👤 Delivery Metrics & Key-Person Risk

📋 Summary

The repository cannot support a credible contributor or delivery-speed analysis: its entire history has been squashed into one commit made on 6 October 2026 under a single name. Every line of code is therefore attributed to one person, which is an artefact of the squash, not a measurement. What the repository's own documents do show is that the product has one owner who directs the work and reviews it visually, and that the code is written largely by AI coding sessions following very detailed written conventions. This is a concentrated key-person risk: the product knowledge, the decisions behind it, the operating access to each client deployment and the legal ownership of the code all appear to sit with one individual. None of the four standard delivery-performance (DORA) metrics can be measured from what was supplied; this report says exactly what access would allow them to be.

🎯 Rating

🔴 ●○○○○ 1 / 5 — Red. Bus factor is evidenced as one, and no delivery metric is measurable from the material provided.

🔍 Findings

Part A — Contributor analysis

Method: git log --all, git shortlog -sne (one line), git blame is uniform by construction. git-fame was not run because it would only restate the squash.

Bus factor

Evidenced bus factor: 1. [Inferred, high confidence] The signals:

• A single copyright holder: "Matthew Prins, trading as Midshift" (LICENSE). [Observed]
• All decisions are recorded as "owner call", "the owner's" open decisions, and the owner reviews work on a "build board" and "comment ledger" (docs/HANDOVER.md, CLAUDE.md). [Observed]
• The build process is written for AI sessions (worktrees, ports, "the session reminder") rather than for a team. [Observed]
• Production database migrations are applied by hand, and CLAUDE.md is the register of which migration has run in which deployment ("applied in production on 2026-09-14…"). Operational state lives in prose maintained by the owner. [Observed]

What walks out of the door if the owner leaves: the rationale for hundreds of product decisions (partially mitigated — they are unusually well written down in CLAUDE.md, ARCHITECTURE.md and code comments); access to and knowledge of every client's Vercel and Supabase projects, environment variables, cron secrets and migration state; the relationships with client teams; the related campaign-studio repository; and the ability to continue the AI-assisted workflow, which depends on the conventions and judgement of the person directing it. The written record is a genuine mitigating asset — far better than typical for a single-founder product — but it is not a substitute for a second person who has operated the system.

Part B — Delivery metrics (DORA)

All four: [Unavailable]. No scorecard is offered; any figure would be fabricated.

Qualitative signals only (not metrics): CLAUDE.md contains dated entries clustered between August and late September 2026 (e.g. migrations applied 2026-08-21, 2026-09-03, 2026-09-06 … 2026-09-28), suggesting a high pace of change in that window. [Inferred] It also records specific failures — a missing migration found in production (035, 2026-08-19), a migration the app depended on before it ran (063), three red pushes to main (2026-09-06) — which show problems were noticed and fixed, but give no rate. [Observed]

🧾 Evidence

• git log --all --format='%h %an <%ae> %ad %s' → one line.
• git rev-parse --is-shallow-repository → false.
• LICENSE line 1; docs/HANDOVER.md lines 1–62; CLAUDE.md sections "Migrations", "Verification", "Parked decisions"; SECURITY.md "Supported version".

⚠️ Risks

✅ Recommendations