Wayfinder: Ship the Codebase Radar Zerops MVP

[BleedingDev]

Destination

Ship and publicly deploy on Zerops an eight-hour MVP of the continuous Codebase Radar: scan a public TypeScript repository snapshot, prioritize evidence-backed improvements for human and agent consumers, compare it with the preceding scan, and expose its machine-readable result through read-only MCP.

Notes

• This effort explicitly carries implementation and Zerops deployment through the map because the challenge deadline is part of the destination.
• Product support starts with TypeScript repositories using React, Angular, Vue, Svelte, or Solid. Coverage must be reported honestly; universal TypeScript analysis does not imply equal framework-native depth.
• The deployment baseline is one UltraModern.js service containing UI, API, Streamable HTTP MCP, and direct bounded analyzer subprocesses, plus PostgreSQL. Do not add a scan-worker service. Add another Zerops service only if eligibility requires it and it has a real product purpose.
• Scans are static-only. Do not install dependencies or execute repository builds, tests, hooks, submodules, package scripts, or repository binaries.
• Prioritization is a bounded mixture: deterministic evidence and base scoring, structured LLM reasoning/reranking, then deterministic validation.
• Audience profiles personalize explanation depth without changing evidence or ranking.
• Use wayfinder, grilling, and domain-modeling for decisions; use deep-research, github-deep-research, and ecosystem-research for external evidence.
• Canonical product vocabulary lives in CONTEXT.md.
• Refer to every map ticket by its linked title, never a bare issue number.

Decisions so far

• Verify the safe multi-framework TypeScript analyzer profile — use the safe pinned static profile; defer Knip and state framework coverage honestly.
• Prove TraceDecay's per-snapshot application-process integration — run pinned TraceDecay as an isolated per-scan child inside the app service.
• Prove the UltraModern.js direct-scan Zerops deployment path — deploy one UltraModern Node 24 app plus PostgreSQL; no scan-worker service.
• Establish the cross-framework MVP validation corpus — validate ingestion across five framework repos and ranking against deterministic golden fixtures.
• Define stable Finding, Scan Result, and comparison identity — preserve provenance, use stable fingerprints, and group related signals without destructive merging.

Not yet specified

• Exact score calibration and permitted LLM adjustment bounds after representative analyzer output is available.
• Exact scan size, time, memory, subprocess-concurrency, and output limits after the first corpus runs.
• Whether Zerops eligibility truly requires a third service and, if so, which product-useful managed service fits without splitting scan execution.
• Which External References can be attached automatically when analyzers do not provide stable weakness or package identifiers.
• Failure and retry UX after real Zerops resource behavior is observed.

Out of scope

• Private repositories, GitHub App installation, OAuth, BetterAuth, and production identity or authorization.
• Scheduled scans, webhooks, and automatic continuous ingestion; manual rescan starts the product history.
• Installing dependencies or executing target-owned code; builds, tests, runtime profiling, and stronger hostile-code sandboxing come later.
• Autonomous fixes, pull requests, or code modification.
• Languages outside TypeScript/JavaScript and equal framework-native depth where the ecosystem does not provide it.
• Market validation, pricing, billing, fundraising readiness, and production multi-tenant hardening.
• Custom Rust application code or architecture optimized against a future rewrite.