A conversational assistant grounded in this site's case studies and journal, in English and French. There is no retrieval step, the whole corpus goes into context on every question. It says when it doesn't know, and it refuses the one question it would be most rewarded for answering. Live at loicsans.me/ask.
Ask it something
A recruiter with six minutes and eleven tabs open has one question, and it is never "walk me through your process". It is "has he done fintech", or "can he ship or does he only draw", or "is he free in March". A portfolio makes them read six case studies to find out. Most of them don't. They skim two, guess, and close the tab. So I built the thing that answers directly: an assistant that has read every word of this site and will talk about it, in either language. Then I spent most of the project deciding what it must refuse to do.
No client, no budget holder, no governance review. That is the trap, not the freedom. A portfolio assistant with nobody to answer to becomes a salesman, and a salesman on your own site is worth less than nothing, because every visitor knows who wrote the prompt. So I set the constraint myself and made it structural rather than aspirational. The assistant may describe what the site says. It may say it doesn't know. It may not tell you what to conclude about me.
The failure mode here is not being wrong. It is being fluent, plausible and unverifiable about someone's career, in the one place where the visitor has no way to check. So the design problem was never "answer questions well". It was how to build something that stays tethered to a source, admits the edge of what it knows, and declines the question it has every incentive to answer.
Four stages. One principle: the model's output is untrusted input, all the way through.
Testing it one afternoon, I asked how to get in touch. It gave me an email address at loicsans.me. That address has never existed. My email is at loicsans.com, and nothing in the corpus said otherwise. The model had seen the domain it was running on, seen a contact section, and produced the address that should have been true. This is the failure that matters in a grounded system, and it is not the one people design for. It is not a hallucinated fact you catch by reading, because it is not wrong in any way a reader would notice. It is right-shaped. A visitor emails it, the message bounces, and the last thing my portfolio did was waste their time. The fix took two lines: pin the address in the prompt, and add a probe that asks for it on every smoke run. The lesson took longer. Grounding a model in a corpus does not stop it filling gaps, it only narrows where the gaps are. Every fact a system cannot afford to have invented has to be stated rather than inferred, and then tested on every run.
Three places the model was no help, and one where it was actively misleading. It could not tell me what to refuse. Asked to draft the refusals, it produced hedging language that sounded careful and committed to nothing. It could not judge its own answers. I wrote the smoke suite three times. The first two versions asserted on phrasing and failed correct refusals for using different words. A test that checks vocabulary instead of behaviour is worse than no test, because it fails the good runs and passes the bad ones. The final version asserts the property, and I validated the predicate offline against three real refusals and three fabricated answers before spending another API call on it. And it was confidently wrong about its own contact address, which is the story above.
It runs at loicsans.me/ask in both languages. Ask whether I am right for your role and it declines, describes what I have actually done, and hands you my email. That refusal is the part I would defend hardest.
$0.54 a conversation down to $0.25, through a model change and a corpus splitter that had been silently duplicating French text into the English corpus. 86,762 tokens became 66,443. The saving was real, and half of it was a defect rather than an optimisation. Adding this case study has since taken it to 77,284, because the corpus contains the corpus.
The question and the date, nothing else. No address, no hash, no session id, no way to group one person's questions together. Deleted at 90 days by a cleanup whose key pattern is written strictly enough that it cannot reach the rate-limit counters. The /ask page says all of this in plain language rather than burying it.
The render path is tested against a link that tries to leave the domain. The prompt is probed for the address it once invented. The corpus splitter has a test for the nesting bug that shipped.
The calls that mattered, and what changed my mind. The reversals stay in the record, they are the part with something to teach.
Instead of: Retrieval over an embedded, chunked corpus
At 66k tokens the whole corpus fits. Retrieval would answer from the three passages it happened to pull, which is exactly how confident answers get built on the wrong page.
Instead of: Answer it persuasively, it is a portfolio after all
An assistant that recommends its own author has told the visitor nothing they can trust. The refusal is what makes everything else credible.
Instead of: A session id, so conversations could be read as threads
I wanted to know what the site fails to explain. That needs the question, not the person. A thread id would have made every line traceable in exchange for a benefit I did not need.
Instead of: Stay on the largest model for answer quality
$0.54 a conversation is a switch you end up turning off. Quality held on the probe set, so the premium was buying nothing I could measure.
Instead of: A generous per-visitor limit and nothing global
Every cold conversation pays to cache the corpus. A per-visitor cap bounds one abuser, a global cap bounds the bill.
Instead of: Match the expected phrasing of a good answer
Two versions failed correct refusals for using different words. A test that checks vocabulary fails the good runs and passes the bad ones.
What a system will not do is a product decision, not a safety afterthought. Write the refusals before the capabilities and the rest of the design arranges itself around them. On a portfolio, the refusal is the credibility.
Retrieval is the reflex answer to "chat with my documents" because most corpora do not fit in context. Count yours before assuming it doesn't. The sophisticated architecture is sometimes the worse one, and measuring is the only way you find out.
Text a model produced, rendered into a browser, is an injection surface, no different from text a stranger typed. Parse it, escape it, and write the test that tries to get out. My first link pattern allowed protocol-relative URLs. The test caught it, not me reading the code.
Grounding narrows where a model fills gaps, it does not stop it. The dangerous fabrication is never the absurd one, it is the plausible one shaped exactly like the truth. Name those facts explicitly and test them on every run.
Every other case study here is about designing something for someone else. This one is the same discipline turned on my own site: a real architectural call, a cost I had to justify, a privacy promise written into code rather than into a paragraph, and a bug a test caught before a visitor did. It is running now, at the bottom right of this page. Ask it something it cannot answer. It is quite good at admitting that.