Meetings — production readiness — design spec

Status: Planned
Author: Christophe
Date: 2026-07-21
Repo: north-os (packages/meetings, apps/worker-meetings, apps/web/lib/meetings, packages/db meeting schema, services/whisperx, apps/polaris, apps/polaris-win, packages/knowledge)
Related: docs/reviews/2026-07-21-meeting-system-review.md (converged adversarial review) · docs/reviews/2026-07-21-meeting-parity-recording-rag-state.md (parity + RAG) · spec 2026-06-22-north-recall-meeting-capture-design · EPIC NOS-57. Sub-specs: 2026-07-21-meeting-lifecycle-recovery-design, 2026-07-21-meeting-rag-ingestion-design.

Problem

Two independent blind reviews (Claude Fable + GPT-5.6-Sol) of the meeting system reached the same verdict: not production-safe for a law firm yet. The server core is strong — AES-256-GCM envelope with org+meeting-bound AAD, RLS modeled in TS and enforced with explicit predicates, an atomic CAS state machine + audit trail, constant-time whisperx auth. The risk is in the bands around that core: capture-client consent integrity, transcription-lifecycle recovery, and retention of the failure paths. Separately, the Windows client is at capture-parity but missing ship-critical safety (retention janitor, secure token store, signed packaging, meeting-end auto-stop), and meetings are entirely absent from the RAG — "what happened" search today is direct SQL only.

This spec frames the program that turns the meeting system into something shippable to a real lawyer and defines the invariants every workstream must hold. The exhaustive findings live in the two review docs; this doc captures the decisions.

Invariants (non-negotiable across all workstreams)

  1. No fabricated legal record. The transcription provider must be confirmed non-stub in every environment that accepts real audio, enforced at boot; retention must never purge a stub-transcribed row; the RAG must never ingest stub content. A canned transcript presented as a real meeting is the worst failure this system can produce.
  2. Consent copy matches behavior, byte for byte. Every recording surface states exactly what is captured (mic vs both sides) and where it goes (on-device vs uploaded). No surface may claim less than the code does.
  3. No silent permanent loss, no fabrication-adjacent read. A meeting can never wedge forever with no operator signal; a corrupt/empty transcript surfaces as a distinct state, never as "the meeting was silent."
  4. Retention is honest for every terminal state, not just ready — failed, stuck, and orphaned audio fall under a bounded, audited policy.
  5. Tenant isolation preserved end to end — every new store (RAG chunks) and path inherits the existing organization_id RLS wall.

The pivotal gate

Confirm the deployed MEETINGS_TRANSCRIPTION_PROVIDER + retention/summary flags in preprod and prod before any other work lands. The stub-fabrication hazard (WS-1) and the RAG-ingestion feature (WS-12) are both gated on this. Everything else can proceed in parallel once it is known.

Scope

In: the correctness/security/reliability remediation from the review, mac/win client parity to a shippable bar, and the meeting→RAG ingestion feature. Out (this program): the broader recall/UX surfaces tracked under NOS-57; new transcription providers; the ethical-wall / matter-team visibility model (a dependency for WS-12, owned elsewhere).

Decisions

See the roadmap plan (2026-07-21-meeting-production-readiness) for workstream sequencing, dependencies, and acceptance.