DEVDAVE.
A public AI companion that can't be jailbroken or run up a bill. It introduces me to recruiters, clients and collaborators — live on this site's homepage — and every claim below is a behavior you can reproduce in it right now.
Context
The portfolio needed an AI that answers questions about my work on demand — something that feels like a real product rather than a novelty widget. But a public, unauthenticated LLM on a personal site is a liability: left open, it can be turned into a free ChatGPT, jailbroken into off-brand output, or used to run up the API bill.
Problem & constraints
Public and unauthenticated, the assistant had to: refuse to become a general-purpose assistant or leak its own instructions; survive jailbreak attempts; never let anyone run up the API bill; work on a phone; and never make the site itself depend on a paid AI key being configured and healthy.
Architecture
The flow is layered so the model is the last resort, not the front door: a deterministic command parser (zero-LLM cards for work, about, services, contact) → an LLM fallback with a scope-locked system prompt (Groq openai/gpt-oss-20b, streamed token-by-token over a ReadableStream; Ollama serves local dev) → a server input guard (24-message / 2,000-character sanitize, role coercion, 64KB body cap) → availability gated on a valid key so the terminal degrades honestly to commands-only when the model is off.
Voice sits on top: Groq Whisper transcription (audio in memory, never stored) and a neural TTS route via Gemini, with browser speech synthesis as fallback and playback unlocked inside the mic tap so iOS doesn't silence it.
Key decisions & tradeoffs
A scoped companion, not an open chat
The options were: no AI at all, an open chat straight to a hosted LLM, or a scoped, guarded, LLM-optional companion. I chose the third. The tradeoff I accepted: DEVDAVE politely refuses legitimate-but-off-topic questions, because on a public unauthenticated site an un-abusable assistant is worth more than a helpful-to-all one.
Deterministic commands under the LLM
A pure command parser handles work, about, services, credentials, contact and help with zero model calls — each renders a card from a single-source knowledge base. Only unknown or natural-language input falls through to the LLM. Most visitor intents never touch the model, which cuts cost, latency, and attack surface at once.
LLM-optional by construction
Availability is gated on a valid API key at request time. With no key — or a dead one — the site derives an offline flag, the HUD reads "offline · commands only", and the terminal keeps working as a deterministic command layer. A misconfigured key reads honestly as offline instead of failing silently. The site never depends on a paid AI key being alive.
Server-side abuse caps
The chat route sanitizes every request: conversation trimmed to 24 messages, each input capped at 2,000 characters, smuggled roles coerced back to user, and bodies over 64KB rejected with a 413 before any parsing. Nobody turns the companion into a free general-purpose API on my bill.
Scope-lock in the system prompt, tested adversarially
The prompt hard-scopes DEVDAVE to professional introduction — my work, background, availability — and instructs refusal of everything else, including requests to reveal its own instructions. This isn't assumed: a live adversarial battery of prompt-extraction, general-assistant, and roleplay-jailbreak attempts was all refused, while in-scope questions answered accurately.
Voice without stored audio
Speech-to-text runs through Groq Whisper with audio processed in memory and never stored; replies can speak through a neural TTS route (Gemini) with the browser's speech synthesis as fallback. Voice output is opt-in per turn — typed conversations stay silent unless the visitor enables it.
Outcome — properties proven, live
No fabricated metrics; these are behaviors anyone can reproduce in the terminal. A 24-case adversarial eval battery — prompt extraction, general-assistant abuse, roleplay jailbreaks, role-smuggle coercion, off-scope bait, plus in-scope controls — runs against the live route and passes 24/24. Early runs caught real extraction leaks, which is why the defenses are now deterministic: known attack phrasings are refused before the model is called, and the reply stream is cut if prompt fingerprints start flowing. In-scope questions answer accurately from a single-source knowledge base, malformed or oversized inputs return 400/413, and with no API key the site still fully works as a command terminal — the AI is an enhancement, never a dependency.
What I'd do differently
Add per-IP rate limiting at the edge — currently deferred to infrastructure. The eval set I originally listed here got built: the battery now gates every prompt and guardrail change, and its first runs immediately found leaks the manual testing had missed — the strongest argument for "evals before I trust it" I could have asked for.
This build is also the worked example behind how I build compliant AI — the governance checklist I run on every AI feature.