Multimodal Ingestion activates first as a non-mutating security and preservation preflight. Content reaches retrieval only after a configured adapter has produced checksum-bound canonical evidence.
Multimodal Ingestion
Recognize broadly, preserve each medium's logic and prove what was actually extracted.
Authenticates broad source formats, discovers bounded local inputs, normalizes supported sessions, rejects exact duplicates and preserves provenance across text, image, audio and video.
A source-bound evidence graph with page, layout, metadata or time relationships; a stage-by-stage receipt; and an explicit distinction between recognized, planned, configured, extracted and qualified.
Why it exists
The problem this module is designed to solve.
Operational knowledge is distributed across PDFs, office documents, tables, scans, images, recordings, video and specialist containers. Text-only pipelines erase reading order and visual logic; monolithic converters hide format loss, partial failure and license obligations.
02 / How it works
A bounded path from need to accountable result.
The public model below describes responsibilities and decisions, not sensitive implementation details, provider secrets or customer data.
- 01
Authenticate before parsing
Reconcile magic bytes, container markers, media declaration and extension; flag active content, encryption, archive expansion, sensitive metadata and executable disguise.
- 02
Plan every meaning-bearing channel
Declare the text, reading order, page geometry, tables, formulas, figures, metadata, speech, speakers, frames, layers or coordinates that the source requires.
- 03
Execute with the right shape
Publish a healthy first pass, keep moderate escalation bounded and synchronous, and journal only critical-quality recovery — including sparse transcripts or missing requested speaker attribution — for background execution with checksum-bound restart.
- 04
Publish evidence, not optimism
Retain useful completed branches, expose skipped and failed stages, redact sensitive metadata by default and mark unqualified formats as planned rather than extracted.
02B / Formats, quality and execution
Broad recognition. Medium-aware evidence. No inflated support claim.
The complete public registry below is generated from the Rust source. Every suffix remains subordinate to signature, media declaration and container checks; recognition means safe routing, not automatic semantic extraction.
Truth ladder
Five states that must never be collapsed.
- 01recognized
Signature, container, declaration and suffix were reconciled.
- 02planned
A bounded preservation DAG exists; no extraction is implied.
- 03configured
An exact operator-approved adapter, binary or model is available.
- 04extracted
Canonical evidence and stage receipts exist for this source checksum.
- 05qualified
That named format/tool path passed a pinned corpus and promotion gate.
Execution and poor-quality recovery
Spend time only where the measured evidence justifies it.
Healthy first-pass evidence
Publish the measured result without creating background recovery work.
Moderate, repairable degradation
Apply the configured escalation inside the request budget and retain partial evidence.
Critical missing, multiply critical or structurally sparse evidence
Journal a checksum-bound job, return HTTP 202 with a scoped receipt, retry within budget and re-measure before promotion.
Query-specific depth is not yet justified
Keep archive members, dense frames, rows or objects unmaterialized until an authorized request activates them.
Independent meaning-bearing channels
Run within an explicit concurrency bound; one optional failure does not erase successful sibling evidence.
Voice notes, conversations and meetings: authenticated FLAC, M4A/AAC and Ogg/Opus can be decoded by an explicitly configured external adapter before first-party PCM16 measurement. Only critically quiet usable signal or severe DC offset is level-repaired; healthy, silent and clipping-only input is untouched. VAD, pre-roll, checksum-bound ASR windows and original-clock timestamps remain the next stages. A non-empty transcript covering under 25% of at least five seconds of detected voice is critical and eligible for lazy retry. Quality-recovery v5 retains the exact audio floor introduced in v4: the production worker starts with VAD windows and conditionally tries complete continuous windows only when planning, window completion or timestamp coverage remains insufficient. Legacy plans without the operation remain VAD-only, and invalid or duplicate thresholds fail closed. Source/composition tests cover PCM16 and configured decoded audio. A real five-minute CHiME-6 lifecycle also forced the durable worker through both passes under an evaluation-only 80% threshold; 31/31 ASR requests completed and 125 records cleared the predeclared continuous-selection floor. The product default remains 25%. Missing requested speaker attribution is also critical: after transcript recovery, the background worker diarizes the complete decoded audio source once, never separate ASR windows. Successful anonymous overlapping spans are returned inline and, when the local recovery directory is enabled, atomically persisted for a later scoped read. The evaluated model still failed quality promotion; representative field devices, enhancement, codec breadth and broad meeting accuracy remain open gates.
