Commitd3a4be7unknown_key
feat: expand TODO to full master checklist — 80+ items across all areas
feat: expand TODO to full master checklist — 80+ items across all areas Covers: revenue gaps, messaging correction, 30+ unverified routes, confirmed missing features, customer UX, admin panel, onboarding, documentation, growth/distribution, enterprise, mobile, reliability. https://claude.ai/code/session_01DzJMTFASjMHt2f5ze4cNLR
1 file changed+166−87d3a4be7898aa68c2c4f483d6aac7337a6ad6c65d
1 changed file+166−87
ModifiedTODO.md+166−87View fileUnifiedSplit
@@ -1,125 +1,204 @@
11# Gluecron Master To-Do List
22
3Last updated: 2026-06-06 (rev 2 — messaging correction)
3Last updated: 2026-06-06 (rev 3 — full expanded list)
44
5Track progress here. Check off items as they ship. Work top-to-bottom — priority order.
5Tick off items as they ship. Add date + commit ref next to each completed item.
6Work top-to-bottom within each priority section.
67
78---
89
9## 🔴 PRIORITY 1 — Revenue-Blocking (Do These First)
10## 🔴 PRIORITY 1 — Revenue (Money In, Do First)
1011
11- [ ] **Stripe Checkout flow** — users cannot self-serve upgrade from Free to Pro/Team/Enterprise. Stripe webhook handler exists, plan tables exist, billing UI exists, but there is zero Stripe Checkout session. Wire `stripe.checkout.sessions.create`, redirect to `/settings/billing?success=1`, handle `checkout.session.completed` webhook to flip `userQuotas.plan`. Without this, zero revenue from the product.
12- [ ] **Verify SSH git push works** — SSH keys are stored in the DB (`ssh_keys` table, `/settings` UI) but the documented protocol is Smart HTTP only. Test `git clone git@gluecron.com:user/repo.git` from a fresh machine. If broken, implement SSH git server (ssh2 library, key lookup, git-upload-pack/receive-pack subprocess). Many devs refuse HTTPS for git.
13- [ ] **API usage dashboard for customers** — users on paid plans have no visibility into their AI token spend, rate limit history, or quota usage. Wire `aiCostEvents` table into a `/settings/usage` page with charts. Required before charging for AI usage.
12- [ ] **Stripe Checkout flow** — no user can self-serve upgrade today. Stripe webhook handler exists, plan tables exist, billing UI exists, zero checkout session. Wire `stripe.checkout.sessions.create`, handle `checkout.session.completed` to flip plan. Without this: zero revenue.
13- [ ] **Stripe customer portal** — let paying users manage/cancel their subscription without emailing support. One Stripe API call (`stripe.billingPortal.sessions.create`), redirect from `/settings/billing`.
14- [ ] **Sponsors payment rails** — `sponsorship_tiers` and `sponsorships` tables exist, UI exists, payment deferred. Wire Stripe Payment Links or Checkout for recurring sponsorships. Maintainers need to actually receive money.
15- [ ] **Pricing page conversion** — `/pricing` exists but copy is not conversion-optimised. Lead with the 90-second spec-to-PR number. Add a comparison table that makes Free look good (drives signups) and Pro look obvious (drives upgrades). Remove all "sleep/wake up" language.
16- [ ] **API usage dashboard** — `/settings/usage` page wiring `aiCostEvents` table. Paid users have no visibility into token spend, rate limit history, or quota usage. Required before charging per-AI-call.
17- [ ] **AI budget enforcement** — `aiBudgets` table exists with monthly spend caps. Verify enforcement is actually wired: when cap is hit, AI features degrade gracefully (return fallback, notify user) rather than silently continuing and racking up cost.
18- [ ] **Free tier viral loop** — make every free user a growth channel. After each AI action, surface a shareable card: "AI just merged my PR in 90 seconds on @gluecron". `/api/v2/me/ai-savings/share` OG-image endpoint. Twitter/LinkedIn share buttons on the AI hours-saved dashboard widget.
1419
1520---
1621
17## 🟡 PRIORITY 2 — Scale-Blocking (Required Before Heavy Traffic)
22## 🟠 PRIORITY 2 — Messaging (Affects Every Page, Fix Fast)
1823
19- [ ] **Redis-backed SSE fan-out** — live comment updates, PR live view, push watch all use single-process in-memory broadcaster (`src/lib/sse.ts`). In a multi-instance deploy, events only reach subscribers on the same process. Replace the in-process broadcaster with Redis pub/sub. Existing `sse.ts` interface stays the same — only the transport layer changes.
20- [ ] **Workflow cache SAVE** — CI caching only does LOAD (`src/lib/actions/cache-action.ts` TODO(v2)). The save-on-job-success path is unimplemented. Every CI run after the first gets a cold cache. Wire the SAVE half of the cache action so `node_modules`, cargo registry, pip cache etc. actually persist between runs.
21- [ ] **Pack-content ruleset enforcement** — `commit_message_pattern`, `blocked_file_paths`, `max_file_size` in repo rulesets (`src/lib/rulesets.ts`) still need actual git pack inspection to enforce at push time. Currently advisory for those rule types only. Implement pack-content scanning in `src/lib/push-policy.ts`.
