Example walkthrough
One item, end to end
A single item travels the whole path: normalized on the way in, judged once, routed by priority and audience, folded into a digest window, and recorded in a delivery ledger. Each stage shows what it does, what it produces, and what happens when it fails.
Records are sampled and reconstructed from the live system for presentation.
01/Ingest
A source adapter pulls what is new and normalizes it into one shape. Each adapter owns an opaque cursor that the pipeline stores and never interprets, so the pipeline does not need to know how a source paginates. Content hashing drops anything already seen.
When it fails
If the run fails before anything is persisted, the cursor does not advance and the next run repeats the same window. If items were committed and the run failed afterwards, the audit row records that explicitly and the cursor still does not advance, so a partial run is visible rather than silently skipped. A run left pending was interrupted mid-flight.
source_id: newsletter-feed external_id: ex_9f2c41... title: Regional grid pricing, week in review received_at: 2026-08-11T07:14:00Z content_hash: sha256:4b21c0... run_id: 6d0e77... state: stored
02/Triage
One model call per item returns priority, audience, a summary, key entities, and whether action is required. The endpoint is chosen by sensitivity: a cloud-capable route for ordinary items, a local-only route for sensitive ones. The verdict records which model actually served it, not the one that was asked for.
When it fails
A missing or invalid priority is never invented: the item is marked degraded and retried, and past the attempt limit it goes to dead-letter. On a local-only route, a served model that looks like a cloud model is treated as a leak and the verdict is discarded rather than recorded as ok. If the local endpoint is unreachable, the item is deferred: no attempt is consumed, and it never falls back to a cloud route.
priority: fyi
audience: personal
action_required: 0
summary: Weekly roundup of regional grid
pricing, with three stories on
winter capacity auctions.
key_entities: grid operator - capacity auction -
winter tariff - regional utility
served_model: qwen3.5-9b (local, verified)
state: ok03/Priority ladder
The tier decides what happens next. The ladder is the denoising decision: everything below the top tier trades immediacy for a quieter day, and the bottom tier is recorded rather than delivered.
What the tiers are for
Tiers are assigned per item against a rubric that lives in the bundled defaults, so the ranking rule is inspectable and replaceable without touching the engine.
- mustDelivered immediately
- shouldFolded into the next digest window
- fyiFolded into the next digest window
- ambientRetained and browsable, never pushed
- dropSuppressed, kept only as a record that it was seen
04/Delivery gates
Two delivery checks sit in front of every send. The audience check requires the channel's audience to match the item's; the sensitivity check allows a high-sensitivity item only on a non-cloud channel. Both read values persisted with the item rather than live configuration, so a later config edit cannot widen what was allowed when the item was judged.
When it fails
Unknown values fail closed: an unmarked audience becomes personal, an unmarked sensitivity becomes high, and a normalizing validator maps anything unrecognized onto the safe value. A refusal is not a failure, so no attempt is consumed and the row stays put until an operator forces it.
channel: cloud-chat
audience: personal
sensitivity: high
state: refused
reason: sensitivity gate: cloud channel
not permitted for this item
attempts: 005/Digest fold
Should and fyi items wait for the next waking-hours window, then leave together as one rollup message. A waiting item ages upward each window it is skipped, so a low-priority item cannot starve behind louder ones.
When it fails
If the rollup would exceed the channel's payload limit, the packer sends what fits in rank order and carries the remainder to the next window, rather than truncating the message or dropping the overflow.
state: sent mode: digest window: personal:fc3532... - [fyi] Regional grid pricing, week in review - three stories on winter capacity auctions.
06/Ledger
Every delivery attempt lands in an idempotent ledger keyed by source, item, and channel, so a retry updates the same row instead of adding a duplicate. The state set is explicit, and the terminal states are honest about which of them mean "sent" and which mean "deliberately not sent".
What the ledger will not do
The read and acked states advance only on an explicit human signal. The delivery path also offers a dry-run that runs full routing and both checks, prints what would be sent, makes zero outbound calls, and writes nothing.
Delivery states
- sent
- pending
- deferred
- failed
- dead
- refused
- suppressed
- read
- acked
sent delivered, receipt recorded
dead attempts exhausted, parked in
dead-letter for review
refused a gate blocked it; no attempt
was consumed
suppressed policy chose not to deliver it07/What this shows
The chain closes. A source becomes a record, a record becomes a verdict, a verdict becomes a routing decision, and every decision leaves a row that can be read back later.
Provenance travels with the verdict, so the question "which model actually judged this" has an answer rather than an assumption.
The fail-closed branches are ordinary code paths rather than instructions to a model, which is why they can be demonstrated at all: a refusal, a deferral, and a degraded retry are things the system does, not things it promises to do.