Waystation

Quality Control (QC) is required before delivering any film, TV show, or commercial for broadcast or streaming. Waystation employs an orchestrated team of LM's to automate and enhance this process.

Comment

Inspiration

Studios move video files with tools like IBM Aspera - costs thousands per year, and the file arrives exactly as dumb as it left. Meanwhile, delivering finished video to Studios still gets QC'd, summarized, and cataloged, by hand or by a second enterprise product (Interra BATON, Telestream Vidchecker, Venera Pulsar - all thousands per seat). The file spends minutes parked in cloud storage either way. Waystation uses that parking time: while your master sits in Backblaze B2, a reactive pipeline QCs it against a delivery spec, reviews it with multimodal AI, and locks the evidence under Object Lock - so what arrives is not a file, but a delivery.

What it does

  • Verified transfer - browser-side BLAKE3 + parallel presigned multipart straight to B2, crash-resumable via ListParts; a bao outboard sidecar enables verified range downloads (every chunk checked against the content root before it's accepted).
  • Reactive pipeline - B2 Event Notifications (HMAC-signed webhook) fire the QC worker the moment the object lands. No polling, no compute babysitting.
  • Broadcast-grade QC - structural (timecode continuity, container integrity, multipart detection), signal (full-decode pass, black/freeze/ silence, EBU R103 legal range with a real amplitude+area policy, ITU-R BS.1770-4 loudness/true-peak/LRA, phase, clipping, hum, mattes, advisory PSE flash-risk screening), captions (timing, collisions, CPS/WPM, encoding, speech-sync drift), and reference SSIM/PSNR/VMAF scored as a 1–5 MOS against an optional source mezzanine.
  • Hosted deterministic worker - The deterministic layer runs headlessly in a dedicated Docker worker on an Ubuntu 24.04.4 LTS x86_64 Vultr VPS. Its image includes FFmpeg/FFprobe, MediaInfo, QCTools qcli, MediaConch, Java, and Netflix Photon. QC reports retain tool, policy, evidence, and time-range provenance.
  • AI QC lane (GMI Cloud) - Gemini vision reviews sampled frames for what filters can't name (slates, watermarks, burned-in timecode, censorship artifacts); Gemini's audio modality transcribes a sample window and the transcript is word-error-rate diffed against the captions - automated caption accuracy. Plus a caption-grounded one-line summary for the recipient.
  • Netflix strict profile - one toggle swaps thresholds for a zero-tolerance delivery spec (−24 LKFS ±1, −2 dBTP, native frame rates only, no pulldown, PSE hard-fail). Findings tier into BLOCKER / ISSUE / FYI.
  • Provable provenance - every run emits a real Genblaze manifest (genblaze-core, schema v1.5): Run → Steps with provider/model attribution → SHA-256 Assets, canonical-hashed and verified with the SDK's own verifier, then written to B2 under Object Lock COMPLIANCE - in our live run the bucket owner's own key, holding deleteFiles + bypassGovernance, was refused deletion.
  • Billing-ready metering - every billable act (transfer GB, QC minutes, AI frames, ASR seconds, heal runs) is a ledger entry traceable to the manifest; maps 1:1 onto Stripe/Lago usage meters.
  • Transfer-only mode - turn everything off and it's a plain verified file-transfer tool. Every service is a sender-side toggle.

How we built it

Browser (Vite/TS + Rust→wasm BLAKE3/bao) → Hono/Node gateway (control plane only - presigned URLs, event webhook, SSE progress, metering; it never touches file bytes) → Python/FastAPI worker (ffmpeg/ffprobe deterministic lanes + GMI Cloud multimodal lane) → everything back into B2 under derivatives/. Backblaze B2 is used deeply: S3-compatible multipart with server-side ListParts assembly (no CORS ETag exposure needed), Event Notifications over a cloudflared tunnel, Object Lock COMPLIANCE for the manifest, presigned delivery. AI runs on GMI Cloud's OpenAI-compatible API (google/gemini-3.5-flash) - one discovery we're proud of: GMI serves no dedicated ASR model, but Gemini accepts input_audio content parts, so Gemini is the ASR for caption-accuracy checking.

Challenges we ran into

  • Absolute-min/max legal-range checking flags every lossy encode (codec ringing), so we implemented the industry policy: out-of-range pixel fraction vs a picture-area threshold, measured exactly with a lut violation-mask (and discovered ffmpeg's lutyuv min/max values are color-range dependent the hard way).
  • Browser multipart on B2/MinIO without CORS ExposeHeaders - solved by assembling from ListParts server-side, so the browser never reads ETags.
  • A caption file that alphabetically sorted before the master exposed a sidecar-detection bug on the delivery page - caught because we demo on the real UI, not just scripts.

Accomplishments we're proud of

  • The same violating master gets 4 BLOCKERs under Netflix strict and zero under Standard - profiles are real policy, not labels.
  • Live Gemini vision caught the burned-in timecode in our test master unprompted; ASR caption accuracy scored 21/21 words.
  • A QC report nobody - including us - can alter for 24 hours.
  • Six one-command proof scripts; every feature claim in this page is executable.

What we learned

Deterministic instruments and AI judges are complements, not substitutes: ffmpeg measures LUFS, Gemini recognizes a slate - a QC system needs both lanes, and the provenance layer must anchor both kinds of verdicts.

What's next

AI-targeted escalation (vision review at the exact timecodes the deterministic lane flags), Ai prompt inovations. Dolby Vision canvas verification via dovi_tool, IMF/Photon execution in a JVM container. Per-customer billing on the metering ledger. Auto fix QC issues!

Built With

Share this project:

Updates