Brain — pulling your own commitments out of a meeting transcript

The problem

You agree to things in meetings. "I'll send that over by Friday." "Let me pick that up." Those commitments are real, and they exist for about four seconds before the call ends and they're gone.

Transcripts are free now — Zoom and Meet generate them automatically. So the raw material is sitting there. The gap is that a transcript summariser gives you back a summary of the meeting, including every action item assigned to everyone in it. That is not the thing you need. The thing you need is the short list of what you now owe someone.

The pipeline

Paste text, get tasks. Four steps, and only one of them involves a model.

1. Persist the raw text first. The note is written to Postgres before extraction runs.
2. Extract, with a schema. generateObject from the Vercel AI SDK against a Zod schema, using GPT-4o-mini. The model returns an array of { title, description, due_date_raw } — typed objects, not prose.
3. Resolve dates in code. due_date_raw comes back as whatever the speaker said: "tomorrow", "next Friday", "15th December". chrono-node turns that into a real date against a reference of now, and it's normalised to YYYY-MM-DD before it touches the database.
4. Store the tasks against the note, scoped to the user, sorted by due date.

The decisions that made it work

The model does one language job and nothing else. Its brief is: find first-person commitments, and hand back the date phrase exactly as it was said. It is explicitly not asked what date "next Friday" is. Asking a language model to do calendar arithmetic gets you a confident answer that is wrong often enough to matter, and — worse — gives you no signal about which answers are the wrong ones. Splitting it means the failure modes are separable: if the extraction is bad, that's a prompt problem; if the date is bad, that's a parser problem with a reproducible input.

It needs to know who you are. The prompt is parameterised with the user's name and the aliases they get called in a transcript, including bare first-person "I'll". Without that, extraction returns everyone's action items and the output is just a worse meeting summary. With it, the tool has an opinion about what belongs to you, which is the entire product.

Failure degrades instead of cascading. If the model call throws, the extractor returns an empty array rather than propagating. The note is already saved, so the input survives and can be reprocessed. The alternative — failing the whole request — loses the only copy of a transcript to a transient upstream error, which is a much worse outcome than a note with no tasks attached.

Constrained output, so there's nothing to parse. Because extraction is schema-validated, there's no regex, no "sometimes it wraps the JSON in a code fence", no branch handling the case where the model got chatty. Output is either a valid typed object or an error.

Security, honestly

The first version stored notes and tasks with no owner column and public database policies. That was fine for a single-user prototype and would have been a real problem the moment anyone else used it.

Fixing it meant a migration that added user_id to both tables with a cascade to auth.users, backfilled the existing rows, made the column NOT NULL, enabled row-level security, and wrote policies scoping select, insert, update and delete to auth.uid(). There is a migration in the repo literally called remove_insecure_public_policies.sql. I'd rather that be visible than quietly squashed — the useful part of the story is noticing, not never having done it.

Every write path checks the session server-side too. The API route resolves the authenticated user before it touches anything and returns a 401 if there isn't one, so RLS is the backstop rather than the only line.

What I'd do next

Source integrations, so transcripts arrive instead of being pasted — that was always the point, and pasting is the deliberately unambitious v0. Beyond that, the interesting problem is evaluation: right now I can tell you the pipeline runs, but I can't tell you what fraction of my actual commitments it catches.