24The current pitch ("label an issue, walk away, wake up to a merged PR") positions Gluecron as slow and async. Developers sit at their computer and want it done NOW. Every page needs to lead with speed.
25
26- [ ] **Landing hero rewrite** (`src/views/landing.tsx`) — new headline: "Write the spec. Gluecron ships it." Subhead: "Spec to PR in 90 seconds. Push to live in 25. AI review, gates, merge — all automatic." Remove async framing. Add live counter showing specs-to-PRs fired today.
27- [ ] **Landing "what just happened" rail** — replace any async/overnight copy with real-time event examples: "PR #47 auto-merged 12 seconds ago", "AI flagged a secret in push 3 minutes ago", "Spec shipped to PR in 1m 43s". Makes it feel alive and instant.
28- [ ] **vs-github AI rows rewrite** (`src/routes/vs-github.tsx`) — reframe the 10 AI-native rows around latency not capability. GitHub Copilot waits for you to type. Gluecron acts in seconds. Add actual timing numbers to each row.
29- [ ] **Demo page rewrite** (`src/routes/demo.tsx`) — replace "watch autopilot work" framing with a live ticker of things happening right now: PRs merging, AI reviews posting, specs being built. Make it feel like a stock ticker for developer productivity.
30- [ ] **Sleep Mode demoted** (`src/routes/sleep-mode.tsx`) — move sleep mode marketing to the bottom of feature pages only. It's a useful secondary feature, never the headline. Primary pitch everywhere = instant results.
31- [ ] **All OG/meta descriptions** — audit every `<meta description>` and OG tag across the app. Strip "wake up to" and replace with speed language.
32- [ ] **Email templates** — the transactional emails (notifications, digests) likely echo the async pitch. Update to celebrate what just happened instantly, not what built up overnight.
2233
2334---
2435
25## 🟠 PRIORITY 3 — Product Completeness (Next 6 Months)
36## 🟡 PRIORITY 3 — Product: Verify What's Built (Routes Exist, Status Unknown)
37
38The codebase has many routes that aren't in the BUILD_BIBLE scorecard. Each needs to be opened in a browser, tested end-to-end, and confirmed working or flagged as broken/stub.
39
40- [ ] **Voice-to-PR** (`src/routes/voice-to-pr.tsx`, 1072 lines) — record voice, get a draft PR. Huge UX differentiator. Is this actually working? Test the full flow: record → transcribe → spec → PR. If broken, fix or remove the route.
41- [ ] **Per-repo AI chat** (`src/routes/repo-chat.tsx`) — chat with Claude about a specific repo. Distinct from the global `/ask`. Test: open a repo, go to chat, ask a code question, verify context is scoped to that repo.
42- [ ] **Personal cross-repo chat** (`src/routes/personal-chat.tsx`) — chat with Claude across all your repos. Test the context window and repo-switching.
43- [ ] **Standup reports** (`src/routes/standups.tsx`) — auto-generated standup from recent activity. What does it generate? Is it useful? Test for a real repo with recent commits/PRs.
44- [ ] **Multi-repo refactoring** (`src/routes/refactors.tsx`) — AI-driven refactor that opens PRs across multiple repos simultaneously. Verify `multiRepoRefactors` + `multiRepoRefactorPrs` tables are wired. Test the full flow.
45- [ ] **Build agent spec** (`src/routes/build-agent-spec.tsx`) — AI spec builder UI. Is this the same as spec-to-PR or a different flow? Clarify and document.
46- [ ] **Migration assistant** (`src/routes/migration-assistant.tsx`) — AI-assisted migration tool. What does it migrate? Code patterns, framework versions? Test and document.
47- [ ] **Comment moderation** (`src/routes/comment-moderation.tsx`) — spam/abuse filtering queue. Test: post a spam comment, verify it enters the moderation queue, approve/reject works.
48- [ ] **Interactive playground** (`src/routes/playground.tsx`) — what is this? Test it. If it's a Claude Code sandbox, make it prominent. If it's broken, fix or remove.
49- [ ] **PR live co-editing** (`src/routes/pr-live.ts`) — `prLiveSessions` table exists. Real-time cursor sharing on PRs? Test with two browsers simultaneously.
50- [ ] **Hosted Claude loops** (`src/routes/claude-deploy.tsx`, `hostedClaudeLoops` table) — Claude agents running as persistent loops on user repos. Verify the UI, test creating a loop, verify it runs, verify cost is tracked in `aiCostEvents`.
51- [ ] **Cloud dev environments** (`src/routes/dev-env.tsx`, `devEnvs` table) — Codespaces equivalent. Massive feature if working. Test: create a dev env for a repo, verify it spins up (or that it's a stub that needs implementation).
52- [ ] **Branch preview URLs** (`src/routes/previews.tsx`, `branchPreviews` table) — per-branch preview deployments. Verify this is wired to the workflow runner and actually generates live URLs.
53- [ ] **PR sandbox** (`src/routes/pr-sandbox.ts`, `prSandboxes` table) — runnable PR environment. Test: open a PR, create sandbox, verify it runs.
