KeepForLater

Ingestion: a workflow that survives failure

Ingesting a one-hour video chains five slow, expensive operations: extraction, distillation, categorization, vector computation, finalization. Written naively, they form one long function where a single network error throws away work that was already paid for.

Each step is therefore a durable workflow step, checkpointed and idempotent. A failing step is retried on its own, with the previous results already persisted: if vector computation fails, transcription is not re-run — and therefore not re-billed.

• Long media transcribed via byte-range segmentation, working around the model output limit without degrading quality.
• Seven automated watch types (YouTube channels and playlists, subreddits, RSS feeds, keywords, weekly digest) triggered by scheduled tasks.

Distillation: the model returns JSON, not prose

The whole distillation — short summary, key points, concepts, narrative summary, timestamped chapters — is emitted as schema-validated JSON. The schema is declared once and shared across server, client and extension: if a field changes, the compiler flags it everywhere before deployment.

The model also self-assesses its faithfulness to the source, and that score is surfaced in the UI. Users can tell when a summary drifts from the original material, instead of having to take it on trust.

Retrieval: hybrid, because dense search alone fails

Dense search alone misses exactly what matters most: a proper noun, an acronym, an exact reference. Lexical search alone misses meaning. So both run in parallel and their results are fused by reciprocal rank, surfacing the passages both methods consider relevant.

Text is split into overlapping semantic chunks so that an idea straddling two paragraphs is never cut in half. Results are then diversified per source, so a single verbose document cannot monopolize the answer.

Every answer cites its sources, and clicking a citation opens the exact passage, highlighted. Search crosses languages: a question asked in French finds an English passage, by meaning.

• A replayable evaluation harness measures retrieval quality on every change — a regression shows up before release, not after.
• Per-user isolation is enforced at the SQL query level, including on the vector index.

Exposure: three surfaces, one contract

The product lives on three surfaces: a server-rendered, installable web app, a browser extension to capture a page in one click, and an MCP server. All three call the same end-to-end typed interface — the client knows the server routes at compile time, with no generated code and no documentation to maintain.

The MCP server is the most structural choice: it exposes the knowledge base as a set of tools usable straight from Claude, ChatGPT or a code editor. Users do not have to come to the app — they bring their own assistant.

• Active retention: on-demand quizzes, spaced repetition, and a knowledge graph linking sources by co-occurrence and semantic proximity.
• Text-to-speech with edge caching and a private podcast feed, to replay your own summaries on the move.

Economics and compliance: measure before billing

An AI product breaks on its costs before it breaks on its engineering. Every model call reports its real consumption, recorded per action. The credit system is calibrated on that measured cost: margin is known before the invoice, not discovered after.

On the compliance side, analytics and error-tracking tools only load after explicit consent, and account data is partitioned and genuinely deleted on request.

Operations: making the pipeline measurable

A production AI system raises three questions code alone cannot answer: what an action truly costs, which prompt produced a given result, and whether quality has dropped since the last release. Three questions, three mechanisms.

Telemetry writes one row per call actually emitted. Failed calls included: the provider bills tokens for a generation that dies mid-flight, and hiding them would understate cost. An unknown cost is recorded as unknown, never as zero — a zero would read as “free call” and skew every downstream total. Writes are batched and off the critical path: an observability outage loses the measurement, never the ingestion the user paid for.

Prompts stay in the repository — Git is the versioning. A registry stores only their identity: id, version, text fingerprint. On every integration run, the check recomputes the fingerprint of the prompt actually sent to the model and rejects an edited text that kept its version number. This is the linchpin: without that guard, before-and-after measurements blend under one version and the history becomes worthless.

Evaluation runs on three layers. Deterministic, free checks on every contribution: length, structure, language, and above all grounding — does every concept and every figure in the summary exist in the source? That is an objective, checkable hallucination signal. Then an independent judge, on a different model from the one under test. Finally a campaign that asks not “is this good?” but “at what point does it break?”.

• Traces are exported to an external observability tool, asynchronously and off the critical path. The official client will not boot on this runtime: since the ingestion API is a plain authenticated call, it is invoked directly — about a hundred lines, no dependency.
• An exporter that swallows its errors by design cannot be assumed to work, it must be proven: an end-to-end test sends a trace through the exact production path, reads it back with its observations, and names the project the keys belong to — the classic cause of “the test passes but the dashboard is empty”.
• Development, staging and production each tag their own traces: a regression caught in staging no longer pollutes production dashboards.
• Deleting an account anonymizes measurements rather than erasing them. Erasing would retroactively change the cost of an already-closed month on every departure — accounts that rewrite themselves make margin impossible to track.