Railgun 2026 Plan

Canonical master plan through December 31, 2026. This Markdown file is the source of truth. The public page at plan.railgun.chat renders from this file.

Changelog

• 2026-08-01 — Added the Railgun Streaming Plan (plan.railgun.chat/streaming-plan): full anonymous-streaming operating manual for Railgun Live, with a 24-month audience/revenue model. Linked from the plan header, the Railgun Live division, Section 14, the subdomain map, and the site footer.
• 2026-08-01 — Railgun Live positioning clarified: Asmongold-style variety streaming (react to anything, talk about whatever is actually interesting) that organically promotes Railgun products, rather than a scripted corporate show. plan.railgun.chat, plan.railgun.chat/progress, and updates.railgun.chat cross-linked to one another and added to the site footer. SQL migrations renamed to a simple numbered scheme (1_, 2_, …).
• 2026-07-31 — Initial plan created. Strategic pivot documented: revenue-first sequencing, open-source foundation stack, content flywheel, and the three-tier privacy boundary.
• 2026-07-31 — Trust fixes shipped: Google Analytics removed from the website; real Content-Security-Policy and HSTS headers deployed. plan.railgun.chat launched.

1. Executive summary

Plain English: Railgun is no longer trying to finish a perfect ultra-private Discord/Signal alternative in secret before anyone has heard of it. That product is still the long-term destination — but the immediate priority is money in the door. Railgun builds an audience with unscripted, Asmongold-style variety streaming — reacting to whatever tech, business, gaming, or culture news is genuinely interesting, no teleprompter, real opinions — sells its most mature and shippable technology first — private multilingual video meetings (Railgun Meet) — and turns every livestream into a content factory that feeds the audience machine. Product promotion is organic, not scripted: mentioned the way a streamer mentions their own setup, tied to whatever just happened on stream. Proven internal infrastructure then becomes a narrow developer catalog, and a creator control product is built around existing streaming tools before ever attempting to replace them. The ultra-private communications platform continues in parallel as the long-term trust moat, without being allowed to delay revenue and reach.

The flywheel:

Railgun Live earns attention. Railgun Meet and Railgun Creator convert attention into revenue. Railgun Developer monetizes reusable infrastructure. Railgun Private becomes the long-term privacy moat.

The core public phrase:

Broadcast loudly. Communicate privately.

The core operating principle: profitability first. Priorities 1, 2, and 3 are revenue.

2. What Railgun is becoming

One coherent media-and-software company with five product families:

Status labels used everywhere: Available · Private Beta · Building · Research · Deferred.

Railgun Live has its own deep operating manual. The full anonymous-streaming strategy — broadcast architecture, cast/roles, anti-doxxing system, monetization ladder, and a month-by-month 24-month audience and revenue model — lives in the Railgun Streaming Plan.

3. The content flywheel

Plain English: every Railgun livestream should automatically become a full week of content — clips, articles, posts — with a human approving before anything publishes. Railgun owns the master recording, transcript, clip metadata, publishing schedule, and analytics. Vendors perform jobs; they must not become Railgun's nervous system.

flowchart TD
    A["Railgun Studio / Meet"] --> B["LiveKit + SRS media core"]
    B --> C["YouTube · Twitch · Kick · Rumble"]
    B --> D["Encrypted master recording"]
    D --> E["OpusClip API"]
    E --> F["Human approval queue"]
    F --> G["Buffer + direct platform APIs"]

Text alternative: Railgun Studio and Meet feed a LiveKit + SRS media core. The core simulcasts to YouTube, Twitch, Kick, and Rumble, and writes an encrypted master recording that Railgun owns. The recording goes to the OpusClip API for clip generation, clips pass through a human approval queue, and approved clips are distributed through Buffer and direct platform APIs.

Every long stream produces: one full VOD, 5–10 horizontal clips, 3–8 vertical clips, one written article, one email/RSS entry, and one deliberate CTA.

4. Open-source foundation: the top 10 repositories

Plain English: Railgun does not rebuild years of solved engineering. It stands on mature open-source projects and spends its effort on the parts that are actually differentiating — privacy policy enforcement, creator workflow, unified metering, and the Railgun experience. "Use" can mean deploy unchanged, embed as a dependency, maintain an open fork, or study the architecture. These are never literally merged into one repository.

