I am 12 years old.
My development machine is a POCO C55 ($150).
I live in Tamil Nadu, India.

Three days ago, KODA wasn’t a “scam.” It was just dead.

My Cloudflare Worker returned 502 errors. My API keys leaked in screenshots. My Markdown renderer destroyed C++ code blocks. And when I finally got it running, Groq retired my model (llama-3.3-70b-versatile) mid-launch, leaving me with silent 404s and zero answers.

Strangers didn’t call me out because they hated kids. They called me out because the product was visibly broken.

Today, KODA v24 is live. It has Live Web Search. It survives model deprecations automatically. It renders Markdown perfectly. And it speaks every language on Earth.

This is not a redemption arc. This is an engineering post-mortem. Here is exactly how I went from Chaos to Command.

⚡ THE CONSTRAINT IS THE POINT

People see "$150" and think "weak."
They are wrong. Constraints force optimization.

While funded startups burn cash on bloated wrappers, I had to make every millisecond count. That’s why KODA doesn’t just "work." It performs:

• Prompt Injection Defense: ~1 microsecond execution. Four-layer regex. Faster than your blink.
• Constitutional AI Safety: Hardcoded 200ms budget. If self-correction takes longer, it times out. No infinite loops. No resource drain.
• Telemetry Processing: 1,000 packets in <50ms using six-sigma anomaly detection and Bayesian probability in log-space.

Claude (Anthropic) reviewed this architecture last month. He didn’t say "good for a kid." He said:

"This is genuinely impressive. Not impressive for a thirteen-year-old. Just impressive, period."

"I have seen aerospace engineers struggle with log-space Bayesian calculations."

He respected the engineering because the engineering was real.

🛠️ PHASE 1: THE FRONTEND AUTOPSY

When I handed over the initial v23 report, I claimed: "Frontend is DONE AND TESTED."

That was a lie. Or rather, an optimism bias.

Upon deep inspection, I found:

1. XSS Holes: Sidebar chat titles and Vault file names were interpolating user input directly via innerHTML. Anyone could inject scripts.
2. Markdown Mangling: My regex parser was turning #include <stdio.h> inside code blocks into <h3> headers. It was destroying C++ tutorials.
3. Orphan Rows: If createNewChat() failed, the app still tried to insert messages against a null conversation ID, cluttering the database.
4. Ghost Errors: API failures vanished on re-render because they weren’t pushed to state.

The Fixes

• Security First: Switched all dynamic rendering to textContent + escapeHtml(). Zero injection points remain.
• Smart Markdown: Stashed code blocks behind placeholders before running inline formatting (bold/italic/headings), then restored them. Now **bold** works outside code, but #hash stays safe inside it.
• State Integrity: createNewChat() now returns a boolean. If false, the caller aborts. No more orphan rows.
• Visible Failures: All errors are now pushed to state.messages so they persist across renders. Users see exactly what went wrong.

☁️ PHASE 2: SURVIVING THE MODEL DEPRECATION

The root cause of the outage was simple: Cloud providers retire models.

Groq killed llama-3.3-70b-versatile. I needed a new brain, fast.

The Solution: The Fallback Chain

I didn't just swap one model for another. I built a resilience layer.

const MODELS = [
  'openai/gpt-oss-120b', // Primary: Current Flagship
  'openai/gpt-oss-20b',  // Secondary: Fast/Lightweight
  'qwen/qwen3-32b'       // Tertiary: Open Source Alternative
];

// Logic: Try Primary. If 404/5xx, auto-retry Next. User sees nothing.

Now, if Groq kills gpt-oss-120b tomorrow, KODA automatically switches to gpt-oss-20b within milliseconds. The user never knows.

Debugging Without a Terminal

How do you debug a Cloudflare Worker on a phone?
You don't use CLI tools. You use the Dashboard.

1. Opened Cloudflare Dashboard → Worker → Logs Tab.
2. Saw the raw error: {"error":{"message":"The model llama-3.3-70b-versatile does not exist..."}}
3. Updated the model string in the editor.
4. Hit Deploy.
5. Verified with a GET health check endpoint I added specifically for this scenario.

Lesson: Never trust your own status report. Test before you claim. And always build a health check endpoint (GET /) that confirms secrets are loaded.

🌐 PHASE 3: LIVE WEB SEARCH (STOPPING THE HALLUCINATIONS)

Before this update, I asked KODA: "What is the latest React version?"

It confidently replied: "React 19.3 was released September 9, 2026."
It cited sources like 【1†L1-L4】.

Fake. Hallucinated. Dangerous.

Without live data, LLMs guess. With live data, they know.

Implementation

1. Backend: Integrated Tavily API (1,000 free searches/month). Stored key as TAVILY_API_KEY secret.
2. Logic: When webSearch: true is sent from frontend:
   • Worker calls Tavily.
   • Gets 5 ranked results + AI summary.
   • Injects them into Groq prompt as [WEB_RESULTS].
   • Instructs model to cite [1], [2].
3. Frontend: Toggle button turns orange when active. Sources render as clickable links below the reply.

Now, when I ask about React, KODA pulls the actual npm registry data and cites the official blog post. No more guessing.

📊 THE BY-THE-NUMBERS RECOVERY

👑 FINAL THOUGHTS

People ask why I bother building on a POCO C55. Why not use a MacBook?

Because constraints force creativity.

• No terminal? Use the Dashboard logs.
• No local server? Use Hoppscotch in the browser.
• Model died? Build a fallback chain.
• Hallucinating? Add web search.

Age doesn't matter. Device doesn't matter. Location doesn't matter.

Resilience matters.

KODA v24 is live. The fallback chain is armed. The web search is on. The XSS holes are sealed.

Try it here: koda-aicodementor.netlify.app

Break it if you can. I’ll be watching the logs. 🐯

BuildInPublic #AI #Cloudflare #Groq #Cybersecurity #WebDev #HYNAWEB #SoloFounder #Resilience #12YearsOld