git log — 183 days of history

The birth of Taski

From a tentative first commit to a full ecosystem across 6 platforms. Six months of code, sleepless nights, impossible bugs and small victories.

0Commits
0Platforms
0Days
0Deploy
$ git log --since="2025-11-26" --oneline | wc -l
Scroll
01 The Spark

Initial Commit

It all starts with an empty folder and an idea: a messaging app that puts privacy first. The first commit is bare — an Xcode skeleton, a SwiftUI project with more hope than code. "tentativo sistemazione login" reads the second commit, minutes later. Nothing works yet, but the journey has begun.

Initial Commit

First words

Within 24 hours, push notifications and WebSocket are working. The backend can deliver messages in real time. The profile photo upload fails on the first try — "App compila update profilo fallito" but by the next morning it works. Messages appear on screen. For the first time, two devices are talking to each other.

Chat is working!

The commit message says it all: "Chat funzionante, profilo funzionante" For the first time chats persist, messages arrive, the profile updates. The foundation is there. From here, we build.

The sleepless nights

Timestamps don't lie: commits at 00:52, at 2:13, at 2:30, at 4:53, at 5:07. A flurry of late-night commits takes the app from "it works" to "it looks real". Typing indicator, read receipts, deeplinks, badges. At 4:53 the first of the ghosts that will haunt this project appears: "fix chat fantasma e push" At 5:07, exhausted: "risolti" A single word. Then silence until tomorrow.

02 The Fortress

E2EE Implemented

Five days after the first commit, end-to-end encryption is live. Every message encrypted with Curve25519 keys. The server can't read a thing. It's not a feature bolt-on: it's the DNA of Taski. From this moment on, not even the person running the server can see users' messages.

"TUTTO FUNZIONANTE DA QUESTO PUNTO"

The all-caps commit message does not lie. Push notifications with encrypted preview, message replies, encrypted messages with correct timestamps. In just 6 days, Taski has the complete foundations of a secure messenger. "NOTIFICHE FUNZIONANTI" shouts a commit moments earlier. The excitement is palpable in the git log.

Contacts and SMS verification

Still at night, at 1:06 AM. User matching by phone number. SMS login. Taski stops being an experiment and becomes something you could install on your mother's phone.

Groups: the roller coaster

On December 4th, groups enter the codebase. The git log tells an epic in four acts: "Gruppi funzionanti" "Gruppi perfettamente funzionanti" "Gruppi quasi perfetti" "GRUPPI PERFETTI" The next day, again: "Logica gruppi perfetta" Five commits, five escalating levels of certainty. Or perhaps of self-persuasion.

The week of "maybe"

21 commits in 4 days, and doubt permeates every line: "Per ora BENE" "Sistamazione spunte? Forse!" "chat eliminate sembra funzionare" "Abbinamento chat quasi perfetto" "sistemato forse tutto" This isn't confidence: it's hope. Read receipts work, then stop working. Ghost chats appear and vanish. The typos in commit messages betray the exhaustion: "Sistamato", "nofifiche", "implemenzazione". But the code pushes forward.

The Christmas limbo

While the world celebrates, the commits don't stop. Voice message transcription. Link previews. Video. On December 23rd: "Posizionamento messaggi quasi perfetto" On the 27th: "Forse ci siamo, chat sistamata" "Chat sembra ok" "Sembra". "Forse". "Quasi". The words of someone who has learned not to trust. On December 26th, Saint Stephen's Day: "Sistemato problema freeze UI in chat" No day off for the app.

03 Maturity

Voice and video calls

Agora SDK integration for real-time calls. Ringback tone, missed call handling, automatic speaker on video calls. The calls too are E2EE-encrypted with Curve25519 keys. "Nascondi tasto videochiamata (da riabilitare)" tells the story of the struggle between ambition and stability. On January 5th: "Chiamate quasi perfette" That word again — "quasi". And then the real enemy: "Fix call zombie: terminate active call when app goes to background or is killed" Zombie calls — the ones that stay alive after the app dies — will haunt the codebase for weeks.

The Watchdog

The most feared error code among iOS developers: 0x8BADF00D ("ate bad food"). It means the system killed the app because the main thread was blocked. "fix: prevent watchdog crash (0x8BADF00D) from background reloadData" It will appear three times in Taski's history. Each time, hours of debugging to find which operation was holding the main thread hostage. In April, the backup. In May, the AI search. The watchdog does not forgive.

The Worker is born

The backend becomes a Cloudflare Worker: serverless, edge-first, globally distributed. v54.13.0. The first commit of the dedicated repo. From here, 717 deploys will follow in 5 months. Giphy proxy with KV cache, GIF endpoints, privacy fixes. The engine of Taski has a new heart.

The infrastructure grows

Key versioning for E2EE key rotation. Call heartbeat system. Stickers with dedicated storage and TTL. Push queue with Durable Objects and client ACK. Anti-abuse rate limits on SMS. Presence pub/sub system. Every week, a new system.

Brute force

Sometimes elegance isn't enough. Push notifications are duplicating, the dedupe doesn't hold. "Forza retry push bypassando dedupe" The next day: "Fix push duplicate" And the classic cycle: the fix for the fix. A pattern that becomes familiar. There will be worker versions deployed 34 times in a single day.

February 2026

Zero D1 queries for push notifications

v56.2.0: the push system no longer touches the database. Everything lives in KV cache. It's the beginning of a performance obsession that will define the months ahead: every query eliminated is a victory, every millisecond saved means a user served better.

The backend ghosts

Durable Objects introduce a new breed of bug: zombie sessions. WebSockets that appear open but are dead. Presence that flickers. "Fix forceDelivery for zombie WS sessions" "alarm-based stale sweep for zombie WS detection" "self-heal stale state" The code learns to heal itself. When a WebSocket stops responding, the system declares it dead and cleans up the state. It's not elegant. It works.

