Changelog — CHIPS
CHIPS — Collaborative Heuristic for Iterative Planning and Story-pointing.
Versions follow semantic versioning: MAJOR.MINOR.PATCH. The version is in
scrumpoker/version.py; the database has its own schema version (Admin → Settings shows both).
1.7.0 — 2026-10-28
A demo area, in every edition — Projects → Demo (/demo) makes a ready-made project, CHIPS demo:
- One active room — Demo · Sprint 12 planning, which counts as one of the edition's active rooms.
- People — a scrum master (Sam), a moderator (Morgan), a watcher (Wes, the product owner) and five team members (Ann, Bob, Cat, Dan, Eve), on the project's team list with seniority and working days.
- Stories — 19 user stories and an epic (Checkout redesign) split into four stories: estimated with votes, notes and second rounds, assigned (Ann over her maximum), some in progress or done, the rest in the backlog, and a revealed round with an outlier left on the table.
- Analytics in Community and Team — three earlier sprints (archived, so they use no active rooms) give the analytics their history; the demo project's analytics are shown in every edition.
- Enterprise and Team features to try — a recording of the first stories (playable in any edition), the demo's activity log entries with a CSV download, REST API examples with the API's answer for the demo room, Jira-style issue keys, and a preview of single sign-on.
- One demo per installation, open to every scrum master and administrator; Reset makes it again, Remove frees its room.
Database schema version 9.
1.6.0 — 2026-10-27
Sprint planning with capacity, and analytics.
Sprint planning (every edition)
- Working days per person — each project has a team list (Projects → the people button): name, seniority and working days per sprint. A room is a sprint: set its dates (working days are counted) and change anyone's days for that sprint only.
- Minimum and maximum story points per person — per person or per sprint; the defaults use 1 story point = 1 working day: maximum = working days × points per day, minimum = half the maximum. The project's points per day can be changed.
- Over the maximum turns red — the room's new Sprint capacity panel shows assigned / maximum for each person: red with a warning sign when over, orange under the minimum, green in between; plus unassigned points and assignees not on the team list. The assignee field suggests the team list's names.
- Delivery data — stories record when work started and was done, defects, times reopened and sprints carried over (Edit → Delivery), or read them from Jira (Delivery from Jira: status changes, resolution date, linked bugs, the Sprint field).
Analytics (Enterprise edition) — a new Analytics page per project and period, every table as CSV:
- Estimator behaviour — first-round votes above, on or below the final estimate; tendency.
- Highest and lowest estimator — how often each person was the highest or the lowest.
- Velocity contribution — planned and delivered points per sprint, each owner's share, utilisation.
- Agreement and divergence — spread of first-round estimates per story, by technique, re-votes.
- Anchoring and influence — whether final estimates move toward the first person to comment or the most senior voter more than toward others; influence by person.
- Ownership quality — defects, rework and carry-over by owner and by the estimator whose vote won.
- Monte Carlo forecast — 50/70/85/95% delivery dates from weekly throughput; chance of finishing by a date.
- Points versus cycle time — Spearman, Pearson, R², scatter, box plot by size; whose votes predict best.
- More — size drift and point inflation, epic trunk versus the sum of its stories, estimation effort, capacity history.
REST API: team list, room capacity, sprint dates, delivery and GET /api/v1/projects/{id}/analytics.
Database schema version 8 (applied automatically).
1.5.0 — 2026-10-26
- American or British English — the administrator chooses the spelling of the interface in the
setup wizard (Installation options → Language (spelling)) or later under Admin → Settings:
English (United States) — color, organization, canceled, license — or English (United Kingdom) —
colour, organisation, cancelled, licence. Menus, messages, notifications and Help follow the choice;
what people type (story titles, names, notes) is never changed, nor are commands and addresses in
Help. Existing installations keep British English. New setting
language(en-US/en-GB) in the site settings and the public settings. - The maker — CHIPS is made by EEZEEZEE: EEZEEZEE with the 2nd, 4th and 6th "E" and the 2nd "Z" reversed. On screen (welcome page, Help, the license agreement, documentation and website) every reversed letter is mirrored; plain text (package metadata, the .deb maintainer, LICENSE.txt) uses Ǝ for the reversed E's, as Unicode has no reversed Z. Screen readers read "EEZEEZEE".
- Welcome page — under the full name it now says "by EEZEEZEE" (styled as above) instead of "for" and the organisation name.
1.4.0 — 2026-10-26
Running a session: eleven new ways to estimate and moderate.
