Community Coliving

Walkthroughs

Three days inside the system

Three scenarios: a property's journey as the investor experiences it, the agent's morning under the write law, and a day where things go wrong.

Overview · Walkthroughs

Why these three

The failure path is where design either holds or does not

What is real in this document is the machinery: every behavior below traces to the architecture described in the spine. We walk three scenarios: a property's journey as the investor experiences it, the agent's morning under the write law, and a day where things go wrong. The third one is here on purpose. Any architecture can narrate its happy path; the failure path is where design either holds or does not.

Illustrative throughout

Everything in this document is illustrative. The address is fictional, the town is fictional, and every value is a stand-in written in words so it cannot be mistaken for real data. Where a step would require detail we do not publish, we say so rather than skipping the step silently, and we name the tier that holds it.

Scenario one

A property's journey

  1. An investor pastes an address into the front door: 418 Corvid Lane, Ashgrove. That is the whole interaction. We deliberately ask zero questions at intake; the first address creates the deal and lands the investor on it.
  2. Before any evidence lands, the platform settles which real property this is. The pasted string resolves into a verified address identity, and everything that follows, every report, field, verdict, and underwriting number, anchors to that identity. The investor never has to wonder whether two screens are talking about the same property, because every part of the platform shares that verified identity and nothing looser.
  3. The deal now needs evidence, and the investor does not wait on it: analysis starts on its own, and the deal page is usable while it runs. The heavy analysis work runs in a separate failure domain from the surface the investor is looking at, a choice scenario three will lean on, because the most failure-prone work in the product must not be able to take the interactive surface down with it. Most of what the analysis needs is not fetched at all: it is served from a nationally pre-cached reference layer of licensed property and rental data and public government and open-data sources, cache-first, with freshness tiers that vary by kind of data. We cache the data and compute the meaning. There is no language model anywhere in this path; interpretation is deterministic code, which is what makes a re-run reproducible and a result auditable.
  4. Minutes later, the deal fills in. The property is now a folder of versioned artifacts: four structured reports, a comparable-sales valuation, a market read, a zoning read, and a property snapshot. Every value in them carries provenance and confidence in plain words. The valuation might land around four hundred and sixty thousand dollars, marked as report-produced with moderate confidence, and the market read might put a furnished room in this area in the low nine hundreds a month. Where the market read reports a trend, say which way rents in this market have moved over the past year, that value is measured over a wide area, and it is presented at the precision it actually has, never sharpened to the block level to look smarter than it is. When two independent reads disagree about the same quantity, the disagreement is surfaced as signal instead of being averaged away. We consider this honesty doctrine a feature of the architecture, not of the copywriting: the provenance and confidence travel with the value through every surface that shows it.
  5. The reports are not the working surface; the deal's fields are. Key facts from the evidence arrive as editable fields on the deal, each labeled with where it came from. The investor can override any of them, and the finding underneath stays intact as the record of what the evidence said before a human disagreed with it. What the investor sees never depends on how a report happens to be stored or computed; the platform guarantees the fields and their provenance, and it keeps that guarantee even as the machinery behind a report changes.
  6. The investor opens the underwriting calculator, and it is already seeded. Every standard assumption arrives through a per-deal template and every default is labeled as a default, because a default that looks like a fact is a quiet way to lose someone money in a market the template was not tuned for. The workbench shows the answer on top, the structure on the left, the statement on the right, and under every number, plain words saying where it came from: this from the valuation finding, this from the market read, this a template default awaiting judgment. Cash-to-close itemizes to zero. The same engine that serves this screen serves the agent, identically, which closes the classic gap where the assistant and the spreadsheet quietly compute different answers.
  7. Last, the buy box renders its verdict: a living fit judgment against this tenant's own explicit, typed criteria, with the reasons written down. If the property falls outside the tenant's stated criteria, the buy box is the one place in the entire product allowed to move the deal automatically, and it records why. Everywhere else, movement through the gated pipeline stages requires a human approval, by design. A recommendation never moves a deal on its own.

Withheld by design Tier 3

Which sources exist is held at Tier 3; the freshness discipline is described here qualitatively.

Withheld by design Tier 3

How the valuation selects and adjusts comparables is held at Tier 3.

Scenario two

The agent's morning

Addi is not a chat window. There is no in-app chat at all. The operator's own Claude connects to the platform over MCP, through an OAuth 2.1 plus PKCE authorization surface built into our backend, with dynamically registered clients, RS256 tokens, and scoped access. Consent and audit are schema, not policy documents: what the operator granted, and everything the agent did with the grant, are rows we can show. We took this path instead of embedding a chatbot because an embedded assistant becomes a second, weaker product surface, while a first-class principal with real credentials inherits every guarantee the platform already makes about identity, tenancy, and writes.

