{"loaderData":{"0":null,"0-17":{"locale":"en","home":{"slug":"index","locale":"en","title":"Skrum documentation","description":"Guides for every Skrum surface: getting started, projects and sprints, chat, meetings, code activity, AI, billing, security, and the developer APIs.","section":"start","order":0},"docs":[{"slug":"getting-started","locale":"en","title":"Getting started","description":"Four steps: create your workspace, invite the team, connect your code, and let AI digest the work.","section":"start","order":1},{"slug":"troubleshooting","locale":"en","title":"Troubleshooting","description":"What to check first when a page, webhook, meeting, or AI action does not behave as expected.","section":"start","order":2},{"slug":"projects-tasks","locale":"en","title":"Projects and tasks","description":"Create a project, use its key to reference tasks, add a task from a single form, and see live activity.","section":"features","order":0},{"slug":"kanban-sprints","locale":"en","title":"Kanban boards and sprints","description":"Drag tasks between columns, keep WIP limits honest, and run sprints without a separate planning tool.","section":"features","order":1},{"slug":"chat","locale":"en","title":"Chat","description":"Channels, DMs, threads, mentions, and read cursors. Realtime is best-effort; the REST cursor is the source of truth.","section":"features","order":2},{"slug":"meetings","locale":"en","title":"Meetings","description":"Native video meetings with consent, recording, transcript, and an AI summary that files action items in the AI Inbox.","section":"features","order":3},{"slug":"code-activity","locale":"en","title":"Code activity","description":"Signed webhooks from GitHub, GitLab, and Gitea. Skrum never calls a git host — it only receives.","section":"features","order":4},{"slug":"ai-features","locale":"en","title":"AI features","description":"BYOK providers, standup and sprint-risk digests, meeting summaries, and the AI Inbox where every action waits for a human yes.","section":"features","order":5},{"slug":"importing-your-data","locale":"en","title":"Importing your data","description":"Wizard-driven import from CSV, Jira, Trello, ClickUp, Asana, and Linear — preview first, commit second.","section":"features","order":6},{"slug":"attachments-and-search","locale":"en","title":"Attachments and search","description":"Upload files up to the configured ceiling, and use Cmd-K search across messages, tasks, projects, channels, and people.","section":"features","order":7},{"slug":"team","locale":"en","title":"Team","description":"Invite teammates, manage seats, remove members. Invites are single-use and expire.","section":"account","order":0},{"slug":"roles-permissions","locale":"en","title":"Roles and permissions","description":"One rule to remember: your workspace role is the ceiling; membership decides what private things you can see; project roles add powers only inside that project.","section":"account","order":1},{"slug":"plans-limits-credits","locale":"en","title":"Plans, limits, and credits","description":"Every plan cap — projects, storage, guest seats, AI actions, transcription and recording minutes — and how credit packs top up.","section":"account","order":2},{"slug":"settings-security","locale":"en","title":"Settings and security","description":"Manage your profile, password, two-factor authentication, sessions, and API keys.","section":"account","order":3},{"slug":"notification-preferences","locale":"en","title":"Notification preferences","description":"Choose which non-essential emails Skrum sends and where in-app notifications go.","section":"account","order":4},{"slug":"sso-scim-setup","locale":"en","title":"SSO and SCIM setup","description":"Single sign-on (SAML / OIDC) and automated provisioning (SCIM 2.0) for the enterprise tier.","section":"account","order":5},{"slug":"security-and-compliance","locale":"en","title":"Security and compliance","description":"What Skrum implements, plus the DPA, data residency, audit trail, and ownership transfer flow.","section":"account","order":6},{"slug":"public-api","locale":"en","title":"Public API","description":"REST endpoints for projects, tasks, sprints, and activity — bearer API key auth.","section":"developers","order":0},{"slug":"mcp","locale":"en","title":"Skrum MCP","description":"Connect Claude, Cursor, VS Code, or any MCP client to your Skrum workspace with a bearer API key.","section":"developers","order":1},{"slug":"outbound-webhooks","locale":"en","title":"Outbound webhooks","description":"Subscribe an HTTP endpoint (or a Slack / Teams URL) to task, sprint, meeting, code, and mention events.","section":"developers","order":2},{"slug":"backup-and-restore","locale":"en","title":"Backup and restore","description":"Nightly retention sweep, backup scripts under `scripts/backup/`, and a documented restore path for Mongo, Postgres, and MinIO.","section":"operations","order":1},{"slug":"reporting","locale":"en","title":"Reporting","description":"On-demand PDF/CSV exports and scheduled email delivery over the leadership insights DTOs.","section":"operations","order":2},{"slug":"performance-and-scaling","locale":"en","title":"Performance and scaling","description":"How Skrum holds up under load: p95 targets on hot paths, workspace-scoped read-through caching, and the chaos behavior when a dependency falls over.","section":"operations","order":3}]},"0-17-0":{"locale":"en","docs":[{"slug":"getting-started","locale":"en","title":"Getting started","description":"Four steps: create your workspace, invite the team, connect your code, and let AI digest the work.","section":"start","order":1,"searchText":"# Getting started\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nSkrum takes about ten minutes to set up. This is the fastest path.