Commit22693d7unknown_key
docs(strategy): GitHub parity, next 10 moves, 5-10 year horizon
docs(strategy): GitHub parity, next 10 moves, 5-10 year horizon
Per owner ask: "all the pros that GitHub has, all the cons that
GitHub has, then we want all the pros and to fix all the cons and
the next 10 biggest moves on top of that. We want to predict
everything we want to predict the next 5 to 10 years in tech."
New file docs/STRATEGY.md captures:
§1 — GitHub's pros mapped against current Gluecron status (12 rows
covering UX polish, Actions ecosystem, Copilot, code search,
Codespaces, Pages, REST/GraphQL, security, brand trust, etc.)
§2 — GitHub's cons + Gluecron's concrete answer for each (12 rows:
AI is bolted-on vs. native; Microsoft data concerns; post-hoc
vs. pre-receive policy enforcement; Workspace paywall vs.
spec-to-PR; static vs. SSE-driven UX; etc.)
§3 — Next 10 biggest moves with priority order, code surface, and
time estimates: container registry, cross-node SSE fanout,
pack-content rule enforcement, app-bot push auth, native
mobile, Codespaces equivalent, AI agent-mode, proactive AI
security advisories, MCP server endpoints, AI repo-health
coach.
§4 — 10 predictions for the 5-10 year horizon, each tied to a
concrete Gluecron architectural bet (so nothing is a "rewrite"
— every prediction is a vector, not a destination):
1. Code as runtime artifact, intent as source
2. Repos become living agents
3. Reviewers become evaluators
4. Continuous compliance
5. Memory-augmented developers
6. Multimodal authoring (voice / screenshots / video)
7. Edge inference + git
8. Open weights, BYO model
9. Sovereign deployments as the default
10. The dashboard is the IDE
§5 — Build-queue feedback loop: every move maps to a bounded code
change; every prediction widens options today (locked
invariants, additive schemas, pluggable AI client).
§6 — Anti-goals: things we will NOT do (no GitHub-pixel-clone, no
in-house foundation model, no platform-locked YAML, no AI
tiering, no user-code tracking).
Living document — updated after each meaningful product move. Next
review after move #1 (container registry) ships.
https://claude.ai/code/session_0163vJChUuZqqtBBznUW6xBU1 file changed+89−022693d7eeed32925bf5f2317cd3cdd6c9ebedc54
1 changed file+89−0
Addeddocs/STRATEGY.md+89−0View fileUnifiedSplit
@@ -0,0 +1,89 @@
1# Gluecron Strategy — GitHub parity + 10 next moves + 5-10 year horizon
2
3**Owner:** Cantynz · **Status:** Living document — update on every meaningful product move.
4
5**Read first:** `BUILD_BIBLE.md` (canonical implementation truth). This doc is the *direction*; the bible is the *position*.
6
7---
8
9## 1. What GitHub does well (the pros we must match)
10
11| # | Pro | Gluecron status |
12|---|---|---|
13| 1 | Network effect — largest dev community | ❌ no shortcut. Earned via product wins, not features. |
14| 2 | Decade-tuned UI polish, keyboard-first chords | ✅ dark/light, Cmd+K palette, `?` shortcuts, /shortcuts page |
15| 3 | Actions marketplace (huge action ecosystem) | 🟡 v2 engine + 5 builtins (cache/checkout/upload-artifact/download-artifact/gatetest); marketplace catalog ✅ |
16| 4 | Copilot completion latency + IDE integration | ✅ POST /api/copilot/completions + VS Code extension |
17| 5 | Code search at scale | ✅ ILIKE per-repo + global · ✅ semantic (Voyage `voyage-code-3`) · 🟡 vector index size at GitHub scale |
18| 6 | Codespaces (cloud dev environments) | ❌ — see move #6 below |
19| 7 | Pages (free static hosting) | ✅ `gh-pages` branch, custom domain |
20| 8 | REST + GraphQL APIs widely integrated | ✅ REST v1 + v2, GraphQL (queries) · 🟡 GraphQL mutations |
21| 9 | Security: Dependabot, code scanning, secret scanning | ✅ AI dep updater (J), advisories (J2), secret scanner, code-scanning UI |
22| 10 | Brand trust + docs | 🟡 still building. /help is ✅, comprehensive docs are 🟡 |
23| 11 | Forks, stars, follows, issues, PRs, reviews | ✅ all shipped |
