Bring the evidence
Upload daily source exports, securely import an existing archive with exact hashed retention of every meaningful artifact, or activate independently tested live connections when production credentials are ready.
Inside Call Insights · 1.2.0
Many source files.
One shared truth.
Call Insights turns fragmented call and outreach data into a visual, conversational story that operators can understand and technical teams can trust.
For everyone
A clear daily answer to a simple question:
“What happened in our calls, and what should we pay attention to?”
Connect the dots
The system lines up calls, conversations, contacts, and campaign streams—even when their timestamps do not perfectly agree.
Ask, see, and shape
Ask one question across several metrics or the whole available history. Data discovery answers coverage directly, calculates weekday-by-campaign booking averages, explains only verified facts, cites each result, and can create, edit, resize, reorder, or remove charts.
What it changes
Less spreadsheet archaeology.
More confident decisions.
A consistent daily rhythm
Each report follows the same rules, format, and campaign structure.
Visible data quality
Unmatched records and source coverage are part of the result—not hidden in the process.
Grounded data discovery
Data discovery shows when it is understanding, checking evidence, and preparing a result. Every number is inserted by the application from a closed evidence pack and linked back to its report observations.
An audit trail
Runs, chat evidence, dashboard changes, and every saved dashboard version remain reviewable.
A visual operating picture
Tested open-source chart and table controls choose readable labels, scales, legends, and responsive layouts from the shape of the approved data.
Safe self-service dashboards
Create charts without code, switch into a full-width arrange workspace with unobstructed controls, change charts through Data discovery, and undo experiments. Every view stays tied to the governed metric catalogue.
A workspace for every person
Each user signs in separately. Everyone works from the same approved report library while their dashboard layout and data conversations stay private to their account.
For technical teams
A small, durable production system
FastAPI coordinates the workflow. PostgreSQL owns job state, governed observations, chat evidence, and versioned dashboard definitions. A worker executes the reporting engine against persistent source and report storage.
Inputs
JSON or report ZIPValidated + hashed
Source APIsAllowlisted · tested · independently enabled
Control plane
FastAPIAuth · upload · API · UI
PostgreSQL queueState + audit trail
Processing
Report workerSafe job claiming
Reporting engineNormalize · match · aggregate
Outputs
Source lake + warehouseExact artifacts · approved observations
Codex subscriptionConstrained plan · closed facts
Dashboard StudioECharts · GridStack · Tabulator
Exact archive, independently verifiable
Historical ZIPs are path-safe and expansion-limited. The original bytes are retained under their SHA-256; every meaningful entry is separately materialized, hashed, typed, and catalogued. Operating-system packaging metadata is counted but excluded. Summary reports publish only after complete validation.
Fail-closed control plane
Ringostat and NextLevel have independent configured, tested, enabled, paused, and failed states. PostgreSQL records every connection test. Live composite reports require both providers to pass against the current endpoint fingerprint; manual imports remain independent.
Approved destinations only
Provider endpoints must use HTTPS and an exact hostname allowlist. UAT or staging hostnames, IP literals, hostnames resolving to private networks, embedded credentials, non-standard ports, redirects, oversized responses, and unknown hosts are rejected. Bounded timeouts, retry with jitter, and sanitized errors are shared by testing and report collection.
Outside code and releases
Source credentials are root-managed files outside GitHub, images, and immutable release directories. Only the worker receives the read-only secret mount. The browser, web process, deployment environment, logs, database, and connection-test history never receive credential values.
Database-backed claims
The worker claims queued jobs with row locking and heartbeat recovery. Duplicate scheduled runs use durable deduplication keys.
State survives containers
PostgreSQL data, exact source archives, extracted lake objects, uploaded source caches, and generated reports live on durable volumes outside immutable application images. The existing Webagents Codex authentication remains in its access-controlled server directory and is mounted only into the web service.
Shared Codex subscription runner
Call Insights reuses the same server-managed Codex runtime and subscription authentication already used by Webagents/Northstar. It neither installs another Codex package nor exposes a second login flow, API key, token, or credential-management screen.
