Hubtask

Task management with room to think — for one person on one box, and for providers running many workspaces. Built backend first and API first: the core and its API are the product, and every frontend, integration and AI agent is an equal client.

Hub Collection Task Work package Activity

Source on GitHub Read the architecture

The model

Five levels, one shape

A hub is an area of life or a client. A collection is a project or a list. A task is the unit of work, a work package a step of it, an activity the smallest tick. Due dates, reminders, labels, members, comments, attachments and custom fields live where you need them — and the hierarchy rolls completion upwards when you tell it to.

The contract

Three doors, one catalogue

REST

A complete, documented HTTP API with a composable query language, idempotency and optimistic concurrency — built for scripts and integrations, not exported from a UI.

MCP

An MCP server for AI agents, speaking the same catalogue. An agent can do whatever your role allows — and nothing more.

Automation

Every use case is registered once and exposed everywhere. A parity check in CI fails the build if the three channels ever disagree.

In the box today

Already shipped, already tested

  • search full-text search and a composable filter DSL
  • views kanban buckets, saved views, CSV/JSON/ICS export
  • time due dates, reminders, RFC 5545 recurrence across DST
  • templates whole task trees instantiated in one call
  • calendar revocable ICS feeds for any calendar app
  • live server-sent events for real-time updates
  • cli hubctl — the whole product from a terminal
  • i18n message codes end to end; any language, zone, direction

The difference

Your data, provably yours

Backups that restore

Encrypted archives on your own target — S3, SFTP, WebDAV or local — with generational retention. The restore drill runs in CI on every change: a backup that has never been restored is a hypothesis.

An audit trail that verifies

Every auditable action lands in a hash chain that stores no content. One call checks the chain and names the first broken link — tampering is found, not suspected.

Retention with brakes

Deletion rules announce what they will delete before they delete it, can be stopped, and are overridden by a legal hold. Nothing disappears quietly.

GDPR as a feature

Access, export and erasure are use cases with a statutory deadline the system watches — served by the product, not by a support ticket.

Operations

Run it yourself

One container image, PostgreSQL as the only required dependency, Compose for one box and Helm for a fleet. The tenant boundary is enforced in the database itself, twelve security gates run in the pipeline, and /meta/health says what is missing instead of crashing.

docker compose up -d

Roadmap

The road ahead

Hubtask is built in the open, milestone by milestone — what follows is the plan, not a promise with a date on it.

  • 0.5 automation rules, webhooks, personal access tokens, the jumble inbox
  • 0.6 multi-tenant operations, OIDC sign-in, MFA, quotas
  • 0.7 optional AI: suggestions, semantic search — switchable off
  • 0.8.5 offline synchronisation with conflict-preserving merges
  • 1.0 the first stable release