MeetMind: meeting videos to cited notes, with the video kept in the browser

Problem & constraints

A one-hour 720p recording is about 1 GB (ADR-0001). Uploading it is slow, costs storage and hands the whole video to a server, when transcription needs only the speech. Groq’s Whisper free tier caps an upload at 25 MB, and Whisper downsamples to 16 kHz mono internally anyway, so everything above that is wasted. MeetMind’s one promise follows from that: the raw video never leaves the browser.

The second requirement is trust in the notes. A summary that names a decision, or an answer to “what did we decide about the budget?”, is only useful if the reader can check it against the moment it was said. So every decision, action item and answer has to carry a quote, and the quote has to be found in the transcript before anything is stored or shown.

The constraints were free tiers and no credentials. The target is 0 EUR/month. Groq’s per-minute token allowance, 8,000 tokens a minute for the summary model (ADR-0006), is the binding limit, not the daily one, so long transcripts are summarised in sequential, paced chunks. The development machine and CI had no cloud keys for most of the build, so every cloud service sits behind an interface with a local driver or a stub, and dev and CI run without accounts.

Architecture

MeetMind is a Nuxt 4 app with Nitro server routes; the model keys live only on the server. A video dropped on the home page goes to a Web Worker running single-thread ffmpeg.wasm, which mounts the file with WORKERFS instead of copying it into the WASM heap and writes the first audio track as 16 kHz mono Opus at 16 kbps. The video stays on the machine.

The upload has three steps. POST /api/meetings validates a small JSON body, checks the storage ceiling and mints a 15-minute presigned PUT URL for Cloudflare R2. The browser uploads the audio to R2 itself. A completion call then HEADs the object and accepts it only if its size equals the declared byte count and any media type it reports is audio/ogg; otherwise the object is deleted and the meeting is marked failed. Meeting metadata, transcripts, summaries and vectors live in Supabase Postgres with pgvector.

Each processing stage is a route started by a button on the meeting’s progress page. Transcribe sends the audio to Groq whisper-large-v3-turbo in one request per meeting and stores segments with integer millisecond offsets, under a compare-and-swap claim with a lease. Summarize splits the transcript on segment boundaries into chunks of at most 2,500 estimated tokens, sized so that a chunk and its reply fit one minute’s token allowance, sends them one after another to gpt-oss-120b, paced through a slot ledger in Postgres that the Q&A calls share, and asks for strict structured output whose schema puts the quote before the claim. reconcile() then looks for every quote in the transcript with attestQuote: text is normalised, matched as whole tokens so that “approved by everyone” does not match inside “disapproved by everyone”, and scripts written without spaces, such as Japanese or Thai, are matched character by character. An item whose quote is not found is dropped, and the timestamp comes from the segment where the quote was found.

Index embeds windows of about 45 seconds with gemini-embedding-2 at 768 dimensions. Ask embeds the question, retrieves the four nearest windows and has gpt-oss-120b answer with citations that must attest against those retrieved segments. Search across meetings returns passages, at most 5 per meeting, and no language model writes an answer. A native audio element plays the audio through a same-origin byte-range route, and a citation click seeks it to the quoted line. The decisions behind it are logged below, each with the alternative it beat.

What has run for real

The unit, end-to-end and browser tests run on stubs and local drivers. The stub summarizer quotes the transcript rather than inventing text, and says in its own output that it is a placeholder. A canary option makes it add one citation that is not in the transcript, so an end-to-end test proves over HTTP that the check drops it; without that, a disabled check would pass every credential-free test.

pnpm test:services exercises the real services. On 2026-10-23 it passed 17 of 17 against R2, Supabase, Groq Whisper and Gemini, the owner’s record in the repo’s pull request #14. The Whisper tests send real Ogg/Opus audio and parse the reply with the production parser. The Gemini tests check that 768 dimensions are honoured, that vectors come back unit-length, and that a question ranks nearer the passage that answers it. All nine database migrations are applied to the real Supabase project, and the R2 bucket has its CORS and lifecycle rules.

