After the roadmap · where Dock aims now

What's next

The original roadmap is delivered. v1 plus Phase A, the core B loop (B1/B2/B5/B6), and the C4 launch gate have all shipped, on top of a perf pass, React 19, the design system, and a Cloudflare edge tier. So "next" is no longer about whether the product exists. It is about sharpening the one thing Dock does that nobody else does, and closing the gaps that keep a strong product from being an obvious one.

How this page was built: the priorities below are cross-checked against three inputs: what is already shipped (the Build Log), the live competitive field (Claude Artifacts, ChatGPT Canvas, v0, bolt, Cloudflare Artifacts, Tiiny.host), and recurring community demand on Hacker News, Reddit, and X. Each item is tagged with where it comes from. Sources are listed at the bottom.

What Dock already won

The competitive scan is unusually kind: the white space Dock was built for is still empty. These four bets have no real answer in the field.

Text-anchored comments on rendered output shipped

A comment sticks to "the button that breaks on mobile" and survives the next version. Figma has this for designs and Google Docs has it for text. No artifact tool has it for rendered HTML, site builds, or decks.

Nobody else does this: Claude Artifacts, ChatGPT Canvas, v0, bolt, and every quick-host (Tiiny, Surge, Netlify Drop) ship a link with zero feedback surface attached.

Agent publishes, human reviews, agent revises shipped

The pull-request model applied to artifacts: an agent proposes a version, a human approves or requests changes, the agent iterates, all over MCP. This is the value crown, and it is live.

The closest competitor still misses the half that matters: Cloudflare's "Artifacts for agents" gives versioned storage but no human review layer; v0 and bolt are human-facing UIs, not agent-first APIs. Dock owns the whole loop.

Open-source, single-container self-host shipped

One container, SQLite and local files, no AWS bill, runs on a $5 VPS. Scales out to Postgres + S3/R2 or Cloudflare D1+R2 by changing env vars. "Ghost for AI artifacts."

Every generator is SaaS: Claude Artifacts, Canvas, v0, bolt, Lovable are all closed and hosted. Searches for self-hosted AI tooling grew sharply through 2025; this is the lane nobody contests.

Trust and safety shipped before growth shipped

Origin isolation (A4), per-org quotas and rate limits, plus report and takedown with an audit trail (C4) all landed before the hosted tier opens. The abuse story exists first, by design.

This is becoming the moat: AI website builders are being abused for phishing at scale (Lovable was publicly flagged; malicious AI-generated URLs spiked through early 2026). Hosts that bolt safety on after the first incident lose. Dock front-loaded it.

The next work, in four tiers

Ordered by leverage, not size. Tier 1 is cheap and compounds; Tier 4 is the frontier. Each item is tagged with where it comes from.

roadmap already on the plan community recurring ask online competitive gap table stakes rivals have review from the holistic reviews

Tier 1 Sharpen the wedge

The product already does the hard thing. The loudest recurring complaint online is narrow and specific: "Claude Code writes HTML to disk but has no publish step; the share button only exists in the web UI, not the CLI where engineers actually work." Dock's dock publish + MCP already solves the capability. The gap is distribution, so the cheapest, highest-leverage work is making the on-ramp and the shared link irresistible.

Embeds + unfurl cards roadmap competitive gap: per-artifact OpenGraph image (title, version, comment count, thumbnail), oEmbed, and a clean <iframe> embed, so every Dock link unfurls rich in Slack, Notion, Linear, and X. Every shared link becomes an ad for the loop. Figma's live embed is table stakes here.
A one-line agent on-ramp community: a published Claude Code / Codex skill and an MCP quickstart so "let my agent ship the page and bring the review comments back" is copy-paste. This is exactly the CLI publishing gap people keep naming, and it is where the puck is heading (autonomous agent deploy).
GitHub Action roadmap community: dock-publish on push, comment the review URL on the PR. A thin wrapper over the CLI + scoped tokens.

Tier 2 Close the credibility gaps

The features a stranger expects and is surprised to find missing. None are differentiators; lacking them is what makes a strong product look unfinished.

Custom domains / vanity URLs (C1) roadmap community competitive gap: the most-cited complaint about Claude and bolt is the ugly, vendor-locked URL ("you cannot point a custom domain at it"). Pairs naturally with the sandbox origin work already done (A4).
Email notifications (B3) roadmap: the one missing notification channel. A reviewer who does not live in Slack never hears that a version is waiting. The router already exists; email is a dumb pipe on it.
Full-text / body search (C3) roadmap: title-only search breaks the moment an org has a few hundred artifacts. SQLite FTS5 and Postgres tsvector behind one MetaStore.search(), no search service.
A real editor (B4) roadmap: inline edit exists; CodeMirror with live preview and a commit-message field closes the loop for humans, not just agents.

Tier 3 Harden to a clean A

The latest six-reviewer pass scored A−. The road to A is not features, it is robustness. Do this before opening any hosted signups.

Verify and merge the review punch-list review: re-check the resolved IP at webhook delivery time (DNS-rebinding SSRF), and add the composite (org_id, created_at, id) index on the artifact feed across sqlite/pg/d1. Both appear started on feat/review-fixes; confirm they reached main.
A frontend test net review: the web app has zero unit tests and e2e runs only post-merge. Add a vitest layer on the pure modules and gate a smoke e2e on PRs.
Router error boundary + theme FOUC review: a thrown route should not blank the app; the theme should not flash on load.
Measure the perf, do not assert it review: the five-tier perf roadmap shipped; put real numbers behind it.

Tier 4 The hosted tier

C4 was the gate: never open signups before the abuse story exists. C4 shipped, so this is now a legitimate frontier rather than a liability.

Signups, flat per-org billing, SSO gating roadmap: the same image, hosted, on the Sentry/GitLab model. The path to a first paying team. Sequence it after Tier 3 so the thing people pay for is already hardened.

Deliberate non-goals

The research surfaces loud demand here. Both are deliberate passes, named so they stop coming back as open questions.

pass Backend-connected artifacts (databases, external APIs, server-side code, persistent state). This is the single loudest want in the field: people complain that Claude Artifacts "gets you 70% there" and cannot connect to a database. But it directly contradicts Dock's decided scope (all static content), and it is a different product: bolt, v0, and Lovable already fight there. Chasing it dilutes the review-layer wedge that nobody else holds. Dock stays the place you publish, version, and review the output, not the runtime that powers it.
cut Realtime co-editing (CRDTs): already cut on the roadmap. The version is the unit of review, not the keystroke. Comments + proposed versions are the model; Google-Docs-style co-editing keeps the system comprehensible by staying out.