Interview Autopsy (AI-Powered Technical Interview Coach)

Zero-framework Node.js application that turns technical-interview recordings into verified, actionable coaching: diarized speaker reconstruction, evidence-backed 8-criterion rubric analysis, cloned-interviewer spoken follow-ups, interactive candidate re-recording, and deterministic delta re-scoring.

---

Features & Milestones (M0–M10)

• M0 — Infrastructure & Application Core: Lightweight, dependency-minimal Node.js server (node:http) with strict CSP, CORS, and request routing.
• M1 — Upload & Multi-Gate Validation: Multi-part file upload with content-type sniffing, extension whitelisting, duration bounds checking, and consent gating.
• M2 — Canonical Audio Processing: Standardized 16kHz mono audio transcoding and probing with ffmpeg/ffprobe.
• M3 — Speaker Diarization & Plain STT: MOSI API integration for multi-speaker diarization and plain transcription with robust retry and error normalizers.
• M4 — Transcript Reconstruction: Automatic interviewer vs. candidate role disambiguation and Turn/Q&A pair pairing.
• M5 — Evidence-Verified Rubric Analysis: 8-criterion structured evaluation via Gemini with deterministic quote verification and weakness selection.
• M6 — Voice Sampling & Spoken Follow-Up: MOSI voice cloning and TTS synthesizing custom follow-up questions in the interviewer's voice (with graceful text-only fallback).
• M7/M8 — Phase 2 Re-Recording & Delta Re-Scoring: Second-answer capture, plain speech-to-text, and delta re-scoring targeting the specific weakness.
• M9 — Security Hardening & Rate Limiting: High-entropy job tokens, sliding-window rate limiters, 24-hour duration quotas (DailyQuotaLimiter), and global concurrency limiters (ConcurrencyLimiter).
• M10 — Observability & Operations: Structured JSON logging with recursive PII/key redaction, /healthz telemetry endpoint, and 100% automated test coverage.

---

Prerequisites

• Node.js: v20.0.0 or higher
• FFmpeg & FFprobe: Installed and available on system PATH (required for media validation, audio slicing, and canonical transcoding).

---

Quick Start (Mock Mode)

By default, the application runs in hermetic mock mode, requiring zero external API keys or active internet connection:

# 1. Install dependencies
npm install

# 2. Run test suite (hermetic mock mode)
npm test

# 3. Start local development server
npm start

Open http://localhost:3000 in your web browser.

---

Live Provider Setup (Real APIs)

To connect the application to live external providers (Google Gemini & MOSI):

1. Create a .env file in the root directory:

# Application Settings
PORT=3000
NODE_ENV=production
MOCK_EXTERNALS=0

# Security & Quotas
RATE_UPLOAD_MAX=12
RATE_STATUS_MAX=300
RATE_DAILY_QUOTA_SEC=3600
CONCURRENCY_CAP=4

# Provider Secrets
GEMINI_API_KEY=your_gemini_api_key_here
MOSI_API_KEY=your_mosi_api_key_here

# Model Selection
GEMINI_MODEL=gemini-2.5-flash
MOSI_MODEL_TRANSCRIBE=mosi-transcribe-diarize
MOSI_MODEL_TTS=mosi-tts

2. Start the server:

npm start

---

Production Operations & Observability

Health & Telemetry (/healthz)

Query the unauthenticated, privacy-safe health endpoint:

curl http://localhost:3000/healthz

Example response:

{
  "ok": true,
  "service": "interview-autopsy",
  "milestone": "M0-M10",
  "uptimeSec": 420,
  "jobsInMemory": 2,
  "memory": {
    "rssMb": 84,
    "heapUsedMb": 38,
    "heapTotalMb": 52
  },
  "toolchain": {
    "ffmpeg": true,
    "ffprobe": true
  },
  "mockExternals": false,
  "models": {
    "gemini": "gemini-2.5-flash",
    "mosiDiarize": "mosi-transcribe-diarize",
    "mosiTts": "mosi-tts"
  }
}

Security Architecture

• Job Authorization: Ephemeral, high-entropy 256-bit job tokens. Only SHA-256 digests are retained in storage.
• Log Scrubbing: Automatic redaction of auth headers, session cookies, raw transcripts, candidate quotes, and API keys.
• Reverse Proxy: When deploying behind NGINX, Cloudflare, or AWS ALB, set TRUST_PROXY=1 so client IP rate limiters evaluate the upstream client IP.

---

Running Automated Tests

Run the complete test suite (291 tests across 55 test suites):

npm test