From a tentative first commit to a full ecosystem across 6 platforms. Six months of code, sleepless nights, impossible bugs and small victories.
It all starts with an empty folder and an idea: a messaging app that puts privacy first. The first commit is bare — an Xcode skeleton, a SwiftUI project with more hope than code. "tentativo sistemazione login" reads the second commit, minutes later. Nothing works yet, but the journey has begun.
Initial Commit
Within 24 hours, push notifications and WebSocket are working. The backend can deliver messages in real time. The profile photo upload fails on the first try — "App compila update profilo fallito" but by the next morning it works. Messages appear on screen. For the first time, two devices are talking to each other.
The commit message says it all: "Chat funzionante, profilo funzionante" For the first time chats persist, messages arrive, the profile updates. The foundation is there. From here, we build.
Timestamps don't lie: commits at 00:52, at 2:13, at 2:30, at 4:53, at 5:07. A flurry of late-night commits takes the app from "it works" to "it looks real". Typing indicator, read receipts, deeplinks, badges. At 4:53 the first of the ghosts that will haunt this project appears: "fix chat fantasma e push" At 5:07, exhausted: "risolti" A single word. Then silence until tomorrow.
Five days after the first commit, end-to-end encryption is live. Every message encrypted with Curve25519 keys. The server can't read a thing. It's not a feature bolt-on: it's the DNA of Taski. From this moment on, not even the person running the server can see users' messages.
The all-caps commit message does not lie. Push notifications with encrypted preview, message replies, encrypted messages with correct timestamps. In just 6 days, Taski has the complete foundations of a secure messenger. "NOTIFICHE FUNZIONANTI" shouts a commit moments earlier. The excitement is palpable in the git log.
Still at night, at 1:06 AM. User matching by phone number. SMS login. Taski stops being an experiment and becomes something you could install on your mother's phone.
On December 4th, groups enter the codebase. The git log tells an epic in four acts: "Gruppi funzionanti" "Gruppi perfettamente funzionanti" "Gruppi quasi perfetti" "GRUPPI PERFETTI" The next day, again: "Logica gruppi perfetta" Five commits, five escalating levels of certainty. Or perhaps of self-persuasion.
21 commits in 4 days, and doubt permeates every line: "Per ora BENE" "Sistamazione spunte? Forse!" "chat eliminate sembra funzionare" "Abbinamento chat quasi perfetto" "sistemato forse tutto" This isn't confidence: it's hope. Read receipts work, then stop working. Ghost chats appear and vanish. The typos in commit messages betray the exhaustion: "Sistamato", "nofifiche", "implemenzazione". But the code pushes forward.
While the world celebrates, the commits don't stop. Voice message transcription. Link previews. Video. On December 23rd: "Posizionamento messaggi quasi perfetto" On the 27th: "Forse ci siamo, chat sistamata" "Chat sembra ok" "Sembra". "Forse". "Quasi". The words of someone who has learned not to trust. On December 26th, Saint Stephen's Day: "Sistemato problema freeze UI in chat" No day off for the app.
Agora SDK integration for real-time calls. Ringback tone, missed call handling, automatic speaker on video calls. The calls too are E2EE-encrypted with Curve25519 keys. "Nascondi tasto videochiamata (da riabilitare)" tells the story of the struggle between ambition and stability. On January 5th: "Chiamate quasi perfette" That word again — "quasi". And then the real enemy: "Fix call zombie: terminate active call when app goes to background or is killed" Zombie calls — the ones that stay alive after the app dies — will haunt the codebase for weeks.
The most feared error code among iOS developers: 0x8BADF00D ("ate bad food").
It means the system killed the app because the main thread was blocked.
"fix: prevent watchdog crash (0x8BADF00D) from background reloadData"
It will appear three times in Taski's history. Each time, hours of debugging to find which operation
was holding the main thread hostage. In April, the backup. In May, the AI search.
The watchdog does not forgive.
The backend becomes a Cloudflare Worker: serverless, edge-first, globally distributed. v54.13.0. The first commit of the dedicated repo. From here, 717 deploys will follow in 5 months. Giphy proxy with KV cache, GIF endpoints, privacy fixes. The engine of Taski has a new heart.
Key versioning for E2EE key rotation. Call heartbeat system. Stickers with dedicated storage and TTL. Push queue with Durable Objects and client ACK. Anti-abuse rate limits on SMS. Presence pub/sub system. Every week, a new system.
Sometimes elegance isn't enough. Push notifications are duplicating, the dedupe doesn't hold. "Forza retry push bypassando dedupe" The next day: "Fix push duplicate" And the classic cycle: the fix for the fix. A pattern that becomes familiar. There will be worker versions deployed 34 times in a single day.
v56.2.0: the push system no longer touches the database. Everything lives in KV cache. It's the beginning of a performance obsession that will define the months ahead: every query eliminated is a victory, every millisecond saved means a user served better.
Durable Objects introduce a new breed of bug: zombie sessions. WebSockets that appear open but are dead. Presence that flickers. "Fix forceDelivery for zombie WS sessions" "alarm-based stale sweep for zombie WS detection" "self-heal stale state" The code learns to heal itself. When a WebSocket stops responding, the system declares it dead and cleans up the state. It's not elegant. It works.
