WorkGraph treats tasks as nodes, relationships as edges and templates as the ontology. Beyond parent/child hierarchy there are dependency, blocking and reference edges - so "who is blocking whom" is no longer something people have to remember. It can be queried, drawn, and subscribed to by other systems.
These are not three lines on a feature list. They are three modelling decisions, and they decide which questions the product can answer.
Each kind of task (bug, requirement, review...) gets a template that defines its fields, and a task is an instance of that template. Editing a template never rewrites existing tasks - every instance remembers the version it was created from.
The task detail page says bug · v3
On top of hierarchy, tasks carry dependency, blocking and reference edges. "Who is blocking whom" becomes something you query and draw, instead of something someone recites in a standup.
Dependency order = the horizontal axis
A project you are not a member of does not exist for you: the answer is 404, not 403. Global admins are no exception - task visibility always goes through project membership, so an admin has to join first, and joining is audited.
404 instead of 403, on purpose
From getting in to projecting out, the product has exactly one main line. Everything else hangs off the side of it.
Sign in with email and password. The project switcher in the top bar decides whose data a page lists; the sidebar is filtered by permission - entries you cannot see are not disabled, your role simply does not have them.
Choose a template before filling in a form. The template decides what the form looks like, and how this kind of task can be counted later.
The form is generated from the template, with custom fields to cover whatever the template does not.
Attach parents (up to 8 levels, never to itself or its own descendants) and draw dependency, blocking and reference edges. This step is where the product diverges from a to-do list.
The turning pointFour states: not started, in progress, done, blocked. The board is drag-and-drop, and progress rolls up as a plain average of direct children - deliberately unweighted, so when you need an exact figure you read the numbers, not the percentage.
Tasks with unfinished predecessors show a lock badge. There is no realtime co-editing, but saving does a version check, so nobody's edit is silently overwritten.
Project the graph outward: webhook events and a JSON-LD read API let other systems subscribe to task changes.
Hand-drawn SVG with ELK layout - not an exported static picture. Horizontal is dependency order, dashed frames are hierarchy; node fill is status, the left bar is priority, the icon is type.
Legend
Hard limits, stated up front
Four things it does differently
Non-matching nodes fade instead of disappearing, and the corner shows "X of Y matched". You always know which part of the whole you are looking at.
Focus mode keeps ancestors, descendants and transitive dependencies; filter, focus and collapse state all live in the URL query, so a colleague opens exactly the screen you were looking at.
Download SVG, download PNG at 2x, copy the PlantUML source, or save it as a project diagram. The first three happen entirely in the browser - the graph never leaves it.
Tab and Enter navigate; clicking a node opens a peek drawer. A plain-text list of nodes and dependencies ships alongside, so a screen reader never has to chew through the SVG.
The five modules you know from WorkSync are five kinds of a single resource mechanism here: one permission model, one trash, one way to share. Not five subsystems each solving it again.
markdownA tree up to 5 levels deep, autosaving about every 2 seconds. Full version history: line-level diff, preview, tagging and rollback, with history append-only. Cross-document links resolve by id, so renaming never breaks them.
diagramRendering goes through a self-hosted PlantUML server, so source never appears in a URL, a Referer header or a proxy log. 100k character cap; syntax errors come back as an annotated error image. The project's task relationship diagram is generated automatically.
whiteboardAn Excalidraw canvas that autosaves, storing the canvas, background and grid only. Paste accepts bitmaps only - SVG carries a script-injection risk, so it is refused. 3MB canvas cap.
file50MB by default, 1-500MB by platform policy. Virus scanning fails closed: if the scanner is unconfigured, unreachable or times out, the upload is rejected rather than waved through.
external_urlOff-site material is registered as a resource, so it attaches to tasks, goes to trash and gets shared like everything else.
The global role (admin / user) decides which pages you can open; the project role (PM / collaborator / tester / observer) decides which tasks you can touch. The two multiply, and any role the system cannot resolve falls back to least privilege.
Governance pages - users, logs, the project list - belong to admins; project content still goes through membership. There is no back door into a project they have not joined, and joining is itself an audited event.
Five whitelisted categories: authorization, sharing, destructive actions, auth and credentials, configuration changes - plus every denied action, highlighted. Ordinary field edits go to the object's own activity feed instead. The audit log has no TTL.
The newest sign-in wins. Force-logout is not an instant disconnect and does not change the password; to actually stop someone, disable the account. Accounts are never deleted - delete one and "who did this" in the audit log points at nothing.
Docs, diagrams, whiteboards, attachments and links are soft-deleted for 30 days. Tasks are deleted immediately and irreversibly, guarded by "a task with children cannot be deleted directly". Share links die on delete and do not come back on restore.
External access happens through an external principal, not a bare API key - and it is bound by the same project membership. Scopes: specific tasks, the project root task, or assigned to me.
Delivery headers
X-TaskGraph-Signature: sha256=HMAC-SHA256(secret, raw body)X-TaskGraph-Delivery: id of this deliveryWorkGraph is the product name; the repository, the CLI and the delivery headers all identify it as TaskGraph. Integrate against the header names above verbatim.
A token is shown in full exactly once at issue time; after that only an 8-character fingerprint remains. Issuing one is a critical audit event.
task.created / task.updated / task.status_changed / task.deleted, plus link.created / link.deleted. Both task and relationship changes are covered.
Consumers must verify the signature against the raw request body and dedupe on the payload id - global ordering is not promised, and duplicate deliveries are allowed by design.
1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours - then the delivery is dead-lettered. The delivery log carries the failure reason.
Two read-only endpoints: task list and task detail. Ask for JSON-LD in the Accept header and you get the semantic projection, with Vary: Accept on the response. Read only for now - there is no external write API.
GitHub is built in. Online and offline import share the same mapping and idempotency code, so results match field by field; re-running is safe, and "created 0 / skipped 48" is a success. One-way and read-only: changes here never flow back upstream.
The main line 0-6 is complete and running on real projects. One compose file brings up the whole stack, and data, diagram sources and files never leave your network.
Six services: the app, a single-instance worker, a MongoDB 7 replica set, object storage, upload virus scanning and PlantUML rendering. Only the app container is published - the other four are reachable on the stack network alone.
P95 internal queries stay under 200ms: every compound index leads with projectId, ancestry is a materialised path, and progress is computed on write. Reads happen in server components, so the client has no requests to cache.
PlantUML is self-hosted with its sandbox profile pinned. Object storage issues no presigned URLs - file bytes are proxied by the app, so it has no reason to be reachable from outside. The build makes no outbound calls either, and telemetry is off.
First collections, validators and indexes, then the built-in manual - both steps are idempotent, so re-running them on upgrade writes nothing twice. Mail settings bump a version counter and take effect hot, so the worker never restarts.
WORKGRAPH
Book 30 minutes: bring a real slice of your plan, we draw its dependencies and hierarchy as a graph, and you see on the spot which chain is stuck. Teams already on WorkSync can use the same call to talk through migration.
We reply within one business day