Under the interface.

Privileged access begins after authorization.

Google sign-in creates the portal session. Sensitive server actions verify session and role helpers before constructing privileged database clients. RLS covers application and internal tables; internal retrieval tables use explicit deny or scoped policies.

The packet becomes a reviewed operating record.

Closing calculators, executed lease materials, and deal files are parsed into commissions, splits, contributions, payments, dates, and lease terms. Deterministic financial math stays out of the prompt. Ambiguous extraction carries source and review state before persistence.

Thirty-six candidate fields retain their evidence.

A separate brokerage deployment supports both new close-out intake and enrichment of historical closed leases. A reviewer can select or upload as many as eight executed leases, amendments, commission agreements, deal sheets, and invoices. PDFs are sent as native documents first, DOCX files are converted to text, and scanned lease pages can use a bounded OCR fallback after two native attempts.

The structured draft covers parties, premises, dates, term, rentable area, rent schedules and escalations, renewal and termination options, notice requirements, concessions, TI, commissions, broker splits, payment terms, and invoice data. Every field carries confidence and source context. Missing values remain null; conditional dates are not promoted to fixed dates; materially conflicting documents require human resolution.

Approval crosses one guarded database boundary.

The browser compares current values with AI candidates and records the reviewer's confirmed values. An idempotent, optimistic-concurrency-checked Postgres function then updates the existing deal and lease plus approved commission, split, provenance, document-link, and reminder state. Source document IDs must belong to the deal, its source listing, or the related lease, and provenance cannot reference a file outside the reviewed packet. Closed stage/date, listing status, and settled payments remain immutable to enrichment.

OMs and Drive folders become upload-ready listings.

Google-native files and uploads are resolved, text and images are extracted, and candidate fields are normalized into the required Crexi and CoStar upload forms plus Canva flyer inputs. Missing required fields keep creation locked for broker review. Saving writes the listing, source files, extracted fields, and provenance to Supabase.

Deals and listings have separate branded pipelines.

A closed-deal save can create Instagram and LinkedIn captions, branded Canva announcement graphics, a Slack approval packet, celebration, and Proxi map record. An approved listing can create its flyer, channel-specific social copy, and #new-listings packet. The published case study attributes roughly $1,000 per month in savings to this flow.

External systems reconcile around the portal.

A Sunday 168-hour Instantly sweep complements live webhook handling, classifies reply intent, performs conservative FUB matching, writes an audit workbook, and sends warm-lead alerts. Lease timing, payments, and commission state drive reminders and receivables work.

Named jobs feed distinct reviewed surfaces.

A reusable GrowthZone adapter crawls multiple regional Chamber of Commerce calendars nightly, dedupes cross-posted events, and delivers a seven-day Slack digest Monday morning. A separate Monday market-presence job uses reviewed market context. Crexi/CoStar exports remain labeled external market data, while the 15-minute Drive queue extends the private corpus and automatically extracts lease/LOI terms.

Seven operating domains, one runtime contract.

• Supabase query/schema plus factual building recommendations
• Follow Up Boss users, deals, calls, people, and activity
• Notion search, page reads, and database queries
• Drive search, folders, file text, and deal folders
• Semantic corpus and reviewed Slack-memory retrieval
• Workspace skill read/write and saved-query lifecycle

The runtime owns the limits.

The outer loop enforces a configurable eight-call ceiling plus a hard iteration cap. Within-question caching prevents duplicate adapter calls. Transient 429/5xx errors retry once. Tool results carry row caps, truncation flags, and source metadata before returning to the model.

Read-only is enforced below the prompt.

SQL passes a single SELECT/WITH validator, then executes through a dedicated Postgres role with transaction read-only mode, a 15-second statement timeout, approved table grants, and result caps. FUB, Notion, and Drive expose no write methods. Skill creation is the narrowly scoped write tool.

Learning becomes inspectable state.

jarvis_skills enforces a unique workspace/name pair and stores description, content, and one of five categories: methodology, user, entity, failure, or workflow. Descriptions preload into the prompt; full bodies require skill_read. The post-answer learning pass skips short questions, short answers, and zero-tool exchanges. Slack-derived guidance enters a review artifact, and only approved items become searchable memory.

A useful question can become a scheduled operation.

Saved questions include a validated cron expression, timezone, channel, and optional read-only condition. APScheduler runs the question inside the same container. Zero-row conditions skip both the model call and Slack post. Jobs can be run, paused, resumed, listed, or deleted through tools.

