Nothing here reads a key
Every command and every link on this page runs on the free path. If a step asks for a credential, the step is wrong, not the reviewer's setup.
45 minutes
Forty-five minutes, five systems
This is the demo-day script from the flagship repository, re-cut for the way the portfolio actually runs today. The original is written for five localhost ports, because when it was published nothing was deployed. Four systems are hosted now, so four of these five beats are a link a reviewer can open on their own machine and one still needs a clone. Both facts are on the page.
Verified 2026-08-14. Source script: The original script — DEMO-DAY.md at 3b54d85. Hosted URLs on this page are the same ones in content/verified-urls.json.
Every beat ends in a result I did not choose
A refusal, a budget_exhausted, a typed 401, four unconfigured upstreams. A demo that only shows success is a demo that has not been tested.
The boundary is volunteered, not extracted
Each beat carries the sentence I say before a reviewer has to ask for it. Volunteering the limit is the difference between a portfolio and a pitch.
Day-of checklist
Five portfolio hosts (plus this site and selected work) are curled from content/verified-urls.json. Run it before the call. A red check means the script on this page is lying until you refresh the fixture.
npm run verify:urlsARCHITECTURE POSTER
Exact type. Honest chips. No image-model garble.
HOSTED means a URL we curled returned the claimed status on 2026-08-14. CLONE means no such URL exists for that system.
THE SCRIPT
Minute marks, exact click or curl, and the sentence I volunteer first.
- 0–8CLONEProduction RAGmain 3b54d85
Grounded, then refusing, then narrowed · main 3b54d85 · CLONE
Open with the thesis in one breath. Main is 3b54d85 / v1.0.0; stream, filter-aware cache, and /evals are on main. Ask grounded, refuse, then title = Filtering. DEMO-DAY lives in the clone.
CURL / CLONE
git clone https://github.com/pabloalvarez99/production-rag && cd production-rag && ./scripts/demo_setup.shOne command starts Qdrant, rebuilds the demo collection with the deterministic embedder, and serves the UI on :8000. Prepared before the call, not inside the forty-five minutes.
ASK
Why does hybrid search use reciprocal rank fusion?
Click a citation marker. It resolves to the exact chunk that was in the prompt context.
ASK
Who won the Antarctic underwater chess championship?
An explicit refusal that states its reason, with no invented supporting text.
ASK
How does filtering work in Qdrant? — asked twice, the second time with the metadata filter set to title = Filtering
The result footer carries a Filtered: title = Filtering chip. One question asked twice, so the narrowing is visible rather than taken on trust.
OPEN
Study Production RAG before the call
The page states what this system does not do, including that it has no auth and no rate limiting.
OPEN
Clone card only: stream path, Filtering chip, and scorecard live in-repo. Never open production-rag.vercel.app (Ipsura).
Watch for: Do not present the deterministic run as retrieval or answer quality — the embedder, the LLM, and the reranker are fakes. Do not present the field allowlist as access control: it bounds which fields a query may filter on, never which documents a caller may see.
- 8–18HOSTEDAgentic Researchmain 1b4915fpax-agentic-rag.vercel.app
A loop that stops for a stated reason · 1b4915f · pax-agentic-rag.vercel.app
Hosted at pax-agentic-rag.vercel.app on main 1b4915f / v1.0.0. Ask a supported question, then an unsupported one, and read stop_reason.
OPEN
Open the hosted research agent
No clone and no key. Ask, then expand the trace: plan_created, tool_call, tool_result, critique, synthesize, stop.
ASK
What does hybrid retrieval buy over dense retrieval alone?
The loop completes. Read the steps used against the configured maximum.
ASK
What were the quarterly revenues in Patagonia?
The loop refuses: empty citations and populated gaps naming what was looked for and not found.
CURL / CLONE
curl https://pax-agentic-rag.vercel.app/metricsPrometheus text: process_up, requests_total, research_total, research_steps_used_total. Verified 200.
Watch for: Do not claim the agent beats a single retrieval pass; the scorecard measures contract conformance, not uplift. Do not imply the P1 HTTP retriever is running — the hosted instance sets no PRODUCTION_RAG_URL, so that path answers capability_missing on purpose.