No automated test calls the chat model. On 2026-10-25 a synthetic one-hour meeting went through the real routes against the real Groq account, and at first it could not be summarised at all: the model spent its default output allowance reasoning, so every reply was cut off, and a full chunk with its reply came to more than the 8,000 tokens a minute allows. Smaller chunks, a set output cap and low reasoning effort fixed that. The check then dropped most of the correctly quoted items, because Whisper splits sentences across segments; a quote may now run across up to three consecutive segments, and 72 of 73 action items are kept. The meeting was synthetic, so this tests the check on verbatim quotes, not the quality of summaries of a real meeting.

GitHub Actions last passed on 2026-09-22. Since 2026-10-22 every run fails before a step starts, because of a billing block on the account, not a failing test. The gates run locally instead: pnpm ci:local runs the six jobs of the workflow, counts a job it cannot run as a failure, and a parity test holds it to the workflow file. Its last full green run was on 2026-10-23.

Outcomes

Build phases 0 to 8 of the plan’s 15 (0 to 14) are built: in-browser extraction, upload, transcription, the transcript player, cited summaries, cited Q&A over one meeting and search across meetings. Several of the plan’s instructions changed after checking: the summary model, the embedding model, a waveform player deferred in favour of the native one, and chunked transcription dropped because the app cannot produce a file over Groq’s cap. Each change has its reason in an ADR.

The extraction is the measured part. On 2026-07-08 a 1,045.8 MB one-hour 720p fixture became 8.11 MB of Opus in 16.0, 16.5 and 16.0 seconds over three runs in one page, with no out-of-memory error, in headless Chrome on a MacBook Air M5. The fixture is a test pattern with a sine tone, not a meeting: a sine encodes faster than speech, so the size class is the finding, and the re-run with a real recording is still open. Safari and Firefox are untested.

Nothing is deployed. A measurement spike before the orchestration phase (ADR-0009, 2026-10-22) built the server for Cloudflare Workers: the bundle is 1.69 MB, 495 kB gzipped, and loads under workerd with nodejs_compat. The blocker is ffmpeg-core.wasm, 30.7 MiB against the 25 MiB per-asset cap, which wrangler refuses locally and which is the same on every plan. Serving it from R2, shipping it gzipped at 9.7 MiB, building a smaller core or moving to WebCodecs are the options, and none is chosen. The spike also corrected an earlier audit: the local drivers fail with a 500 under workerd, so a deployment without credentials breaks loudly instead of serving stub transcripts.

Phase 9, orchestration, is underway (ADR-0012). On the Workers free plan a one-hour meeting takes about 8 minutes of paced Groq calls, so each request will do one bounded step and the browser will drive the loop. The Groq slot ledger in Postgres and the run ledger are built; until the later steps land, the stages are still started by hand, one button each. Phase 10, rate limiting, follows. An admin-only DELETE route closed the gap the repo had listed first (ADR-0011), and authentication has no phase yet.

Lessons

A check is only as good as its stated limits. attestQuote proves that words were said; it cannot see a dropped “not”. Writing that next to the check, and showing the quote under every item so the reader can judge, was worth more than another matcher rule.

A review needs a diff it can read. The file where model output becomes stored data held a literal NUL byte as its token separator, so Git treated it as binary and five review rounds passed over it without seeing a line. The separator is a space now, and a test fails on any control character in a tracked text file.

Passing tests can claim more than they prove. A manual review with four adversarial passes found six mutations the whole suite let through, among them dropping the trailing token boundary and moving the quote-length floor anywhere from 11 to 24. Each fix was proven by re-running the mutation that had survived.

Measure the runtime before designing against it. The audit’s worst operational hazard turned out not to exist on Workers, and the real blocker was a file size that wrangler dev reports locally. Subrequests per route were measured later, on 2026-10-25; CPU time still is not, so the orchestration design assumes the worst case and makes the size of each step a setting (ADR-0012).