SmartCommunity

1Purpose and scope

SmartCommunity answers a resident's questions about the place they live, out of that association's own documents, and names the document and the section every answer came from. It does nothing else. It does not book a tradesperson, take a payment, or issue a parking pass, and the reason it does not is the subject of section 8.

It began as a floating panel inside the Service Assistant. It is now its own application, on its own machine, with its own database and its own address, and this document specifies it as that. Section 6 says what is still shared and what is not.

The qualities this system is judged on are grounding, scoping, fallback, latency, security and observability. Grounding and scoping come first, and that ordering is deliberate: an assistant that answers a rules question wrongly is worse than one that declines, because a resident will act on it.

2The system in one picture

One path, with one place where it can branch. Retrieval happens before any engine is called, and it is scoped to one association before it ranks anything. If nothing in that association's documents clears the threshold, no engine is called at all: there is nothing for it to ground an answer in, and asking it anyway is asking it to invent.

3Who uses it

There is no provider role and no office staff role beyond the admin token. Both exist on the Service Assistant and neither was carried across, because neither has anything to do with reading a rule.

4What it does

Asking

• F-1Accept a question in ordinary language, typed or spoken, and answer it from the asking resident's association's documents.
• F-2Name the document and the section behind every answer, and offer both ways into it: opening it to read, and saving it.
• F-3Where the documents contradict each other, say so and quote both, rather than silently picking one. The quiet hours question does this today: Rule 2 and Rule 18 disagree, and the answer says they disagree.
• F-4Where nothing in the documents covers the question, say so, name what the documents do cover, and call no engine.
• F-5Ask which association the resident belongs to when it is not known, remember the answer across visits, and let it be changed in one tap from beside any answer.

Asking out loud

• F-6Hold a spoken conversation: listen, answer aloud, and listen again until it is stopped. One microphone permission for the whole conversation, not one per question.
• F-7Show what was heard as the resident's own turn. A misheard question is a common failure and otherwise an invisible one.
• F-8Speak the short form of an answer, not the long one. A list of seven documents is useful to read and unbearable to hear.
• F-9Where speech synthesis is unavailable, fall back to the browser's own voice rather than answering a spoken question in silence.

Documents

• F-10List everything the resident's association holds, alongside the conversation rather than behind a second navigation.
• F-11Serve any document two ways: inline, for checking one line, and as a download, for a form somebody has to fill in.
• F-12Say on the card when a document cannot be quoted from. Several are scans with no readable text, and somebody who saves a site map and then asks a question about it should not learn this from a refusal.

The office

• F-13Upload a document against an association, and have it answerable without a restart.
• F-14Report what each association currently holds and how much of it is indexed.
• F-15Choose which engine words the answers. It reports the hardware's state and never changes it: starting and stopping the GPU belongs to exactly one panel, and it is not this one.

5How it must behave

5.1Grounding and refusal

Every sentence of every answer is required to come from a passage that retrieval returned. The engine is given those passages and told to use nothing else; it is never asked what it knows.

5.2Community scoping

Scoping is applied before ranking, not after. The candidate set is narrowed to one association's passages and the search runs over that slice, so a passage belonging to a neighbouring association cannot place first and then be filtered out: it is never a candidate.

The associations are not evenly stocked, and the specification has to admit it: Serenity Point has 98 passages and Lauderdale Lakes 92, while Kendall Square, Valencia and Enclave at Old Cutler have one each. Those three can be searched and can be downloaded from, and a rules question asked against them will usually and correctly be refused. That is a content gap, not a defect, and it closes by uploading documents.

Where an answer does come from another association, because a resident asked for it deliberately, the citation strip says so in the resident's own words. It must not say so when it is not true: comparing an internal key against a printed label made that warning fire on a resident's own association, which is a warning that gets believed. It now compares like with like.

5.3Fallback

Two engines can word an answer: Gemini, and an open model on hardware we control. The switch chooses which is tried. Whichever answers, the passages it was given are the same, so the answer is grounded either way and the citations do not move.

• N-1When the chosen engine does not answer, the other one answers, within the same request. The resident is not shown an error and is not asked to try again.
• N-2The panel reports which engine actually answered, and says when that was not the one selected, and why.
• N-3Retrieval never falls back to anything. If the documents do not cover it, both engines are equally not asked.

This is the property that was proved end to end on 30 August 2026, against a real model in the client's own AWS account: with the switch set to the open model and the machine stopped, a resident's question was answered correctly in 1.6 seconds by Gemini, and the panel reported the fallback and named the reason.

5.4Latency and scale

The honest conformance note: this runs as one process on a machine with under 2GB of memory, and the embedding model is most of that. It is sized for one association's residents, not for a portfolio of them. The index is small enough that retrieval is not the constraint and will not become one at this scale; memory is the constraint, and the first thing that fixes it is a bigger machine rather than a change to this design.

5.5Security

• N-4A resident's association scopes retrieval on the server. It is never taken from anything the browser could edit into a different answer.
• N-5Office functions require an admin token. Without one, every one of them returns 401 rather than a partial answer.
• N-6No question and no document leaves the machine unless an engine is called, and an engine is only called with the passages retrieval already selected.
• N-7Where the open model is used, the port it listens on is reachable only from the three application addresses. It has no authentication of its own, so the network boundary is the whole of its protection and is treated that way.

5.6Observability

• N-8Every question is logged with the association it was scoped to and the time it took, so a slow answer can be attributed to a stage.
• N-9The panel reports the index: how many passages, how many documents, per association. A document that was uploaded but not indexed is visible as a number rather than as a refusal in front of a resident.
• N-10The panel reports what answered the last question, separately from what is switched on. Those are two different facts and conflating them hides every fallback.

6Where it runs

Port 8200 rather than 8100 is deliberate. This machine was cloned from the Service Assistant's, and a stray request meant for that product must not find something listening here and be answered by it.

What is shared with the other two agents: the engine switch setting, and the hardware behind it. What is not shared: the database, the accounts, the sessions, the documents, the index, the process and the address. An outage of either of the other two agents does not reach this one.

7Assumptions and limits

• A-1The documents are the authority. Where they are wrong, out of date or silent, the answers are wrong, out of date or absent, and no amount of engine quality changes that.
• A-2A scanned document with no readable text can be downloaded and cannot be quoted. The screen says which is which.
• A-3English only. The retrieval model is an English model, and a question in another language will usually and correctly be refused rather than answered badly.
• A-4One association per resident at a time. Asking as a different one is deliberate, one tap, and visibly labelled.
• A-5Speech is best effort in both directions. A failed transcription asks the resident to repeat themselves and a failed voice hands the reply to the browser; neither takes the written answer away.

8Out of scope

Named rather than left to be assumed, because every one of these exists on a sibling product and could reasonably be expected here.