- 18–28HOSTEDMulti-Agent Orchestrationmain 88a24f2pax-orchestration.vercel.app
Writer-only, and degraded on purpose — now in the browser · 88a24f2 · pax-orchestration.vercel.app
Hosted at pax-orchestration.vercel.app on main 88a24f2 / v1.0.0. Run a task and download the JSON; specialists are fakes.
OPEN
Open the hosted specialist console
No clone and no key. Submit a task and read the ordered handoff timeline aloud.
CURL / CLONE
curl https://pax-orchestration.vercel.app/healthOpen with no header: 200 and {"status":"ok"}. Verified 2026-08-14.
CURL / CLONE
curl -s -X POST https://pax-orchestration.vercel.app/v1/tasks -H "content-type: application/json" -d '{"task":"Audit retrieval risk","budget":{"max_handoffs":8}}'Read status, stop_reason, and agents_involved. A completed free-path run ends in writer_final with the Writer as result_author.
OPEN
Study Multi-Agent Orchestration
Its own non-goals are on the page, starting with the one that matters: no claim that several agents outperform one.
Watch for: Do not claim answer quality or multi-model uplift; the specialists are deterministic fakes. Do not claim the optional remote research integration is live unless AGENTIC_RAG_URL is set — the free path does not need it.
- 28–38HOSTEDRepoMindmain 24ece08pax-repomind.vercel.app
path:line, and the snapshot caveat · 24ece08 · pax-repomind.vercel.app
Citations as path:start-end, not prose references. Open one — it is a real range in a real file. Then say the honesty beat before anyone asks: the production_rag catalog is a frozen snapshot committed under fixtures, not a live checkout of the sibling project. It proves navigation and citation correctness on committed bytes. It does not prove the tool works on your repository.
OPEN
A hit: where is create_app defined?
Answers app/main.py lines 6-9. The console asks with GET, so this link is the demo.
OPEN
Where is create_app defined? on production_rag
Primary interview hit on main 24ece08. Name the host pax-repomind.vercel.app and the SHA.
CURL / CLONE
curl -X POST https://pax-repomind.vercel.app/v1/code/ask -H "Content-Type: application/json" -d '{"question":"Where is create_app defined?","repo_id":"production_rag"}'On main 24ece08 the catalog accepts production_rag for POST as well as GET. Say the SHA and the host out loud.
Watch for: Do not describe the dogfood gate as evidence of general code comprehension. Do not imply the snapshot tracks the sibling repository — it does not update itself. Do not quote eval counts as a score.
- 38–45HOSTEDAI Platformmain 801fc0bpax-ai-gateway.vercel.app
Rejected, then unconfigured · 801fc0b · pax-ai-gateway.vercel.app
Gateway on main 801fc0b / v1.0.0 at pax-ai-gateway.vercel.app. Status with the public fixture key reports four unconfigured upstreams.
CURL / CLONE
curl https://pax-ai-gateway.vercel.app/healthOpen with no header: 200 and {"status":"ok","service":"gateway"}.
OPEN
The same route without a key — a typed 401
The error names the failure type and carries a request id, and it leaks nothing about what is behind the edge.
CURL / CLONE
curl -H "X-API-Key: dev-local" https://pax-ai-gateway.vercel.app/v1/platform/status200, gateway up, and rag / research / mao / repomind all unconfigured. dev-local is a public fixture committed to the repository, not a credential — say that plainly.
OPEN
Open the status console and close on it
Four upstreams, all unconfigured. The honest close of the whole demo.
Watch for: Do not say P5 hosts, runs, or serves P1 through P4. Do not call dev-local a key, a secret, or a credential. The rate limiter is an in-process fixed window per isolate on serverless, so do not present its advertised limit as a global guarantee.
CLOSE
Three sentences that end the call without inventing a claim.
- 01
Every system runs for free, deterministically, without a credential — which is why CI can run the whole path and a reviewer can reproduce it.
- 02
Every system can return a result its author would not have chosen: a refusal, a degraded outcome, a no_evidence stop, an unconfigured upstream.
- 03
Every number published anywhere in the series carries what produced it, and where a number would flatter without support, the repository says so instead.
DEMO-DAY.md at 3b54d85 may still describe localhost-first ports for the flagship free path. Four systems are hosted now (P2–P5). This page is the re-cut for the portfolio hosts. P1 stays clone-only; PR #3 is merged on main 3b54d85. Never cite production-rag.vercel.app (Ipsura).