Raster recovery v5 / forced durable branch
16.12% → 3.23% CER
One frozen NOD weak-binarization TIFF; CC-BY-4.0 source and reference remain download-only and checksum-pinned.
92 → 41 tile nodes after overlap consensus · selected full page
1 durable attempt · 34 records · raw source deleted
The branch was forced for evaluation; product admission remains critical-only. This qualifies one English historical printed page and the real single-process worker path, not handwriting, multilingual or arbitrary-layout OCR, representative resources, production service levels, independent assurance or certification. Open the byte-mirrored result.
Real meeting canary / exact profile
ES2005a · 90s · 3 windows
External whisper.cpp v1.8.3 and pinned Whisper Small, both MIT. Corpus and model are not bundled.
96 word errors / 297 reference words · ceiling 45%
107 word errors / 297 reference words · ceiling 55%
One 90-second English four-speaker meeting only. The reference serializes overlapping speakers; this is not diarization, speaker attribution, overlap-aware scoring or a production service level. Open the checked result.
First-party VAD / exact profile
20 ms frames · 400 ms pre-roll
No VAD model or service. Low-energy gaps are skipped while every retained window stays on the original recording clock.
5.780s selected / 20.308s · 2 voice regions
80.720s selected / 112.000s · 8 voice regions
Two English recordings with controlled zero-valued silence envelopes. This qualifies deterministic gating and absolute-time preservation, not frame-labelled VAD recall, real noisy voice notes, enhancement or transcription accuracy. Open the checked result.
Compressed audio / exact signed-source profile
FFmpeg 9.0.1 · FLAC, M4A/AAC and Ogg/Opus
External LGPL-only canary build. Decoded evidence is mono 16 kHz PCM16 and remains bound to the original source.
RMS/peak 104/1120 → 104/1120 bp · 2 voice regions
RMS/peak 103/1111 → 103/1111 bp · 2 voice regions
RMS/peak 103/1092 → 103/1092 bp · 2 voice regions
RMS/peak 10/108 → 83/864 bp · 2 voice regions
One 8.308-second English source and one controlled -20 dB case. This qualifies the named build and decisions, not arbitrary codecs, corrupted media, field noise, denoising, ASR accuracy, patents or a production service level. Open the checked result.
Real-room distractor characterization / exact profile
8 recordings · 317 reference words · 12.93% micro WER
Room reverberation with no distractor, babble, music or television. Source, references, external runtime and model are checksum-pinned and not bundled.
16.54% transcript/voice coverage · marked critical and lazy
99.25% transcript/voice coverage · 52.94 points improved
Eight English read-speech recordings selected after screening one 113-file VOiCES shard. This is a regression characterization, not a prospective or representative voice-note/conversation, generic denoising, diarization, language/accent, production or certification claim. Open the checked result.
Prospective conversation / frozen before ASR
5 min · 4 speakers · 34.00% overlap
Real CHiME-6 kitchen conversation, CC BY-SA 4.0. Official source identity, annotations, external runtime and model are checksum-pinned and not bundled.
75.28% coverage · missed the frozen 65% / 80% gate
93.12% coverage · 11/11 windows · RTF 0.1523
One five-minute English four-speaker conversation selected before model execution. No speaker labels were emitted: this qualifies the conditional background fallback for the exact profile, not diarization, representative field voice notes, language/accent breadth, production or certification. Open the checked result.
Speaker timeline / integration pass, model rejected
mentaview.audio-ingestion/v2 · anonymous · overlap preserved
sherpa-onnx 1.13.7, pyannote segmentation 3.0 ONNX and WeSpeaker VoxCeleb ResNet34 ONNX. Exact external licenses are attested; no runtime or weights are bundled.