- Custom decks — a sixth technique with your own cards (numbers, words or emoji, 2–30), named, with presets; scrum masters save decks for their other rooms. Number decks get averages and totals.
- Pass card —
?now means pass (abstain): it counts as voted but is left out of averages, consensus and outliers; results show how many passed. - Timer — a countdown per vote (rule: seconds per vote, reveal when time is up) or started from the room (30 s – 5 min), with +30 s and stop.
- Outliers — after the reveal, votes two or more cards (configurable) from the median are ringed in red with "ask them to explain"; for three-point estimates, PERT values far from the median.
- Moderators — the scrum master makes anyone in the room a moderator, who runs the session without an account (rule: moderators vote too).
- Kick, lock, hide — remove people from the ⋮ menu (moderators too), lock the room with the padlock, Hide results in one click.
- Anonymous voting — revealed cards without names for everyone, including the scrum master; history, downloads and recordings keep them anonymous; turning it off never un-hides a round.
- Watchers — Join as watcher (or switch someone): they see everything but do not vote, add notes or react, and never count as missing votes.
- Averaging rules — suggested estimate from the mean, the median, the most common card, or the mean without the highest and lowest vote.
- Emoji reactions — ten reactions shown next to names and in a feed for ten seconds.
- Epics and quick split — estimate an epic as a whole (the trunk), then split it in one step (equal
parts, SPIDR, workflow steps, CRUD or your own list) into stories under it; the backlog shows the
parts as a tree with their progress and total; an optional "too big — split it?" prompt after a
reveal;
POST /api/v1/rooms/{room}/stories/{story}/split.
Also: CSV downloads add Type, Epic, Passed, Outliers, Team value rule; the REST API reports roles; database schema version 7.
1.3.0 — 2026-10-25
Builds for macOS and Windows, and Windows as a host.
- Windows hosting (Windows 11, Windows Server 2022 / 2025, x64):
deploy\windows\install.cmd/install.ps1installs Python and PostgreSQL with winget when needed, creates the database, installs CHIPS underC:\Program Files\CHIPS, keeps settings and data inC:\ProgramData\CHIPS(Administrators, SYSTEM and the service only), runs it as LOCAL SERVICE in the background (scheduled task, started at boot, restarted if it stops), opens the firewall for domain and private networks and prints the setup code;uninstall.ps1with-DryRun,-Backup,-KeepData,-RemovePrerequisites;setup-code.ps1. - Protected builds for every platform:
packaging/protect.pycompiles on Linux (gcc), macOS (clang, arm64 / x86_64 / universal2) and Windows (MSVC,.pyd); the release builder names packages by platform (linux-x86_64,linux-aarch64,macos-arm64,macos-x86_64,windows-amd64) with correct wheel tags,.debarchitectures and Docker images per architecture. - GitHub Actions release workflow: tests on Linux, macOS and Windows; builds on GitHub's Linux x64/ARM64,
macOS arm64/Intel and Windows x64 machines; smoke-tests every installed package with Python 3.10 and 3.13
(
packaging/smoke_test.py); publishes one release with a combinedSHA256SUMSwhen a version tag is pushed. The signing key comes from a repository secret. - The Linux and macOS installers pick a Python version the compiled package was built for.
- Windows-safe text handling: every file is read and written as UTF-8, and console output never fails on characters the Windows code page lacks.
1.2.0 — 2026-10-24
A welcome page and setup wizard, security hardening, and protected (compiled, signed) builds.
- Welcome page. The start page introduces CHIPS — Collaborative Heuristic for Iterative Planning and Story-pointing, the five techniques, sign-in and joining a room.
- Setup wizard (
/setup). On a new installation the welcome page offers Set up CHIPS: a one-time setup code (printed by the installer and in the server log;manage setup-codemakes a new one), the license agreement, the administrator account, the installation options (organisation, public address, default time zone, two-factor for administrators, self-registration, password length, sign-in lifetime, people per room, default technique, log retention, REST API, Jira), an optional license key, server checks, and review. Everything is saved together. The old "first account becomes the administrator" path is closed: without the setup code nobody can take over a new installation. - Two-factor sign-in with authenticator apps (TOTP) and 10 single-use recovery codes; can be required for administrators; administrators can turn it off for someone who lost their phone.
- Sign-in protection: accounts lock after 5 wrong passwords (for 1 minute, doubling, at most an hour), addresses after 20; administrators can unlock. Responses take the same time whether or not a username exists. A password policy (configurable length, no common passwords, not the username) applies everywhere passwords are set.
