Commit3bf10d4unknown_key

docs: ROADMAP.md — living checklist of done / in-flight / pending / queued

docs: ROADMAP.md — living checklist of done / in-flight / pending / queued

Captures the full state of the platform at end of the 2026-05-17 polish
session:

  - BLOCKING items before tomorrow's onboarding (env vars + dry-run)
  - IN-FLIGHT polish agents (4 still running)
  - 20+ commits shipped this session (audit + polish + Google OAuth + dashboard +
    repo home + issues + PRs + settings + code browse + notifications +
    import + discovery + admin)
  - Known P1 bugs from AUDIT-v2.md not yet fixed
  - 120+ niche routes still unpolished
  - Untested categories (E2E browser, mobile, a11y, load, security pentest, cross-browser)
  - 'Lightning years ahead' roadmap ranked by leverage/hour:
      Tier 1: GateTest aggregation platform, multi-agent CI, AI proactive monitoring
      Tier 2: sub-30s deploys, mobile pass, DiffView rebuild
      Tier 3: realtime collab, visual workflow editor, time-travel state, self-host installer
      Tier 4: edge network, API docs, localization, SOC2, mobile PWA

This is the single source of truth. Update as items move.

Claude committed on May 19, 2026Parent: 07f4b70

1 file changed+229−03bf10d40ebe3088370e783ffa84ab0697506763e

1 changed file+229−0

AddedROADMAP.md+229−0View fileUnified Split

@@ -0,0 +1,229 @@

1# Gluecron Roadmap & Checklist

3**Living document. Last updated: 2026-05-17. Edit as items move.**

5This is the single source of truth for what's done, what's in flight, what's

6critical for the next demo, and what's queued for after. If it's not on this

7list, it's either not real or not committed to. Update it every time we

8ship something or learn something new.

10---

12## 🚨 BLOCKING — must do before tomorrow's onboarding

14These take ~10 minutes total. Without them the demo doesn't show what gluecron actually is.

16- [ ] **SSH to Hetzner box, edit `/etc/gluecron.env`, add:**

17 - [ ] `ANTHROPIC_API_KEY=sk-ant-...` (from console.anthropic.com)

18 - Without this: AI PR review, AI incident responder, AI commit messages, AI auto-merge, AI spec-to-PR are ALL silent no-ops. The entire "AI-native git host" pitch is dark.

19 - [ ] `EMAIL_PROVIDER=resend`

20 - [ ] `RESEND_API_KEY=re_...` (from resend.com — free tier covers thousands of emails)

21 - [ ] `EMAIL_FROM=noreply@gluecron.com` (or whatever domain you have set up)

22 - [ ] `GATETEST_API_KEY=...` (so push-time security scans actually run instead of silent no-op)

23 - [ ] `DEPLOY_EVENT_TOKEN=$(openssl rand -hex 32)` (also add the SAME value to GitHub repo Settings → Secrets → Actions)

24 - [ ] `SELF_HOST_REPO=ccantynz-alt/Gluecron.com` (fixes the "platform repo not found" warn)

25- [ ] `systemctl restart gluecron` to pick up the env vars

26- [ ] Open `/admin/health` — confirm everything turns green/non-red

28- [ ] **Configure social sign-in (optional but valuable):**

29 - [ ] `/admin/google-oauth` — paste Google OAuth Client ID + Secret

30 - [ ] `/admin/github-oauth` — paste GitHub OAuth Client ID + Secret

32- [ ] **Dry-run the demo in incognito:**

33 - [ ] Sign up as a fake user

34 - [ ] Verify the auto-verify fallback works (no email needed)

35 - [ ] Create a repo

36 - [ ] Push some code (use a small public repo)

37 - [ ] File an issue labelled `ai:build` — confirm autopilot picks it up

38 - [ ] Open a PR — confirm AI review fires (now that ANTHROPIC_API_KEY is set)

39 - [ ] Merge the PR

41---

43## 🟡 IN FLIGHT — finishing now

45- [ ] **4 polish agents still running:**

46 - [ ] Agent J — `/help` page polish

47 - [ ] Agent K — marketing pages (`/features`, `/about`, `/vs-github`)