54- [ ] **Slack/Discord/Teams integration** (`src/routes/integrations-chat.ts`, `chatIntegrations` table) — notifications into chat channels. Test connecting a Slack workspace, push an event, verify message arrives.
55- [ ] **Google OAuth login** (`src/routes/google-oauth.tsx`) — sign in with Google. Test the full OAuth flow: click → Google → callback → logged in.
56- [ ] **Connect Claude** (`src/routes/connect-claude.tsx`) — distinct from `/connect/claude-guide`. What does this do? Clarify.
57- [ ] **Import secrets** (`src/routes/import-secrets.tsx`) — import secrets from GitHub/Vault/env file into workflow secrets. Test the full flow.
58- [ ] **Agent settings** (`src/routes/settings-agents.tsx`) — per-user agent configuration. What settings exist? Verify UI is complete.
59- [ ] **Integration settings** (`src/routes/settings-integrations.tsx`) — user-level integrations (Slack, Linear, etc.). Verify complete.
60- [ ] **Activity feed** (`src/routes/activity.tsx`) — distinct from the dashboard feed. Test and verify it's showing meaningful data.
61- [ ] **Message inbox** (`src/routes/inbox.tsx`) — distinct from notifications. What goes here? Verify it's working.
62- [ ] **Admin > Diagnose** (`src/routes/admin-diagnose.tsx`, 1337 lines) — stale issue/PR detection, suspicious pattern detection. Test each diagnostic and verify results are accurate.
63- [ ] **Admin > Self-host wizard** (`src/routes/admin-self-host.tsx`, 1240 lines) — bootstrap automation for self-hosting. Test the full setup flow.
64- [ ] **Admin > Server targets** (`src/routes/admin-server-targets.tsx`) — SSH deploy targets UI. Verify admin can add a target and trigger a deploy.
65- [ ] **Admin > Advancement flags** (`src/routes/admin-advancement.tsx`) — per-block feature gating. Verify all flags are wired to their features.
66- [ ] **Admin > Integration secrets** (`src/routes/admin-integrations.tsx`) — admin sets Anthropic API key, Resend key, GitHub OAuth keys from the UI. Verify each saves correctly and the feature it powers activates.
67- [ ] **2030 landing page** (`src/views/landing-2030.tsx`) — future landing page in the codebase. What is this? Is it a planned redesign? Decide: ship it or delete it.
68- [ ] **Legal pages** — terms, privacy, DMCA, acceptable-use exist as routes. Verify: (1) actual legal text is there (not placeholder), (2) linked from footer, (3) accessible to logged-out users.
69
70---
2671
27### Hosting & Infrastructure
28- [ ] **Container registry (Docker/OCI)** — npm package registry is shipped (`src/lib/packages.ts`). Schema is ready for containers but the OCI push/pull protocol is not implemented. Wire Docker-compatible registry: `GET /v2/`, `HEAD /v2/:name/blobs/:digest`, `POST /v2/:name/blobs/uploads/`, `PUT /v2/:name/manifests/:ref`. This is why many teams can't fully leave GitHub.
29- [ ] **Server targets — customer-facing rollout** — SSH deploy targets (Block ST) are admin-only. Expose `/settings/deploy-targets` for all users: add SSH target (host, user, private key, deploy script), push-to-deploy pipeline from any branch. This is the "push to Gluecron, it lands on your Hetzner box in 30 seconds" pitch.
30- [ ] **Sponsors payment rails** — `sponsorship_tiers` and `sponsorships` tables exist, UI exists, but payment is deferred. Wire Stripe Payment Links or Checkout for recurring sponsorships. Maintainers need to be able to actually receive money.
31- [ ] **Workflow artifact retention policy** — workflow artifacts accumulate indefinitely. Add a retention window (default 90 days, configurable per repo) with an autopilot cleanup task.
72## 🟢 PRIORITY 4 — Product: Known Gaps (Confirmed Not Built)
73
74### Core Infrastructure
75- [ ] **SSH git push** — SSH keys stored in DB, Smart HTTP documented, but `git clone git@gluecron.com:user/repo.git` may not work. Test from a clean machine. If broken: implement SSH server (ssh2 library, key lookup, `git-upload-pack`/`git-receive-pack` subprocess). Many devs refuse HTTPS for git.
76- [ ] **Container registry (Docker/OCI)** — npm registry shipped, schema ready for containers, OCI protocol not implemented. Wire: `GET /v2/`, blob upload/download, manifest push/pull. Without this, Docker users cannot fully leave GitHub.
77- [ ] **Server targets — customer rollout** — SSH deploy targets (Block ST) are admin-only. Expose `/settings/deploy-targets` for all users: add target (host, user, private key, deploy script), push-to-deploy from any branch. The "push and it's live in 25 seconds" story needs this for customer repos, not just Gluecron.com itself.
78- [ ] **Redis SSE** — live comment updates, PR live view, push watch use single-process in-memory broadcaster. Multi-instance deploys break it. Replace with Redis pub/sub behind the same `sse.ts` interface.