Architectural bench (study, hold, or adopt later):

• signalapp/libsignal — essential cryptographic reference; AGPL and explicitly unsupported for third-party use.
• Chocobozzz/PeerTube — future owned video archive and federated network.
• coturn/coturn — independent STUN/TURN infrastructure.
• plausible/analytics — privacy-respecting analytics.
• contentauth/c2pa-rs — cryptographically sign official Railgun footage and clips so provenance can be verified.

5. Essential API inventory

Launch-critical

The content flywheel APIs

Buffer caveat: Buffer's public docs expose account API keys but no clear third-party OAuth onboarding. Therefore: use Buffer for Railgun's own media operation immediately; obtain written partner/multi-tenant authorization before building it into a customer-facing Creator product; keep Postiz and direct connectors as the escape hatch.

Meeting intelligence

Model discipline: do not use a frontier model for ordinary meeting minutes — that is using a ceremonial sword to butter toast. Claude Haiku for routine extraction, Sonnet for important summaries; reserve the frontier tier for premium board-level reports or complex multi-document reasoning. Prompt caching substantially reduces repeated-context cost. Prompt caching + pricing

6. Meter everything

Railgun Meter records these usage events from day one:

webrtc.participant_minute · media.ingress_minute · media.egress_minute · media.transcode_minute · recording.gb_month · cdn.egress_gb · stt.audio_minute · translation.character · llm.input_token · llm.cached_input_token · llm.output_token · clip.source_minute · clip.render_minute · publish.attempt · publish.success

That is how Railgun Meet and Stream avoid becoming popular machines for converting money into warm data-center air. The ledger is append-only or correction-event based; Stripe receives billing events from the ledger and is never the only source of truth for raw usage.

7. The non-negotiable privacy boundary

Three content classifications, enforced in code:

LiveKit can keep media and data E2EE so its servers cannot read them, but Railgun must securely distribute room keys; signaling and API metadata remain visible to the server. LiveKit encryption docs

The blunt cryptographic truth:

Claude, OpusClip, or any other cloud service cannot analyze ciphertext.

If Claude writes a summary, Claude received readable transcript content during inference. Railgun can encrypt the resulting transcript and summary so Railgun employees can never read them — but the processing provider still saw plaintext temporarily. Truly provider-blind processing requires local inference or carefully designed confidential-compute infrastructure.

What this does not mean: enabling an E2EE switch does not make server-side transcription private. A transcription agent must receive plaintext audio (breaking content blindness), run locally on the device, or run in a remotely attested confidential-compute boundary to which clients deliberately release a key.

8. Railgun Meet product specification

Positioning:

Private multilingual meeting rooms that turn conversations into decisions, follow-ups, quotes, and sales — without making Railgun the owner of the conversation.

Initial target customers: jewelers and luxury retail, real-estate brokerages, international consultants, immigration and professional-services firms, export/import businesses, distributed sales teams, high-value remote consultations.

The wedge is not basic grid video. It is: browser guest join without an account; private-by-default rooms; per-participant translated captions; useful minutes, decisions, action items, and follow-up drafts; meeting-to-CRM and meeting-to-quote workflows; branded client rooms; explicit AI consent; honest retention and deletion; zero-access encrypted storage.

Feature layers:

• A — Meeting core: orgs and accounts, rooms and scheduling, signed expiring guest links, waiting room, roles, device preflight, screen share, chat/reactions, PiP, reconnection, moderation, keyboard accessibility, mobile browsers, clear consent indicators.
• B — Privacy: LiveKit E2EE where supported, client-generated room secrets, membership-change key rotation, encrypted artifact storage, retention policies, irreversible deletion, room/org AI controls, recorded consent events, no content in logs/traces/crash reports/analytics/support tools.
• C — Assisted intelligence: real-time captions, optional translation, speaker-attributed transcript, structured minutes, decisions and action items, unanswered questions, follow-up email draft, CRM note, quote handoff, export to Markdown/PDF/JSON/webhook.
• D — Revenue and operations: subscription plans, prepaid AI credits, usage dashboard, hard tenant spend caps, overage consent, metered invoices, customer portal, design-partner plans, abuse limits, support tooling that cannot decrypt customer artifacts.

