Generate a task management app that survives the first engineering hire

What you get in the generated ZIP

Concrete file tree from a recent task-tracker generation:

app/
├── blueprints/
│   ├── auth_bp.py              # JWT + refresh, httpOnly cookies
│   ├── workspace_bp.py         # multi-tenancy CRUD
│   ├── project_bp.py
│   ├── task_bp.py
│   ├── comment_bp.py
│   ├── activity_log_bp.py
│   ├── billing_bp.py           # Stripe subscription
│   └── webhook_bp.py           # Stripe webhook signature verification
├── models/
│   ├── user.py                 # email_verified, password_hash, audit fields
│   ├── workspace.py            # owner_id, plan, usage counters
│   ├── project.py              # FK workspace_id, RLS-eligible
│   ├── task.py                 # state machine: draft → in_progress → in_review → done → archived
│   └── comment.py              # free-text body, flagged for indirect-PII risk
├── services/
│   ├── notification_service.py # SMS via Twilio, email via Resend
│   └── reminder_scheduler.py   # Celery Beat for daily digest
└── tests/
    └── (one folder per blueprint)

frontend/
├── src/app/
│   ├── (auth)/                 # login, register, forgot-password, verify-email
│   ├── (protected)/            # dashboard, projects, tasks
│   └── settings/               # billing, profile, team

mobile/                          # optional Expo target
└── ...

docs/
├── decisions/
│   ├── ADR-0001-backend-stack-flask-nextjs.md
│   ├── ADR-0003-database-postgresql.md
│   ├── ADR-0005-jwt-httponly-cookies.md
│   ├── ADR-0009-payment-provider-stripe.md
│   └── ...
├── traceability/matrix.md + matrix.csv
├── compliance/dpia.md          # GDPR, populated from the entity model
├── security/posture.md
├── cost/tco.md
└── handoff-readme.md

What's already wired

• Auth: Email + password, password reset via email, email verification, JWT in httpOnly cookies (web) and expo-secure-store (mobile). Passwords hashed with the platform's standard helper.
• Multi-tenancy: Every protected route filters by workspace_id. Every model with tenant data has the FK. The Query.all() anti-pattern is flagged by the quality scorer.
• Billing: Stripe subscription scaffold with webhook signature verification, idempotency keys on payment events, plan enforcement in middleware, downgrade handling.
• State machine: Task lifecycle is a documented state machine with from-state guards on every transition. The transitions are logged for audit.
• Background jobs: Celery Beat for daily digest emails (or weekly, depending on your PRD), Celery worker for transactional sends.
• Observability: Structured logging, optional Sentry wiring, health endpoint at /api/health, deployment config for nine targets.
• Mobile: Optional Expo app with the same auth flow, list/detail/edit screens for tasks, and biometric gate for sensitive actions if your PRD mentions security-conscious users.

Compliance overlay

If your PRD mentions GDPR (or you flag it in the wizard), the generated docs/compliance/dpia.md populates with the actual entity model — User.email flagged direct PII, User.ip_address flagged direct PII, Task.assignee_id flagged indirect PII, Comment.body flagged "indirect PII risk — likely contains" because users will type names and emails into free-text fields. The data-subject access export endpoint scaffold is generated too.

Internal links

• See the Archiet vs Cursor comparison for how this fits next to your IDE assistant
• The for/cto page covers the handoff pack from a CTO perspective

CTA

Try it — free plan, no credit card. archiet.com.

Generate a task tracker, look at the docs/ tree, decide if it's the shape your team would actually maintain.