ ] `GET /api/v2/repos/:owner/:repo/actions/workflows/:filename/runs` (in flight tonight)
287- [ ] `GET /api/v2/repos/:owner/:repo/actions/runs/:run_id` (in flight tonight)
288- [ ] `GET /api/v2/repos/:owner/:repo/actions/runs/:run_id/logs` (zip) (in flight tonight)
289- [ ] `POST /api/v2/repos/:owner/:repo/actions/runs/:run_id/cancel` (in flight tonight)
290
291Helpers verified available: `getBlob`, `getTree`, `getCommit`, `resolveRef`,
292`updateRef`, `writeBlob`, `refExists`, `objectExists`, `getBlobShaAtPath`,
293`createOrUpdateFileOnBranch`, `enqueueRun`. Auth uses existing `requireApiAuth` +
294`requireScope("repo")`. No schema changes needed.
295
296---
297
298## 🛸 "2030 KILLER MOVES" — 2026-05-20 (external strategic doc, 30 items)
299
300Triaged for feasibility from current architecture. Tagged: **[NOW]** = can
301build inside the current platform with no new infra; **[NEXT]** = needs
302one major piece of new infra (vector store, edge runtime, enclave); **[FAR]**
303= multi-quarter or requires partner ecosystem.
304
305### Next-gen security & agent scoping
306- [ ] **[NOW]** 1. Token-level identity binding — `agent_session` tokens scoped to a single branch/issue. Builds on existing PAT scopes — add a `target_ref` field to `api_tokens`. **~4-6 hrs**
307- [ ] **[NOW]** 2. Ephemeral branch sandboxes — `refs/scratch/*` exempt from CI, pruned after merge. **~4-6 hrs**
308- [ ] **[NOW]** 3. Nonce-enforced PUT queries — `If-Match: <blob_sha>` semantics. Group 1 PUT/DELETE already needs `sha`; lift to an HTTP header. **~2-3 hrs**
309- [ ] **[NOW]** 4. Byte-range content patching — `PATCH /contents/:path` with RFC-6902 JSON patch or unified-diff body. **~4-6 hrs**
310- [ ] **[NEXT]** 5. Semantic content hashing — AST-aware hash to suppress comment/whitespace CI. Needs per-language parsers. **~10-15 hrs**
311
312### AI-native git data layer
313- [ ] **[NOW]** 6. LLM-native content bundling — `GET /contents/:path?format=llm-xml`. Existing repo-walker + XML wrap. **~3-4 hrs**
314- [ ] **[NEXT]** 7. On-the-fly dependency analysis on commit POST. Needs language-aware parsers. **~8-10 hrs**
315- [ ] **[NOW]** 8. Graph-native history walks — `?depth=10&include_diffs=true` on `/git/commits/:sha`. **~3-4 hrs**
316- [ ] **[NOW]** 9. Auto-clustered staging trees — agents stream blobs, server batches into one commit on `flush`. Sits next to Group 2 tree builder. **~6-8 hrs**
317- [ ] **[NEXT]** 10. Intent metadata + pre-receive intent matcher. Needs semantic-diff infra. **~10-12 hrs**
318
319### Real-time observability & build fabric
320- [ ] **[NOW]** 11. Zero-polling SSE workflow log streams — `/actions/runs/:run_id/stream`. SSE infra already exists. **~3-4 hrs**
321- [ ] **[NEXT]** 12. Programmable inline step interceptors — workflow_dispatch body conditional hooks. **~6-8 hrs**
322- [ ] **[NEXT]** 13. State-saves on failure — snapshot runner FS on crash. Needs container snapshot capability. **~10-15 hrs**
323- [ ] **[NEXT]** 14. Predictive execution caching — keyed by `tree_sha + input_shape`. Cache layer. **~6-8 hrs**
324- [ ] **[NEXT]** 15. Vector-formatted workflow log outlets — embeddings on log lines. Pairs with item #2 of prev list. **~4-6 hrs**
325
326### Enclave runtimes & advanced security
327- [ ] **[FAR]** 16. Post-quantum API auth (ML-DSA / Falcon). **~weeks**
328- [ ] **[NEXT]** 17. Cryptographic reproducibility proofs / signed BOM per run. Builds on SLSA item from prev list. **~6-8 hrs**
329- [ ] **[FAR]** 18. Zero-trust local storage — orchestration-plane-only mode. Massive architectural shift. **~quarters**
330- [ ] **[NOW]** 19. Context-aware 429 — `X-Gluecron-Backoff-Context` header on throttles. **~1-2 hrs**
331- [ ] **[FAR]** 20. Automated fork-enclave execution for unverified agents. Needs biometric integration. **~quarters**
332
333### Architectural superiority
334- [ ] **[FAR]** 21. Edge-native API compilation (Rust/Wasm). Rewrite of the metadata-API surface. **~quarters**
335- [ ] **[NEXT]** 22. Native workspace sync — long-lived file-watcher endpoint. Pairs with realtime collab. **~8-10 hrs**
336- [ ] **[NEXT]** 23. Autonomous cost gating — `budget_limit` on workflow_dispatch. Needs runner-cost telemetry. **~4-6 hrs**
337- [ ] **[NEXT]** 24. AI hallucination sandboxing — npm/PyPI/crates pre-check on commit. **~6-8 hrs**
338- [ ] **[FAR]** 25. P2P code swaps for large assets. Needs IPFS/WebTorrent. **~weeks**
339- [ ] **[NOW]** 26. Immutable audit ledger separate from git graph. `audit_log` already exists; add append-only signature chain. **~3-4 hrs**
340- [ ] **[NOW]** 27. Context-aware auto-pruning — delete merged auto-branches after 24h. Cron-style autopilot task. **~2-3 hrs**
341- [ ] **[NEXT]** 28. Dynamic mid-run resource balancing. Needs runner-pool elasticity. **~8-10 hrs**
342- [ ] **[NEXT]** 29. Multi-model orchestration in workflows — workflow YAML can call into a model router. **~6-8 hrs**
343- [ ] **[NOW]** 30. Self-healing endpoint schemas — accept slight param drift + return `X-Gluecron-Schema-Warning`. **~2-3 hrs**
344
345### Top picks if shipping next
346The **[NOW]** items with best ROI for the agent-build use case:
347- 1 (token-binding) + 3 (nonce/If-Match) + 8 (history depth) + 11 (SSE logs)
348 = an agent's full safety + observability story in ~12-16 hrs of work
349- 6 (LLM-XML bundling) + 9 (auto-clustered tree) = differentiated IDE-agent UX in ~10-12 hrs
350
351---
352
264353## 📊 Latest commits on main (auto-updated, top of `git log`)
265354
266355Run `git log --oneline -15` to see what's actually shipped. The HEAD SHA the live server is running can be confirmed at `https://gluecron.com/version`.
267356