From 6a33467206f1e2dd677c84423338133b8cabe2f6 Mon Sep 17 00:00:00 2001 From: che cheng Date: Sun, 5 Jul 2026 15:43:50 +0800 Subject: [PATCH 1/4] =?UTF-8?q?feat:=20sharpen=20vs-context7=20positioning?= =?UTF-8?q?=20=E2=80=94=20security-by-construction=20+=20free/unmetered=20?= =?UTF-8?q?(#52)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit positioning.md already carried these axes but understated + un-cited, and line 52 over-asserted "queries hit their servers" — context7's Enterprise page contests it (local processing + SOC-2 + self-host). Sharpened + honesty-corrected: - Differentiator #2 → "Private and free, by construction" with inline concession. - Head-to-head: honest Architecture ("hosted SaaS by default") + Privacy ("default routes through their cloud") rows; Access → Cost (unmetered vs metered + paid). - Prose: context7-cited evidence + concessions + dated pricing capture (2026-07-05) + "cite the structure, not the rotting figure" caveat. Both axes are STRUCTURAL, not harness-measured like freshness — so the honesty mechanism is dated citation + concession. Scope: positioning.md only (zero #50 overlap). --- docs/positioning.md | 29 +++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-) diff --git a/docs/positioning.md b/docs/positioning.md index 0aca816..52a06bc 100644 --- a/docs/positioning.md +++ b/docs/positioning.md @@ -37,7 +37,11 @@ footnote. about ten releases behind — and its *top-ranked* match carried no version at all. Numbers rot (this line once said `0.138.2`); the harness is the living source — re-run `evals/look-up/compare_context7.py` for today's. -2. Private, no key. Queries never leave your machine. No account, no API key, no hosted quota. +2. Private and free, by construction. Queries never leave your machine — there is no vendor + backend to trust, meter, or breach. No account, no API key, no seat, no per-token fee for + private repos. Matching that vendor-free posture on context7 means self-hosting, which is a + paid tier. (context7 is SOC-2-certified and *offers* self-host — the edge is structural + absence, not that context7 is unsafe; see the head-to-head.) 3. Raw and installed. Returns verbatim primary text, and can read the version you actually have. context7 returns ranked, model-summarized snippets, often weeks old. @@ -48,9 +52,9 @@ footnote. | Freshness | live, direct-to-source, ETag-revalidated | periodically recrawled, so it lags | | Fidelity | raw verbatim reachable | ranked, model-summarized snippets | | Your environment | matched to the installed version | version-agnostic snapshot | -| Architecture | local tool, no backend | centralized hosted service | -| Privacy | queries stay on your machine | queries hit their servers | -| Access | no account, no API key | hosted (quota / keys) | +| Architecture | local tool, no vendor backend | hosted SaaS by default (self-host is a paid tier) | +| Privacy | queries never leave your machine | default routes through their cloud (local processing + SOC-2 claimed) | +| Cost | free, unmetered; private repos included | metered free tier (public only) + paid Pro / Enterprise | | Breadth | ~any public lib via generic discovery + adapters | large pre-indexed corpus | The Freshness row is measured, not asserted: the @@ -58,6 +62,23 @@ The Freshness row is measured, not asserted: the (dated capture + per-library data, honesty caveats inline) is the living source of the head-to-head numbers — cite it rather than copying figures into prose that will rot. +The Architecture / Privacy / Cost rows are cited from context7's own pages, with the +concessions inline (measured-not-asserted applies to every competitive axis, not just +freshness). Both are **structural** claims, not measured metrics — so the honesty mechanism +is dated citation + concession, not a drift-guarded number: + +- **Vendor / privacy.** context7's default is a managed cloud service ("Built by Upstash"; a + dedicated hosted database per organization). It *offers* self-hosted / on-premise, claims + local query processing, and is SOC-2 Type II certified. LiveDocs has no vendor server at all + — nothing to deploy, trust, or breach. The edge is *structural absence*, not that context7 is + insecure; note that vendor-free operation on context7 is itself the paid self-host tier. +- **Cost** (dated capture, context7 pricing 2026-07-05): Free = 1,000 calls/mo, public repos + only; Pro = $10/seat/mo, with private-repo parsing billed at $25 / 1M tokens; Enterprise = + custom. LiveDocs is unmetered because it never calls a metered API — it reads your sources + locally, private repos included, at no cost. Figures rot; the durable claim is the *structure* + (metered SaaS vs unmetered local), so cite the structure and date any figure. context7's free + tier is real, and its pre-indexed breadth is its home turf (conceded above). + ## Honest reality: positioning ≠ winning context7 leads on distribution, not fidelity. Better-but-niche loses to worse-but-universal. From c6a08cb1390ed89cb8a4f838de6f68e505c02db0 Mon Sep 17 00:00:00 2001 From: che cheng Date: Sun, 5 Jul 2026 15:47:07 +0800 Subject: [PATCH 2/4] =?UTF-8?q?refine:=20precise=20privacy=20claim=20?