Resources

Architecture

People on the outside, providers on the far side, and one storage spine that every stage reads from and writes to.

Toluva architecture. Uploaders, reviewers and operators on the left; Backblaze B2 in the centre holding source lineage, manifests, the timing verdict and the authorization record; providers, quality gates and the worker on the right. A six-stage spine runs across the top: ingest, transcribe, translate, authorize, time-fit QA, master.ToluvaGoverned video localization on Backblaze B2Approved at intake.  Measured at every segment.  Verifiable at rest.B2Backblazesystem of recordUPLOADERSBring one approved clip andconfirm rights up front.1–30s MP4 · ≤ 8 MBrights + disclosureREVIEWERSApprove exact wording beforeanother billable call.hash-bound revisionOPERATORSRun the worker and hold theprovider budget.toluva-worker.serviceENABLE_LIVE_INTAKESource pathApproval pathControl pathb2://toluva/intake-57f5ca73/localize-c33715dfSource lineageappend-only job recordssource-1cf1052f….mp460 job-scoped objects writtenjob_id · project_id on every recordManifests & lineageGenblaze runs · canonical hashesrun.provider=elevenlabs-ttsrun.model=eleven_flash_v2_5parent_run_id=a9cc6c70…9 / 9 canonical manifests validno unverified stored byteshash re-checked before displayTiming verdictSEGMENT DRIFTFIXEDattempt timeline8.127s → 3.576s3.800s slotapproved by a human, not guessed−5.9%drift vs slotAuthorization recordevaluated before any provider callLanguage in scopeallowedEvidence hashOutside scopeblockedorigin = policyno provider was calledGenerated mediaMeasured findingsClaim → spendProviderstranscription · translation · speechfaster-whisper base.enargos translate en_de 1.3eleven_flash_v2_5 stockffmpeg segment audio fan-inffmpeg captioned mp4Quality gatesmeasured, then enforcedtranscript confidencedrift bands · green/amber/redprotected term preservationauthorization scopeWorkerone replica, bounded spendone replica claims a job4 TTS calls · 400 chars3 admission slots / UTC dayresumes from checkpointsGermaneditionCaptionsidecarCorrectionarchiveStorage is the recordEvery stage writes to B2before the next one runs.Correction is boundedA red segment blocks thenext billable call.Claims stay narrowLineage and integrity, notlegal compliance.Toluva capabilitiesOne governed lane · evidence-readySourceintakeRightsconfirmationSegmenttranscriptionProtectedtermsAuthorizationgateDriftmeasurementBoundedretriesSilencepaddingTempofitCaptionsidecarHashverificationMedia path — source, speech, final renderEvidence path — records · manifests · hashesApproval path — block → approve → resumeToluva measures generated audio; it never estimates duration from characters.A manifest proves lineage and integrity, not regulatory compliance.HOW TOLUVA WORKS1Ingest2Transcribe3Translate4Authorize5Time-fit QA6Master123456

Reading the diagram

Left — people

Uploaders bring an approved clip and confirm rights. Reviewers approve exact wording. Operators run the worker and hold the provider budget.

Centre — evidence

Backblaze B2 is where source lineage, manifests, the timing verdict and the authorization record all become visible.

Right — machinery

Providers for transcription, translation and speech; the quality gates that stand in front of them; and the single worker that claims a job.

The ribbon across the top is the six-stage spine. Everything below it is what each stage touches.

Component map

text
app/(marketing)/    overview page
app/(workspace)/    upload, runs, editions, evidence
app/(docs)/         this documentation
app/api/            narrow server routes, credentials never leave here
lib/                B2 bridge, job contract, policy evaluation, formatting
services/pipeline/
  domain/           timing, transcript quality, authorization — pure logic
  providers/        transcription, translation, speech adapters
  storage/          B2 keys, checkpoints, append-only records
  worker/           claim, run, checkpoint, resume
deploy/vps/         one-replica worker deployment contract

Domain logic is pure — no I/O, no clock, no network — which is what lets the whole decision layer be exercised without Docker, B2, or a live provider.

The two processes

Web applicationGeneration worker
RuntimeCloudflare WorkersSingle VPS replica
On the generation pathNoYes
DecidesWhat to show, what to refuseWhat to generate, what to spend
WritesJob requests, review approvalsEvery stage record and artefact
If it diesRuns continue; UI unavailableJobs queue durably in B2

The web app never calls a provider. That separation is why an outage on either side degrades one thing rather than corrupting a run.

Failure behaviour

FailureBehaviour
B2 read unavailableStored snapshot stays visible, labelled as such
Worker offlineJobs queue durably; no provider is called
Provider call failsRecorded as a failed attempt, kept in the trail
Segment outside bandBlocks; waits for a hash-bound approved revision
Review record missingJob stays blocked rather than retrying blind
Job pointer expiredCleared from the browser; B2 record unaffected

Known boundaries

  • A second worker replica could claim the same job and double-bill, so the replica count is part of the deployment contract, not a scaling knob.
  • Argos performs translation, not length-targeted rewriting; shortening must come from an approved human revision.
  • Tempo fit is deliberately bounded — beyond a small adjustment Toluva stops rather than distorting delivery.
  • A manifest proves recorded lineage and canonical integrity, not the truth of every supplied fact.

Source files