How we build
Eleven products do not run alongside each other unless the expensive parts are shared. Research, production, release and measurement run through one internal system, so the fifth product costs less to launch than the first and is better informed when it does.
The loop
Every product goes round the same circuit. The stages are named for what happens in them, which is why learning something and acting on it are two stages and not one.
What the system guarantees
Most of the work in a production system is not making things. It is making sure that a retry, a crash or a duplicate trigger cannot do damage — which is what lets the rest be automatic.
Content and publish jobs are identified by deterministic hashes of their own inputs. A duplicate trigger, a retry or a crash-and-restart resolves to the same identity, so the system cannot double-render or double-post.
Retrying is always safe, which is what makes automation restartable.
Every stage checkpoints its result before the next begins. A failure halfway through picks up from the last completed stage rather than repeating the expensive work behind it.
A long pipeline can fail without costing the whole run.
Everything that varies by product — voice, content families, asset locations, rules about what may never be claimed — lives in that product’s own configuration. The shared code reads it and never references a product directly.
A new product is a configuration, not a fork.
Each piece carries a fingerprint of its topic, hook and script. New work is compared against that product’s recent history and rejected when it is too close, which sends the generator back for a different angle.
Volume without a feed that reads like one product talking to itself.
External calls are retried with bounded backoff and sorted into transient, permanent and not-configured. A platform that has not been set up yet is a normal warning, never a crash and never a silent skip.
The difference between broken and not-yet-connected is always visible.
Generated output is checked automatically before it reaches a queue, including whether every scene used real product material rather than a placeholder. What a person reviews has already passed the mechanical tests.
Review time goes on judgement, not on catching obvious faults.
The awkward failures — a template that mangles a topic already phrased as a question, an opener doubling a prefix — were each found by generating real output and reading it, then pinned by a regression test.
The same class of error cannot come back quietly.
Catalogues are checked for parity against the reference language before a build passes, so a locale cannot ship with half its keys and an English sentence in the middle of a screen. Where a language needs more than text — a right-to-left layout, a longer compound word, a recorded voice — that is checked too, on the screen rather than in the file.
Ten, sixteen or twenty-nine languages, and no half-translated screen in any of them.
Assets produced by a model carry the model, its exact revision, its licence and the candidate set they were selected from, stored beside the file. Recorded audio carries its engine, its licence and the measurement its own QA scored it on. A capture set carries a hash per file.
A licence question years later is a lookup, not an investigation.
The system prepares, packages and proposes. A person approves. Publishing is never fully autonomous, by design rather than by omission.
Scale without handing over editorial control.
Check it yourself
Rather than describe the standard, here is what is enforced on the page you are reading now.
The line
This page describes what the system does and what it produces. It does not describe how it is deployed. Hosts, endpoints, credentials, machine names, storage paths and security architecture stay private — not because they are interesting, but because publishing them would be careless. The public site and the internal systems share no credentials and no control path.