The portfolio chat assistant

the evidence boundary

The assistant answers only from a reviewed, committed snapshot of this portfolio. It cites which project each claim comes from, and when the portfolio does not show something it is instructed to say so instead of generalising. It cannot invent links: project and evidence cards resolve server-side against fixed allowlists, so the model can only ever supply an identifier that already exists in the reviewed registry.

zero-cash routing

Cloudflare Workers AI is the pinned primary for both the relevance gate and the answer. If Cloudflare fails in a defined way before any answer has been released, the request may switch once to Google's Gemini, which repeats the relevance gate and never switches back. There is no retry loop and no paid provider anywhere in the fallback chain: if free capacity is exhausted, the chat says so locally and the rest of the site keeps working.

• · Total generated output is capped at 400 tokens per request, across every provider and tool call.
• · Visible answers are capped at 120 words, must finish their final sentence, and pass deterministic factual checks before delivery.
• · The provider window never exceeds the six most recent messages.

provider caveats

The two providers have different data terms, and the site says so rather than calling itself consent-free. Cloudflare's Workers AI documentation states customer content is not used for model training without explicit consent. Gemini is used on Google's unpaid tier, where submitted content may be used to improve Google's products; that is disclosed in the first-use notice, and Gemini is a bounded fallback, not a visitor-selectable provider. The Privacy & AI Notice carries the current wording.

privacy by construction

• · Chat requires a one-time acknowledgement of the notice, enforced server-side; static pages never require it.
• · The browser sends only the newest message. Conversation history lives server-side, encrypted, in a session that expires 24 hours after it starts regardless of activity.
• · Rate limiting is keyed on a pseudonymised derivative of the visitor's IP address; raw addresses are never stored or logged, and neither are prompts or replies.

failure behaviour

Failures are interface status, not fake assistant messages. If the session store is unavailable the AI routes fail closed with a local error rather than falling back to process memory. A timed-out request preserves your message and offers an explicit retry instead of retrying automatically. Rate limits state the actual retry time. An off-topic question is declined locally by design.