Building Scout

Cycle time and pickup time now start when a merge request is marked ready for review, not when the draft was first opened — so teams that open drafts early (to preview the diff against target or to park work-in-progress) no longer see inflated review times. Draft MRs are also consistently excluded from WIP / open-MR counts across the dashboard, team list, delivery, personal actions and CSV exports. The real ready-for-review moment is captured from the GitHub timeline / GitLab system notes, and existing history was backfilled so past metrics are corrected too.

CSV data export for the Pro plan (issue #7) — download team and project metrics for spreadsheets and BI tools. Export respects every visibility rule: masked authors stay masked, hidden data stays hidden, and the project endpoint is admin-gated to match the UI. Security hardening on the export path: CSV injection protection, hidden-author leak fixes, and metric-drift correction so exported numbers match what's on screen. Covered by new E2E tests for both the PRO export flow and the FREE-plan paywall.

Finer-grained control over which repos feed aggregate metrics. New per-project flag excludedFromStats, independent from active — excluded repos keep syncing and stay accessible from their detail page, but drop out of the dashboard, team, actions, delivery, drill-down, and AI Impact aggregations. Useful for sandbox repos, legacy/archived projects, or boilerplate repos whose activity would skew throughput and lead time. Toggle exposed on the admin Projects page with a clear "Excluded from stats" badge. 5 new integration tests covering default value, the dashboard-style query, flag flipping, downstream commit filtering, and admin-page visibility.

Every metric is now clickable — drill down to see the raw Git data behind it (issue #38): the exact commits, MRs, and reviews that feed each number, so the figures are auditable rather than opaque. Sync reliability hardened in the same pass: commits are now ingested from all branches (not just the default one), deduplicated by SHA to prevent unique-constraint violations, and merge commits are filtered by parent count to avoid false ownership attribution.

Full AI adoption tracking — admins declare tool rollouts with method/workflow context, Scout compares Git metrics before and after. New AI Impact page with 5 KPIs (throughput, cycle time, MR size, pickup time, review comments), colored deltas, data quality warnings, and pedagogy section. Contributors can self-declare their AI tools in Account. Dashboard card shows active rollouts. Key design decision: track the method (CLAUDE.md, TDD with AI), not just the tool — same tool with different workflows produces very different results. 18 unit tests + 7 E2E tests.

Data consistency audit on commit/MR attribution for fair scoring. Fixed reviewer assignments lost during author merge (MergeRequestReviewer cascade delete). Reviews now count both comments and reviewer assignments (deduplicated by MR) — approvals without comments get proper collaboration credit. Draft MRs excluded from team page metrics. Account page redesigned: workspace list with role badges, human-readable session info (browser + OS parsing), reordered sections. Fixed invite form stuck open on error (try/finally). Resolved production 502s caused by nginx proxy buffer overflow on large SSR headers.

Full multi-workspace routing — all app routes under /{slug}/. Two-level layout: parent handles auth, [slug] layout resolves workspace + membership. Workspace switcher in sidebar (conditional: only visible with 2+ workspaces). Cookie-based redirect to last visited workspace. Security audit found and fixed critical workspace scoping bugs in all form actions. Onboarding lobby for new users (create vs invited). Editable slug with auto-suffix on collision. Workspace creation limit (1 per user) with discrete link in Account. 85 E2E + 270 unit tests, zero failures.

Append-only audit log with centralized logAudit() helper — 15 critical actions instrumented (auth, roles, settings, integrations, data operations). Admin UI at /audit-log with cursor pagination and filters by actor/action. Ticket prefix allowlist in Settings — admin selects real project prefixes, false positives (GPL-3, UTF-8) hidden from Delivery. User last seen tracking with throttled updates. 265 unit tests.

Enforce team profile access control — SELF/GROUP/ALL visibility checks on individual pages. Redirect SELF users from dashboard to actions. Uniform page widths (max-w-4xl standard, max-w-5xl for data-heavy pages). Fix all 31 svelte-check warnings. Update nodemailer for security patch. Docker Hub credentials in CI. 23k+ lines of code, zero warnings.

Parse ticket keys (Jira/Linear) from branch names, commits, and MR titles via regex. New Delivery page with ticket list, Git activity per ticket, WIP/delivered status. Dashboard KPIs: features delivered, features in progress, average lead time. Draft MRs excluded from all metrics. Shared Avatar component with pastel fallback colors. Collapsible settings cards. Rename to Scout, new domain tryscout.tech.

Invite non-contributor users (CEO, PM) by email with role. Welcome flow — 2-step onboarding customized by role. Role-based landing page (CEO → dashboard, Dev → actions). Design system: dark sidebar, Epilogue font, indigo primary, branded color palette. Login redesign with glassmorphism. Separate E2E test database. Hydration fix for Playwright. 69 E2E tests, 68 integration, 247 unit.

KPI cards rework — hero/secondary tiers aligned with DORA and SPACE frameworks. Release notes drawer. Zero-downtime deploy with PM2 cluster mode and atomic build swap. Metrics research. E2E test fixes.

Role-based access control — 7 roles (Admin, CEO, CTO, Tech Lead, Lead Dev, Dev, Member). Users management page. Configurable visibility per role (SELF / GROUP / ALL). Sidebar adapts dynamically: My Stats, My Squad, or Team.

Lemon Squeezy integration for self-serve PRO upgrade. In-app feedback widget with email notifications. Show/hide score setting per workspace.

GitHub provider support alongside GitLab. FREE plan paywall — 5 contributors, 3 months history. Activity score algorithm with 5 dimensions and radar chart.

Landing page design. Auth UI redesign with shared AuthPanel component. "Copy for AI" button on every metrics card. Contributor groups filter for team views.

Unit tests with coverage, E2E Playwright tests. ESLint, Prettier, Husky pre-commit hooks. GitHub Actions CI pipeline with PostgreSQL service. Database indexes. Forge deployment config. First documented PR.

SvelteKit app, Prisma schema, magic link auth, GitLab provider, sync worker. Dashboard, Team, Projects, Actions pages. Auto-sync scheduler, settings tabs, rate limiting, AES-256 token encryption. The entire architecture in a single day.