One run, one accumulated trace.

Each question produces one audit record containing question, workspace/thread identifiers, tool calls, result counts, latency, response state, and errors. The audit granularity keeps a complete investigation together instead of creating partial rows inside the loop.

HNSW replaced an index that failed at small scale.

IVFFlat with 100 lists over roughly 2,000 rows produced too few rows per list and missed known results. HNSW with cosine operators was adopted after those recall failures and works reliably at the current corpus size.

firm_id IS NULL means shared only.

Public queries are constrained to null-firm rows. Firm queries call a dedicated firm-only RPC and a separate public-KB RPC, then label and merge results with firm evidence first. Unknown firm IDs are rejected before retrieval.

Teams tenancy binds before the search.

The Teams adapter maps Microsoft tenant ID to one allowed firm. That mapping determines retrieval scope before any question is processed. The generic REST adapter still needs one-key-to-one- firm binding before production multi-tenant use.

Coverage, fixed points, and peer scoring stay distinct.

EN1 data coverage is weighted by floor area and ownership share, never asset count. An ASHRAE Standard 100:2024 EUI threshold can deterministically select the Energy Efficiency pathway. LEED O+M is an operational certification reported under BC1.2. Its scenario shows the ownership-adjusted floor-area coverage change, compares it with the supplied peer average, and states the expected direction against the benchmark. It reserves an exact point gain because the final result depends on the full peer group and GRESB's non-public certification weighting.

Files require an explicit tool request.

Claude can call the deterministic Excel generator only when the user asks for a file. The output contains scenario summary, actions and impact, aspect comparison, and asset detail sheets. Chat history supports follow-ups but is not evidence.

One question can compose a market snapshot.

“Give me a capital-markets snapshot” resolves into current SOFR, Treasury yields, mortgage rates, policy rates, and inflation series from FRED. Individual indicators remain addressable by series ID when a workflow needs one signal instead of the bundle.

Metro labor signals remain tied to industry.

“How are office-using and industrial jobs trending in Dallas–Fort Worth?” uses BLS metro employment tools with explicit industry series. Address-level unemployment resolves the relevant geography before requesting the current measure.

Industry concentration can start with an address.

“What does the tenant base around 4000 Westchase Boulevard look like?” resolves the county and queries County Business Patterns for establishments, employment, and payroll by NAICS. A separate tool can count one requested industry after listing supported codes.

Demographics, housing, and hazard stay source-specific.

Census/ACS tools return tract and county population, income, rent, and tenure context. HUD returns fair-market rents and income limits. FEMA reports flood zone, SFHA status, mapped state, and base-flood elevation where the source supports it.

Null, suppressed, and unmapped do not become zero.

FRED and ACS sentinel values normalize to null. Suppressed CBP employment and payroll remain null. FEMA distinguishes an unmapped location from low risk and normalizes invalid elevation sentinels instead of passing them through as facts.

Each server can ship alone and prove its own contract.

HTTP, geocoding, environment, error, and sentinel helpers are vendored into every source package. Live smoke tests assert values, geography, and payload structure; authentication errors, empty responses, schema drift, and incorrect geography fail rather than counting as successful network calls.

Utilities anchor the prototype.

Property type, ASHRAE climate zone, size, and ASHRAE 90.1 vintage select a DOE Commercial Prototype Building archetype. CBECS and ENERGY STAR property-type benchmarks validate the starting EUI. Actual fuel-specific consumption calibrates the baseline before measures are evaluated, and every result retains whether it is observed, calibrated, modeled, or unavailable.

Applicability is evaluated before savings.

Lighting, HVAC, DHW, ventilation, envelope, controls, renewables, appliances, conveying, and water measures use explicit definitions, deltas, costs, climate rules, and regional factors. Unsupported measures are skipped or flagged.

AI extracts; code accepts.

Claude parses PCA and utility documents into typed candidate data. Python owns DOE prototype deltas, calibration, combustion Scope 1, EPA eGRID location-based Scope 2, water/DHW linkage, capital cost, payback, IRR, NPV, incentives, and jurisdiction policy logic.

No sample number is presented as field truth.

The public report is an interface and methodology demonstration. Property facts are synthetic. Numeric BPS exposure is withheld when applicability or policy data is not supported. Confidence and limitations stay visible beside the modeled result.

Credentials remain local.

