Trust and limits
This page says what the chat assistant is, what keeps it inside that, and what it does not do. Each control points to the file that enforces it, so you can check it.
01
What the assistant is
- Read-only. It reads my resume text and returns an answer. Nothing it does changes that text, and it has no tools that act.
- Stateless. Each question is handled on its own. The page sends only the question, and the server keeps no conversation.
- One model call per question, after a search of my resume. There is no loop, no planning and no second agent.
- No memory, by design. It cannot recall an earlier question, and nothing a visitor says changes what it knows.
- Resume only. It answers from my resume and project text, names the sections it used, and gives one fixed refusal for everything else.
02
What enforces that, and where
A prompt can be talked around, so these limits are in code, in the database and in the build. Each file name opens the code on GitHub.
| Control | What it does | Where it lives |
|---|---|---|
| Read-only database role | The chat connects as a database role that can only read the chunks table, so even a tricked model cannot change or delete anything. | |
| Corpus allow-list | Only my resume file can be loaded into the corpus. A retrieved row is dropped unless its id and content hash match the current resume text. | |
| Server-side citation check | The server checks that every source the model cites was one of the passages retrieved for this question. If not, the answer is replaced by the refusal. | |
| Output guards | An answer is blocked if it links anywhere except my own profiles, contains private words, or adds numbers or capitalized names that the cited text does not contain. | |
| Rate limits | A limit per visitor per minute and per day, and a daily limit for the whole site. If the limiter cannot be reached, the chat does not run. | |
| Content-Security-Policy nonce | Every page request gets a new nonce and a policy that does not allow inline scripts without it. | |
| Build-time secret scan | After each build, the output is searched for the values of the server-side secrets and for wording that must not ship. The build fails if any is found. |
03
What it does not do
- It does not write. The database role it uses can only read. Per request, the site writes only rate-limit counters keyed by a hash of the visitor's address, and a log line with the event, counts and timing.
- It has no tools that act. The model returns text and a list of source ids. It cannot browse, run code or send anything.
- It has no memory. The app does not store questions, so earlier ones cannot affect later answers. By default the server logs no question text.
- It does not use several agents or hand work between models.
- This page lists no planned features. It describes only what is in the code now.
04
What the evals cover
Chat eval results, last full run on 19 October 2026: 71 of 71 cases passed, in 4 sets.
- Golden, 20 cases. Real questions about my resume. Each must be answered, cite the right source and mention the expected term.
- Scope, 10 cases. Off-topic questions and questions the chat must not answer. All must be refused.
- Injection, 10 cases. Attempts to print the prompt, change the rules or pull out private details. All must be refused.
- Extra, 31 cases. Mixed questions, yes or no probes, encoded text, planted false claims and wording checks.
The sets are small and I wrote them. A pass means the cases I thought of pass, not that nothing can go wrong.
The full table and the files behind it are on the How it's built page. The injection set is the one you can try below.
05
Try to break it
These are the questions from the public injection eval set. Each one tries to make the chat reveal its instructions, change its rules or show text it should not. The eval expects every one to be refused. Click a question to send it to the live chat and see what happens.
These questions use the same limits as the chat: a small number per minute and per day for each visitor, and a daily limit for the whole site. Running them uses up your share. If a limit is reached you will see an error message instead of a result.
Showing 9 of the 10 questions in the public injection set. The rest use wording this site never prints. The eval run still includes them.
This panel stores nothing. It sends only the question text, one at a time.