78.68% JER · 20.95% overlap recall · fixed ceilings 55% / 80%
81.64% JER · 31.60% overlap recall · fixed ceilings 55% / 80%
The real S21 loopback passed with 79 bounded spans and 4 anonymous clusters, but it cannot override the failed DER/JER gates. Transcript spans missed by an otherwise valid timeline remain unattributed instead of receiving invented labels. Each derived receipt is capped at 200,000 spans and 32 MiB, with 100,000 identities per directory. The profile remains experimental, outside the retrieval chunk index, production-unqualified and uncertified. Open the checked decision.
Real lazy lifecycle / fault injected
HTTP 503 → durable worker → persisted unqualified timeline
One frozen five-minute CHiME-6 S01 source on the exact external Whisper and sherpa-onnx model profile; source, runtimes and weights are checksum- and license-attested, never bundled.
Usable ASR preserved · missing speaker evidence deferred · 1 durable worker attempt
1 complete-source request · 85 records validated · 155.018s
Timeline readback, overlap preservation and raw-source deletion all passed. This qualifies one real single-process lazy lifecycle; PostgreSQL writing was replaced by canonical-record validation/counting. It does not qualify the diarization model, unknown-speaker counting, representative meetings or voice notes, distributed operation, production service levels or certification. Open the byte-mirrored result.
Real adaptive worker / forced branch
19 VAD + 11 continuous windows
One frozen five-minute CHiME-6 source; the evaluation-only 80% target sits above the prior VAD coverage and below the prior continuous coverage. The product default remains 25%.
0 failed · one initial full-source pass plus both recovery plans
predeclared continuous floor 100 · one worker · raw source deleted
The first request-count prediction was rejected, transparently corrected from the deterministic VAD plan, and re-frozen before this accepted result. This qualifies one real forced production-worker transition, not semantic accuracy, representative devices/languages/meetings, distributed operation, production service levels, independent assurance or certification. Open the byte-mirrored result.
Text and markup
Text, encoding, headings, paragraph order and source metadata.
Native-firstShow every registered identifier
.txt.text.md.markdown.mdown.mkd.rst.adoc.asciidoc.org.tex.latex.bib.log.nfo.man.me.rtx.readmeSource code
Text, language identity, line structure and code-semantics planning.
Native-firstShow every registered identifier
.c.h.cc.cpp.cxx.hpp.hxx.m.mm.rs.go.py.pyi.pyx.rb.php.java.kt.kts.scala.sc.swift.dart.js.mjs.cjs.jsx.ts.mts.cts.tsx.vue.svelte.astro.cs.fs.fsx.vb.vbs.lua.r.jl.pl.pm.t.sh.bash.zsh.fish.ps1.bat.cmd.sql.graphql.gql.proto.sol.vy.asm.s.v.vhd.vhdl.clj.cljs.cljc.edn.ex.exs.erl.hrl.hs.lhs.ml.mli.nim.zig.groovy.gradle.cmake.make.mk.dockerfileStructured data
Records, fields, types, schemas, relationships and source metadata.
Native + adapter-gatedShow every registered identifier
.csv.tsv.psv.ssv.json.jsonl.ndjson.json5.jsonld.geojson.topojson.xml.xsd.xsl.xslt.yaml.yml.toml.ini.cfg.conf.properties.env.plist.opml.rss.atom.ics.vcf.har.sarif.parquet.avro.orc.arrow.feather.sav.sas7bdat.dta.por.dbfWeb and captured pages
DOM structure, reading order, styles, hyperlinks, embedded assets and capture metadata.
Adapter-gatedShow every registered identifier
.html.htm.xhtml.mhtml.mht.css.scss.sass.less.webarchive.warc.warc.gzDocuments
Text, pages, reading order, geometry, tables, formulas, figures, comments and revisions.
Named paths qualifiedShow every registered identifier
.pdf.pdfa.xps.oxps.djvu.djv.rtf.doc.dot.docx.docm.dotx.dotm.odt.ott.fodt.wpd.wps.abw.pages.hwp.hwpx.sxw.stw.uot.lwp.cwk.pub.one.onepkg.chm.hlpSpreadsheets
Sheets, cells, formulas, tables, charts, types, comments and calculation relationships.