React + Vite + Tailwind. The web client arrives with QR code pairing, full E2EE, real-time WebSocket. In 17 days it will become a complete client: chat, media, calls. "SECURITY: Remove open user search" The paranoia is already part of the DNA.
Stories come to Taski: like Instagram, but encrypted. Message reactions with emoji. Story likes with push avatar. The app starts to feel complete — no longer a project, but a product.
"Hey Siri, manda un messaggio con Taski" and it arrives E2EE-encrypted. Key verification via QR code and safety numbers, just like Signal. Share Extension for sharing photos and videos from any app, all encrypted.
In a single day, 6 commits bring Taski to the Apple Watch. Chat, photos, avatars, logo in the toolbar. Real-time sync, loading spinners, parallel fetch. Taski is on your wrist. The next day, fixes for UI freeze, off-main-thread decrypt, async lock. The Watch is small but the problems are big.
Tauri 2 wraps the web client into a native app. macOS and Windows in a single day. Native menu bar, native notifications with E2EE preview, direct reply from notification, dock badge. Auto-update, Handoff with iOS for continuity. 76 commits will build a complete desktop client.
Claude Haiku enters Taski. A sparkle button in the input bar rewrites your messages: more formal, more casual, corrected, translated. The first step toward integrated AI is subtle — not imposed, offered.
In one day, 10 commits build a complete chatbot. Claude Sonnet as a conversation in the chat list. Photo and PDF attachments. Markdown rendering. PDF document generation. Rate limit 20/hour. Auto model switching. "AI memo creation with reminders + Siri App Shortcut" The AI creates reminders from messages and schedules them via Siri.
Hash-chain audit of public keys. Ed25519 for client signatures. If someone tries to swap your key, the cryptographic chain detects it. Like Certificate Transparency, but for messaging keys. "Houston, we have a problem!" reads the space-themed maintenance screen added the next day.
April is a month of creative explosion. Spotify integration with PKCE auth. Voice TaskiAI with GPT Realtime for voice conversations. AI anti-abuse system with Llama Guard 3 + Haiku double-check, 7-day auto-suspension. Ban system with real-time broadcast via WebSocket. The app isn't just beautiful — it's also safe.
59 commits in 24 hours. The all-time project record. The worker alone accumulates 21 that same day. It's a day when everything happens at once: critical bugs, new features, hotfix upon hotfix. The git log for that day is a novel in its own right. More commits than the entire Desktop repo has.
Three consecutive days with 34, 34 and 41 commits across iOS and Worker. AI anti-abuse, ban system, real-time broadcast, push queue dedup, TaskiAI image context. The worker hits 34 deploys in a single day: one deploy every 42 minutes on average. Sleep is optional.
Two rounds of security audits. timingSafeEqualString across all sensitive comparisons.
AI mention with atomic D1 queries. Upload pre-size-check.
Every endpoint reviewed, every input validated. Paranoia pays off.
TaskiAI Voice gets the web_search tool via Tavily.
The AI can search the web during a voice conversation, announcing the search
for transparency. Country mapping by language, cap of 3 searches per call.
First as a Capacitor wrapper, then migrating toward a native Kotlin client. On May 17-18, during late-night sessions with parallel AI agents working autonomously, the native client takes shape: WebSocket, E2EE, FCM push, encrypted media. A bug surfaces between iOS and Android: encrypted push notifications aren't arriving. Two lines in the iOS NSE were needed — invisible before because the cache was covering the path. 10 critical bugs fixed in post-audit. The sixth platform is live.
Sometimes the right answer isn't "fix" but "accept". A second push arrives after 60 seconds under burst conditions. Four sub-agents analyze the problem in parallel. The conclusion: APNs volume is low, iOS deduplicates via collapse-id, and an architectural fix would break more things than it solves. The bug is documented and accepted. Not everything needs fixing. Some things need understanding.
Full offensive audit: 6 fixes deployed. XSS protection, admin ratelimit, error oracle elimination, country block SMS, CORS whitelist. Cloudflare Access on admin panel. You don't wait for the attack: you go looking for it.
Apple attestation and assertion integrated. Trust tiers for devices. Only genuine apps can talk to the backend. The bypass header is gone. The chain of trust is complete: from Apple silicon all the way to the Cloudflare server.
iPhone. Apple Watch. Mac. Windows. Web. Android.
3,165 commits. 717 worker deploys. 66 database migrations. 322 web commits. 76 desktop commits.
End-to-end encryption on every message, call, photo, video, sticker.
Integrated AI that respects privacy. Anti-abuse with dual AI model.
Hash-chained key directory for cryptographic transparency.
Apple App Attest for hardware trust.
59 commits in a single day. Commits at 5 in the morning. Typos in commit messages
that betray the exhaustion. "Forse", "sembra", "quasi perfetto" —
the words of someone building something bigger than themselves.
From Initial Commit to here: 183 days. From an empty folder to an ecosystem.
Every commit is a step forward. Every bug fixed is a lesson learned. Every feature is a promise kept.