ackboard

AI proposes. You ack.

A kanban board where AI drafts the subtasks, estimates and dependencies, and nothing touches your board until a person signs off on it.

Try the demo (one click, no sign-up) · Watch the video · Read the decisions

▶ From a card to an acked plan in 28 seconds. Click to watch on YouTube.

---

Why ackboard

AI that writes straight to your board is a liability. Auto-generated tasks look productive until someone has to clean them up.

ackboard keeps the AI in draft mode. It suggests and you decide, so your board only holds work a person signed off on. Ack is engineer shorthand for "seen it, approved", and that's the whole product: nothing the AI suggests is saved until you ack it.

How it works

The review is the product

Everything on the board

🔗 Dependencies that mean something	Blocked-by links, cycle checks, blocked badges and a bottlenecks panel.
👥 Built for the whole team	Live sync and presence for everyone on the board; invite with single-use links.
📝 Cards with depth	Markdown, labels, due dates, members and subtask checklists.
✋ Move fast	Reorder cards and columns with mouse, touch or keyboard.
🔒 Private by default	Owner, editor and viewer roles, enforced by Row Level Security in Postgres.
🧪 Try it in one click	Demo boards with no sign-up, deleted automatically after 7 days.

Engineering highlights

Designed, built and shipped end to end by one person, in production at kanban.utitytools.com.

• AI you can trust: versioned prompts, streaming structured output validated with Zod, user text delimited as untrusted input, an eval suite for quality, and per-call observability (cost, latency, tokens, outcome).
• Security in depth: Row Level Security on every table, tested with pgTAP; column-level grants; a nonce-based Content Security Policy; and AI calls routed only to providers that don't train on your data (ADR 0025).
• Deterministic where it matters: cycle detection, blocked tasks and bottlenecks live in pure, unit-tested TypeScript, not in the model.
• Cost under control: daily quotas per account and per demo session, plus a global budget cap (ADR 0016, ADR 0024).
• Tested on every PR: unit tests (Vitest), end-to-end tests (Playwright) and database tests (pgTAP). Production deploys only after migrations succeed.
• Every decision written down: 25 architecture decision records and blameless incident post-mortems.

Stack

Area	Tools
App	Next.js 16 (App Router, Server Actions, React Compiler) · React 19 · TypeScript strict
UI	Tailwind CSS v4 · shadcn/ui · dnd-kit
Data	Supabase: Postgres, Auth, Row Level Security, Realtime
AI	Vercel AI SDK v6 · AI Gateway · Zod-validated structured output
Quality	Vitest · Playwright · pgTAP · ESLint · Prettier · Husky · commitlint · GitHub Actions

AI: privacy and limits

• What is sent: when you click Suggest with AI (subtasks), the card's title, description and existing subtask titles; when you click Suggest blockers with AI, the card's title, description and column, plus the titles, columns and done state of up to 100 other cards on the board. Nothing else. It goes through Vercel AI Gateway to the model provider (Anthropic, Claude Haiku 4.5 by default). Don't put secrets or personal data in cards on a board where you use the AI.
• No training: every call asks the Gateway to route only to providers that don't train on the data you send; if none is available, the call fails instead (ADR 0025).
• What is stored: nothing from the model until you accept it. Accepted subtasks and blockers are saved like any others. For quotas and monitoring, the app records metadata about each call (who, when, which feature, model, tokens, cost, duration and how it ended), never the card text or the response (observability).
• Limits: 20 suggestions a day per account and 3 per demo session (subtasks and blockers combined), plus a global daily budget. All reset at midnight UTC (ADR 0016, ADR 0024).

Roadmap

• v0.1 Board, auth, RLS, drag and drop, demo mode, deploy
• v0.2 AI task decomposition with streaming, human review and daily quotas
• v0.3 Card dependencies (cycle checks, blocked badges, bottlenecks), invites, Realtime and AI-proposed blockers
• v0.4 AI evals and observability (cost, latency, tokens, outcomes)
• Launch Custom domain, email confirmation and password reset, AI live in production
• Brand The ackboard identity, a landing page with product loops, and a promo video

Getting started

Requirements: Node 24, pnpm, Docker (e.g. OrbStack).

pnpm install
pnpm db:start     # local Supabase in Docker
pnpm env:local    # writes local Supabase values into .env.local
pnpm dev          # http://localhost:3000

Full guide, commands, environments and known issues: docs/setup.md.

Documentation

Doc	What it covers
Setup	First run, commands, environments, where each variable lives, known issues
Workflow	Branch → PR → preview → merge, agents, enforcement layers, dependencies
Security	Secrets inventory, rules, safeguards, leak procedure, incidents
Observability	AI call events, usage records and ready-made SQL
ADRs	Architecture decisions and why they were made

How this project is built

Development is AI-assisted, with guardrails:

• Context for agents: AGENTS.md holds the stack, commands and conventions; CLAUDE.md adds Claude Code specifics.
• Specialised subagents in .claude/agents: DB architect, frontend, AI, QA and a read-only code reviewer.
• Enforced workflow: feature branches, Conventional Commits, PRs squash-merged into main with CI green. Enforced by Claude Code hooks, git hooks and branch rules, not just by convention.
• Decisions are recorded as ADRs in docs/adr, incidents as blameless post-mortems in docs/incidents.

License

MIT · Built by utity tools (Héctor Arrieta)