24| 12 | Enterprise SSO + audit log | ✅ OIDC SSO + per-user + per-repo audit UI |
25
26## 2. What GitHub falls short on (the cons we are fixing)
27
28| # | Con | Gluecron's answer |
29|---|---|---|
30| 1 | AI is bolted on, not native | ✅ End-to-end: AI review on every PR, AI triage on every PR + issue, AI commit messages on the editor, AI PR descriptions on the new-PR form, AI explain on every commit, AI tests, semantic search, spec-to-PR, AI changelog, AI incident responder. Every surface degrades gracefully without ANTHROPIC_API_KEY. |
31| 2 | Owned by Microsoft → data + training concerns | ✅ Self-hostable single Bun binary; AGPL/MIT-friendly. Bring-your-own model. |
32| 3 | Push policy enforcement is via Actions (post-hoc) | ✅ Pre-receive: protected tags + ruleset name patterns block at the HTTP layer. Pack-content rules in flight (move #3). |
33| 4 | Copilot Workspace is paywalled, narrow scope | ✅ Spec-to-PR is built-in: paste an issue body → AI opens a draft PR. "Build with AI" button on every issue. |
34| 5 | Slow merge of feedback (PR review iteration takes days) | ✅ Re-run AI review + Re-run AI triage buttons (idempotency-bypass), live SSE comment banner, auto-merge on green gate. |
35| 6 | Workflow secrets advertised but Actions-only | ✅ AES-256-GCM-stored, substituted into v1 runner step.run via `${{ secrets.NAME }}` |
36| 7 | Wait timers, protected tags, environment approvals shown but not all enforced | ✅ Wait timer flips status="waiting_timer" + autopilot sweeper releases on tick. Protected tags 403 at receive. |
37| 8 | No first-class scheduled workflows beyond external cron | ✅ `on: schedule: [{cron: ...}]` driven by autopilot tick (50/tick safety cap) |
38| 9 | Limited live UX — refresh-driven | ✅ SSE foundation, live comment banner on issue + PR detail; live log tail on workflow runs |
39| 10 | Vendor lock-in (.github/workflows) | ✅ `.gluecron/workflows/*.yml` is a parallel namespace; importer respects `.github/workflows/*` for inbound migration |
40| 11 | Org-level gating is policy-only, no enforcement | ✅ Branch protection + required-checks matrix enforced at merge handler |
41| 12 | DMCA / privacy / sovereign deploys are hard | ✅ Single-tenant deploys are first-class (fly.toml, Dockerfile in repo) |
42
43## 3. Next 10 biggest moves (the strategic build queue)
44
45Numbers are priority, not size. Each maps to a concrete code surface; bible §3 is the canonical block list.
46
471. **Container registry (OCI / Docker)** — schema is ready (workflow_run_cache backs blobs). Closes the only major package-ecosystem gap. Estimated: 1 week.
482. **Cross-node SSE fanout (Redis pub/sub or NATS)** — `src/lib/sse.ts` TODO(scale). Required for >1 Bun instance behind a load balancer. Estimated: 2-3 days once Redis is on the deploy.
493. **Pack-content rule enforcement** — extend `src/lib/push-policy.ts` to read the new pack via `git index-pack --stdin`, scan commit messages + tree blobs for: `commit_message_pattern`, `blocked_file_paths`, `max_file_size`. Bible §2.5 J6 partial. Estimated: 1 week.
504. **App-bot push auth (`ghi_` install tokens)** — `src/db/schema.ts` `app_bots` lacks a `users.id` link. Add a synthetic-user shim so installation tokens identify a bot account that can own pushes / comments. Unblocks third-party integrations. Estimated: 3-4 days.
515. **Native mobile apps (iOS + Android)** — only ❌ in the parity scorecard. Wrap the PWA first (Capacitor), full native after. Estimated: 2 weeks for PWA wrap, 6+ weeks for native.
526. **Codespaces equivalent** — Bun-powered ephemeral container per branch + browser IDE. Backed by the existing workflow runner pool. Estimated: 4-6 weeks.
537. **AI agent-mode (multi-turn PR authoring)** — promote spec-to-PR to a *conversation*: the agent proposes, the human comments, the agent iterates. Builds on existing chat memory + PR comments. Estimated: 2-3 weeks.
