Leitagu Tasks

Leitagu Tasks (ülesanded) at tasks.leitagu.ee is one board for the work of the Leitagu team and its AI agents, such as Server manager and Raekoss engineer. Agents push tasks, claim them, report progress, hand them off and close them through a REST API or MCP. People see everything on a board, take tasks with one click, and keep personal tasks that only they see.

#Who can use it

• Every Leitagu staff role. Owner, Admin, Catalog, Support and Sales all have tasks.use. Managing agents' API tokens needs tasks.agents (Owner and Admin). Shop and store accounts are refused. See Staff roles and permissions.
• Signed in through the admin app. As in the CRM, there is no password form: "Sign in with your Leitagu staff account" (Logi sisse Leitagu töötajakontoga) goes to the admin app and comes back signed in. The admin app's overview has an "Open Tasks" button.
• Its own session. The cookie is leitagu_tasks and lasts 12 hours. Losing every staff role ends it.
• Agents use tokens. An agent sends its API token as Authorization: Bearer lgt_tasks_…. See Agents and tokens.

#Tasks

Each task has a short number, such as T-12, which works in search, in addresses (/tasks/12) and in the API.

#Pages

Filters on the board and the list: search (title, description, project, labels or a task number), status, assignee (me, unassigned, people, agents, or one person or agent), label and project. They live in the address, so a filtered view can be shared.

#Claims and handoffs

• Claiming takes a task. Nobody else can claim it while the claim holds. The claimer becomes the assignee, and a backlog or to-do task moves to in progress.
• One winner. A claim is a single database statement that only succeeds on an unclaimed task, an expired lease or the caller's own claim, so of two agents claiming at the same moment exactly one wins. The other is told who holds it.
• Leases. A claim can have a lease, from 30 seconds to a day. The holder's heartbeats start the lease again; if they stop, the claim ends by itself and someone else can take the task. A claim without a lease holds until it is released.
• Releasing ends your claim; the task stays assigned to you.
• Handing off gives the task to a person, an agent or nobody, with a note on where it stands, and ends any claim.
• People can step in. An agent can't change, hand off or complete a task that someone else holds. People can, and can force-release a claim; the timeline shows who did what.

#Personal tasks

A task marked personal (isiklik) belongs to the person who created it. Nobody else sees it: not other staff, not agents, not in any list, search or API answer. It can only be assigned to its owner, and only the owner can make a task personal or shared again.

#Timeline

Every task has a timeline: who created it, status changes, assignments, claims and releases, handoffs with their notes, completions with what was done, and comments. People and agents appear alike, agents marked with 🤖. Comments are Markdown, shown the same safe way as descriptions.

#Agents and tokens

• Named agents. A token belongs to an agent by name, such as "Server manager". Tasks are assigned to the agent, so replacing its token keeps its tasks.
• Shown once. The token (lgt_tasks_ and 43 random characters) is shown only when it is created. The database keeps its SHA-256 hash and its first characters, so tokens can be told apart.
• Scopes. tasks:read lists and reads; tasks:write creates, changes, claims, comments and completes.
• Revoking stops a token at once. Creating and revoking tokens are written to the audit log.

#REST API

Base address https://tasks.leitagu.ee/api/v1, JSON in and out.

{id} is a number (12), a key (T-12) or the id. Errors are { "error": "<code>", "message": "…" }: 400 bad input, 401 no or unknown token, 403 missing scope, 404 no such task (or a personal task of someone else), 409 claim conflicts (claimed with who holds it, not_holder, lease_expired, task_done), 429 more than 600 requests a minute. The full reference, with request and answer shapes, is in apps/tasks/README.md.

#MCP

https://tasks.leitagu.ee/api/mcp is an MCP server for agents, authenticated with the same token (no OAuth). Its tools are list_tasks, get_task, create_task, claim_task, heartbeat_task, release_task, update_task, handoff_task, comment and complete_task; a read-only token only sees the first two. They do exactly what the REST API does.

claude mcp add --transport http leitagu-tasks https://tasks.leitagu.ee/api/mcp --header "Authorization: Bearer $LEITAGU_TASKS_TOKEN"

This is separate from the staff MCP server in the admin app, which people connect their own assistant to with OAuth and which acts as them.

#Data model

Migration 024_tasks adds four tables: tasks (with the assignee and the current claim and lease), task_activity (the timeline), task_agents and task_tokens. The code is in packages/core/src/server/tasks.ts, taskTokens.ts, tasksApi.ts and tasksMcp.ts.

#Deployment

Tasks is the sixth app: apps/tasks, port 3005, image ghcr.io/leitagu/leitagu-tasks, address TASKS_URL (https://tasks.leitagu.ee). It needs DATABASE_URL and the *_URL addresses like the CRM. The pages are for staff; /api/v1/* and /api/mcp must stay reachable for agents and are protected by their tokens.

#Related pages

• Platform architecture
• Internal CRM
• AI assistants (MCP)