48 - [ ] Agent L — `/settings/tokens` (PAT creation)

49 - [ ] Agent M — `/:owner/:repo/compare` (branch compare for new PRs)

50- [ ] **Agent N (repo settings)** committed `c14f275` to worktree — cherry-pick onto main with the others when batch completes

52---

54## ✅ DONE this session (commits already on main)

56### Reliability sweep (Phase 1)

57- [x] AA reload loop killed (PWA ripped out, kill-switch shipped) — `d7ba05d`, `44fe49b`, `904927d`

58- [x] Hetzner deploy git-remote URL fixed (was 404'ing 17h) — `ec16b67`

59- [x] Minimum-viable Hetzner script with `set -x` tracing — `d8b9606`

60- [x] Migration step re-added to deploy — `a358c63`

61- [x] AUDIT.md + AUDIT-v2.md produced (4-agent + 5-agent audits)

62- [x] Silent failure sweep across 18 files — `a28cede`

63- [x] `/admin/health` + JSON endpoint + autopilot/deploy/queue/crontech checks — `115c66b`

64- [x] AI incident responder for platform deploy failures — `89a0761`

65- [x] Deploy paths unified (`scripts/self-deploy.sh` is canonical) — `ff4423b`

66- [x] `/admin/diagnose` auto-merge check uses SELF_HOST_REPO — `a3b6378`

68### Polish — marketing surfaces (Phase 2.1)

69- [x] Web fonts (Inter + Inter Tight + JetBrains Mono) — `3a5755e`

70- [x] Animated hero blobs + bigger headline — `3a5755e`

71- [x] Pricing: "One subscription. Replaces three on GitHub." + bundle-math card — `13ac035`

72- [x] Login + Register premium gateway feel — `98f45b4`

73- [x] Global page entrance animation + accent focus rings — `ed6e438`

75### Polish — auth + dashboard (Phase 2.2)

76- [x] Real Sign in with Google (`/admin/google-oauth` + login button + tests) — `582cdac`

77- [x] Dashboard: greeting eyebrow + gradient title + animated orb — `a004c46`

79### Polish — app-level surfaces (parallel batch 1)

80- [x] Repo home page (`/:owner/:repo`) — `544d842`

81- [x] Issues UI (list + detail, AI-comment treatment) — `f7ad7b8`

82- [x] Pull requests UI (list + detail, gate-status + merge card) — `b078860`

83- [x] User settings (8 section cards + danger zone) — `98eb360`

85### Polish — onboarding surfaces (parallel batch 2)

86- [x] Code browse (file viewer + commit detail + new repo + profile + per-repo search) — `efb11c5`

87- [x] Notifications page (hero + filter pills + AI-row treatment) — `fd8be1f`

88- [x] Import flow (`/import` + `/import/bulk`) — `7a99d47`

89- [x] Discovery (`/explore` + `/search`) — `283fbc2`

90- [x] Admin panel (hero + stat cards + 11-tile action grid) — `07f4b70`

92**Cumulative this session: 20+ commits on main. 2011/2011 tests pass. TypeScript clean.**

94---

96## 🟢 SHOULD ship tonight if time (high leverage, low risk)

98- [ ] **Build `/admin/integrations` page** — env vars via UI instead of SSH'ing to the box. ~1.5 hrs.

99 - DB-stored config (encrypted secret column)

100 - `getConfigValue(key)` helper that checks DB first, env var fallback

101 - Site-admin gated form for ANTHROPIC_API_KEY, RESEND_API_KEY, GATETEST_URL+KEY, CRONTECH_DEPLOY_URL+SECRET, DEPLOY_EVENT_TOKEN

102 - Audit log every change

103 - Demo moment: paste ANTHROPIC_API_KEY in admin UI → watch AI features turn green on `/admin/health` live

104- [ ] **Sub-30s deploys for code changes:**

105 - [ ] Lockfile-hash cached `bun install` (skip when bun.lock unchanged) — ~10 min