\n\n1. **Create your workspace.** Sign up with email or Google, verify the address, and you land in your workspace with a \"Sample project\" seeded so you can click around.\n2. **Invite the team.** Go to Team settings, add up to your plan seat count by email. Invites are single-use links that expire.\n3. **Connect your code.** In Project settings → Code, create a webhook endpoint. Skrum shows a URL and a signing secret — paste both into GitHub, GitLab, or Gitea. See the [Code activity guide](./code-activity.en.md).\n4. **Try the AI features.** In Settings → AI, paste an API key from a supported provider. Digests start on the next sweep; AI proposals wait in the [AI Inbox](./ai-features.en.md) for your approval.\n\n## FAQ\n- **Do I have to connect code?** No. Everything else works without a git provider.\n- **Can I skip the sample project?** Yes — delete it from Projects. Re-seed anytime from Home → onboarding.\n- **Which login provider is default?** Email + password. Google OAuth appears only when the operator has set the client credentials.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"troubleshooting","locale":"en","title":"Troubleshooting","description":"What to check first when a page, webhook, meeting, or AI action does not behave as expected.","section":"start","order":2,"searchText":"# Troubleshooting\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nMost issues fall into one of five buckets. Work through the checks in order.\n\n1. **Signed out silently.** Sessions expire after a period of inactivity or if you sign in from another device. Sign back in.\n2. **Plan cap reached.** The billing page shows every cap. Metered actions (AI, transcription, recording) refill monthly; standing caps (projects, storage, seats) require a plan change or credit pack.\n3. **Webhook signature mismatch.** In [Code activity](./code-activity.en.md), the endpoint shows recent deliveries with the failure reason. Wrong secret is the most common cause — recreate the endpoint to rotate.\n4. **Meeting join blocked.** Consent is required before every recorded meeting starts. Everyone in the room must acknowledge the recording banner. See [Meetings](./meetings.en.md).\n5. **AI key invalid.** In Settings → AI, the provider status turns red if validate-on-save fails. Rotate the key.\n\nStill stuck? Contact support from the app menu — the message carries your workspace id so we can look up your account.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"projects-tasks","locale":"en","title":"Projects and tasks","description":"Create a project, use its key to reference tasks, add a task from a single form, and see live activity.","section":"features","order":0,"searchText":"# Projects and tasks\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nA project is the container everything else scopes to. Every project has a short **key** (e.g. `WEB`, `MOBILE`, `OPS`) and tasks are numbered `KEY-N` — the reference is stable, sharable, and links across chat, code, and AI.\n\n1. **Create a project.** Projects page → New project. Pick a name and a two-to-six letter key. That is all you need — the project appears with a default board.\n2. **Add a task.** From any board column, press \"+\" and type the title. Enter submits. Details (assignee, labels, due date) inline-edit on the row.\n3. **Reference tasks.** Type `KEY-123` in chat, in a git commit, or in an AI meeting summary — Skrum links it automatically. See [Kanban and sprints](./kanban-sprints.en.md) for board mechanics.\n\n## FAQ\n- **Can I rename a key?** No — task references would break. Archive and recreate if you must change it.\n- **Is there a per-workspace task ceiling?** No. The cap is on projects (see [Plans, limits, and credits](./plans-limits-credits.en.md)).\n- **Where do I edit permissions?** In [Roles and permissions](./roles-permissions.en.md).\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"kanban-sprints","locale":"en","title":"Kanban boards and sprints","description":"Drag tasks between columns, keep WIP limits honest, and run sprints without a separate planning tool.","section":"features","order":1,"searchText":"# Kanban boards and sprints\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nEvery project ships with a Kanban board. Sprints are a lightweight overlay — turn them on when you want a time-boxed batch, off otherwise.\n\n1. **Board.** Columns are configured in Project settings → Board. Drag a task to reorder or move between columns; the underlying rank is lexorank so moves stay conflict-free across users.\n2. **WIP limits.** Set a soft limit per column. Skrum warns above the limit but never blocks — the limit is a coaching signal, not a lock.\n3. **Sprints.** In the Sprints tab: create a sprint, add tasks from the backlog, start it, and Skrum tracks a burndown. Close the sprint when done — unfinished tasks return to the backlog by default.\n\n## FAQ\n- **Multiple boards per project?** No — one board per project.\n- **Story points?