79- [ ] **Workflow cache SAVE** — CI caching only does LOAD. Save-on-job-success unimplemented. Every CI run after the first is cold. Wire the SAVE half of the cache action.
80- [ ] **Pack-content ruleset enforcement** — `commit_message_pattern`, `blocked_file_paths`, `max_file_size` in rulesets need actual git pack inspection. Currently advisory for those types. Implement in `src/lib/push-policy.ts`.
3281
3382### AI & Automation
34- [ ] **Spec-to-Live full pipeline** — currently Spec→PR. Wire the remaining loop: PR→AI review approval→auto-merge→deploy→smoke test→real-time notification in the browser "done in 2m 14s". The K2/K3 auto-merge and push watch exist separately — connect them into one visible end-to-end flow with a live progress bar the developer watches happen right now, not tomorrow.
35- [ ] **AI budget enforcement** — `aiBudgets` table exists with monthly spend caps. Verify the enforcement is actually wired: when `aiCostEvents` total for the month exceeds the cap, AI features should degrade gracefully (return fallback, notify user) rather than silently continuing.
36- [ ] **L7 skill files build step** — `scripts/install.sh` writes `.claude/skills/` SKILL.md bodies via inline heredocs that can drift from the canonical files. Add a build/release step that materialises the heredocs from the actual skill files so they stay in sync.
37- [ ] **Imported repos get skill bundle** — L7 skill files are only bundled into this repo + L2-installed users. When a user imports a GitHub repo, the skills should be bundled into the imported repo's `.claude/settings.json`.
83- [ ] **Spec-to-Live full pipeline** — currently Spec→PR. Wire the rest: PR opens → AI review fires → gates run → auto-merge → deploy → real-time browser notification showing elapsed time "merged in 1m 52s". Make the whole loop visible in the browser while it happens.
84- [ ] **L7 skill files build step** — `scripts/install.sh` writes skill file bodies via heredocs that drift from canonical `.claude/skills/` files. Add a release step that materialises heredocs from actual files.
85- [ ] **Skill bundle on import** — when a user imports a GitHub repo, the Claude Code skills should be bundled into the imported repo's `.claude/settings.json` automatically.
86- [ ] **GitHub Actions → Gluecron YAML translator** — auto-translate `.github/workflows/*.yml` to `.gluecron/workflows/*.yml` at import time. Removes the biggest migration blocker.
3887
3988### Developer Experience
40- [ ] **@mention in commit messages** — `src/lib/mention-autocomplete.ts` wires `@mention` on comment textareas. Extend to the web file editor commit message field and the PR/issue title field.
41- [ ] **Bulk issue operations polish** — bulk close/reopen via `POST /:owner/:repo/issues/bulk` is shipped but the floating action bar and checkboxes are flagged in-flight. Verify this is fully working.
42- [ ] **K3 tasks surface on `/admin/autopilot`** — `auto-merge-sweep` and `ai-build-from-issues` run every tick but aren't listed in the admin UI. Add them to the autopilot dashboard with last-run + count stats.
43- [ ] **System/autopilot user** — K3 auto-merge and ai-build marker comments are posted with the PR/issue author's ID because no system user exists. Create a synthetic `system` user (or add `is_system_comment` boolean to `pr_comments`/`issue_comments`) so autopilot actions aren't credited to the wrong human.
44- [ ] **L1 sleep-mode uses shared `last_digest_sent_at`** — sleep-mode digest (L1) and weekly email digest (I7) both update `users.last_digest_sent_at`, which means a user opted into both could starve one feed. Add `users.last_sleep_digest_sent_at` as a separate column.
45- [ ] **GitHub unlink route** — `/settings/sso/unlink` removes any SSO link including GitHub. Add `/settings/github/unlink` as a dedicated cleaner UX for L6 GitHub OAuth users.
46- [ ] **AI commit message audit** — `audit_log` entries for `ai.commit_message.generated` aren't emitted. Add `audit()` call in `src/lib/ai-generators.ts generateCommitMessage` so the L9 hours-saved counter works for this line item.
89- [ ] **Spec-to-PR real-time progress UI** — the spec form submits and... what does the user see? Wire a live progress view: "Analysing repo → Writing code → Creating branch → Opening PR → Done." This makes the 90-second wait feel fast, not slow.
90- [ ] **Bulk issue operations polish** — bulk close/reopen is in-flight per the BUILD_BIBLE. Verify the floating action bar and checkboxes are complete and working.
91- [ ] **K3 tasks on `/admin/autopilot`** — `auto-merge-sweep` and `ai-build-from-issues` run every tick but aren't in the admin UI. Add them with last-run time and count stats.
92- [ ] **System/autopilot user** — K3 posts marker comments credited to the PR/issue author. Create a synthetic `gluecron[bot]` user row so autopilot actions show a bot avatar, not a human's name.
93- [ ] **@mention autocomplete on commit messages** — mention-autocomplete wires textareas. Extend to the web editor commit message field.
94- [ ] **Workflow artifact retention policy** — artifacts accumulate forever. Add 90-day default with per-repo override and autopilot cleanup task.
