Polymath AI Workspace — a project by Ahsan Mahmood
A document-based AI workspace with four lenses — Study, Career, Knowledge, and Document-Pro — over one shared RAG core.
Four different tools, and underneath they are the same tool.
Studying from a textbook. Keeping notes that can be found again. Preparing for an interview against a job description.
Reading a contract for the clause that will cause trouble. Each of those starts by taking a document apart so it can be asked questions.
Polymath builds that part once and puts four faces on it.
A file arrives, whether a PDF, a word processor document, plain text or a clipped web page, and the core parses it, splits it into chunks, embeds those and classifies the content. Everything above that is an interface onto the same store.
The four lenses are Study, Knowledge, Career and Document-Pro.
Study carries spaced-repetition cards on a scheduling algorithm, timed exams and hands-free audio review. Knowledge does semantic search across notes with suggested links and a daily review feed. Career handles tailoring a resume, drafting a cover letter, mock interview chat and a Kanban tracker for applications. Document-Pro scans contracts and financial documents for risk and compares one document against another.
One core, four faces. That is the reason one person could build all of them.
It is also the reason a document uploaded for one purpose is immediately available to the others, which is a property nobody would build deliberately across four separate applications and which turns out to be the useful part.
Retrieval answers with citations that deep-link to the exact chunk.
That precision is the whole difference between a citation and a gesture at one. An answer pointing at a hundred-page document has told you almost nothing about where its claim came from, and checking it means reading the document again, which is what you were trying to avoid. Pointing at the passage makes verification a click.
For a system that can be confidently wrong, that is not a nicety.
The key model is bring-your-own.
That decides what this can be. A retrieval product makes a paid call every time somebody asks something, which is the cost structure that quietly kills side projects. Here the user supplies their own key, held encrypted and decrypted only on the server rather than in the browser, so per-call costs sit with the person making the calls.
That is what makes it operable by one person at all.
A stored key is a stored credential, so the encryption is not decoration either. It is the reason asking somebody for their key is a reasonable request rather than an alarming one.
There is a design consequence of the shared core that is worth naming, because it cuts both ways.
Four lenses over one store means a change to how documents are chunked or embedded affects all four at once. That is efficient when the change is an improvement and unforgiving when it is not, so the core is the part of this codebase where a mistake is most expensive. Building it first and putting interfaces on afterwards is the only sequence in which that risk is visible.
What it cost is that none of it is deployed.
The record is precise about this and calls its own status honest: wired end to end, typecheck and build and continuous integration passing, no live address, no store listing. Compiling is not shipping. It is a genuine milestone on a product this size and it is not the same as somebody being able to use it, and this page keeps the two apart.
What it does, and what that costs to build
- Document ingest and RAG chat with citations that deep-link to the source chunk
- FSRS spaced-repetition flashcards, timed exams, and hands-free audio review
- Semantic note search with AI-suggested links and a daily-review feed
- Resume tailoring, cover letters, mock-interview chat, and a Kanban application tracker
- Contract, finance, and general document risk scanning with doc-vs-doc comparison
- Bring-your-own-OpenAI-key vault with AES-GCM encryption, decrypted only server-side
- Stripe billing with tiered plans and a role-gated admin panel
- One codebase shipped to web, iOS, Android, and desktop
Built with
- React 19
- TypeScript
- Vite
- Supabase
- PostgreSQL
- pgvector
- Deno Edge Functions
- Capacitor
- Tauri
- Tailwind CSS
- shadcn/ui
- Stripe
- OpenAI
- Zustand
- TanStack Query
Worth knowing
- ai-workspace
- rag
- supabase
- pgvector
- spaced-repetition
- document-ai
- capacitor
- tauri
What state is Polymath in?
Wired end to end, with typecheck, build and continuous integration passing, and not deployed anywhere. The record is unusually precise about this and calls its own status honest. So the four lenses described below exist as code that compiles rather than as a product anybody is using, and there is no live address and no store listing. Working and shipped are different claims and this page keeps them apart.
Why four different products on one core?
Because they are the same problem seen from four angles. Studying, keeping notes, preparing for interviews and reading contracts all begin with documents that have to be parsed, split, embedded and made searchable. Building that ingest core once and putting four interfaces on it is far less work than four applications, and it means a document uploaded for one purpose is already available to the others.
What does a citation deep-link to?
The exact chunk it came from, not the document. That distinction is the difference between a citation and a gesture at one. An answer pointing to a hundred-page PDF has told you almost nothing about where it got its claim, and it cannot be checked without rereading. Pointing at the specific passage makes verification a click, which is the only version of a citation worth having in a system that can be confidently wrong.
Whose OpenAI key does it use?
Yours. The design is bring-your-own-key, with the key held encrypted and decrypted only on the server side rather than in the browser. That has two consequences: per-call costs belong to the person making the calls rather than to whoever runs the service, and a product that would otherwise be unaffordable to leave running becomes possible for one person to operate. The encryption detail matters because a stored key is a stored credential.
Does Polymath work on iPhone?
Nothing is deployed anywhere yet. The codebase targets web, mobile through Capacitor and desktop through Tauri, and the record lists iOS among the intended targets, which describes configuration rather than a published application. No Apple Developer account sits behind this work and nothing I build has shipped to the App Store. There is no live address and no store listing on any platform today.
https://aoneahsan.com/projects/com.aoneahsan.polymath