Environment variables configure test or live ESPM access. Basic Auth travels over HTTPS only to the official API. The MCP process has no project database, hosted service, or analytics endpoint.

Identity, metrics, groups, and certification stay distinct.

Tools cover account status, property discovery, property detail, metric retrieval, group discovery, group score summary, portfolio summary, and certification summary without forcing the model to manipulate raw XML.

Discover before requesting.

The server resolves available report metric names and reporting year before requesting score, EUI, emissions, and certification values. Portfolio and group rollups parallelize member requests and return predictable structures.

Working integration, no automated suite.

The repository documents test and live account paths but does not currently ship automated tests. Public response examples are illustrative and do not claim a real user's portfolio values.

Scanning does not automatically create work.

Arthur reads explicit KWC Slack requests, RCB emails, Granola commitments, unfinished Codex or Claude Code handoffs, GitHub evidence, and verified failures. A task must include a named requester or verified signal, desired outcome, source reference, stable dedupe key, one owner, one next physical action, and a due-date state. Vague candidates remain silent.

The handoff is technical, not a paraphrased email.

For each qualified request, Arthur records the problem and evidence, constraints, likely repository, proposed approach, acceptance criteria, live-verification requirements, and the recommended Codex or Claude Code handoff. It does not collapse planning, code, merge, and deploy into one authorization.

Notion owns the work; SQLite owns the machinery.

The Notion Work Queue is the human-readable source of truth. SQLite stores source cursors, locks, retries, dedupe hashes, and notification state. Stable Source Keys join requests, coding sessions, branches, and repeat scans to the same ticket instead of creating parallel task systems.

Every surfaced ticket has one private control thread.

The changed-items-only 8:30 AM ET brief contains at most three actions plus meaningful blockers. Each task is a Slack card linked to its Work Queue record. Replies such as start, waiting on someone, done, or a correction update only that ticket and confirm the resulting state in the same thread.

A completion message triggers reconciliation.

A matching commit or a Slack reply saying done cannot close code work. Arthur requires a merged PR and passing checks, then live verification when the ticket is marked for it. Blocked work remains Waiting with the decision and next action visible.

Quiet by default; consequential writes stay gated.

Gmail reconciliation runs twice daily and KWC Slack intake runs three times daily without generating scan notifications. Arthur raises only changed work, verified failures, urgent requests, or decision blockers. Client messages, merges, deployments, invoices, contracts, payments, and calendar writes require explicit approval.

Ambiguity becomes a review flag.

• Spreadsheet or PDF input maps to one documented schema
• Low-confidence cells remain visible instead of guessed
• Dates, missing rent, totals, and occupancy are checked
• Stated totals reconcile against extracted rows

The template is an asset, not a suggestion.

• Structured JSON fills a fixed document hierarchy
• Formatting and section order are enforced in code
• Sparse input preserves the output structure
• Same input produces byte-identical output

Configuration lives per contractor.

Contractor records own sender, messaging provider, campaign state, opt-in evidence, AI prompt, calendar credentials, business hours, and admin recipients. Leads, conversations, appointments, and opt-outs retain that boundary.

STOP, START, and HELP run before AI.

Outbound messaging is blocked until campaign state, sender, consent copy, privacy, terms, and opt-in evidence are complete. Phone-level opt-outs persist by contractor and number. Provider webhook signatures are verified.

Payloads normalize at the edge.

Telnyx, Twilio, and GoHighLevel adapters own sending, inbound normalization, and webhook validation so qualification and booking logic never branches on raw provider shapes.

The agent offers actual availability.

OAuth credentials refresh per contractor. Configured hours and busy intervals determine offered slots; a confirmed selection creates both the Google Calendar event and internal appointment record.

Webhook speed, polling reliability.

Drive notifications do not identify every file, so rescan sentinels expand into modified-since tree scans. The nightly job is the durable backstop and renews watch channels before expiration. Queue rows preserve retry and stale-run state.

OCR cannot exhaust a small server.

Low-text PDFs enter Tesseract fallback. OCR is serialized, capped by page count, and rasterized at controlled resolution because concurrent page images can exhaust a small droplet.

Embedding batches commit as they finish.

Section-aware chunks use 1,024-d Voyage embeddings to match the database vector type. Batches write before the next request, reducing lost work during long files and respecting provider limits.

Retrieval is narrower than application access.

The Slack agent receives chunk text, metadata, similarity, and source references through a dedicated tool and approved read policy. It never receives the portal's privileged server client.