95- [ ] **L1 sleep-mode column** — sleep-mode digest and weekly digest share `last_digest_sent_at`. Split to `last_sleep_digest_sent_at` to avoid starving one feed.
96- [ ] **GitHub unlink route** — `/settings/sso/unlink` removes any SSO link. Add `/settings/github/unlink` for GitHub OAuth users specifically.
97- [ ] **AI commit message audit events** — `audit()` call missing from `generateCommitMessage`. Adds the L9 hours-saved counter line item for commit message generation.
4798
4899---
49100
50## 🔵 PRIORITY 4 — Customer-Facing Sections (Needs to Look Polished)
101## 🔵 PRIORITY 5 — Customer-Facing Sections (Must Look Complete and Polished)
102
103### The "Now" Dashboard Experience
104- [ ] **Dashboard "AI just did this" widget** — top of dashboard, shows what autopilot did in the last hour: PRs auto-merged, specs shipped, secrets repaired, AI reviews posted. Real-time feel. Not "last 7 days" — "last hour."
105- [ ] **Push Watch → make it prominent** (`/:owner/:repo/push/:sha`) — the page exists. Add a "Live" link directly on the repo header that lights up after every push and shows the push-to-live progress bar. This is the "wow" moment new users need to see.
106- [ ] **Repo overview: health badge + AI stats** — health score badge top-right of repo header. Below the file tree: "AI merged 3 PRs this week · Saved ~4.5 hrs · 0 open security alerts." Makes AI value visible at a glance.
107- [ ] **Notification preferences overhaul** — `/settings/notifications` is a flat list. Restructure into categories: AI activity, CI/CD, code review, mentions/assigns. Per-category email + push + in-app toggle.
108
109### Admin Panel (Must Be Production-Grade)
110- [ ] **Admin > AI cost breakdown** — total AI spend this month, cost per feature type (review vs triage vs completion vs chat), top spenders. Unit economics tracking.
111- [ ] **Admin > Stripe sync view** — Stripe subscription status per user vs local plan. Flag mismatches. Allow manual sync.
112- [ ] **Admin > Autopilot health dashboard** — last tick time, tasks completed per tick, error rates, average tick duration. Time-series chart showing autopilot activity.
113- [ ] **Admin > Mirror status** — failed mirrors, sync lag, last successful sync. Alert column for repos that haven't synced in 24h.
114- [ ] **Admin > Email deliverability** — sent/bounced/failed counts from Resend. Currently fire-and-forget with zero visibility.
115- [ ] **Admin > User growth chart** — signups over time, activation rate (users who created a repo), conversion rate (free → paid). Business health at a glance.
116- [ ] **Admin > Revenue dashboard** — MRR, new subscribers this month, churn, plan distribution. Pull from Stripe API.
117
118### Onboarding Flow
119- [ ] **Onboarding email sequence** — after signup, users should get: (1) welcome + quick start at T+0, (2) "try spec-to-PR" prompt at T+1 day, (3) "here's what AI did for repos like yours" at T+3 days. Resend sequences.
120- [ ] **Empty state for new repos** — new repo with no code should show: "Push your first commit" with exact git commands + "Or import from GitHub" + "Or try Spec-to-PR to let AI write your first feature." Not a blank page.
121- [ ] **Onboarding checklist widget on dashboard** — for users who haven't done: ☐ push a repo ☐ open a PR ☐ try spec-to-PR ☐ enable auto-merge. Disappears once complete.
122- [ ] **`curl | bash` install flow** — `curl -sSL gluecron.com/install | bash` (L2) exists. Test on a clean machine. Verify it: signs in, mints PAT, writes Claude Desktop config, imports a repo. Fix any broken steps.
123
124### Help & Documentation
125- [ ] **Documentation site** — `/help` exists as a migration cheatsheet. Need a proper docs site: Getting Started, CLI reference, API reference, MCP server setup, workflow YAML syntax, migration guide. Could be `/docs` served from git or a separate subdomain.
126- [ ] **Changelog / what's new** — users have no way to know what shipped. Add `/changelog` showing recent releases with AI-generated notes. Feeds trust.
127- [ ] **In-app contextual help** — "?" icons next to non-obvious features (DORA metrics, rulesets, merge queues) that expand a tooltip or link to docs.
128- [ ] **Status page completeness** — `/status` and `/status.svg` exist. Verify: uptime history, incident history, subscribe-to-alerts link. Make it look like Atlassian Status Page quality.
51129
52### Messaging Correction (IMPORTANT — affects landing, demo, vs-github, pricing)
53- [ ] **Rewrite all "sleep and wake up" copy** — the current pitch ("label an issue, walk away, wake up to a merged PR") positions Gluecron as slow and async. Developers sit at their computer and want results NOW. Replace every instance with instant/speed framing: "Label an issue. It's a PR in 90 seconds." The real story is: spec→PR in 2 minutes, AI review fires the moment the PR opens, auto-merge triggers the instant gates pass, push→live in ~25 seconds. Sleep Mode stays as a secondary feature for async users — it must NOT be the headline anywhere. Pages to update: `src/views/landing.tsx`, `src/routes/vs-github.tsx`, `src/routes/pricing.tsx`, `src/routes/demo.tsx`, `src/routes/sleep-mode.tsx` (marketing section only), any OG/meta descriptions.
