Sprint 9: The Infrastructure Sprint Nobody Wanted But Everyone Needed

What Went Wrong First We planned 155 points. We shipped 42. That sounds like failure, and it was — a planning failure. Our velocity is 38 points per sprint, validated across 3 sprints. We committed to 4x our capacity because infrastructure stories feel smaller than they are. An Architecture Decision Record forced the reckoning: cut 113 points of UI tab work and focus on what the platform actually needs before any new features get built. The hardest part wasn't cutting scope. It was admitting that 7 new browser tabs don't matter if your API serves HTTP in production. What We Actually Built Sprint 9 was infrastructure-first. Every story was foundational work that has to land before Sprint 10's feature tabs can exist. TLS termination — We were running HTTP-only. In 2026. The fix: nginx reverse proxy on port 443, self-signed cert generation for dev, certbot auto-renewal for production, HSTS headers at both the nginx and Express middleware layers. Defense in depth, not just a checkbox. Test