The delivery machine is unusually strong. The next major productivity gain is to aim it at customer evidence, growth, education, analytics, and recurring security controls.
Engineering work reliably turns into code, verification, and releases. Market signals rarely turn into measured experiments, decisions, and reusable learning with the same discipline.
Snapshot taken 12 July 2026. Codex history covers Sep 2025 to Jul 2026. Available Claude history covers May to Jul 2026. Scores are directional maturity judgments, not financial KPIs.
The answer is not less engineering. It is to copy the same root-cause, verification, and automation discipline into discovery and growth.
This loop has runbooks, specialist skills, release gates, independent verification, and a strong bias toward root causes.
This loop needs a ledger, attribution, a weekly decision cadence, stop conditions, and memory of what actually worked.
VilaNet, VPNCheap, router clients, protocol cores, and fleet work dominate the project distribution. Code and operations receive deep, repeated attention.
VilaVista already measures MRR, ARR, revenue, churn, refunds, LTV, signups, affiliates, traffic, and capacity. The missing layer is a recurring decision process, acquisition cost, and product usage cohorts.
SEO work appears as isolated audits, mainly around one web project. Exact searches found no substantive Google Ads or Apple Ads operating history. There is no persistent channel experiment ledger.
VilaNet has one focused user guide under docs/user. The tvOS README explains remote navigation, but neither app has a complete visual tutorial system or repeatable media capture harness.
Threat modeling and security-sensitive code review are real strengths. Recurring control evidence is weaker, and always-loaded workspace instructions currently include literal operational credentials that should be removed.
Support handling is active, but searches for user interviews resolve to skill-template language, not a sustained customer discovery program. Feedback is not yet a measured input to roadmap, docs, and marketing.
The target is not perfect symmetry. It is enough commercial, security, and education capacity to turn delivery speed into durable business outcomes.
High confidence: delivery, automation, tutorial, and schedule coverage. Medium confidence: security and analytics maturity. Low confidence: work that may happen outside Claude and Codex, especially offline sales and finance.
Scores combine leverage, urgency, evidence quality, reversibility, and fit with your existing strengths.
Your marginal bottleneck is not coding throughput. Add specialists only when a measured loop has a clear owner and recurring input.
The global files are already compact and strong. Put growth, analytics, tutorial, and security detail in scoped skills and domain guidance.
The sequencing matters. Paid traffic before attribution and content before customer evidence would create activity, not learning.
Self-improvement should mean measured feedback and proposed runbook changes. A task must never silently rewrite its own prompt, spend money, publish content, or mutate production.
Founder decision brief
VilaVista, App Store, support, releases, incidents.
One HTML brief with three decisions, owners, confidence, and prior-action outcomes.
Read-only. Learns forecast error and retires unused metrics by proposal.
VOC to product and docs
Support, cancellation reasons, app reviews, Sentry clusters.
An anonymized signal map and ranked queues for fix, tutorial, experiment, and proof.
No customer reply or public issue. Learns from later resolution and deflection.
Tutorial freshness check
Screen routes, UI strings, release notes, tutorial manifest.
Stale-asset report and draft recapture bundle for only the affected journeys.
No public publish. Learns which code changes actually invalidate media.
Growth experiment review
Attribution, funnel, SEO, product page, current experiment.
Continue, stop, or revise one experiment. Maximum one new experiment per cycle.
No ad spend or metadata change without approval. Learns from lift and retention.
Security evidence review
Secrets, access, dependencies, backups, restore proof, public surfaces.
Control evidence matrix, overdue items, and one prioritized remediation proposal.
Report-only first. No credential rotation, deploy, or access change.
Automation portfolio audit
Run success, duplication, duration, resource use, actionability.
Pause, merge, keep, or redesign recommendations with estimated value and cost.
No self-edit. One heavy job at a time and a fixed RAM/time budget.
Each loop keeps a small ledger: input, hypothesis, recommendation, human decision, outcome, error, and proposed change. It may recommend a prompt or metric change, but approval remains external.
Builds the weekly decision brief from approved aggregate sources. Separates measured facts, observed signals, inferences, and proposals.
Runs manifest-driven capture, composition, redaction, localization, and QA for VilaNet and tvOS help media.
Maintains one experiment ledger with hypothesis, metric, budget, stop rule, review date, and result. Drafts assets but does not publish or spend.
Anonymizes and clusters support, churn, reviews, and errors. Routes every cluster to a named owner and measurable outcome.
Collects control evidence against a compact catalog, tracks overdue proof, and proposes one remediation at a time.
Finds duplicate jobs, stale prompts, missing outputs, resource collisions, and schedules that no longer influence a decision.
Resource-aware orchestration: Before broad scans or parallel lanes, estimate corpus size and working set. Do not run multiple memory-heavy workers against the same index. Start with bounded queries and samples, cap concurrency, monitor RSS, and stop to narrow if the first pass exceeds budget. Business evidence: For business, growth, and customer-facing product decisions, label each claim as measured, observed, inferred, or proposed. Do not treat implementation activity as customer demand. Tie every recommendation to a metric, owner, review date, and stop condition. Secret context: Instruction files may name secret variables and approved retrieval paths, but must not contain literal passwords, tokens, recovery codes, or private keys.
Computer Use removes the manual navigation burden. Stable UI hooks and a tutorial manifest remove the brittleness. Record and Replay can capture your preferred flow once, then the skill should use semantic controls instead of coordinate replay.
| Surface | Primary driver | Recorder | One-time work | Best first journey |
|---|---|---|---|---|
| VilaNet iOS | Flutter integration test or semantic Computer Use | Simulator video and screenshots | Add stable keys and demo fixtures | Sign in, connect, disconnect |
| VilaNet Android | Flutter integration test, Maestro only if semantics are stable | Emulator video and screenshots | Add stable keys and permission handling | Choose server and auto-select |
| VilaNet macOS | Computer Use with accessibility targets | ScreenCaptureKit or platform recorder | Deterministic window size and demo data | Menu, server, connect, settings |
| VilaNet Windows | Computer Use with accessibility targets | Platform recorder | Deterministic window size and permission states | Install, login, connect |
| VilaNet tvOS | XCUITest focus navigation plus Computer Use inspection | tvOS Simulator video | Create a UI test target and stable focus identifiers | Package, server, remote focus, connect |
Security-sensitive implementation and threat modeling are visible in the history. A business-scale program needs recurring evidence that controls still work when no incident is forcing attention.
Keep: root-cause analysis, fail-loud invariants, exact-target gates, remote-config checks, secure-storage work, backups, threat models, and independent verification.
Add: least-context secret handling, access review, dependency and supply-chain evidence, restore drills, incident-to-control mapping, data retention, and a single current asset inventory.
Reduce prompt exposure and accidental transcript leakage. Refer to Keychain, environment variables, or approved secret files by name only.
Backup age is not recovery evidence. Run a scheduled sample restore with integrity and time-to-recover recorded.
Accounts, keys, admin surfaces, certificates, DNS, exposed ports, and stale hosts should have an owner and review date.
Generate dependency, signing, and release-artifact evidence. Use a compact OWASP ASVS-based checklist for the billing and web surfaces.
Every incident gets cause, missed detection, corrective control, test, owner, and scheduled evidence. Close the learning loop.
Document what support, analytics, crash, billing, and tutorial systems collect, where it flows, how long it remains, and who can access it.
This keeps the plan small enough to start while establishing the foundations that make later automation safe and measurable.