54- [ ] **Rewrite landing hero** — current hero leads with the async pitch. New headline should hit speed and instant AI action. Suggested direction: "Write the spec. Gluecron ships it." or "AI that acts in seconds, not suggestions that sit in a tab." Sub-head should call out the 2-minute spec→PR and 25-second push→live numbers.
55- [ ] **Rewrite `/vs-github` AI-native section** — the 10 AI-native rows compare features but the copy still leans async. Reframe around real-time speed advantage: GitHub Copilot waits for you to type; Gluecron acts the moment you open a PR. Lead with latency numbers.
130---
56131
57### Marketing & Acquisition
58- [ ] **60-second demo video** — record "I write a spec, it's a merged PR in under 3 minutes." Show the real-time flow: spec form → AI writes code → PR opens → AI review posts → gates pass → auto-merged. No voiceover needed. Embed on landing, `/demo`, and `/vs-github`. This does more than any feature page.
59- [ ] **Shareable AI hours saved card** — L9 hours-saved counter is on the dashboard. Add a `/api/v2/me/ai-savings/share` endpoint that generates an OG-image card (e.g. "I saved 14 hours this week with Gluecron") for Twitter/LinkedIn sharing. Viral growth lever.
60- [ ] **`/vs-github` ongoing maintenance** — 26-row comparison table. As GitHub ships features, update this. Make it a living document, not a snapshot.
61- [ ] **Pricing page A/B** — `/pricing` exists. Test different price points and feature-gating messaging. The current copy is functional but not conversion-optimised.
62- [ ] **Developer program page** — for Marketplace app builders. Registration, docs, revenue share terms, `gluecron-partner` badge. Required before the Marketplace can grow organically.
132## 🟣 PRIORITY 6 — Growth & Ecosystem
63133
64### Admin Panel
65- [ ] **Admin > AI costs overview** — total AI spend across all users this month, top spenders, cost per feature type (review vs triage vs completion). Needed for unit economics tracking.
66- [ ] **Admin > Stripe sync** — view of Stripe subscription status per user alongside the local `billing_plans` override. Flag mismatches (paid in Stripe but free locally, or vice versa).
67- [ ] **Admin > Autopilot health** — last tick time, tasks completed per tick, error rates, average duration. Currently `/admin/autopilot` has basic info — expand with time-series.
68- [ ] **Admin > Mirror status dashboard** — `repo_mirrors` + `repo_mirror_runs` data. Show failed mirrors, sync frequency, lag behind upstream.
69- [ ] **Admin > Email deliverability** — sent/failed/bounced counts from Resend. Currently email is fire-and-forget with no visibility into delivery.
134### Acquisition
135- [ ] **60-second demo video** — screen record: type a spec → watch AI write code → PR opens → AI review posts → gates pass → merged. Show the elapsed time counter. No voiceover. Embed on landing, `/demo`, `/vs-github`. This is the single highest-ROI marketing asset.
136- [ ] **Zero-friction GitHub migration** — import page already exists but make it the primary CTA on landing for GitHub users. Add: "Migrate your entire GitHub org in 60 seconds" with a big button. The bulk import is built — just needs prominence.
137- [ ] **`/vs-github` ongoing maintenance** — living document. As GitHub ships, update the table. Set a monthly reminder to review it.
138- [ ] **HackerNews / dev community launch** — plan a Show HN post. The platform is substantial enough. Need: a live demo URL, the 60-second video, a clear "what's different" paragraph. Time it with the demo video completion.
139- [ ] **Developer program page** — `/developer-program`: register as a marketplace app builder, revenue share terms, `gluecron-partner` badge, dedicated support. Required before the marketplace can grow organically.
140- [ ] **Blog / devlog** — even a simple `/blog` with monthly updates. Developers follow platforms that ship visibly. Show the build.
70141
71### User Dashboard
72- [ ] **Dashboard "AI work done for you" widget** — summary of what autopilot did in the last 7 days: PRs auto-merged, issues built by AI, secrets auto-repaired. One prominent widget at the top of the dashboard.
73- [ ] **Notification preferences overhaul** — current `/settings/notifications` is a flat checkbox list. Restructure into categories (AI activity, CI/CD, reviews, mentions) with per-category granularity.
74- [ ] **Repository health score on repo overview** — `computeHealthScore` exists and the `/insights/health` page is shipped. Add a small health score badge to the repo overview page (top-right corner of RepoHeader).
142### Distribution
143- [ ] **VS Code extension → publish to VS Code Marketplace** — `vscode-extension/` is built. Run `vsce package`, publish. Free discovery from millions of VS Code users.
144- [ ] **CLI → publish to npm** — `cli/gluecron.ts` is built. Publish as `gluecron` npm package. `npx gluecron login` as zero-install entry point.
145- [ ] **CLI → Homebrew formula** — add to homebrew-core or a tap. `brew install gluecron`. Mac developer standard.