** Optional per-task field; roll up in the sprint burndown.\n- **Do sprints require the Pro plan?** No — every plan gets sprints.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"chat","locale":"en","title":"Chat","description":"Channels, DMs, threads, mentions, and read cursors. Realtime is best-effort; the REST cursor is the source of truth.","section":"features","order":2,"searchText":"# Chat\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nChat has channels (workspace scope), DMs (person-to-person), and group DMs. Every message can start a thread. Mentions notify the mentioned user through their [notification preferences](./notification-preferences.en.md).\n\n1. **Post.** Type in the composer, Enter sends, Shift+Enter for a newline. Rich text and mentions autocomplete.\n2. **Threads.** Hover a message and press the thread icon. A thread is a side conversation attached to the original message.\n3. **Read cursors.** The unread indicator advances when you scroll to the last message. Sockets deliver in real time; if you reconnect, Skrum re-fetches from the cursor over REST — the socket never replays.\n\n## FAQ\n- **Do messages get deleted after a while?** Free and Starter workspaces keep 90 days of history; older messages are archived (see [Backup and restore](./backup-and-restore.en.md)).\n- **Can I invite non-members to a channel?** Only workspace members. Guests can join public channels but not DM.\n- **File uploads?** See [Attachments and search](./attachments-and-search.en.md).\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"meetings","locale":"en","title":"Meetings","description":"Native video meetings with consent, recording, transcript, and an AI summary that files action items in the AI Inbox.","section":"features","order":3,"searchText":"# Meetings\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nMeetings run on Skrum's own LiveKit stack (no third-party media service). Every meeting has a lobby, an in-call screen, and — when recording is on — a red-dot consent banner every participant must acknowledge.\n\n1. **Schedule.** From any project, Meetings → Schedule. Set title, time, invitees, and whether to record.\n2. **Join.** Click the meeting link. The lobby asks for camera and microphone; if recording is on, you must consent before joining.\n3. **After the meeting.** Skrum transcribes the recording, generates a summary and action items, then files each action item as an [AI Inbox proposal](./ai-features.en.md) for a human yes.\n\n## FAQ\n- **Where do recordings live?** In the service's object storage, attached to the meeting record.\n- **Can I opt out of recording?** Yes — leave the room. Meetings without recording never trigger the consent banner.\n- **Which plans get recording?** Starter and above (see [Plans, limits, and credits](./plans-limits-credits.en.md)).\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"code-activity","locale":"en","title":"Code activity","description":"Signed webhooks from GitHub, GitLab, and Gitea. Skrum never calls a git host — it only receives.","section":"features","order":4,"searchText":"# Code activity\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nCode activity is inbound only. Skrum has zero outbound calls to any git host. You configure a webhook on the git side; Skrum verifies the signature and files each push, pull request, and review into the work graph.\n\n1. **Create the endpoint.** In Project settings → Code, pick a provider (GitHub, GitLab, or Gitea) and click Create endpoint. Skrum shows a **payload URL** `https:///api/hooks/git/` and a **signing secret** — shown once. Copy both.\n2. **Configure the git side.**\n - **GitHub:** Repo Settings → Webhooks → Add. Payload URL as shown, content type `application/json`, Secret = the signing secret. Skrum verifies `X-Hub-Signature-256`.\n - **GitLab:** Repo Settings → Webhooks. URL as shown, Secret token = the signing secret. Skrum verifies `X-Gitlab-Token`.\n - **Gitea:** Repo Settings → Webhooks → Gitea. URL, Secret = the signing secret. Skrum verifies `X-Gitea-Signature`.\n3. **Task refs.** Include `KEY-123` in a commit message, PR title, or review body — Skrum links the activity to that task.\n\n## FAQ\n- **Rotating the secret?** Delete the endpoint and create a new one — that is the only rotation path.\n- **What happens on signature mismatch?** 401, logged with the failure reason in the endpoint's recent-deliveries panel.\n- **Replay protection?** Yes — every delivery is deduped per `(endpoint, delivery-id)`.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"ai-features","locale":"en","title":"AI features","description":"BYOK providers, standup and sprint-risk digests, meeting summaries, and the AI Inbox where every action waits for a human yes.","section":"features","order":5,"searchText":"# AI features\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nSkrum's AI is bring-your-own-key (BYOK). Set a key per provider in Settings → AI; the key is encrypted at rest with AES-256-GCM and validated on save. AI never runs without a key.\n\n1. **Configure a provider.** Settings → AI → paste your key (OpenAI, Anthropic, Google, DeepSeek, Kimi, or Zhipu GLM). Skrum tests it against the provider before saving.\n2. **Digest schedule.** The standup digest runs daily on the sweep. The sprint-risk feed updates when project or sprint state changes.\n3. **AI Inbox.