106 - [ ] Migration skip when no new `drizzle/*.sql` files — ~10 min

107 - [ ] CSS-only fast path (if diff is only in `src/views/`, skip migrations + smoke) — ~15 min

108

109---

110

111## 📋 KNOWN BUGS (from AUDIT-v2.md P1 list — not yet fixed)

112

113- [ ] Repo-scoped routes 500 instead of 404 on missing record (issues, pulls, packages, releases, security, symbols, sponsors) — each needs a try/catch

114- [ ] No DB-blip resilience middleware — every page blocks 5-15s on a sick DB

115- [ ] No Fly rollback path (Hetzner has one, Fly doesn't)

116- [ ] Workflow log truncation has no UX warning

117- [ ] Dead schema: `pr_risk_scores` table never written to

118- [ ] Dead code: `scripts/deploy-crontech.sh` not invoked

119- [ ] `/admin/sso`, `/admin/github-oauth`, `/admin/mirrors/sync-all` use middleware `requireAuth` but rely on inline `isSiteAdmin()` — inconsistent pattern, not insecure

120- [ ] Documentation drift: BUILD_BIBLE.md (4500 lines) and CLAUDE.md both contain claims that don't match code

121

122---

123

124## 🎨 SURFACES still unpolished (post-tomorrow polish queue)

125

126### Repo-scoped features

127- [ ] `DiffView` component itself (used inside polished commit + PR pages — only surrounding card is polished)

128- [ ] Releases (`releases.tsx`)

129- [ ] Contributors / Insights (`contributors.tsx`, `insights.tsx`)

130- [ ] Traffic analytics (`traffic.tsx`)

131- [ ] Dependencies (`deps.tsx`)

132- [ ] Security advisories / code scanning (`advisories.tsx`, `code-scanning.tsx`)

133- [ ] Symbols / xref nav (`symbols.tsx`)

134- [ ] AI features pages (`ask.tsx`, `ai-changelog.tsx`, `ai-explain.tsx`, `ai-tests.tsx`)

135- [ ] Workflows / Actions (`workflows.tsx`)

136- [ ] Gates / branch protection / rulesets / required checks / protected tags (`gates.tsx`, `rulesets.tsx`, `required-checks.tsx`, `protected-tags.tsx`)

137- [ ] Environments + Deployments (`environments.tsx`, `deployments.tsx`)

138- [ ] Webhooks (`webhooks.tsx`)

139- [ ] Web file editor (`editor.tsx`)

140

141### Settings sub-pages

142- [ ] 2FA setup (`settings-2fa.tsx`)

143- [ ] Passkeys (`passkeys.tsx`)

144- [ ] Developer apps / OAuth apps (`developer-apps.tsx`)

145- [ ] Audit log (`audit.tsx`)

146- [ ] Sponsors (`sponsors.tsx`)

147- [ ] Saved replies (`saved-replies.tsx`)

148- [ ] Marketplace (`marketplace.tsx`)

149- [ ] Workflow secrets (`workflow-secrets.tsx`)

150- [ ] Signing keys (`signing-keys.tsx`)

151

152### Specialized routes

153- [ ] Orgs (new, view, members, teams) — `orgs.tsx`, `org-insights.tsx`

154- [ ] Wiki pages — `wikis.tsx`

155- [ ] Discussions / forums — `discussions.tsx`

156- [ ] Project boards / kanban — `projects.tsx`

157- [ ] Gists — `gists.tsx`

158- [ ] Packages — `packages.tsx`

159- [ ] Playground (`/play` — anonymous try-it) — `playground.tsx`

160- [ ] Demo (`/demo` — live demo with tiles) — `demo.tsx`

161

162### Admin sub-pages

163- [ ] `/admin/ops` (Operations console) — `admin-ops.tsx`

164- [ ] `/admin/deploys` (deploy timeline) — `admin-deploys-page.tsx`

165- [ ] `/admin/status` (synthetic monitor) — `admin-status.tsx`

166- [ ] `/admin/self-host` (self-host config) — `admin-self-host.tsx`

167- [ ] `/admin/sso` (Enterprise SSO config) — `sso.tsx`

168- [ ] `/admin/github-oauth` (already styled — minor polish only)