The model never calculates
Codex maps language to a schema-constrained summary or raw-detail plan with approved datasets, dimensions, measures, aggregation, and time scope. Deterministic rules protect precise requests and archive-coverage questions; validated application code executes every query and returns hashed source evidence.
Queryable does not mean unrestricted
The query engine can aggregate approved CSV dimensions and measures across the retained history, de-duplicates entity snapshots by the latest report date, and enforces source-file and row budgets. Phone numbers, names, contact identifiers, message text, recordings, arbitrary raw rows, and free-form SQL are not available to the model or browser.
Weekday × campaign, with denominators
For booking-average questions, the warehouse groups approved Service scheduled observations by report-date weekday and campaign stream, then divides each pair by its own observed report-day count. Answers disclose that campaign stream is the available grouping—not a separate company field—and never treat missing report dates as zero.
Closed evidence compiler
The explanation model receives only a bounded fact pack with opaque evidence IDs. It writes prose using placeholders such as an evidence value or label; the server inserts the exact value, adds sentence-level citations, and rejects bare numbers, unknown evidence, new calculations, causal claims, or predictions. A rejected or unavailable model response becomes a deterministic fact summary instead.
Deterministic chart compiler
The model emits only a constrained chart intent. Application code validates the metric and data shape, then compiles it into Apache ECharts 6.1.0, GridStack 13.1.2, or Tabulator 6.5.2 configuration. Responsive policies adapt labels, axes, legends, and controls for narrow screens. Raw model-generated chart code is never executed.
Versioned widget and layout API
Create, edit, remove, arrange, resize, and undo operations share CSRF and ownership checks. Arrange mode expands the grid to the full workspace, makes move and resize affordances explicit, and temporarily removes Data discovery from the interaction layer. Grid geometry is validated and saved with optimistic concurrency protection.
Visible asynchronous work
During a Data discovery request, the panel exposes an accessible busy state, a restrained progress row, staged progress copy, and disabled duplicate-submit controls. Completion and failure return explicit UI states instead of leaving a silent wait.
Business-first dashboard hierarchy
Metric cards use a neutral surface, compact type scale, restrained status colour, and consistent left alignment. Decorative gradients and oversized values are avoided so comparisons remain scannable at desktop, narrow, and zoomed layouts.
Durable users and revocable sessions
PostgreSQL stores individual accounts with salted scrypt password hashes and administrator/member roles. Signed, Secure, same-site sessions expire after 12 hours by default and carry a version checked against the live account on every protected request. Password reset, role change, or account disablement invalidates active sessions immediately.
Private dashboard and chat ownership
The report library is shared organizational evidence, while dashboard definitions, versions, and chat history are owner-scoped. Every lookup and mutation validates ownership; another user's identifier returns not found. Only administrators can upload sources, import archives, or queue report processing.
Lifecycle controls and audit
Administrators can create, enable, disable, change roles, and reset temporary passwords without deleting history. First sign-in requires a password change, five failed attempts trigger a timed lock, the last active administrator is protected, and security events are retained without credential material.
No data or execution back door
Each model turn uses codex exec in an empty temporary directory with the read-only sandbox selected. Codex receives a bounded schema catalogue for planning or a closed evidence pack for explanation—not database access, report files, identifiers, contact records, message text, or arbitrary chart code.
A deliberately narrow edge
Only Caddy owns public ports. The app is authenticated, CSRF-protected, security-headered, and reachable through a host-only Docker bridge. Subscription and provider credentials stay in access-controlled server directories and are never returned to the browser or stored in the Call Insights image.
How changes reach production
One push. A controlled release.
Every deployment moves through the same automated gates before the live release is promoted.
View private repository ↗- 01VerifyPython tests, user-role and cross-workspace isolation tests, shared Codex runner tests, deterministic chart tests, responsive Chromium UI tests, lint, migration
- 02PackageImmutable multi-architecture image in GHCR
- 03ProtectDatabase backup before schema migration
- 04ReleaseHealth-check, promote symlink, rollback on failure
Open-source visual analytics