tapir/VISION.md

# Tapir — Product Vision

> **One line:** Tapir quietly watches the channels you already follow and hands you
> the substance of each new video — highlights and takeaways — so you can decide what
> deserves your full attention without watching everything.

## The problem

People subscribe to far more YouTube/Vimeo channels than they can watch. Valuable
videos go unwatched; time is spent watching videos that turn out not to be worth it.
The signal is buried in hours of runtime. Existing "summary" tools are one-off,
paste-a-URL affairs — they don't *watch on your behalf* and they don't respect where
your attention and data should live.

## The product

Tapir connects to a user's YouTube/Vimeo account, learns their subscriptions, and
when a subscribed channel posts a new video, it:

1. Detects the new video.
2. Fetches its transcript (captions first).
3. Summarizes it into highlights and takeaways relevant to the user.
4. Delivers the summary to the user's store (and, optionally, to other sinks).

The analysis runs on a **local-first AI stack**. If the local stack cannot do the job
reliably, the user may connect their own Claude / ChatGPT / Gemini account as a
fallback — their key, their choice.

## Principles (the guardrails)

- **Local-first, user-owned.** The default processor is the self-hosted stack. External
  AI is opt-in, per-user, with the user's own credentials. Tapir never silently ships a
  user's content to a third-party model.
- **Standalone is the product.** Tapir is a standalone service first. Feeding a personal
  knowledge base ("brain") is *one optional sink*, not the reason Tapir exists.
- **Attention is the scarce resource, not compute.** Every feature is judged by whether it
  helps the user spend less time deciding what to watch. Summaries exist to protect
  attention.
- **Data isolation is a promise, not a feature flag.** Each user's connected accounts,
  credentials, and summaries are separated. This holds from the first user, not "later."
- **Respect the source.** Captions where available; no fragile or ToS-hostile scraping in
  the core path. Where richer transcription is added later, it is a clearly-bounded,
  optional component.

## Who it is for

- **Now (the first customer):** the maintainer — one person, their own subscriptions,
  summaries delivered to their own store and brain.
- **Soon (Future B):** a small number of known, trusted users (friends / beta) — each with
  their own account, isolated data, optional BYO-AI.
- **Maybe (Future C, explicitly not built yet):** a public multi-tenant service. Deferred
  until there is evidence of sustained personal use **and** real demand. Building for C
  before that evidence is a known anti-goal.

## Definition of Success

Success is staged. Each stage has a single, falsifiable headline test. We do not advance
to the next stage's ambition until the current stage's test passes.

### Stage 0 — Useful to me (the gate)

> **Headline test:** For four consecutive weeks, the maintainer reads Tapir-produced
> summaries for their own subscriptions at least weekly, and at least once acts on a
> summary (watches / skips / saves a video *because of* the summary).

- Captions-first summarization works end-to-end for the maintainer's real subscriptions.
- Summaries land in the maintainer's store and (optionally) brain.
- Local-first AI produces summaries of acceptable quality without manual intervention
  most of the time.
- **This is the gate.** Multi-user, BYO-AI-for-others, and any SaaS ambition stay deferred
  until Stage 0 holds. (Ties to the 2026-07-01 self-use check-in.)

### Stage 1 — Useful to a few (Future B)

> **Headline test:** At least one trusted user other than the maintainer connects their
> own account and, within their first month, keeps using it (returns to read summaries in
> ≥2 separate weeks) without the maintainer hand-holding each summary.

- Multiple users, each with isolated accounts, credentials, and summaries.
- A new user can self-connect a YouTube/Vimeo account and get summaries with no code change.
- Optional BYO-AI works per-user.
- No cross-user data leakage — demonstrable, not assumed.

### Stage 2 — Trustworthy at rest (hardening, still Future B)

> **Headline test:** Credentials (OAuth tokens, BYO-AI keys) are encrypted at rest via the
> homelab's existing secrets convention; a documented, rehearsed recovery path exists; and
> a deliberate isolation test (user A cannot read user B's data) passes in CI or a
> documented manual drill.

### Non-goals (current)

- Public sign-up / billing / a marketing surface.
- Google OAuth app verification at production scale.
- Audio-download + speech-to-text transcription in the core path (a bounded optional
  component at most, deferred).
- Becoming a general-purpose video archive, player, or recommendation engine.

## How we will know we are drifting

- We are building Stage 1+ machinery before the Stage 0 gate has passed.
- A user's content reaches a third-party model without that user's explicit, per-user opt-in.
- "Brain ingestion" starts dictating the architecture instead of being one sink behind an
  interface.
- The codebase acquires a second language or a parallel auth/secrets system that duplicates
  the homelab's existing Dex / ESO conventions.

---

_This document is a guardrail. Changes to the principles, the staged definition of success,
or the non-goals are architecture decisions and must be recorded in `DECISIONS.md`._