9. Privacy modes and encrypted artifacts

Two honest production modes:

• Private Local — promise: meeting media, captions, transcripts, minutes, and summaries remain readable only on authorized participant devices. E2EE on; local whisper.cpp transcription; caption segments signed over the encrypted data channel; local or omitted summaries; client-side artifact encryption; no cloud recording or cloud AI. Tradeoffs: device CPU/battery, weaker on older devices, local models less accurate.
• Private Cloud Assist — promise: Railgun's normal servers, employees, DBAs, support tools, and observability cannot read meeting content; approved AI subprocessors may process content under explicit consent and disclosed retention. Confidential-compute worker verified by remote attestation; plaintext never written to database, object store, log, trace, swap, or crash report; output encrypted to the artifact key before leaving the trusted boundary; every subprocessor disclosed in the consent screen.

Language rules: "zero-access storage" is claimable when Railgun stores only ciphertext it cannot decrypt. "Railgun-operator-zero-access processing" is claimable only after attestation is implemented and independently tested. Never claim "only participants can ever read it" if any provider receives plaintext.

Encrypted artifact design (to be externally reviewed): per-artifact random data-encryption keys; XChaCha20-Poly1305 via a well-maintained library; keys wrapped to authorized devices or an opt-in workspace recovery key; the database stores only ciphertext, nonces, algorithm versions, wrapped keys, and minimal routing metadata; private keys in platform secure storage; no server-side plaintext search; explicit key-wrap for sharing; honest revocation and recovery semantics; algorithm versioning and migration plan. Do not invent cryptography.

10. Pricing and unit economics

Never offer unlimited AI.

Starting overage reference points (subject to validation): participant minute $0.002 · cloud transcription minute $0.02 · translated-caption source minute per language $0.01 · AI summary ~$0.10–$0.25 · confidential compute surcharged separately · storage/recording metered after allowance.

Targets: ≥80% subscription gross margin; ≥70% blended margin; tenant hard caps; real-time cost ledger; provider shadow cost; alerts at 50/75/90/100%; automatic stop or prepaid top-up at cap; no postpaid overage without explicit consent and a valid payment method.

Core formulas:

participant_minutes = participants × duration_minutes
livekit_minute_overage = max(0, monthly_participant_minutes − included_minutes) × rate_per_minute
downstream_GB = participants × duration_seconds × avg_received_bitrate_bps ÷ 8 ÷ 1024³
stt_cost_mixed = duration_minutes × stt_rate_per_minute
stt_cost_isolated = Σ(track_connected_minutes × stt_rate_per_minute)
llm_cost = input_tokens/1e6 × input_rate + output_tokens/1e6 × output_rate
gross_margin = (recognized_revenue − variable_COGS) ÷ recognized_revenue

Worked planning example — 4 people, 60 minutes: 240 participant-minutes; WebRTC overage after quota ≈ $0.12; mixed-audio STT at $0.0058/min ≈ $0.348 (four isolated tracks ≈ $1.392); a 10k-in/1k-out summary ≈ $0.015 (Haiku) / $0.045 (Sonnet) / $0.15 (frontier tier); one hour transcode overage $1.20; 2 GB encrypted R2 recording ≈ $0.03/mo. Planning range for cloud transcription + summary before translation, recording, support, payment fees, and confidential compute: ≈ $0.45–$2.25 per meeting. All prices dated 2026-07-31 and re-verified before publication.

11. The final stack recommendation

• LiveKit for meetings and guest rooms
• OBS immediately; public Railgun Studio fork later
• SRS + Restreamer for the streaming relay
• FFmpeg for all media processing
• R2 for Railgun-owned masters and derived assets
• OpusClip for clip creation
• Buffer for initial post-stream distribution
• whisper.cpp for Private Mode
• Deepgram, DeepL, Claude for Assisted Mode
• Owncast for live.railgun.chat
• Postiz as self-hosted fallback and connector reference
• Direct YouTube and Twitch APIs first; Kick and Rumble via RTMP initially

This combination saves years of undifferentiated engineering while keeping the valuable pieces — privacy policy enforcement, creator workflow, intelligent automation, unified metering, and the Railgun experience — entirely Railgun's.