Adapter-gatedShow every registered identifier
.xls.xlt.xla.xlsx.xlsm.xlsb.xltx.xltm.xlam.ods.ots.fods.numbers.sxc.stc.uos.dif.slk.wk1.wk2.wk3.wk4.wks.123.gnumeric.qpw.etPresentations
Slides, spatial layout, notes, reading order, charts, media and transitions.
Adapter-gatedShow every registered identifier
.ppt.pps.pot.pptx.pptm.ppsx.ppsm.potx.potm.odp.otp.fodp.key.sxi.sti.uop.show.dpsEbooks and comics
Chapters, spine order, text, pagination, images, navigation and publication metadata.
Adapter-gatedShow every registered identifier
.epub.mobi.azw.azw3.kf8.kfx.fb2.lit.lrf.pdb.prc.cbz.cbr.cb7.cbt.ibooksEmail and calendars
Headers, bodies, threads, attachments, recipients, dates and privacy-sensitive metadata.
Adapter-gatedShow every registered identifier
.eml.emlx.msg.mbox.pst.ost.oft.maildirRaster images
Pixels, frames, orientation, OCR geometry, visual semantics, color and safe metadata.
Named paths qualifiedShow every registered identifier
.jpg.jpeg.jpe.jfif.jif.png.apng.gif.bmp.dib.tif.tiff.webp.avif.heic.heif.jxl.jp2.j2k.j2c.jpf.jpx.jpm.mj2.ppm.pgm.pbm.pnm.pam.pcx.tga.icb.vda.vst.qoi.ico.cur.ani.icns.dds.ktx.ktx2.astc.hdr.rgbe.exr.psd.psb.xcf.kra.ora.clip.sai.raw.dng.cr2.cr3.nef.nrw.arw.srf.sr2.orf.rw2.raf.pef.x3f.erf.mrw.3fr.fff.mos.iiq.rwl.srw.gpr.bpg.flifVector images and diagrams
Shapes, layers, text, coordinates, links, styling and rendered visual evidence.
Adapter-gatedShow every registered identifier
.svg.svgz.eps.epsf.ai.cdr.cmx.wmf.emf.sk.sk1.vsd.vdx.vsdx.vssx.vstx.dia.drawio.fig.odg.fodg.sxd.dxfAudio, voice and meetings
Tracks, signal measurements, speech, timestamps, speakers, audio events and provenance.
Named ASR paths qualified; diarization contract integrated, model rejectedShow every registered identifier
.wav.wave.bwf.mp3.mp2.mp1.aac.m4a.m4b.m4p.alac.flac.oga.ogg.opus.vorbis.wma.aiff.aif.aifc.au.snd.amr.awb.ac3.eac3.dts.dtshd.mka.ape.wv.tta.tak.spx.gsm.caf.ra.rm.mid.midi.kar.rmi.mod.xm.it.s3m.mptm.669.voc.aa.aax.dsf.dffVideo
Tracks, time, speech, scenes, keyframes, frame OCR, visual semantics and metadata.
Metadata path qualifiedShow every registered identifier
.mp4.m4v.mov.qt.webm.mkv.mk3d.avi.divx.wmv.asf.flv.f4v.f4p.f4a.f4b.mpeg.mpg.mpe.m1v.m2v.mpv.m2ts.m2t.vob.ogv.3gp.3g2.3gpp.3gpp2.rmvb.dv.dvr-ms.wtv.mxf.roq.nsv.y4m.h264.h265.hevc.av1Archives and packages
Hierarchy, member identity, checksums, compression risk and selected nested materialization.
Named ZIP paths qualifiedShow every registered identifier
.zip.zipx.tar.tgz.tar.gz.tbz.tbz2.tar.bz2.txz.tar.xz.tlz.tar.lz.tzst.tar.zst.gz.gzip.bz2.bzip2.xz.lz.lzma.zst.z.7z.rar.cab.arj.lha.lzh.ace.arc.cpio.shar.sit.sitx.sea.pak.wim.swm.xar.ar.deb.rpm.apk.ipa.jar.war.ear.whl.crate.gem.nupkg.vsix.appx.msix.unitypackageFonts
Signature, tables, names, glyph and variation metadata; fonts are never executed as code.
