Research · implementation

A private document pipeline with explicit fallback behavior

The private Quesar application implements bounded ingestion, workspace-scoped extraction and search, and consent-gated model access while making degraded retrieval behavior visible instead of silently changing providers.

AIWDBX

Ingestion and workspace isolation

Document creation validates the upload, normalizes the filename, checks whether the requested format has an installed extraction capability, verifies workspace access, and creates a tracked extraction job. Failure cleanup removes the newly written upload rather than leaving an untracked artifact behind.

Search is scoped to the current workspace and to documents whose extraction state is ready or partial. The hybrid path merges semantic and keyword results, while keyword-only retrieval remains available when embeddings cannot be produced.

Provider and degradation boundaries

Local model providers are restricted to loopback endpoints. Hosted providers require HTTPS, reject credentials embedded in endpoint URLs, and require workspace consent before use. Those checks prevent a configuration string from quietly turning a private local workflow into a hosted one.

If semantic embedding fails, the search result records keyword fallback and its reason. That observable degradation is important for research interpretation because a returned answer is not automatically evidence that vector retrieval ran successfully.

Limitations

  • These sources establish committed implementation behavior, not a current production deployment, successful extraction for every supported format, or live hosted-provider acceptance.
  • Keyword fallback preserves availability but is not equivalent to semantic retrieval, and its results should be labeled accordingly in evaluation data.