- Web hardening: strict Content-Security-Policy, no framing,
nosniff, referrer and permissions policies, HSTS behind HTTPS,no-storeon pages and API, no server banner, HTTPS-only cookies when the public address is HTTPS, proxy headers trusted only fromFORWARDED_ALLOW_IPS, error pages without technical details (a reference number instead; details in the log). - Secrets: CHIPS refuses to start without a
STORAGE_SECRETof at least 32 characters (development:CHIPS_ALLOW_INSECURE=1); Docker Compose requiresSTORAGE_SECRETandDB_PASSWORDin.env; browser storage files are private to the service account. - Sandboxing: a stricter systemd unit (no capabilities, read-only system, restricted system calls and address families, private devices); the Compose app container is read-only, drops all capabilities and cannot gain privileges.
- Protected builds. Releases are compiled to native code with Cython (Python 3.10–3.13), without source or docstrings, with symbols stripped, and carry a signed integrity manifest. At startup CHIPS checks the manifest, that no source was added, that signature checking works and that the license code was not replaced; a modified installation runs as Community and tells administrators. The license agreement (version 1.1) forbids reverse engineering and working around these measures.
- Security checks in the wizard, under Admin → Settings and with
manage security-check; new commandsmanage setup-code,unlock,reset-2fa.
1.1.0 — 2026-10-22
CHIPS becomes a product: editions, license keys, a license agreement and installable packages.
- Editions. Community (free: 3 scrum master/administrator accounts, 5 active rooms, every estimation technique, CSV, history and help), Team (unlimited rooms, Jira, recording and playback, REST API and access tokens; 10 seats by default) and Enterprise (adds OAuth 2.0 / OpenID Connect sign-in and the activity log download and API, with priority support). People who only vote are never counted.
- License keys. Signed offline keys (Ed25519): no activation server, nothing phones home. Install
under Admin → License or with
manage license install. Reminder 30 days before expiry, 14 days of grace afterwards, then the Community limits; no data is ever deleted. Keys can be bound to one installation. - License agreement (EULA) accepted when the first administrator sets CHIPS up, plus third-party
notices; both under Legal in the user menu and in
LICENSE.txt. - Packages. Release archives (
.tar.gz,.zip, optional offline bundle), a Python wheel and sdist (chipsandchips-managecommands), a Debian/Ubuntu.deb, a Docker image, all with SHA-256 checksums. - Documentation site (installation, administration, licensing, user guide, API, security,
support) and a product website, built by
packaging/build_release.py. - A logo, used in the header, the favicon, the docs and the website.
- Vendor tools for issuing and tracking license keys (kept out of the product).
1.0.0 — 2026-10-22
First release under the name CHIPS (previously "Scrum Poker").
- Help centre inside the app (the ? in the header): how everything works, for team members, scrum masters and administrators, with search and context links from the room.
- Flowcharts in Help: how CHIPS operates end to end, one estimating round, the affinity board, and how the parts fit together.
- Hover descriptions on every button.
- A version number, shown in Help → About, the user menu,
/healthz,/api/v1/health, the API documentation,python -m scrumpoker --version,manage versionand the installers. - Internal names are unchanged (Python package
scrumpoker, servicescrum-poker, install folders, database), so existing installations upgrade in place; personal access tokens keep working.
Earlier stages (before version numbers)
- 0.9 — Story attributes (assignee, priority, fix versions, affected versions, labels); updating Jira with them and story points, selected by JQL, with preview.
- 0.8 — Recording and playback of sessions; personal display settings (dark mode, accent colour, text size, time zone, compact, reduced motion); activity log with an administrator viewer, retention and truncation.
- 0.7 — Estimation techniques in one session: planning poker, Fibonacci scale, t-shirt sizing, three-point (PERT) and affinity estimation.
- 0.6 — Projects, session history, CSV upload and download, notes, administrator role and console, OAuth 2.0 / OpenID Connect sign-in, Jira personal access tokens, REST API with personal access tokens.
- 0.5 — Hosting on macOS (launchd, Homebrew) with a clean uninstall.
- 0.4 — Clean uninstall for Linux and Docker.
- 0.3 — One web application; nothing to install on users' devices.
- 0.2 — Clients for Windows, macOS, iOS and Android.
- 0.1 — Client–server scrum poker on Linux: rooms of up to 30 users, scrum master role, Fibonacci and t-shirt sizing, hidden story point values, PostgreSQL.