= =?UTF-8?q?=E2=80=94=20"no=20third-party=20index=20sees=20your=20query",?= =?UTF-8?q?=20not=20"never=20leaves=20your=20machine"=20(#52)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Self-caught honesty fix (#27/#29): LiveDocs DOES fetch from npm/PyPI/docs hosts, so the library name in a query reaches the origin host. The literal "queries never leave your machine" over-claimed. Precise + defensible: no third-party INDEX/vendor sees the query (context7's exact role), and version reconciliation reads the local install offline. --- docs/positioning.md | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/docs/positioning.md b/docs/positioning.md index 52a06bc..451a335 100644 --- a/docs/positioning.md +++ b/docs/positioning.md @@ -37,11 +37,13 @@ footnote. about ten releases behind — and its *top-ranked* match carried no version at all. Numbers rot (this line once said `0.138.2`); the harness is the living source — re-run `evals/look-up/compare_context7.py` for today's. -2. Private and free, by construction. Queries never leave your machine — there is no vendor - backend to trust, meter, or breach. No account, no API key, no seat, no per-token fee for - private repos. Matching that vendor-free posture on context7 means self-hosting, which is a - paid tier. (context7 is SOC-2-certified and *offers* self-host — the edge is structural - absence, not that context7 is unsafe; see the head-to-head.) +2. Private and free, by construction. Your query goes straight to the authoritative source + (npm, PyPI, the docs host) with no third-party index in between to see, log, meter, or + breach it — and version reconciliation reads your locally-installed copy offline. There is + no LiveDocs vendor at all. No account, no API key, no seat, no per-token fee for private + repos. Matching that vendor-free posture on context7 means self-hosting, a paid tier. + (context7 is SOC-2-certified and *offers* self-host — the edge is structural absence, not + that context7 is unsafe; see the head-to-head.) 3. Raw and installed. Returns verbatim primary text, and can read the version you actually have. context7 returns ranked, model-summarized snippets, often weeks old. @@ -53,7 +55,7 @@ footnote. | Fidelity | raw verbatim reachable | ranked, model-summarized snippets | | Your environment | matched to the installed version | version-agnostic snapshot | | Architecture | local tool, no vendor backend | hosted SaaS by default (self-host is a paid tier) | -| Privacy | queries never leave your machine | default routes through their cloud (local processing + SOC-2 claimed) | +| Privacy | no third-party index sees your query (direct to source) | default routes through their cloud (local processing + SOC-2 claimed) | | Cost | free, unmetered; private repos included | metered free tier (public only) + paid Pro / Enterprise | | Breadth | ~any public lib via generic discovery + adapters | large pre-indexed corpus | From e12209d32390bca8f98013b1987a319cc73c56d7 Mon Sep 17 00:00:00 2001 From: che cheng Date: Sun, 5 Jul 2026 18:27:29 +0800 Subject: [PATCH 3/4] fix: honesty-symmetry per #52 verify round 1 (#52) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit R1 opus ensemble: delivery confirmed, but the framing counted what LiveDocs REMOVES (vendor / index / meter) without what it ADDS. Closed: - "nothing to trust or breach" over-claimed → trust doesn't vanish, it SHIFTS to the local signed binary + its GitHub-Release / --self-update distribution (a compromised release / signing key is arguably a larger blast radius). - Reconcile context7's own "queries processed locally" claim → even client-side processing sends the index lookup to their hosted per-org DB; that hosted index is exactly what LiveDocs structurally lacks (pre-empts the strongest rebuttal). - "no third-party index sees your query" narrowed → the origin host still sees it; the win is removing one observer (context7's index), not "nobody sees it". - Cost: "unmetered" isn't "costless" (you bear origin-host rate limits + bandwidth); "private repos" is a different mechanism (local installed copy vs cloud parse), not a free superset. - Symmetric conclusion: a DIFFERENT trust surface, not a strictly smaller one. - Accuracy: drop unverified "/mo" on Free ("1,000 included calls"); SOC-2 Type II uniformly; source's word "private" DB; self-host = the (custom-priced) Enterprise tier. Scope: positioning.md only (zero #50 overlap). --- docs/positioning.md | 47 ++++++++++++++++++++++++++++----------------- 1 file changed, 29 insertions(+), 18 deletions(-) diff --git a/docs/positioning.md b/docs/positioning.md index 451a335..adc6b0c 100644 --- a/docs/positioning.md +++ b/docs/positioning.md @@ -38,12 +38,14 @@ footnote. rot (this line once said `0.138.2`); the harness is the living source — re-run `evals/look-up/compare_context7.py` for today's. 2. Private and free, by construction. Your query goes straight to the authoritative source - (npm, PyPI, the docs host) with no third-party index in between to see, log, meter, or - breach it — and version reconciliation reads your locally-installed copy offline. There is - no LiveDocs vendor at all. No account, no API key, no seat, no per-token fee for private - repos. Matching that vendor-free posture on context7 means self-hosting, a paid tier. - (context7 is SOC-2-certified and *offers* self-host — the edge is structural absence, not - that context7 is unsafe; see the head-to-head.) + (npm, PyPI, the docs host) — no third-party index in between to log, meter, or rank what you + looked up — and version reconciliation reads your locally-installed copy offline. There is no + LiveDocs *service* on the query path: no account, no API key, no seat, no per-token fee, no + server that could be breached to leak what you looked up. (Trust doesn't vanish — it *shifts* + to the local signed binary and its distribution; a different surface, spelled out in the + head-to-head.) Matching that vendor-free posture on context7 means self-hosting — its + custom-priced Enterprise tier. context7 is SOC-2 Type II certified and *offers* self-host; the + edge is structural absence, not that context7 is unsafe. 3. Raw and installed. Returns verbatim primary text, and can read the version you actually have. context7 returns ranked, model-summarized snippets, often weeks old. @@ -54,9 +56,9 @@ footnote. | Freshness | live, direct-to-source, ETag-revalidated | periodically recrawled, so it lags | | Fidelity | raw verbatim reachable | ranked, model-summarized snippets | | Your environment | matched to the installed version | version-agnostic snapshot | -| Architecture | local tool, no vendor backend | hosted SaaS by default (self-host is a paid tier) | -| Privacy | no third-party index sees your query (direct to source) | default routes through their cloud (local processing + SOC-2 claimed) | -| Cost | free, unmetered; private repos included | metered free tier (public only) + paid Pro / Enterprise | +| Architecture | local tool, no backend (trust → the signed binary) | hosted SaaS by default (self-host = Enterprise tier) | +| Privacy | no third-party index in the query path (origin host still sees it) | cloud by default (local-processing claimed; SOC-2 Type II) | +| Cost | unmetered (you bear origin-host rate limits) | metered free tier (public only) + paid Pro / Enterprise | | Breadth | ~any public lib via generic discovery + adapters | large pre-indexed corpus | The Freshness row is measured, not asserted: the @@ -70,15 +72,24 @@ freshness). Both are **structural** claims, not measured metrics — so the hone is dated citation + concession, not a drift-guarded number: - **Vendor / privacy.** context7's default is a managed cloud service ("Built by Upstash"; a - dedicated hosted database per organization). It *offers* self-hosted / on-premise, claims - local query processing, and is SOC-2 Type II certified. LiveDocs has no vendor server at all - — nothing to deploy, trust, or breach. The edge is *structural absence*, not that context7 is - insecure; note that vendor-free operation on context7 is itself the paid self-host tier. -- **Cost** (dated capture, context7 pricing 2026-07-05): Free = 1,000 calls/mo, public repos - only; Pro = $10/seat/mo, with private-repo parsing billed at $25 / 1M tokens; Enterprise = - custom. LiveDocs is unmetered because it never calls a metered API — it reads your sources - locally, private repos included, at no cost. Figures rot; the durable claim is the *structure* - (metered SaaS vs unmetered local), so cite the structure and date any figure. context7's free + dedicated *private* database per organization). It *offers* self-hosted / on-premise (its + custom-priced Enterprise tier), is SOC-2 Type II certified, and claims queries are "processed + locally." Read that claim precisely: even client-side processing still sends the *index lookup* + to context7's hosted per-org database — that hosted index is exactly what LiveDocs structurally + lacks. LiveDocs has no service on the query path to breach. But be symmetric about the trust + surface — it doesn't disappear, it *moves*: to the local signed binary and its distribution + channel (a compromised release or signing key is its own, arguably larger, blast radius), and + the origin host + your network still see which library you fetched. So the honest claim is a + *different* trust surface, not a strictly smaller one — with no third-party doc index in it, + and no metered vendor. +- **Cost** (dated capture, context7 pricing 2026-07-05): Free = 1,000 included calls, public + repos only; Pro = $10/seat/mo, with private-repo parsing billed at $25 / 1M tokens; Enterprise + = custom. LiveDocs is unmetered because there is no metered API to call — but "unmetered" isn't + "costless": you bear the origin hosts' own rate limits and your bandwidth. And "private repos" + is a *different mechanism*, not a free superset — context7 parses+indexes a repo in its cloud, + whereas LiveDocs reads the copy already installed on your machine (it can't fetch a private repo + you haven't checked out). Figures rot; the durable claim is the *structure* (metered SaaS vs + unmetered local), so cite the structure and date any figure. context7's free tier is real, and its pre-indexed breadth is its home turf (conceded above). ## Honest reality: positioning ≠ winning From 0fc653fe6a1567c72bdf54be83e35b669d643243 Mon Sep 17 00:00:00 2001 From: che cheng Date: Sun, 5 Jul 2026 18:41:52 +0800 Subject: [PATCH 4/4] fix: align lead/wedge with sharpened privacy register per #52 verify R2 (#52) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit R2 found a HIGH consistency straggler: #2/table/bullets were sharpened to "origin host still sees it / different trust surface", but the WEDGE (the lead) still asserted flat "private" — a direct contradiction. Propagated the verified register to the lead: - wedge "it is private" → "no third-party doc index in the query path"; lead outcome "(latest, private, keyless)" → "(latest, keyless, no index in the middle)". - "context7 can't become local, private, keyless without giving up its model" → states the reconciliation: centralized SaaS by default; local+keyless = its Enterprise self-host tier (aligns with the self-host concession, drops the absolutist "can't"). - factual hedge: "client-side processing still sends the index lookup" → "a hosted SaaS with a per-org database must still route the index lookup" (architectural inference, not a claim of context7 internals). The anti-positioning "lost privacy" (line ~119) is left as-is — it refers to the third-party index a central cache would add, the one privacy LiveDocs retains. --- docs/positioning.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/docs/positioning.md b/docs/positioning.md index adc6b0c..2d81cf4 100644 --- a/docs/positioning.md +++ b/docs/positioning.md @@ -14,11 +14,12 @@ The pain: always-latest, straight from the source, with no periodically-recrawle sitting in between. Why that holds and is hard to copy: LiveDocs runs locally and goes direct to the source. -That is also why it is private and needs no API key. context7 is a centralized service; -it can't become local, private, and keyless without giving up its model. +That is also why there is no third-party doc index in the query path and no API key. +context7 is a centralized SaaS by default; matching that locally and keylessly means its +Enterprise self-host tier — i.e. leaving the default model. -Lead with the outcome (latest, private, keyless). "Decentralized" is the mechanism behind -that outcome, not the headline. +Lead with the outcome (latest, keyless, no index in the middle). "Decentralized" is the +mechanism behind that outcome, not the headline. ## The sharpest angle: "the docs your code actually runs on" @@ -74,8 +75,8 @@ is dated citation + concession, not a drift-guarded number: - **Vendor / privacy.** context7's default is a managed cloud service ("Built by Upstash"; a dedicated *private* database per organization). It *offers* self-hosted / on-premise (its custom-priced Enterprise tier), is SOC-2 Type II certified, and claims queries are "processed - locally." Read that claim precisely: even client-side processing still sends the *index lookup* - to context7's hosted per-org database — that hosted index is exactly what LiveDocs structurally + locally." Read that claim precisely: a hosted SaaS with a per-org database must still route the + *index lookup* to that hosted database — that hosted index is exactly what LiveDocs structurally lacks. LiveDocs has no service on the query path to breach. But be symmetric about the trust surface — it doesn't disappear, it *moves*: to the local signed binary and its distribution channel (a compromised release or signing key is its own, arguably larger, blast radius), and