** Every AI proposal — create a task, assign a task, add an action item, update a due date, post a digest — appears in the [AI Inbox](./ai-features.en.md#ai-inbox). Approve or dismiss. Nothing runs on your behalf without your click.\n\n## Metering\n- **BYOK runs** never consume workspace `ai_actions` — you pay your provider directly.\n- **Operator-key runs** (a managed hosted tier) consume `ai_actions` from your monthly cap.\n- **Transcription** consumes `transcription_minutes` regardless of provider.\n\n## FAQ\n- **Can I mix providers?** Yes — set keys for several and configure the fallback order.\n- **Where does the digest post?** As a message in the project channel or the workspace-wide summary channel.\n- **Which plan gets digests?** Starter and above; sprint risk is Pro and above.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"importing-your-data","locale":"en","title":"Importing your data","description":"Wizard-driven import from CSV, Jira, Trello, ClickUp, Asana, and Linear — preview first, commit second.","section":"features","order":6,"searchText":"# Importing your data\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nThe import wizard is a two-step preview-and-commit flow. Nothing lands in your workspace until you approve the mapping.\n\n1. **Choose the source.** Settings → Import → New import. Pick CSV, Jira, Trello, ClickUp, Asana, or Linear and upload the export file.\n2. **Preview.** Skrum parses the file and shows the mapped project, columns, and task counts. Fix mappings inline before committing.\n3. **Commit.** Approve — Skrum creates the project (subject to the `projects` cap) and imports tasks in order. The commit is idempotent by import id, so a retry never doubles anything.\n\n## FAQ\n- **Are assignees remapped?** Only if the source email matches a Skrum member email. Everyone else lands as unassigned.\n- **What if the projects cap is reached?** The import fails with a clear cap message — no partial writes.\n- **Can I re-import the same file?** Yes — the same import id is a no-op.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"attachments-and-search","locale":"en","title":"Attachments and search","description":"Upload files up to the configured ceiling, and use Cmd-K search across messages, tasks, projects, channels, and people.","section":"features","order":7,"searchText":"# Attachments and search\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nAttachments and search share one guarantee: everything is workspace-scoped. Cross-account results are impossible by construction — a foreign result would be a 404 by design.\n\n## Attachments\n1. **Upload.** Drag a file into any chat message or task. Skrum presigns a direct upload to storage, then confirms the upload after a magic-byte MIME sniff.\n2. **Ceilings.** Per-file size and MIME allowlist are set by the platform. Defaults: 25 MB per file; images, PDF, plain text, CSV, JSON, ZIP, docx, xlsx.\n3. **Scan.** A configurable AV scan runs before the file becomes reachable. EICAR-marked test files are rejected.\n\n## Search\n1. **Cmd-K palette.** Anywhere in the app, press Cmd-K (Ctrl-K on Linux/Windows). Start typing.\n2. **What it covers.** Messages, tasks, projects, channels, people. Every result is filtered by your membership at query time.\n3. **Rate-limited.** The palette debounces client-side so a normal keystroke burst never trips the search rate bucket.\n\n## FAQ\n- **Are files virus-scanned?** Yes when the operator has enabled the AV provider. Skrum ships a deterministic fake scanner for development.\n- **Do search results honor RBAC?** Yes — private channels and invisible projects never surface.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"team","locale":"en","title":"Team","description":"Invite teammates, manage seats, remove members. Invites are single-use and expire.","section":"account","order":0,"searchText":"# Team\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nTeam settings is where seats live. The number of seats you can fill follows your plan (see [Plans, limits, and credits](./plans-limits-credits.en.md)).\n\n1. **Invite.** Team settings → Invite. Enter one or many email addresses. Skrum sends a single-use link that expires.\n2. **Roles.** Every invitee lands with the default role. Change it after they join (see [Roles and permissions](./roles-permissions.en.md)).\n3. **Remove.** Team settings → the row → Remove. The seat is freed immediately.\n\n## FAQ\n- **Can I re-invite the same email?** Yes — the previous invite is invalidated automatically.\n- **What are guest seats?** Members whose workspace role resolves to Guest — reduced access, still a seat.\n- **Do owners count as seats?** Yes.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"roles-permissions","locale":"en","title":"Roles and permissions","description":"One rule to remember: your workspace role is the ceiling; membership decides what private things you can see; project roles add powers only inside that project.","section":"account","order":1,"searchText":"# Roles and permissions\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nSkrum ships four built-in workspace roles — Owner, Admin, Member, Guest — and permits custom roles on the Pro plan and above. Permissions are `resource.verb` strings evaluated at every route.\n\n1. **Workspace role.** Sets the ceiling. An Admin can never be denied a permission a Member has.