04 The Expansion

Taski Web is born

React + Vite + Tailwind. The web client arrives with QR code pairing, full E2EE, real-time WebSocket. In 17 days it will become a complete client: chat, media, calls. "SECURITY: Remove open user search" The paranoia is already part of the DNA.

Stories and reactions

Stories come to Taski: like Instagram, but encrypted. Message reactions with emoji. Story likes with push avatar. The app starts to feel complete — no longer a project, but a product.

Siri and QR key verification

"Hey Siri, manda un messaggio con Taski" and it arrives E2EE-encrypted. Key verification via QR code and safety numbers, just like Signal. Share Extension for sharing photos and videos from any app, all encrypted.

Apple Watch companion

In a single day, 6 commits bring Taski to the Apple Watch. Chat, photos, avatars, logo in the toolbar. Real-time sync, loading spinners, parallel fetch. Taski is on your wrist. The next day, fixes for UI freeze, off-main-thread decrypt, async lock. The Watch is small but the problems are big.

Taski Desktop: Mac and Windows

Tauri 2 wraps the web client into a native app. macOS and Windows in a single day. Native menu bar, native notifications with E2EE preview, direct reply from notification, dock badge. Auto-update, Handoff with iOS for continuity. 76 commits will build a complete desktop client.

05 Intelligence

TaskiAI: message rewriting

Claude Haiku enters Taski. A sparkle button in the input bar rewrites your messages: more formal, more casual, corrected, translated. The first step toward integrated AI is subtle — not imposed, offered.

TaskiAI Chatbot

In one day, 10 commits build a complete chatbot. Claude Sonnet as a conversation in the chat list. Photo and PDF attachments. Markdown rendering. PDF document generation. Rate limit 20/hour. Auto model switching. "AI memo creation with reminders + Siri App Shortcut" The AI creates reminders from messages and schedules them via Siri.

AKD: Auditable Key Directory

Hash-chain audit of public keys. Ed25519 for client signatures. If someone tries to swap your key, the cryptographic chain detects it. Like Certificate Transparency, but for messaging keys. "Houston, we have a problem!" reads the space-themed maintenance screen added the next day.

April 2026

Spotify, Voice AI and Anti-Abuse

April is a month of creative explosion. Spotify integration with PKCE auth. Voice TaskiAI with GPT Realtime for voice conversations. AI anti-abuse system with Llama Guard 3 + Haiku double-check, 7-day auto-suspension. Ban system with real-time broadcast via WebSocket. The app isn't just beautiful — it's also safe.

The longest day

59 commits in 24 hours. The all-time project record. The worker alone accumulates 21 that same day. It's a day when everything happens at once: critical bugs, new features, hotfix upon hotfix. The git log for that day is a novel in its own right. More commits than the entire Desktop repo has.

The 72 hours

Three consecutive days with 34, 34 and 41 commits across iOS and Worker. AI anti-abuse, ban system, real-time broadcast, push queue dedup, TaskiAI image context. The worker hits 34 deploys in a single day: one deploy every 42 minutes on average. Sleep is optional.

06 The Armor

Audit and Hardening

Two rounds of security audits. timingSafeEqualString across all sensitive comparisons. AI mention with atomic D1 queries. Upload pre-size-check. Every endpoint reviewed, every input validated. Paranoia pays off.

Voice Web Search

TaskiAI Voice gets the web_search tool via Tavily. The AI can search the web during a voice conversation, announcing the search for transparency. Country mapping by language, cap of 3 searches per call.

Taski lands on Android

First as a Capacitor wrapper, then migrating toward a native Kotlin client. On May 17-18, during late-night sessions with parallel AI agents working autonomously, the native client takes shape: WebSocket, E2EE, FCM push, encrypted media. A bug surfaces between iOS and Android: encrypted push notifications aren't arriving. Two lines in the iOS NSE were needed — invisible before because the cache was covering the path. 10 critical bugs fixed in post-audit. The sixth platform is live.

The accepted bug

Sometimes the right answer isn't "fix" but "accept". A second push arrives after 60 seconds under burst conditions. Four sub-agents analyze the problem in parallel. The conclusion: APNs volume is low, iOS deduplicates via collapse-id, and an architectural fix would break more things than it solves. The bug is documented and accepted. Not everything needs fixing. Some things need understanding.

Offensive security audit

Full offensive audit: 6 fixes deployed. XSS protection, admin ratelimit, error oracle elimination, country block SMS, CORS whitelist. Cloudflare Access on admin panel. You don't wait for the attack: you go looking for it.

Apple App Attest

Apple attestation and assertion integrated. Trust tiers for devices. Only genuine apps can talk to the backend. The bypass header is gone. The chain of trust is complete: from Apple silicon all the way to the Cloudflare server.

07 The Ecosystem
May 2026 — Today

6 platforms, one ecosystem

iPhone. Apple Watch. Mac. Windows. Web. Android.
3,165 commits. 717 worker deploys. 66 database migrations. 322 web commits. 76 desktop commits.
End-to-end encryption on every message, call, photo, video, sticker.
Integrated AI that respects privacy. Anti-abuse with dual AI model.
Hash-chained key directory for cryptographic transparency.
Apple App Attest for hardware trust.

59 commits in a single day. Commits at 5 in the morning. Typos in commit messages that betray the exhaustion. "Forse", "sembra", "quasi perfetto" — the words of someone building something bigger than themselves.

From Initial Commit to here: 183 days. From an empty folder to an ecosystem.

The story
continues

Every commit is a step forward. Every bug fixed is a lesson learned. Every feature is a promise kept.

$ git log --oneline | wc -l 3165