12. Public subdomain map

No pay.railgun.chat in 2026 — billing lives at account.railgun.chat/billing. Public storytelling subdomains stay in this repository and one Vercel project via hostname-aware routing; separate Vercel projects only where the security boundary differs. Media workloads (SFU, transcription sessions, transcoding, relays, confidential compute, durable workers) never run on Vercel.

13. Execution timeline: August–December 2026

14. Streaming schedule through December 2026

Canonical timezone: America/Sao_Paulo (BRT); the website renders viewer-local time.

Full detail: this section is a summary. The complete streaming operating manual — cast personas, broadcast/OBS architecture, anti-doxxing system, platform monetization thresholds, content engine, and the 24-month audience and revenue model — is the Railgun Streaming Plan.

Positioning: Asmongold-style variety streaming, not a corporate webinar. Railgun Live is unscripted — reacting to whatever tech, business, gaming, or culture news is actually interesting that day, riffing, going on tangents, having fun — with product promotion woven in organically rather than bolted on. The audience shows up for the personality and the takes; Railgun Meet, Railgun Private, and the Build Log get mentioned the way a streamer mentions their own setup or sponsor, not as an ad break. That means: no teleprompter, no marketing script, real reactions to real things, and genuine opinions — while every plug for a Railgun product is honest, specific, and tied to something that just happened on stream (e.g. "we're recording this in Railgun Meet right now" beats a generic pitch). This is deliberate: attention compounds fastest when the personality is real, and trust in the personality transfers to trust in the products.

Editorial pillars: 40% tech/culture/business/news reactions · 25% building Railgun in public · 15% terrible-software teardowns · 10% privacy, censorship resistance, digital ownership · 10% founder/talent/customer/investor episodes.

Brand separation: candid founder entertainment is "Rosser Live, powered by Railgun." Formal encryption, retention, availability, pricing, and security claims come only from reviewed Railgun pages — never asserted off-the-cuff mid-stream.

Co-host rules: max one required weeknight per employed co-host; any show proceeds with Rosser plus one; a pre-recorded emergency episode exists; no workday clip/chat monitoring duty. Distribution: YouTube (archive), Kick, Rumble, Twitch (only while simulcast-compliant), X/Shorts/Reels/TikTok clips, and live.railgun.chat as the owned home.

15. Railgun Developer catalog

Four initial products only — no catalog of half-extracted internal tools:

1. Railgun Meet SDK — rooms, guest links, tokens, consent, captions, summaries, webhooks, usage.
2. Railgun Guard — AI-agent tool policies, hard-denied actions, human approvals, spending gates, audit logs, rate limits.
3. Railgun Meter — tenant usage, provider rate cards, quotas, prepaid credits, overage, kill switches, auditable billing ledgers.
4. Railgun Translate — captions, meeting artifacts, catalogs, app localization, caching and cost controls.

Platform requirements: prefixed hashed API keys, scopes, rotation, test/live modes, versioned APIs, idempotency keys, signed webhooks with replay, OpenAPI source of truth, generated TypeScript SDK, stable error taxonomy, rate limits, cost dashboard, sandbox, changelog, deprecation policy, example apps, security contact. No public SDK without versioning and deprecation policy.

16. Railgun Creator: the OBS-to-Studio path

• Stage 1 — Railgun Control: a better control layer around OBS/libobs — setup wizard, scene templates, Meet guest links, one-click multistreaming, stream-key management, health monitoring, unified chat, local recording, emergency backup, remote phone controller, local-first config. Dogfooded on Railgun broadcasts before it is sold.
• Stage 2 — Browser studio: only after Stage 1 usage — capture, remote guests, layouts, overlays, media playback, multistream, recordings, isolated tracks, clip markers, privacy-aware captions.
• Stage 3 — Native Railgun Studio: authorized only when one gate is met — 100 paying creators, or $10,000 creator MRR, or 1,000 retained weekly actives, or a strategic customer funds it.