146- [ ] **JetBrains plugin** — IntelliJ, WebStorm, GoLand users. Kotlin plugin, same four commands as VS Code extension. Covers the second-largest IDE population.
147
148### Platform Expansion
149- [ ] **Agent marketplace — real listings** — currently 4 seed listings. Need 20+ real agents with real installs. Reach out to 10 developers to build and list agents. Create a "build an agent" tutorial.
150- [ ] **Dependency network graph UI** — `repositoriesDependingOn()` is implemented in `src/lib/deps.ts`. Wire `/:owner/:repo/dependencies/dependents` — "who depends on me?" page. Big for open source maintainers.
151- [ ] **Multi-agent pipeline UI** — `agentSessions` + `agentLeases` tables exist. Wire a UI to define pipelines: Agent A writes, Agent B reviews, Agent C deploys. The future of automated software teams.
152- [ ] **AI pair programmer (browser)** — real-time Claude session in the browser alongside the file editor. Think Cursor-in-a-tab. Uses web editor + AI completion endpoint + SSE for live edits. Biggest competitive moat against Cursor/Copilot.
75153
76154---
77155
78## 🟣 PRIORITY 5 — Strategic / Long-Term Moat
156## ⚫ PRIORITY 7 — Strategic / Long-Term
79157
80### Compliance & Enterprise
81- [ ] **SOC 2 Type II preparation** — without this certification, no mid-market or enterprise deal closes. Engage an auditor, scope the controls (access control, encryption, incident response, change management, availability). Estimated 6–9 months.
82- [ ] **EU data residency option** — enterprises need to know their code stays in the EU. Evaluate Neon postgres EU region + Fly.io EU region. Surface a "data region" selector at org creation.
83- [ ] **GDPR account deletion** — verify the full deletion cascade: repos (with bare git dir), issues, PRs, comments, tokens, audit log anonymisation. There may be a grace period implementation already — confirm it's complete.
84- [ ] **Audit log SIEM export** — the audit log UI exists. Add `GET /api/v2/audit?since=&format=json` for SIEM integration (Splunk, Datadog, etc.). Required for enterprise security teams.
158### Enterprise
159- [ ] **SOC 2 Type II** — engage an auditor, scope controls, begin evidence collection. 6–9 months to certification. Without it: no mid-market or enterprise deals close, regardless of features.
160- [ ] **EU data residency** — Neon postgres EU region + Fly.io EU region. "Data region" selector at org creation. Enterprise legal requirement in many EU companies.
161- [ ] **GDPR full deletion cascade** — verify: repo bare git dir deleted, issues/PRs/comments purged or anonymised, tokens revoked, audit log entries anonymised. Confirm grace period implementation is complete.
162- [ ] **Audit log SIEM export** — `GET /api/v2/audit?since=&format=json` for Splunk/Datadog/Elastic integration. Required by enterprise security teams.
163- [ ] **Enterprise sales page** — `/enterprise`: custom pricing, SSO/SAML, dedicated support SLA, audit log export, data residency. Contact form → Calendly.
164- [ ] **99.9% SLA commitment** — write it down, publish it. Enterprises need a contractual uptime commitment before signing.
85165
86### Platform Expansion
87- [ ] **Native iOS app** — the only ❌ in the entire platform scorecard. PWA covers most of the ground but push notifications + Face ID login require native. Minimum viable: repo browser, notifications, PR approval. React Native or Swift.
88- [ ] **Native Android app** — same as iOS. Could share React Native codebase.
89- [ ] **Multi-agent workflow** — multiple AI agents collaborating: one writes, one reviews, one deploys, one monitors. The `agentSessions` + `agentLeases` tables exist. Wire a UI for defining multi-agent pipelines per repo.
90- [ ] **AI pair programmer (browser-based)** — real-time collaborative coding session with Claude in the browser. Different from the file editor — think Cursor-in-a-tab. Uses the web editor + AI completion endpoint + SSE for live edits.
91- [ ] **Dependency network graph UI** — `repositoriesDependingOn(ecosystem, name)` is implemented in `src/lib/deps.ts`. Wire a "who depends on me?" page at `/:owner/:repo/dependencies/dependents` showing the reverse graph. Big for open source maintainers.
92
93### Ecosystem
94- [ ] **GitHub Actions compatibility layer** — auto-translate `.github/workflows/*.yml` to `.gluecron/workflows/*.yml` at import time. Removes the biggest migration friction.
95- [ ] **VS Code extension — publish to marketplace** — `vscode-extension/` is built. Package it (`vsce package`) and publish to VS Code Marketplace. Discovery is free distribution.
96- [ ] **CLI — publish to npm/brew** — `cli/gluecron.ts` is built. Publish `gluecron` to npm (`npx gluecron`) and add a Homebrew formula. Zero-install entry point for new users.
97- [ ] **JetBrains plugin** — after VS Code, JetBrains IDEs (IntelliJ, WebStorm, GoLand) are the next biggest developer surface. Kotlin plugin exposing the same four commands as the VS Code extension.
166### Mobile
167- [ ] **Native iOS app** — the only ❌ in the entire platform scorecard. Minimum viable: repo browser, notifications, PR approve/reject, AI chat. React Native for code share with Android.
