Capstone: Ship Something a Stranger Can Use

Build it — step by step

Do not paste all of this at once. Build one step, run it, break it deliberately, then move on. Code you have watched fail is code you understand.

Step 1 — the endpoint Pattern 1

<?php
// ask.php — the loop: take in, decide, act
header('Content-Type: application/json');

$input = json_decode(file_get_contents('php://input'), true);
$question = trim($input['question'] ?? '');

if ($question === '') {
    http_response_code(400);
    echo json_encode(['ok' => false, 'error' => 'Ask me something.']);
    exit;
}

// everything else goes here
echo json_encode(['ok' => true, 'answer' => 'not built yet']);

Break it on purpose: send an empty body. Send malformed JSON. Send a 50,000-character question. Whatever it does badly now is what it will do in production.

Step 2 — cache before you spend Pattern 2

$key = 'ans:' . hash('sha256', mb_strtolower($question));
$cached = cacheGet($key);          // your Supabase read
if ($cached) {
    echo json_encode(['ok' => true, 'answer' => $cached, 'cached' => true]);
    exit;                          // no model call, no money spent
}

Measure it: time the same question twice. Write down both numbers. That difference is the Two Clocks pattern in milliseconds, and it is a sentence in your interview.

Step 3 — classify before you call Pattern 2 + ML

// A cheap local classifier. No model call, no cost.
// Later you replace these keywords with a trained classifier —
// the SHAPE of the code does not change, only what decides.
function inScope($q) {
    $topics = ['loop','cloud','robot','model','deploy','api','data','train'];
    $q = mb_strtolower($q);
    foreach ($topics as $t) if (strpos($q, $t) !== false) return true;
    return false;
}

if (!inScope($question)) {
    echo json_encode(['ok' => true, 'answer' => 'I only answer questions about building systems.']);
    exit;
}

Notice what you just did. You made an engineering decision about cost, not just a feature. When you later swap those keywords for a trained model, steps 1, 2, 4, 5 and 6 do not change at all. That is Pattern 4 — you hid the method behind a promise called inScope().

Step 4 — the model call Pattern 1 · decide

$ch = curl_init('https://api.anthropic.com/v1/messages');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST           => true,
    CURLOPT_TIMEOUT        => 20,          // ALWAYS set this
    CURLOPT_HTTPHEADER     => [
        'x-api-key: ' . kodiConfig('ANTHROPIC_API_KEY'),   // never in JS
        'anthropic-version: 2023-06-01',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS => json_encode([
        'model'      => 'claude-haiku-4-5-20251001',
        'max_tokens' => 400,
        'system'     => 'You explain system-building to a 16-year-old in plain words. '
                      . 'If you are not sure, say so. Never invent an API that does not exist.',
        'messages'   => [['role' => 'user', 'content' => $question]],
    ]),
]);
$raw  = curl_exec($ch);
$code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

Two things most people get wrong here. No timeout means one slow call holds a connection open until your whole site stops answering. And the key belongs on the server — the moment it is in JavaScript, it is public and someone else is spending your money.

Step 5 — the guard Pattern 6

if ($code !== 200 || !$raw) {
    logEvent('model_failed', ['code' => $code]);      // LOUDLY
    echo json_encode([                                 // SOFTLY
        'ok'     => true,
        'answer' => 'I cannot reach my brain right now. Try again shortly.',
        'degraded' => true,
    ]);
    exit;
}

Test this properly: put a wrong API key in on purpose and call your endpoint. A user must see a calm sentence. You must see a log line. If you see a stack trace on screen, you have failed both halves.

This step is the single most valuable thing in the whole build. Nearly every portfolio project you will compete against has no step 5 at all.

Step 6 — respond and record Patterns 1 + 6

cacheSet($key, $answer);
logEvent('answered', [
    'q_hash'  => substr($key, 4, 12),
    'ms'      => $elapsedMs,
    'cached'  => false,
]);
echo json_encode(['ok' => true, 'answer' => $answer]);

Log the hash, not the question. You do not need people's raw text sitting in a table, and choosing not to collect it is a decision you should be able to defend out loud.

Step 7 — the correction loop Pattern 3

// /api/feedback.php  — thumbs up or down against the question hash
// Once a week, read every thumbs-down. Those are your eval set.
// Adjust the system prompt. Re-run them. Did the bad ones improve?
// Did any GOOD ones get worse?  <-- that second question is the job.

This is gradient descent done by hand: measure the error, make a small correction, measure again. Same pattern as PID, same pattern as training. You are the optimiser.

Ship it — the part people skip