Meetings — production readiness — roadmap

Status: Planned
Author: Christophe
Date: 2026-07-21
Repo: north-os
Related: design spec 2026-07-21-meeting-production-readiness-design · reviews docs/reviews/2026-07-21-meeting-system-review.md + docs/reviews/2026-07-21-meeting-parity-recording-rag-state.md · EPIC NOS-57. Linear EPIC: this roadmap.

Twelve workstreams, ordered by failure severity. Each maps to findings in the two review docs; the per-workstream spec + plan lives in its Linear sub-issue. Two net-new builds carry their own design spec: WS-4 (meeting-lifecycle-recovery) and WS-12 (meeting-rag-ingestion).

The gate (do this first)

WS-0 / pivotal: confirm the deployed MEETINGS_TRANSCRIPTION_PROVIDER + retention/summary flags in preprod and prod. WS-1 and WS-12 are blocked on the answer. This is a lookup, not a build.

P0 — ship-blockers (gate a real-lawyer rollout)

• WS-1 — Close the stub-fabrication hazard. Provider mandatory at boot, refuse stub outside an explicit test gate, retention never purges transcribed_by='stub'. Relates to NOS-58/59. Deps: the gate.
• WS-2 — Consent truth on both clients. macOS: disclose "both sides" + a real systemAudioActive state; visible mic-only fallback. Windows: prompt states upload/transcription when signed in. Relates to NOS-63. Ship-blocking.
• WS-3 — macOS recorder stop/start race. Awaited start/stop state machine, synchronized stopped flag checked after every await, flush + header-patch + close as the final block on writeQueue. Kills the corrupt-WAV / crash-at-stop / capture-after-stop trio.

P1 — lifecycle, integrity, reliability

• WS-4 — Transcription lifecycle recovery. (own spec: meeting-lifecycle-recovery) Owner/lease + claimed_at on transcription, reclaim stale transcribing under CAS, failed→pending re-drive, pending-rescue sweep, AudioFetchError retryable, worker non-zero exit on fatal + unhandledRejection hook, and — the prerequisite for WS-12 — durable delivery of source.meeting.transcribed (re-emit-from-ready).
• WS-5 — Retention covers the failure paths + poisoned-batch-safe sweep. Terminal-state audio policy (bounded quarantine + audit row for failed/stuck), R2-prefix orphan sweep, and a claim-based sweep (SKIP LOCKED + last_purge_attempt_at + backoff + keyset pagination) so one undeletable batch cannot stall retention fleet-wide.
• WS-6 — Ingest idempotency. Client-generated recording UUID in the multipart form, unique (organization_id, uploaded_by, client_recording_id), return-existing on retry, and publish audio_received through a transactional outbox; 202 once the row is durably committed even if the emit lags.
• WS-7 — whisperx concurrency + backoff + streaming. whisperx worker concurrency 1, minutes-scale backoff (or slot reservation before materializing audio), adapter timeout ≥ service self-bound, streaming AES-GCM envelope + request body-size limit before parsing.
• WS-8 — Windows client parity to a shippable bar. Port the 7-day retention janitor, switch the 4h cap to a monotonic wall clock, auto-stop on meeting-end (match macOS + fix the doc lie), replace the XOR token blob with a real secure store, and sign/package (Authenticode/MSIX) + remove the plain-HTTP DLL side-updater.

P2 — cost, correctness, security, tests

• WS-9 — Summary robustness. Terminal-state cap on the backfill (attempt counter / terminal marker; stop the every-5-min infinite re-drive), AbortSignal timeout on the Anthropic call, a distinct "transcript unreadable" state (never read corrupt segments as empty), and preserve lawyer-entered action-item state on re-generation.
• WS-10 — Security hardening. Environment-driven upload hosts (kill the dead jeremy.design defaults, https-only overrides), Windows secure token store (folds into WS-8), matched-host-only debug logging (no raw URLs / Zoom passcodes), truncate the transcript body written to meeting_audit.metadata, and a dedicated KMS-scoped meeting-audio key domain (out of the OAuth-token namespace).
• WS-11 — CI gate + failure-mode tests. Gate the hermetic @workspace/meetings suite in CI, wire the DB/RLS suites to CI's throwaway Postgres, and add crash-after-CAS, poisoned-retention-batch, ASGI concurrency/RSS, and native lifecycle tests (delayed system-audio start, stop-before-start, mic loss, WAV finalization, duplicate-upload, 7-day janitors).

P3 — feature (after WS-1 + WS-4)

• WS-12 — Meeting → RAG ingestion for "what happened" search. (own spec: meeting-rag-ingestion) A transcript-chunking consumer of source.meeting.transcribed, new doc_type/chunk_kind values, speaker/timestamp-aware chunks, voyage-law-2 embed into knowledge_chunks, and semantic retrieval replacing the label-substring filter. Blocked on WS-1 (no stub in the RAG) and WS-4 (durable transcribed-event).

Sequencing

• Now: the gate (WS-0) + WS-1, WS-2, WS-3 in parallel (independent surfaces).
• Next: WS-4 → unblocks WS-12; WS-5, WS-6, WS-7 independent; WS-8 is a Windows track that can run alongside.
• Then: WS-9, WS-10, WS-11 (WS-11 lands the guardrails that keep 1–8 from regressing).
• Last: WS-12, once the provider is confirmed non-stub and the event is durable.

Acceptance for the EPIC

Every P0/P1 workstream merged with tests; the invariants in the design spec hold under the failure-mode suite (WS-11); a real HSE meeting recorded on both platforms transcribes with a confirmed non-stub provider, is retained honestly, survives a worker restart, and is retrievable by semantic "what happened" search — with consent copy that matches what was captured.