\n2. **Membership.** Private channels, private projects, and DMs need explicit membership. A Member who is not in a private project simply does not see it — a request would be a 404.\n3. **Project role.** Adds powers inside a project: `task.create`, `project.settings.manage`, `sprint.close`. Never lets a Guest do something the Guest workspace role denies.\n\n## FAQ\n- **Guest boundaries?** Guests never see billing, admin, or workspace settings. They see only projects they are added to.\n- **Custom roles on Free?** No — Pro plan and above.\n- **Can I make a role that bypasses the workspace ceiling?** No.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"plans-limits-credits","locale":"en","title":"Plans, limits, and credits","description":"Every plan cap — projects, storage, guest seats, AI actions, transcription and recording minutes — and how credit packs top up.","section":"account","order":2,"searchText":"# Plans, limits, and credits\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nEvery plan grants standing caps (projects, file storage, guest seats) and monthly allowances (AI actions, transcription minutes, recording minutes). Credit packs top up AI actions and transcription minutes without changing plan.\n\nBelow are the exact tier numbers. Yearly billing saves twenty percent.\n\n\n| Plan | Monthly | Yearly | Projects | Storage (MB) | AI actions | Transcription minutes | Recording minutes | Guest seats | Seats |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n| Starter | $49 | $470.40 | 10 | 10240 | 100 | 300 | 600 | 0 | 10 |\n| Pro | $139 | $1334.40 | 50 | 51200 | 500 | 1200 | 3000 | 5 | 25 |\n| Agency | $449 | $4310.40 | 200 | 204800 | 2000 | 6000 | 12000 | 25 | 100 |\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"settings-security","locale":"en","title":"Settings and security","description":"Manage your profile, password, two-factor authentication, sessions, and API keys.","section":"account","order":3,"searchText":"# Settings and security\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nSettings is the personal account page. Everything here affects only your login — workspace-wide settings live in Team, Roles, Billing, and Admin.\n\n1. **Profile.** Name, avatar, working hours. Working hours drive quiet hours for notifications.\n2. **Security.** Password change, two-factor authentication (TOTP), sign-in alert email. Turn 2FA on if your workspace policy does not already require it.\n3. **Sessions.** See every active browser and revoke any you do not recognize.\n4. **API keys.** Create one per client — shown once at creation. See [Public API](./public-api.en.md) and [MCP](./mcp.en.md).\n\n## FAQ\n- **Password rules?** Minimum twelve characters; the rest is up to you.\n- **What if I lose my 2FA device?** Use a recovery code from setup. If both are lost, an owner can force a reset from Team settings.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"notification-preferences","locale":"en","title":"Notification preferences","description":"Choose which non-essential emails Skrum sends and where in-app notifications go.","section":"account","order":4,"searchText":"# Notification preferences\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nNotification preferences separate essential security email (always sent) from product email (opt-in) and in-app category filters.\n\n1. **Email categories.** Billing and product-update email each toggle independently. Security email — password resets, verification, sign-in alerts — always sends.\n2. **In-app.** Filter the notifications center by category (mentions, meetings, code, digest).\n3. **Quiet hours.** Set by your working hours in [Settings and security](./settings-security.en.md). Non-urgent notifications stay silent outside working hours.\n\n## FAQ\n- **How do I stop mention emails?** They come from the in-app notifications center; a mention is treated as urgent and always emails.\n- **Can I unsubscribe from a specific channel?** Not per-channel — per-category only.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"sso-scim-setup","locale":"en","title":"SSO and SCIM setup","description":"Single sign-on (SAML / OIDC) and automated provisioning (SCIM 2.0) for the enterprise tier.","section":"account","order":5,"searchText":"# SSO and SCIM setup\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nSSO and SCIM are on the Agency (enterprise) plan. Once configured, your identity provider is the source of truth for who has an account and what role they hold.\n\n## SSO\n1. **Pick the protocol.** Settings → SSO → New. SAML for legacy IdPs, OIDC for modern ones.\n2. **Paste the metadata.** Skrum shows its ACS URL and entity id; paste the IdP metadata or endpoints. The IdP certificate (SAML) and client secret (OIDC) are envelope-encrypted at rest.\n3. **Enforce.** Once \"Test connection\" succeeds, turn on enforce-SSO. The workspace owner keeps a break-glass fallback.\n\n## SCIM\n1. **Mint a token.** Settings → SCIM → New token. Shown once; store it in your IdP.\n2. **Point the IdP.** Base URL: `https:///api/scim/v2`. Bearer auth uses the token.\n3. **Provision.** Users created in your IdP appear in Skrum with the configured default role and the seat cap enforced.\n\n## FAQ\n- **Enforce-SSO locks me out — what now?** The workspace owner keeps a password fallback and can rotate the SSO config.\n- **Can SCIM tokens be rotated?