[GSoC 2026] blog: final work product — self-hosted LLM chatbot for IntelOwl

[berardifra]

This is my GSoC 2026 final work product write-up for the self-hosted LLM chatbot project, following
the shape of the previous years' posts.

Per @mlodic's guidance, the content is in the post rather than behind links: the architecture, the
security model, the benchmark methodology and the measured numbers are all explained inline, with
GitHub links confined to an appendix table that identifies every merged pull request (a Google
work-product requirement).

What's in it

• Why the model has to run locally for a threat intelligence platform, and what that constraint costs.
• The architecture, as an inline SVG diagram (the blog renderer already mounts rehype-raw).
• The multi-tenancy model: per-request tool factories closed over the user, visible_for_user
  everywhere, LLM arguments treated as untrusted — plus the full security audit and its seven findings.
• Three engineering deep dives: the human-in-the-loop guardrail on analyze_observable, the
  reliability harness and same-session A/B methodology, and reading IntelOwl's own reconciled verdict
  instead of letting a 3B model invent one.
• Measured latency and reliability numbers, each stated with its methodology.
• A "What did not work" section: the exhausted prompt lever, a residual failure that turned out not to
  be reproducible (so nothing shipped), a criterion that genuinely does not hold, and the open
  question in #3909.
• A "How to extend this work" section for the next contributor.

Files

• Blogs/gsoc26_llm_chatbot.md — the post.
• public/images/chatbot_turn.png, public/images/chatbot_confirm.png — two screenshots, the same
  assets already published in the documentation repository.

Verification

npm run build passes and the page was checked in a browser at desktop and mobile widths: the SVG
diagram scrolls inside its own container instead of forcing the page to scroll, the tables and code
blocks render with the site's existing styles, and all external links return 200.

Frontmatter follows contentlayer.config.ts (title, date, cover, author), so the post appears
in the blog index and the RSS feed. Published URL will be /blogs/gsoc26_llm_chatbot.