548. **Proactive AI security advisories** — extend `src/lib/advisories.ts` to *propose patches*, not just flag. PR opened automatically against a `security/auto-patch-*` branch. Estimated: 1-2 weeks.
559. **MCP server endpoints** — Gluecron speaks the Model Context Protocol so any MCP-compatible client (Claude Desktop, Claude Code, Cursor) can read repos, post issues, run workflows. Estimated: 1 week.
5610. **AI repo-health coach** — daily/weekly digest surfaced on the dashboard: "your `auth.ts` has 3 TODOs older than 90 days; here's a draft PR fixing 2 of them." Builds on the existing health-score + autopilot. Estimated: 1-2 weeks.
57
58## 4. The 5-10 year horizon (the bets)
59
60Predictions, not promises. We optimise the architecture so each is a small step, not a rewrite.
61
621. **Code is a runtime artifact, intent is the source.** Humans describe; AI maintains 70%+ of generated code under continuous review. *Gluecron bet:* spec-to-PR + AI review + auto-merge are the load-bearing primitives. Every commit signed by an identifiable agent.
632. **Repos become living agents.** A `.gluecron/agent.yml` declares "what this repo does"; the agent self-heals dependencies, self-runs migrations, self-files incidents. *Gluecron bet:* autopilot framework + auto-repair + scheduled workflows are the seed. Add per-repo agent declarations next.
643. **Reviewers become evaluators.** "Did the agent meet the spec?" replaces line-by-line review. *Gluecron bet:* AI review already does this for every PR. Spec-to-PR closes the loop end-to-end.
654. **Continuous compliance.** Every push proves itself against policy (regulatory, security, custom). *Gluecron bet:* rulesets + protected tags + gate runs + audit log already do this; add SOC2 / HIPAA preset rulesets.
665. **Memory-augmented developers.** Each engineer carries a personal context that follows them across orgs and AI assistants. *Gluecron bet:* AI chat persistence per repo is in. User-level cross-repo memory is move #11 (off-list).
676. **Multimodal authoring.** Issues + PRs authored partly from speech, screenshots, video. *Gluecron bet:* the AI helpers all accept text only today; extending to multimodal is one prompt-shape change (Claude already supports vision).
687. **Edge inference + git.** Repo data + AI compute close to each user (CDN + on-device or regional inference). *Gluecron bet:* Bun + Fly.io regional placement makes this trivial; add per-region runner pools.
698. **Open weights, BYO model.** Users bring their own model (small fine-tuned or local). *Gluecron bet:* `src/lib/ai-client.ts` already isolates the Anthropic call; swap with an OpenAI-compatible adapter is hours.
709. **Sovereign deployments are normal.** Enterprises and states run their own Gluecron, mirroring upstream selectively. *Gluecron bet:* repo mirroring + SSO + admin panel + audit log + single-binary deploy → already shipped. Add a "Gluecron Federation" peer protocol.
7110. **The dashboard is the IDE.** Users live on a Gluecron tab the way they live on Slack. *Gluecron bet:* live comment banners, SSE foundation, command palette (Cmd+K), AI chat, dashboard health → the substrate is in. Codespaces (move #6) is the missing leg.
72
73## 5. What this means for the build queue
74
75- Every move in §3 maps to a bounded code change with a defined entry point.
76- Every prediction in §4 is a *vector*, not a *destination* — we widen options today (locked invariants, additive schemas, pluggable AI client) so any of these can land without a rewrite.
77- The bible is updated in lockstep. New work shows up in §2 (scorecard), §4 (locked files), §7 (in-flight). Strategy → reality flow stays one-way.
78
79## 6. Anti-goals (things we will NOT do)
80
811. Re-implement the GitHub UI pixel-for-pixel. Different platform, different UI choices.
822. Train our own foundation model. We integrate the best (Claude today, swappable tomorrow).
833. Lock users into Gluecron-specific YAML. Workflow files are portable; importer respects `.github/workflows/*`.
844. Tier essential AI features into paid plans. AI is the platform, not an add-on.
855. Track or sell user code. Privacy + sovereignty are first-class.
86
87---
88
89*Last updated 2026-04-30 alongside the AI-native flow batch (Build with AI, pre-receive enforcement, scheduled workflows, secret substitution, re-review/re-triage buttons, live comment banners). Next review: after move #1 ships.*
090