** Yes — mint a new one and delete the old.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"security-and-compliance","locale":"en","title":"Security and compliance","description":"What Skrum implements, plus the DPA, data residency, audit trail, and ownership transfer flow.","section":"account","order":6,"searchText":"# Security and compliance\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nSkrum is not SOC2 certified. This page describes the controls we implement. No badges we did not earn.\n\n## What Skrum implements\n- Envelope-encrypted secrets at rest (AES-256-GCM, keyed by `MASTER_ENCRYPTION_KEY`).\n- Session-based authentication with optional TOTP two-factor.\n- Role-based access control with a tamper-evident, append-only tenant audit trail.\n- Rate limits on every mutation surface; pino redaction across every credential path.\n- Cross-account isolation returns 404, not 403 — the existence of a foreign resource is never disclosed.\n- Data Processing Addendum with click-acceptance and a downloadable receipt.\n- GDPR data-rights endpoints (export + delete with a grace window).\n- Sanctioned workspace ownership-transfer flow with step-up re-authentication.\n\n## Audit trail and residency\n- **Audit trail.** Settings → Compliance → Audit. Read + CSV/JSON export (the export gate is a tier feature). CSV cells are neutralized against spreadsheet formula injection.\n- **Data residency.** Skrum shows the configured deployment region.\n- **DPA.** Accept the current version from Settings → Compliance. The receipt is downloadable.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"public-api","locale":"en","title":"Public API","description":"REST endpoints for projects, tasks, sprints, and activity — bearer API key auth.","section":"developers","order":0,"searchText":"# Public API\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nCreate an API key in [Settings → API keys](./settings-security.en.md) — it is shown once. Send it as a bearer token to `/api/v1`. Every list endpoint returns `{ data, nextCursor }`; pass `nextCursor` back as `cursor` for the next page (limit 1–100, default 25). The error envelope is `{ error: { code, message } }`. The full schema is at `/api/v1/openapi.json`.\n\n## Endpoints\n- `GET /projects`\n- `GET /projects/{key}`\n- `GET /projects/{key}/tasks`\n- `GET /projects/{key}/sprints`\n- `GET /projects/{key}/activity`\n- `GET /tasks/{ref}` (e.g. `WEB-42`)\n- `POST /tasks`\n\n## Try it\n\n```\ncurl -H \"Authorization: Bearer $SKRUM_API_KEY\" https://your-workspace.example/api/v1/projects\ncurl -H \"Authorization: Bearer $SKRUM_API_KEY\" https://your-workspace.example/api/v1/tasks/WEB-1\ncurl -H \"Authorization: Bearer $SKRUM_API_KEY\" -H \"Content-Type: application/json\" \\\n -d '{\"projectKey\":\"WEB\",\"title\":\"Ship the docs\"}' https://your-workspace.example/api/v1/tasks\n```\n\n## FAQ\n- **Plan?** Agency plan for the REST API (see [Plans](./plans-limits-credits.en.md)).\n- **Rate limits?** Per token, tunable via env; defaults are conservative.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"mcp","locale":"en","title":"Skrum MCP","description":"Connect Claude, Cursor, VS Code, or any MCP client to your Skrum workspace with a bearer API key.","section":"developers","order":1,"searchText":"# Skrum MCP\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nThe Skrum Model Context Protocol server lets your MCP client — Claude Code, Cursor, VS Code, or any other — read your projects, tasks, sprints, and activity and create tasks. MCP access requires the Pro or Agency plan.\n\nEndpoint: `POST /api/mcp` — Streamable HTTP, stateless JSON. Auth is the same `Authorization: Bearer $SKRUM_API_KEY` header as the REST API. Rate-limited per token.\n\n## Tools (8)\n\n| Tool | Arguments | Returns |\n| --- | --- | --- |\n| `list_projects` | (none) | Projects visible to your key with key/name/status/open-task count |\n| `get_project` | `key` | Project detail: columns and active sprint |\n| `list_tasks` | `key`, filters: `column`/`assignee`/`sprint`/`updated_since`, `cursor`, `limit` | Tasks + `nextCursor` |\n| `get_task` | `ref` (KEY-N) | Full task DTO with checklist totals and comment count |\n| `create_task` | `projectKey`, `title`, optional description/columnId/assigneeIds/labels/priority/dueDate | The created task |\n| `list_sprints` | `key` | Sprints with status, dates, done/total |\n| `get_sprint_summary` | `key`, `sprintId` | Sprint plus per-column open counts and a burndown series |\n| `get_activity` | `key`, `cursor`, `limit` | Activity events with localized summary lines |\n\n## Connect\n\n```\nclaude mcp add --transport http skrum https://your-workspace.example/api/mcp \\\n --header \"Authorization: Bearer $SKRUM_API_KEY\"\n```\n\nCursor — Settings → MCP Servers → Add:\n\n```\n{\n \"skrum\": {\n \"url\": \"https://your-workspace.example/api/mcp\",\n \"headers\": { \"Authorization\": \"Bearer $SKRUM_API_KEY\" }\n }\n}\n```\n\nVS Code — `.vscode/mcp.json`:\n\n```\n{\n \"servers\": {\n \"skrum\": {\n \"type\": \"http\",\n \"url\": \"https://your-workspace.example/api/mcp\",\n \"headers\": { \"Authorization\": \"Bearer ${env:SKRUM_API_KEY}\" }\n }\n }\n}\n```\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"outbound-webhooks","locale":"en","title":"Outbound webhooks","description":"Subscribe an HTTP endpoint (or a Slack / Teams URL) to task, sprint, meeting, code, and mention events.","section":"developers","order":2,"searchText":"# Outbound webhooks\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nOutbound webhooks fan out event notifications. They are the outbound counterpart to [Code activity](./code-activity.en.md) — Skrum is the source, the third party is the receiver.