GPL discipline: OBS is GPLv2. Any client linking to or derived from OBS/libobs gets license counsel and a compatible open license; proprietary hosted multistreaming, teams, storage, AI clipping, scheduling, and network operations stay in a private creator-cloud repository.

17. Risk register

18. Non-negotiable gates

• No "E2EE transcript" claim if plaintext transcription occurs on ordinary servers.
• No "Railgun cannot read it" claim until key handling and the processing path prove it.
• No cloud AI without participant disclosure and consent.
• No unlimited AI plan.
• No production billing without reconciliation and spend caps.
• No public SDK without versioning and deprecation policy.
• No native OBS replacement before the creator gate.
• No investor page before IP ownership, trademark risk, and metrics are presentable.
• No mail privacy launch while server-readable plaintext paths remain.
• No security-sensitive release from unsigned, unreviewed builds.
• No empty repository explosion.

19. Metrics and 2026 definition of success

Proposed until approved: ≥16 consistent schedule weeks · ≥40 long-form broadcasts · ≥200 useful clips · owned email/RSS audience established · 10 Meet design partners · ≥5 paying Meet customers by November · $2.5k–$10k Meet MRR by year-end (target range, not a promise) · ≥70% blended gross margin · no unlimited AI plans · ≥99.9% measured availability after beta stabilization · documented deletion and recovery drills · external security review commissioned · one stable public SDK · Railgun Control used internally · no native Studio commitment without its gate.

20. Deferred to 2027

Native Railgun Studio (unless its gate passes earlier) · encrypted mail relaunch (threat model must be repaired and audited first) · public expansion of the ultra-private communications platform · invest.railgun.chat (unless December gates pass) · native calendar/CRM integrations beyond signed webhooks · PeerTube-backed owned video network.

21. Immediate next 10 business days

1. Finish the cross-repository inventory and IP-provenance register for anything extracted from prior internal work.
2. Remove Google Analytics from the website layout — Done 2026-07-31. Superseded 2026-09-06: GA4 was reinstated by an explicit owner decision, scoped to the public marketing pages and gated on consent. It never loads on a signed-in surface, the admin console, or any credential or token-scoped URL (src/lib/analytics/scope.ts, pinned by scope.test.ts, which walks the route tree and fails if a new internal page would be measured). Google Signals and ad personalisation are off. The privacy policy gained a Cookies and Website Analytics section, and the product pages that promise "no telemetry" now say explicitly that this is a claim about the products, which remains true — the apps and the extension still contain no analytics of any kind.
3. Implement a real Content-Security-Policy and align all security headers — Done 2026-07-31. CSP + HSTS deployed; no external script origins permitted.
4. Verify vendor pricing (LiveKit, Anthropic, Deepgram, DeepL, Supabase, Vercel, R2, Stripe, OpusClip, Buffer) with dates; build the typed price-config module.
5. Launch plan.railgun.chat (this page) with hostname routing and canonical metadata.
6. Add a test runner and calculator formula tests.
7. Stand up uptime monitoring and status.railgun.chat.
8. Resolve the public-repository license contradiction.
9. Set the August streaming calendar, book rehearsal streams, launch the Meet design-partner waitlist.
10. Plan the migration of authenticated app surfaces out of the marketing security boundary.

22. Appendix: terminology and price sources

Terminology: E2EE — end-to-end encryption: content readable only by participant devices; signaling and metadata still processed. Zero-access storage — Railgun stores only ciphertext it cannot decrypt. Confidential compute — processing inside a remotely attested trusted execution environment. SFU — selective forwarding unit routing media between participants. BRT — Brasília Time (America/Sao_Paulo).

Price sources (verify and date before each publication): LiveKit pricing · Cloudflare R2 pricing (storage $0.015/GB-mo, free internet egress, Class A/B ops billed separately) · Anthropic pricing / prompt caching · Deepgram, DeepL, Supabase, Vercel, Stripe, OpusClip, Buffer — pending verification.

Every estimate on this page is an estimate. Volatile prices are dated. Facts verified in source code are distinguished from proposals. Nothing here should be read as a promise of availability, uptime, or security properties that have not shipped and been reviewed.