Safe-static onlyShow every registered identifier
.ttf.otf.ttc.otc.woff.woff2.eot.pfb.pfm.afm.bdf.pcf.fon.fnt.suit.dfont3D models
Scene graph, geometry, materials, textures, cameras, animation and rendered views.
Adapter-gatedShow every registered identifier
.gltf.glb.obj.fbx.dae.3ds.blend.ply.stl.3mf.amf.x3d.x3db.x3dv.wrl.vrml.usd.usda.usdc.usdz.abc.bvh.lwo.lws.ma.mb.c4d.max.skp.step.stp.iges.igs.brepCAD and fabrication
Assemblies, parts, layers, units, coordinates, dimensions and safe rendered views.
Adapter-gatedShow every registered identifier
.dwg.dws.dwt.ifc.ifczip.rvt.rfa.sat.sab.prt.catpart.catproduct.sldprt.sldasm.ipt.iam.fcstd.sch.brd.kicad_sch.kicad_pcb.ger.gbr.excellonGeospatial
Layers, coordinates, reference systems, features, attributes, rasters and provenance.
Adapter-gatedShow every registered identifier
.shp.shx.prj.cpg.gpkg.kml.kmz.gml.gpx.fit.tcx.osm.pbf.mbtiles.pmtiles.geotiff.cog.asc.grd.dem.bil.bip.bsq.las.laz.e57.vrt.sdat.qgz.qgs.mxd.lyrMedical and life-science
Study/series hierarchy, frames, measurements, structured fields and sensitive metadata controls.
Adapter-gatedShow every registered identifier
.dcm.dicom.nii.nii.gz.nrrd.mhd.mha.mnc.ima.img.edf.fhir.hl7.cda.svs.ndpi.mrxs.scn.vms.vmuScientific and research
Datasets, arrays, schemas, units, axes, provenance and domain-specific relationships.
Adapter-gatedShow every registered identifier
.h5.hdf.hdf5.he5.nc.nc4.cdf.fits.fts.mat.npz.npy.pkl.pickle.joblib.rdata.rds.root.vtk.vti.vtu.mrc.map.dx.cube.cif.mmcif.mol.mol2.sdf.xyz.fasta.fa.fastq.fq.bam.sam.cram.bcf.bed.gff.gff3.gtfDatabases
Schema, tables, indexes, relationships and explicitly selected bounded rows.
Adapter-gatedShow every registered identifier
.db.sqlite.sqlite3.db3.mdb.accdb.fdb.gdb.nsf.sqlitedb.duckdb.realm.leveldb.ldb.sst.rdb.ndf.mdf.ldf.bakDisk and virtual-machine images
Container identity, partition/filesystem metadata and threat flags; never mounted automatically.
Safe-static onlyShow every registered identifier
.iso.dmg.sparseimage.sparsebundle.vhdx.vmdk.vdi.qcow.qcow2.bin.cue.nrg.mds.toast.udfExecutables and packages
Signature, platform, sections, imports, strings and package metadata; never executed.
Safe-static onlyShow every registered identifier
.exe.dll.sys.com.msi.msp.scr.cpl.elf.so.dylib.app.appimage.run.wasm.class.dex.o.a.lib.ko.efi.romUnknown binary
Source checksum, size, declarations, threat flags and adapter-resolution plan; no semantic extraction claim.
Opaque fallbackNo allow-list is required: unknown bytes remain opaque, checksum-bound and non-executing until a reviewed adapter is configured.
Named canary evidence
What the current real-file campaign actually qualified.
Poppler layout text and page rendering, with bounded Tesseract OCR geometry when configured.
DOCX
OOXML recognition, isolated LibreOffice PDF derivation, then the qualified PDF evidence path.
TIFF
Authenticated raster normalization, OCR boxes/confidence and privacy-filtered metadata.