\n\n1. **Create.** Settings → Integrations → Webhooks → New. URL, signing secret (Skrum generates one; shown once), and event subscriptions (`task.*`, `sprint.*`, `meeting.*`, `code.*`, `message.mention`).\n2. **Signed body.** Every delivery carries an HMAC-SHA256 signature over the raw body, verified with your signing secret.\n3. **Retries.** Non-2xx retries with exponential backoff, capped at five attempts. SSRF-protected — private IPs and metadata hosts are refused.\n\n## Slack / Teams\nPaste a Slack or Teams incoming-webhook URL. Skrum recognizes the scheme, formats a bounded plain-text payload, and posts it — same SSRF check as any outbound URL.\n\n## FAQ\n- **Rotate a secret?** Delete + recreate; secrets are shown once.\n- **Delivery history?** Recent deliveries are shown per webhook, with the failure class on non-retryable errors (`ssrf_refused`, `signing_failed`, `http_4xx`).\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"backup-and-restore","locale":"en","title":"Backup and restore","description":"Nightly retention sweep, backup scripts under `scripts/backup/`, and a documented restore path for Mongo, Postgres, and MinIO.","section":"operations","order":1,"searchText":"# Backup and restore\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nBackup is the operator's responsibility. Skrum ships scripts and a retention sweep — you supply the schedule, off-site destination, monitoring, and recovery drills.\n\n## Recovery objectives and schedule\n\nChoose objectives from your own data volume and business requirements; the scripts cannot promise a universal recovery time.\n\n- **Recommended cadence:** one complete backup every night, with a quarterly restore drill. Workspaces that cannot tolerate a day of lost writes should schedule every six hours or more often.\n- **RPO:** at most the interval between successful complete backup sets plus the duration of the interrupted run. A nightly schedule therefore targets an RPO of no more than 24 hours only when every run is monitored and completes.\n- **RTO:** establish it from a timed restore of production-sized data. A practical initial operating target is four hours, but the measured drill result is authoritative.\n- **Retention:** as a starting policy, retain 7 daily, 4 weekly, and 12 monthly complete sets. Apply bucket lifecycle/immutability controls outside Skrum and keep at least one copy outside the application host and primary object store.\n\nAlert on a missed schedule, non-zero exit, absent `MANIFEST.txt`, or failed off-site replication. Never delete the previous known-good set until the new set and its checksum sidecars are present.\n\n## Create a backup\n\n```\n./scripts/backup/backup-all.sh\n```\n\nThe scripts read only backup-related values from the authoritative repository-root `.env` when those variables are absent from the invoking process. Explicit process variables — including an explicitly empty value — take precedence. The parser does not `source` or evaluate the file, and no credential value is printed.\n\nRequired values are `MONGODB_URI`, `DATABASE_URL`, `S3_ENDPOINT`, `S3_ACCESS_KEY`, `S3_SECRET_KEY`, and `S3_BUCKET`. `BACKUP_TARGET=local` writes the timestamped set under `BACKUP_DIR`; `BACKUP_TARGET=s3` uploads a hashed bundle under `BACKUP_S3_PREFIX` and prints its restorable `s3://` URI. The orchestrator hashes the Mongo, Postgres, and MinIO archives plus the complete manifest before any restore is allowed.\n\nMongo, Postgres, and object storage are dumped sequentially. For a transactionally quiet recovery point, stop incoming writes and pause workers for the short backup window; otherwise records created across stores during the run may land on different sides of the recovery point. Do not stop the database or object-store services themselves.\n\nExample scheduler entry for the nightly recommendation, run from the repository root:\n\n```\n15 2 * * * cd /srv/skrum && ./scripts/backup/backup-all.sh >> /var/log/skrum-backup.log 2>&1\n```\n\nUse a scheduler/secret manager appropriate to your platform and restrict backup directories, logs, and root `.env` to the operator account.\n\n## Retention sweep\nA daily `retention-sweep` BullMQ job archives prune-eligible messages, task comments, and work-graph events losslessly to cold storage under `archive/{accountId}/{kind}/{sha256}.ndjson.gz` before deletion. Retention days per tier follow `historyDays` (30 / 90 / 365 / unlimited). Unlimited tiers no-op.\n\n## Restore expectations\n\nRestore is destructive: Mongo uses `--drop`, Postgres uses `--clean --if-exists`, and object storage mirrors with removal. Schedule a maintenance window, stop API/worker writes, take a safety copy of the current stores when possible, and confirm the destination identifiers before proceeding.\n\n```\n./scripts/backup/restore-all.sh \n```\n\nThe command validates the complete manifest and every archive checksum before mutating any datastore, then restores Mongo, Postgres, and MinIO. A successful command means the archives were accepted by their restore tools; it does not by itself prove application-level recovery.