168- [ ] **Native Android app** — same codebase as iOS via React Native.
169- [ ] **PWA push notification fix** — Web Push (M8) is implemented. Verify push notifications actually arrive on mobile browsers (iOS Safari is particularly finicky with Web Push standards).
170
171### Reliability
172- [ ] **End-to-end test suite** — unit tests are 1491 passing. But is there a full E2E suite (Playwright/Puppeteer) covering: register → create repo → push code → open PR → AI review fires → merge? This is what catches regressions in the full flow.
173- [ ] **Load testing** — what happens at 1000 concurrent git pushes? At 10k concurrent web sessions? Run k6 or Artillery before any growth push.
174- [ ] **Database connection pooling** — Neon + Drizzle direct connection. Under load, connection limits become the bottleneck. Verify PgBouncer or Neon's built-in pooling is configured correctly.
175- [ ] **Backup and recovery verification** — Neon has backups. Test restoration. Document the RTO/RPO. Required for SOC 2 and for not losing customer code.
98176
99177---
100178
101## ✅ COMPLETED (Reference)
102
103Everything in the BUILD_BIBLE §2 marked ✅ is done. Key highlights:
104- Git hosting, forking, stars, topics, archiving, templates, mirroring, transfer
105- File browser, syntax highlighting, blame, diff, raw, branch switcher, tags
106- Issues, PRs, inline comments, draft PRs, reactions, mentions, notifications
107- Discussions, wikis, gists, projects/kanban, milestones
108- GitHub Actions equivalent (workflow runner, secrets, matrix, caching LOAD)
109- Package registry (npm), Pages (static hosting), Environments, Merge queues
110- AI: code review, PR/issue triage, changelogs, test gen, spec-to-PR, auto-merge, autopilot
111- MCP server (K1), Claude Code skills (L7), VS Code extension (G4), CLI (G3)
112- Sleep Mode (L1), AI hours saved (L9), demo page (L3), vs-github page (L5)
113- Organizations, teams, SSO/OIDC, 2FA/TOTP, WebAuthn/passkeys, OAuth provider
114- DORA metrics, velocity, health score, hot files, pulse, traffic analytics
115- Admin panel, billing infrastructure, audit logs, rate limiting, observability
116- GraphQL API, REST v2, API docs, PWA manifest, SEO
179## ✅ COMPLETED (Reference — Do Not Redo)
180
181Everything in `BUILD_BIBLE.md §2` marked ✅ is shipped. Key capabilities:
182
183**Git hosting:** clone, push, fetch, SSH key storage, forking, stars, topics, archiving, templates, mirroring, repository transfer, public/private visibility
184
185**Code browsing:** file tree, syntax highlighting (40+ languages), blame, diff, raw, branch/tag switcher, commit history, semantic search, symbol navigation, dependency graph, security advisories, commit signature verification, repository rulesets
186
187**Collaboration:** issues, PRs, inline comments, draft PRs, reactions, mentions, notifications, discussions, wikis, gists, projects/kanban, milestones, code owners, issue/PR templates, saved replies, merge queues, required checks, protected tags
188
189**CI/CD:** workflow runner (GitHub Actions equivalent), workflow secrets, matrix builds, caching (LOAD), environments with approval gates, deployment tracking, branch protection, gate runs, auto-repair, secret scanner
190
191**AI (all wired, not stubs):** code review (blocks merges), PR/issue triage, changelogs, test generation, spec-to-PR, auto-merge (K2), AI build from issues (K3), codebase explanation, dependency updater, merge conflict resolver, commit message suggestion, PR description suggestion, copilot completions, sleep-mode digest (L1), AI hours saved (L9)
192
193**Platform:** organizations, teams, SSO/OIDC, 2FA/TOTP, WebAuthn/passkeys, OAuth 2.0 provider, GitHub sign-in (L6), MCP server (K1), Claude Code skills (L7), VS Code extension (G4), CLI (G3), GraphQL API, REST v2, package registry (npm), static hosting (Pages), marketplace, DORA metrics, velocity, health score, hot files, pulse, traffic analytics, admin panel, billing infrastructure, audit logs, rate limiting, observability, PWA, SEO
194
195**Marketing shipped:** landing hero (L10), vs-github page (L5), pricing page (L8), demo page (L3), public stats counters (L4), install script (L2), onboarding flow, help page, keyboard shortcuts, command palette
117196
118197---
119198
120## Notes
199## How to Use This File
121200
122- Work through this top-to-bottom. Priority 1 before Priority 2, etc.
123- When an item ships: replace `- [ ]` with `- [x]` and add the date and commit/PR reference.
124- When a new gap is discovered: add it to the appropriate priority section.
125- This file lives on branch `claude/platform-analysis-roadmap-1nUGL`. Merge to main after first review.
201- `- [ ]` = not started
202- `- [x] YYYY-MM-DD commit:abc1234` = done
203- Add new gaps here as they're discovered
204- When in doubt about priority, Revenue (P1) > Messaging (P2) > Verify existing (P3) > Build new (P4+)
126205