AVIS
Every hour, document and budget line tied to a project, with no free text to lose them in.
Engineering time tracking · Jul 2026 - Nov 2026
Engineering work as it is counted here: every hour belongs to one project, one discipline and one activity.
- 27
- Relational tables, no free-text names
- 12
- Tools the AI analyst can call
- 288
- Commits, as the sole engineer
AVIS is a web platform where an engineering firm records man-hours against projects, disciplines and activities, keeps each project's document register, compares budget with actual, and runs performance reviews. Employees, managers, HR and administrators use it on desktop and mobile browsers.
The problem
The tool it replaced took free text for employee, project, discipline and activity. The same person or activity typed two ways counted as two, so man-hours by project, by discipline or by activity could not be added up.
The approach
Every one of those fields is now a foreign key to a reference table, and no API path creates one by typing. Imports are previewed row by row and nothing is saved until a person confirms it.
How a register gets in
- 01Upload
- 02Read
- 03Preview each row
- 04A person confirms
- 05Saved
What I did
- Sole engineer on both repositories: 288 commits across the web client and the API, from the first schema to production.
- Designed the relational model that replaced the free-text records, and the validation that protects hours data.
- Built the AI analyst, its scheduled reports and the permission scoping that keeps it on a read-only database role.
- Owned deployment: automated releases, encrypted daily backups, and written recovery procedures.
What it does
- Timesheets and attendance
- Weekly entries against a project, discipline and activity, with duplicate checks and CSV and Excel export.
- Document register
- Project documents with file attachments and approvals. Registers arrive from Excel, CSV, PDF and Word; each import is previewed with a problem listed per row before anything is saved.
- Budget versus actual
- Estimates, phase budgets and milestones per project, with overrun requests when logged hours pass the estimate.
- AI analyst
- Answers questions about the hours data in chat, reviews anomalies, and sends scheduled reports as PDF, Word or HTML. It works through 12 tools and can only query a read-only database role.
- Performance reviews
- Reviews that repeat monthly, quarterly or yearly from a question bank. Employee and manager answer the same questions, and answers are released to both only after both have sent.
- Encrypted answers
- Review answers are encrypted with AES-256-GCM, and the analytics role cannot read the review tables at all.
How it is built
- Web client
- Next.js 16 with the App Router, React 19, Tailwind and TanStack Query, across 17 pages. Next is the router and renderer only: every byte of data comes from the API, and there are no Next API routes.
- API and data
- Express 5 and TypeScript over Postgres 17 with Drizzle and Zod: 10 route modules, 27 tables and 18 migrations. Sign-in is an allowlist, so an address with no employee row is refused. The analyst runs as a separate service on Mastra with its own memory.
- Production
- One server running Docker Compose, with only the reverse proxy exposed and the database unreachable from the internet. Pushes to main deploy through GitHub Actions and are verified afterwards. Complete encrypted backups go to separate object storage every night.
- Next.js 16
- React 19
- TypeScript
- Express 5
- PostgreSQL 17
- Drizzle
- Clerk
- Mastra
- Docker