Overview
Starting 2026-07-08 15:06, this portfolio went from an empty repository to a deployed, evidence-gated platform in four passes: an initial ~28-hour build-and-harden sprint (through 2026-07-09 19:31); semantic job-fit evaluation and credential proof on 2026-07-10; production-incident recovery and navigation-parity fixes on 2026-07-11; and a GitHub-to-Vercel migration with a backend security pass and site-wide copy cleanup through 2026-07-12 01:34. This repository's own commit history (154 commits) is the citation source for this case study.
Starting Point
The first three commits (2026-07-08, 15:06) built the whole platform skeleton in minutes: the FastAPI backend and deployment config (58 files, 5,422 insertions), the static frontend (27 files, 4,735 insertions), and the résumé variants -- a from-scratch build, not an iteration.
Buildout Phase
The next ~24 hours shipped a four-slot AI News Ticker, a chat canary gate, an EN/ES bilingual toggle, a Resume Match Explainer, a JD Fit Score, the Career Evidence Platform Trust Gate, live provider health checks, an Enterprise Deliverables case study, an autoplaying hero video, and a Go evidence-normalizer proof slice -- each a discrete, single-purpose commit.
Hardening Phase
The back half of 2026-07-09 shifted to closing QA gaps: proof-label renaming across app/frontend/tests, mobile hero-media repair, capture-slice stabilization, SEO/browser-preview polish, a perception-layer QA pass, and real Microsoft certification proof.
The chat assistant got the same treatment: fixed over-rejection and skill-routing bounds, added answers for public AI-tooling and years-of-experience questions, a dedicated Guardrail Validation surface, and structured employment-sequence answering.
Verification Phase
A pair of commits closed gaps found by a live regression sweep against the deployed chat assistant -- real HTTP calls against nkosifelix.com/chat, checked against the evidence ledger. That live-sweep discipline continued in every later pass (see below).
July 10 Hardening: Trust, Credentials, and Recruiter UX
A follow-on pass on 2026-07-10 worked a second fix list, one concern per commit -- the next iteration on the same system, not a rewrite.
Reliability fixes: the hero video's blank-render regression got a real fallback (poster image, PNG-decode paint check); the weather signal gained a no-key backup provider (Open-Meteo) and a fix for a timezone bug in its freshness check.
Chat assistant fixes: collaboration and cross-functional questions, previously rejected outright, now answer from public evidence; the job-fit evaluator moved from keyword-only matching to a 17-cluster semantic evidence mapper (exact/adjacent/missing evidence, eligibility blockers).
Copy and resume clarity: homepage copy and the two-resume system (Data Platform vs. Forward-Deployed) were tightened so the default resume is unambiguous.
Credential proof: three verified Credly credentials (Google PM Professional, Fortinet Cybersecurity Fundamentals, Aviatrix Multicloud Network Associate) gained public verification links after the original links proved login-walled. The three Microsoft Fundamentals certifications (AZ-900, AI-900, DP-900) gained Microsoft Learn links. Expired Alteryx badges aren't presented as active.
Recruiter-facing UX hardening: an audit-first pass checked live signal degradation, credential-button tap targets, and mobile chat keyboard behavior; only the credential buttons needed a fix (~20px to genuine ~40px targets).
Documentation, residue, and architecture hardening: this case study and ledger were brought current, stale labels fixed, FastAPI's interactive docs (/docs, /redoc, /openapi.json) disabled as defense-in-depth, and a chat input cap raised from 500 to 4,000 characters after a real job description was rejected. A recruiter-intent test bank and bilingual key-parity checking became standing regression gates.
Trust-system precision: coverage and confidence are intentionally independent -- one primary source can support high confidence for a narrow question -- and a new adjudicator gate rejects only broad, totalizing conclusions (e.g. "all of his work is synthetic") drawn from that same source.
July 11 Hardening: Production Recovery, Navigation Parity, and Content Consistency
A third pass on 2026-07-11 started from a real incident: a 39-minute-old weather reading still showed a LIVE badge, and the production domain began returning Vercel's own platform 404.
Weather freshness SLA: root cause: a cached signal computed LIVE/STALE status once at fetch time, serving that frozen status for the full cache window as the reading aged past the 30-minute SLA. Fix: a compute_freshness() function that never reads the clock, a cache storing only raw data, and a watchdog that can only downgrade a badge. 24 frozen-clock tests pin the boundary cases.
Production 404 recovery: the Vercel project's Root Directory pointed at the monorepo root instead of the nkosi-felix-portfolio subfolder, so builds produced zero output. Confirmed with the Vercel CLI, corrected, and verified across every route.
Navigation and language parity: /labs/ shipped with zero shared <script> tags, so the mobile menu never opened and EN/ES controls never rendered. Fixed, with a regression check requiring both scripts together.
Homepage consolidation: Use-Case Labs, Engineering Principles, Selected Technical Proof, and the signals widget moved off the homepage to their own pages. Certifications was redesigned with real Microsoft badge artwork and moved ahead of Safety Checks.
Chat content consistency: a homepage edit changed "most recent publicly listed role" to "most recent role," but chat answers still used the old phrasing -- found by comparing UI copy against chat output. The contact answer now includes LinkedIn, and location intent resolves phrasing like "where does he live."
Vercel Migration and Site-Wide Cleanup
A fourth pass, the evening of 2026-07-11 into early 2026-07-12, moved production deployment and cleaned up public copy site-wide.
Security and performance: added strict CSP/security headers, rate limiting, a conditional hero video, deferred fetches, and a minified, fingerprinted production build.
Backend hardening: closed three real gaps -- input PII reaching providers, an unprotected travel endpoint, a manifest-drift bypass -- and extracted security.py/evidence_projection.py out of main.py.
Direct GitHub-to-Vercel migration: moved production to build directly from this repository instead of the GitLab monorepo. The first deploy 404'd site-wide (a missing build step); fixed and verified. Retired the GitHub-to-GitLab sync workflow.
Site-wide plain-language pass: simplified the recruiter page, exposed weather/currency signals through real navigation, then extended that treatment site-wide -- removing jargon, correcting a Trust-page claim, and stripping raw commit hashes from this Ledger.
What This Shows
- Ship velocity with discipline, not chaos. 154 commits across four build passes, each scoped to one concern, with commit messages that describe what changed and why.
- Regression-tested public claims. Every phase above comes from real QA findings (mobile capture regressions, live chat-sweep failures, a timezone bug, measured tap-target sizes), not guesswork.
- Audit-first, not fix-everything. The July 10 UX pass verified two of its three target areas were already correct before touching anything, rather than "fixing" issues that didn't exist.
- Operator-grade delivery on a public system. The same evidence-gating discipline used for a portfolio chat assistant elsewhere in this repo (see Hiring Manager Proof) is visible here in the commit history itself.