How Ferro is built.
Ferro is the assistant in the corner of every page. It is built the way we build AI features for clients: a person stays in the loop, the guardrails are deterministic, and everything it does is observable.
Ferro assists. People decide.
It never quotes, schedules, or commits
Ferro explains what is possible and how we generally work. Pricing, timelines, scope, and any agreement are worked out by a person, in a conversation.
Every lead goes to a person
When a visitor wants to talk, Ferro shows a short contact form. What is submitted goes to the owner, who replies. No automated follow-up.
The owner sees the whole conversation
A lead notice carries the full transcript, so the reply can pick up exactly where the visitor left off instead of asking again.
You can ask for a person at any time
The email address is always one line away, and Ferro points to it whenever a question deserves a real answer.
Deterministic checks, on both sides of the model.
Scope-locked prompt
The system prompt is hard-scoped to Ironstone Foundry. Off-topic and general-AI requests are declined, and instructions only ever come from the prompt, never from the conversation.
Origin allowlist
The endpoint answers only requests that come from this site.
Short-lived signed page token
Each page load mints an HMAC-signed token that expires quickly. A request without a fresh one is refused.
Rate limits and token budgets
Per-session and daily budgets cap what any conversation can spend, with rate limits behind them. The windows are generous so real conversations are not cut short.
Injection pre-filter
Deterministic checks run on the input before a single model token is spent. Suspicious turns are softly declined and flagged.
Canary post-filter with holdback
A secret marker is planted in the prompt. Output is streamed with a small holdback so if the marker ever appears, the response is withheld and an alert fires.
Plain text only
Model output is rendered as text, never as HTML. Nothing the model writes can become markup or script in your browser.
Strict content security policy
Scripts load only from this origin, with no inline code. The browser talks only to same-origin endpoints for chat.
A hand-off, never an error screen.
Watched from the first turn.
Every turn is traced
Each exchange is captured with its provider, model, token counts, tool calls, latency, and guardrail flags — including the turns a guardrail stopped early.
An offline eval suite, gated in CI
A versioned set of legitimate, injection, abuse, and scope-escape cases runs through the real guardrail pipeline on every change. The build fails if pass rates slip.
Online evals and alerting
Production conversations are scored continuously, and injection, leak, or error signals raise an alert to a person.
- Pages
- Astro, static HTML
- Endpoint
- One serverless function
- Model
- OpenAI primary, optional Claude path
- Log
- Turso
- Lead email
- Resend
- Alerts
- Discord
- Observability
- Grafana Cloud
This is the same Define → Build → Improve path we use with clients, applied to our own site. If you want an assistant like this for your business, the conversation starts the same way.