\n\nBefore reopening writes:\n\n1. Boot the API and worker against the restored stores and wait for health checks.\n2. Verify sign-in, workspace/project/task/message reads, and one known uploaded-file download.\n3. Confirm queue depth, migration state, and recent audit/work-graph records.\n4. Record start/end time, restored set URI, byte counts, and smoke-test result in the recovery log.\n\nKeep the system in maintenance mode and investigate if any check fails. A quarterly drill should restore into an isolated environment, prove seeded Mongo/Postgres/object data by content, and update the measured RTO.\n\n## FAQ\n- **Managed hosting?** Backups are our responsibility on the managed tier.\n- **Can I override the retention window?** Yes — `retention_policies` per account clamps downward only.\n- **Does application retention replace disaster-recovery backup retention?** No. The retention sweep governs product records; complete backup-set lifecycle is an operator policy.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"reporting","locale":"en","title":"Reporting","description":"On-demand PDF/CSV exports and scheduled email delivery over the leadership insights DTOs.","section":"operations","order":2,"searchText":"# Reporting\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nReporting is the manager surface for the leadership insights: portfolio, delivery throughput, workload, aggregate risk, cadence, and digests. Every report is a snapshot of a DTO that the [Home](./getting-started.en.md) and Insights pages already show.\n\n1. **Save a report.** Insights → the block → Save as report. Pick PDF or CSV.\n2. **Schedule.** Report → Schedule → set the recipients (workspace members only, resolved by userId) and the cadence.\n3. **Delivery.** The `report-delivery-sweep` BullMQ job runs the schedule idempotently per `(scheduledReportId, period)`. CSV cells are neutralized against spreadsheet formula injection.\n\n## FAQ\n- **Plan?** Advanced reporting is a tier feature — Pro and above.\n- **Can I send to a non-member?** No — recipients must be workspace members with a verified email.\n- **Where does a scheduled report render?** Through the PDFKit-confined renderer seam. Production uses PDFKit; tests inject a deterministic fake for stable assertions.\n\nSee also: [Skrum documentation](./index.en.md)"},{"slug":"performance-and-scaling","locale":"en","title":"Performance and scaling","description":"How Skrum holds up under load: p95 targets on hot paths, workspace-scoped read-through caching, and the chaos behavior when a dependency falls over.","section":"operations","order":3,"searchText":"# Performance and scaling\n\nSkrum is the all-in-one AI project control plane — team chat, tasks and sprints, native video meetings, and inbound code activity in one workspace, with every AI action waiting for a human yes.\n\nSkrum is engineered to stay responsive when a workspace grows and when infrastructure has a bad day. This page documents the concrete numbers, the caching model, and the failure modes.\n\n## Load thresholds\n\nOpt-in k6 scenarios under `load/` hold Skrum to these targets against the composed stack with deterministic fake providers:\n\n- **Realtime fan-out** — 500 concurrent socket clients in one channel, p95 message-to-fanout latency ≤ 250 ms, error rate < 0.1%.\n- **POST message** — p95 ≤ 200 ms at 50 rps, error rate < 0.5%.\n- **Board read** (`GET /api/tasks?projectId=…`) — p95 ≤ 150 ms at 100 rps, error rate < 0.5%.\n- **Search** (`GET /api/search`) — p95 ≤ 300 ms at 50 rps, error rate < 1%.\n- **Home summary** (`GET /api/home/summary`) — p95 ≤ 200 ms at 100 rps, error rate < 0.5%.\n\n## Read-through caching\n\nA small Redis-backed read-through cache covers three hot paths: the channel list per workspace, project board projections, and the dashboard/home summary. Every key is prefixed with the workspace `accountId` — a workspace can only ever read its own cached data. Invalidation is event-driven off the realtime spine (`message.posted`, `channel.*`, `task.*`), with a short TTL as a backstop. The cache stores only already-authorized, non-secret projections.\n\n## Chaos resilience\n\nWhen a dependency falls over, Skrum fails closed rather than partial-writing or leaking data.\n\n- **Redis down.** Realtime and cache degrade; REST still serves the source of truth from Mongo and Postgres. Rate limiters fail safe (deny, never open the gate).\n- **Mongo or Postgres unreachable.** Routes surface a localized 503-class error — no unhandled crash, no partial write.\n- **MinIO or LiveKit down.** File uploads and meetings fail closed with a localized error; the rest of the app keeps working. See [Backup and restore](./backup-and-restore.en.md).\n\nWhen a dependency returns, service resumes automatically — no manual restart required.\n\n## FAQ\n- **Do I run the k6 suite in CI?** Yes, behind an opt-in job. Load scenarios never gate a normal pull request.\n- **Can I raise the cache TTL?** The TTL is deliberately short. Event-driven invalidation is the primary correctness path; the TTL is only a Redis-outage backstop.\n- **Does the cache ever leak across workspaces?** No — every key is `accountId`-prefixed and a dedicated test proves cross-tenant isolation.\n\nSee also: [Skrum documentation](./index.en.md)"}]}},"actionData":null,"errors":null}