169

170### Cross-cutting

171- [ ] Loading skeletons (`skeleton.tsx` exists, not used everywhere)

172- [ ] Empty states across niche routes

173- [ ] Error pages 404 / 500 / 403 (`error-page.tsx`)

174- [ ] Mobile responsive audit pass — ALL polished surfaces work on mobile but haven't been audited

175

176---

177

178## 🧪 UNTESTED categories

179

180- [ ] **E2E browser flows** — no real-browser test runner wired (chromium download blocked in this Anthropic container)

181- [ ] **Mobile responsive on real devices** — works on Chrome DevTools mobile sim, no physical device test

182- [ ] **Accessibility (axe / Lighthouse)** — needs browser

183- [ ] **Load test (k6 / locust)** — needs live infra hammering

184- [ ] **Real security pentest** — GateTest configured but API key not set, scans silently no-op

185- [ ] **Cross-browser** (Safari, Firefox, Edge) — one container, one engine

186

187---

188

189## 🚀 "LIGHTNING YEARS AHEAD" roadmap (post-onboarding)

190

191Ordered by **leverage per hour**. The first 3 are the differentiators that competitors don't have.

192

193### Tier 1 — true product differentiators

1941. [ ] **GateTest aggregation platform** — extend GateTest to be the unified scan-results surface. Playwright (E2E), k6 (load), axe (a11y), and the existing GateTest static scanner all POST results to the same `/api/v1/gate-runs` endpoint. One UI shows everything. Genuinely new product positioning. **~3-4 hrs.**

1952. [ ] **Multi-agent CI on every PR** — code reviewer (exists), security reviewer (new), QA agent that tries to break the PR (new), all run in parallel. Surfaces three independent AI perspectives. **~4-6 hrs.**

1963. [ ] **AI proactive monitoring** — hourly autopilot task that reads recent logs + audit_log via Claude and opens issues like "I noticed memory growth on workflow-runner". Goes from reactive to proactive. **~3-4 hrs.**

197

198### Tier 2 — speed + polish wins

1994. [ ] **Sub-30s deploys** (already partially listed under "Should ship tonight")

2005. [ ] **Mobile responsive pass** — design audit + fix across all polished surfaces. **~3-4 hrs.**

2016. [ ] **`DiffView` component rebuild** — the diff renderer used in commit/PR pages. Currently plain. Make it Vercel-quality. **~2-3 hrs.**

202

203### Tier 3 — new capabilities

2047. [ ] **Realtime collaboration on issues/PRs** — multiple users editing same draft simultaneously. SSE infra exists, needs the merge layer. **~6-8 hrs.**

2058. [ ] **Visual workflow editor** — DAG editor for `.gluecron/workflows/*.yml` instead of YAML. **~10-15 hrs.**

2069. [ ] **Time-travel state explorer** — replay any past state of an issue/PR/repo. Differentiation nobody has. **~10-15 hrs.**

20710. [ ] **Self-host one-click installer** — `curl gluecron.com/install-server | bash` for a full gluecron on any Linux box in 60s. **~6-8 hrs.**

208

209### Tier 4 — infrastructure / enterprise

21011. [ ] **Edge-network deploy** — Cloudflare Workers in front of Hetzner. Sub-100ms anywhere on earth.

21112. [ ] **Comprehensive API docs site** — `/api-docs` exists but plain. Should be Stripe-quality.

21213. [ ] **Localization** — English-only today.

21314. [ ] **SOC2 compliance path** — for enterprise customers.

21415. [ ] **Mobile PWA done right** — properly architected this time (not the broken one we ripped out).

215

216---

217

218## 📊 Latest commits on main (auto-updated, top of `git log`)

219

220Run `git log --oneline -15` to see what's actually shipped. The HEAD SHA the live server is running can be confirmed at `https://gluecron.com/version`.

221

222---

223

224## How to update this file

225

226- Move items between sections as they ship / change priority

227- Don't delete items — strike them through or move to a "shipped" log

228- Update the date at top whenever you edit

229- Commit the change so it persists for everyone (future you, future Claude, anyone else looking at the repo)

0230