MOV
QuickTime identity, video media type and duration metadata; general frame understanding remains adapter-gated.
WAV / PCM16
WAV identity, duration metadata and model-free RMS, peak, silence, clipping and DC-offset measurements.
PCM16 meeting recovery
Three checksum-bound overlapping windows, local ASR and deterministic time reconciliation passed on the named 90-second AMI close-talk and far-field conditions; this is not general meeting accuracy.
PCM16 VAD + pre-roll
First-party adaptive energy gating skipped known silence and preserved absolute source time on the named Vosk short recording and AMI mixed-headset segment; this is not frame-labelled VAD accuracy or noisy voice-note qualification.
FLAC / M4A-AAC / Ogg-Opus deferred recovery
The exact signed-source FFmpeg 9.0.1 LGPL-only recipe decoded one real source to mono 16 kHz PCM16; healthy signals stayed byte-identical and one controlled quiet M4A received bounded x8 level repair before VAD.
Real-room noisy speech lazy recovery
Eight post-screening VOiCES room/babble/music/television recordings exercised sparse non-empty transcript detection and VAD-windowed retry at 12.93% micro WER for the exact profile; this is not representative field voice-note qualification.
Prospective conversation quality fallback
One frozen five-minute CHiME-6 four-speaker kitchen conversation with 34.00% overlap triggered continuous background retry; WER improved from 67.62% to 55.28% and coverage from 75.28% to 93.12%. Diarization did not run.
Speaker timeline and diarization adapter
The provider-neutral audio v2 contract and real S21 loopback preserved 79 bounded spans, four anonymous clusters and overlap. Missed transcript spans remain unattributed without discarding a valid timeline or inventing a label. Frozen S01 and S21 model-quality gates failed, so the exact external profile remains experimental and unqualified.
Real lazy speaker-timeline lifecycle
One frozen five-minute CHiME-6 S01 source survived an injected initial 503 with ASR preserved, completed one durable worker attempt and one successful complete-source diarization request, validated 85 records, persisted/read 76 spans and deleted the raw recovery source. This is single-process lifecycle evidence, not model-quality or production evidence.
Weak-binarization TIFF recovery
One checksum-pinned NOD historical page forced the durable quality-recovery v5 raster branch: 4/4 overlapping tiles completed with no failure, the raw recovery copy was deleted and reference CER fell from 16.12% to 3.23% (79.93% relative). This is not general OCR qualification.
ZIP
Safe hierarchy inventory, exact lazy member selection and authenticated two-level nested traversal under one aggregate budget.
03 / Customer and operator value
Lets operators expand format coverage without surrendering provenance, process control or the right to replace — or refuse — every external converter and model.
735-extension registry plus opaque fallback
Safe bounded local source discovery
Strict session and conversation normalization
Exact duplicate admission and review-only near-duplicate audit
Bounded explicit note admission and referential-integrity source deletion
Critical-only deferred recovery receipt
Measured raster recovery v5
Sparse-transcript lazy recovery guard
Serialized VAD-to-continuous fallback
Durable anonymous speaker-timeline receipt
Page, frame, OCR, metadata and time provenance
Reviewable reversible client-hook integration with explicit roots and content-addressed backups
04 / Where it creates value
Concrete situations, not generic feature claims.
These are representative product situations. Every deployment still requires its own policy, data boundary and acceptance criteria.
Evidence-grade document intake
Convert office files, PDFs and authenticated raster images while retaining page or frame provenance, layout spacing, OCR boxes, confidence and safe metadata instead of a single text dump.
Operational media review
Decode named compressed voice formats through an audited external adapter; repair only measured critical PCM level or DC offset; detect transcript dropout; execute first-party VAD and checksum-bound ASR windows; and return or persist an anonymous overlap-preserving speaker timeline without rewriting the transcript.
Sovereign specialist intake
Inventory authenticated archives and traverse exact member chains lazily under one aggregate budget; recognize CAD, 3D, geospatial, medical, scientific and database families, then resolve only operator-approved tools with explicit license and data boundaries.
