Case study
Muanjai (ม่วนใจ๋)
An AI-powered compliance helper bot that helps hotels, homestays, and individuals track licenses, certificates, and document expiry — via LINE Official Account and a web client.
Stack
240+
Automated tests guarding CI
30s
LINE reply-window guarantee
0
Duplicate side-effects (idempotency ledger)
24/7
Expiry reminders & doc status summaries
The problem
License and certificate expiry dates for small hotels and homestays live in paper folders and scattered spreadsheets. A missed renewal means fines — or worse, operating without a valid license.
Owners needed something that meets them where they already are: LINE chat, in Thai, with answers grounded in their own documents — not a generic chatbot guessing from training data.
Thai RAG architecture
The core is retrieval-augmented Q&A over Thai documents, built on NECTEC's Pathumma LLM running on ThaiSC supercomputing infrastructure. Uploaded documents are chunked, embedded, and retrieved at query time so every answer cites the owner's own paperwork.
Keeping retrieval and generation decoupled means the knowledge base can grow — new license types, new regulations — without retraining anything. The model answers in Thai, grounded in retrieved context.
Real-time PromptPay verification
Subscriptions are paid over PromptPay, Thailand's national real-time rail. The system verifies payment slips and scan-to-pay transactions automatically instead of routing them through a human admin.
Verification results feed straight back into the chat flow, so a user can go from expiry warning to paid-and-confirmed without leaving LINE.
Webhook hardening
LINE enforces a hard ~30-second reply-token window: miss it and the user gets silence. The webhook pipeline answers inside that window with concurrency caps, deadline guards, and a retry idempotency ledger so a retried delivery never causes a duplicate charge, reminder, or reply.
Critical failures — e.g. webhook error-rate spikes — push rate-limited alerts to an admin LINE account, so operators hear about incidents before users do.
DevOps & quality gates
Every change ships through cloud deployment with CI enforcing lint, type checks, and 240+ tests. Security practices are structural, not advisory: session secrets fail fast when missing, CORS origins are anchored, and proprietary code and customer data stay protected by pipeline policy.
What I took away
- Grounding beats model size: a modest Thai LLM with good retrieval outperforms a bigger model guessing without context.
- Messaging-platform constraints (reply windows, retry storms) shape backend architecture more than framework choice.
- Idempotency is a product feature, not plumbing — users experience it as 'the bot never double-charges me'.
- Rate-limited operator alerting is the difference between knowing about an outage and drowning in one.