Early in the morning, the agent begins an autonomous session. Autonomous work here flows through a work queue under hard budget caps, so what a session can spend and touch is bounded before it starts. At session start the agent fetches its operating doctrine from the platform itself, so the doctrine it works from is always the deployed, current one; there is no pasted prompt aging in a drawer somewhere.

Withheld by design Tier 3

Cadence and cap figures are held at Tier 3.

The agent takes up one piece of work: a property outlook for the Corvid Lane deal. Every tool call it makes independently re-verifies tenant identity; a stale or overreaching call dies at the choke point, not in a code review. It reads the findings snapshot, the same composed contracts a human surface reads, and drafts its outlook. One value the outlook would update was confirmed by a human in an earlier review, and that single fact decides how the write lands.

Here is the part a skeptical reader is right to slow down on: the agent writes. An agent with write access to a system of record sounds like the beginning of an incident report. Our answer is the write law, and it is the same law for every writer, human or machine. Machine writes land freely into empty or machine-sourced fields, and never over a value a human has confirmed; that rule is enforced mechanically at the write door, not held as a guideline. When the agent's outlook would touch a human-confirmed value, the write does not fail and does not force; it becomes a proposal, queued for the human it belongs to. The provenance ladder is the authorization mechanism. We did not build approval gates in front of agent writes, because a gate in front of every write becomes either a rubber stamp or a bottleneck, and both teach people to stop reading. Safety here is budgets, traceability, and reversibility, and any capability we judge genuinely risky ships read-only instead.

So the outlook lands as a proposal. It has already passed a mechanical house-style gate at the write door, because output quality enforced by prose guidelines is output quality that decays. The acquisitions lead opens the deal mid-morning, reads the outlook next to the findings that support it, and accepts. The value stamps human-confirmed. From this moment the write law protects it against every future machine write, including the agent's own later revision, which will arrive as a proposal too. The agent got the door, never the tables, and the door kept the rules.

Scenario three

The bad day

Two things go wrong on the same deal. Neither is hypothetical in kind; both are the normal weather of working with public and licensed data, which is why the architecture was shaped around them rather than around the happy path.

  1. First, during a re-run of the analysis, one upstream source category is down. The analysis engine's producers are fail-soft by design: each producer either delivers or is recorded as unavailable, and one missing source never blocks the analysis. External access runs rate-gated through one governor, and a failing route degrades the analysis instead of stalling it. The re-run completes, and because artifacts are versioned and never silently rewritten, it lands as a new version beside the old one rather than on top of it. The affected report renders with its confidence honestly downgraded and the gap named in plain words. The alternative design, holding the whole analysis hostage to its least reliable input, fails exactly when the investor most needs a partial answer, so we rejected it. A degraded answer that says it is degraded beats a complete-looking answer built on a silent hole.
  2. Second, a public record is simply wrong: the county's data credits 418 Corvid Lane with one bedroom fewer than the house actually has, the kind of error that survives in official records for years. No pipeline of ours can out-compute a wrong source, so the architecture gives the human an authoritative move instead. The operator records a correction. Corrections short-circuit downstream reads: every consumer of that value, the reports, the fields, the calculator seeding, now receives the corrected value, and the correction itself is recorded alongside the original claim rather than replacing it. The wrong value is not erased, because erasing it would erase the evidence that our source disagreed with reality, and the next re-run would happily reintroduce the error. The finding stays immutable, the correction stays visible, and downstream stays right.

By end of day the deal carries a versioned record of an outage and a documented human override of a public record, and nothing downstream is confused about which values to trust or why. That is the failure model doing its job: the bad day is legible.

Epilogue

Three design lessons

These scenarios were chosen because each one exercises a rule we consider load-bearing, and the rules read best when watched in motion.

The evidence chain runs one way. Artifacts produce findings, findings project into fields, fields feed underwriting, and nothing reaches backward. Immutable evidence under editable judgment is what allowed the correction in scenario three to fix every downstream consumer without destroying the record of what the source originally said.

The write law is one law for every writer. Free into empty, never over a human, and proposals where the two meet. It is simultaneously the agent's blast-radius contract and the human's guarantee of final say, and it needed no approval gates to deliver either. The morning in scenario two works because authorization lives in provenance, not in ceremony.

Honesty is visible at every handoff. Provenance tags on values, confidence in words, defaults labeled as defaults, coarse data shown at coarse precision, disagreement surfaced instead of averaged, outages named in the artifact they degraded. Each container tells the next one not just what it knows but how it knows it and how much to trust it, and that, more than any single component, is what the platform is.

Addi architecture disclosure · v1.0 · 2026-07-31
The spine · Traceability