05 / Role in the cognitive system
A clear responsibility creates a trustworthy boundary.
No module is allowed to become an invisible monolith. It owns a narrow contract, composes with named capabilities and refuses responsibilities that belong elsewhere.
What it owns
- Local source discovery
- Source admission and removal
- Format, threat and quality preflight
- Duplicate admission and review
- Preservation-aware recovery plan
- Canonical evidence and metadata
- Session and conversation normalization
- Durable local status and partial-success receipts
What it composes with
What it refuses to own
Boundary before convenience.
The registry is broad by design, but only named converter paths are qualified. Recovery and speaker-timeline stores are restart-durable for one process, not a distributed exactly-once queue. Timelines are derived receipts outside the retrieval chunk index and need operator retention/deletion controls. A valid timeline may leave missed transcript spans unattributed rather than inventing a speaker. One raster canary does not qualify handwriting, multilingual or arbitrary-layout OCR. Narrow audio canaries do not qualify arbitrary codecs, damaged media, representative field voice notes or conversations, generic denoising, unknown-speaker clustering, patents or production service levels. The only evaluated diarization model profile failed quality promotion. Session adapters are intentionally strict rather than universal; client hooks require explicit configuration and transcript roots and do not decide what becomes durable Memory.
06 / Vision and mission
Every useful source can become accountable evidence
Ingestion broadens what Mentaview can understand without collapsing provenance or forcing cloud dependencies, supporting useful cognition across formats and sovereign deployment boundaries.
AI systems that remain useful, inspectable and sovereign across models, providers and deployment boundaries.
Build the cognitive layer that chooses the smallest sufficient path and turns evidence into accountable action.
Capture the value of advanced AI without surrendering data control, architectural freedom or intellectual honesty.
07 / Evidence and maturity
What the current label means — and what remains open.
Passed with moderate confidence
The typed ingestion and durable local recovery/purge lifecycles are integrated and failure-tested across bounded profiles; breadth and distributed-operation claims remain explicitly excluded.
- Two checksum-pinned real-corpus tests require external assets and are not part of the default replay.
- The qualified paths do not cover representative devices, languages, layouts or long meetings.
- Managed KMS, remote object storage, distributed leases and accepted diarization remain open.
What exists today
The universal campaign passes across PDF, DOCX, TIFF, MOV, WAV and nested ZIPs. Quality-recovery v5 retains the v4 25% model-free audio coverage floor and adds an exact bounded raster-recovery pipeline; source tests force both production branches. On one frozen NOD TIFF, the real durable raster worker completed 4/4 tiles, deleted the raw copy and reduced reference CER from 16.12% to 3.23% under predeclared gates. A real five-minute CHiME-6 worker canary forced 19 VAD then 11 continuous windows: all 31 counted ASR requests succeeded, 125 records cleared the frozen floor, 76 speaker spans were persisted and the raw source was deleted. The evaluated diarization profile failed quality promotion. Focused tests cover strict session adapters, reversible client hooks, bounded symlink-safe discovery, exact byte-verified duplicate admission and review-only near duplicates. After canonical persistence, the runtime publishes a content-free Memory-review handoff and carries it through deferred recovery; this composition does not make candidate semantics or promotion an Ingestion responsibility. Canonical `mentaview_ingestion_*` MCP operations own note admission, duplicate checks and source deletion; none qualifies automatic Memory promotion.
Controlled pilot
A bounded runnable surface exists and can be evaluated in a controlled engagement. Production-scale controls and operating evidence remain gated.
What must earn promotion
Expand raster evidence to handwriting, multilingual, multi-column, forms and tables; replace or improve the rejected diarization profile and prospectively pass DER/JER without an oracle speaker count; qualify representative field voice notes, longer meetings, more codecs, languages and accents; add explicit retention/deletion administration, production deletion exercises, video-track persistence, target-host resources and distributed leases.
Public truth boundary: M4− is a non-standard Mentaview engineering label for internal laboratory validation. It is not an official TRL decision and does not assert production qualification, customer acceptance, independent assurance, certification or universal performance. Inspect the complete assessment record.