Proof
AI-built property-management software: proof and limits
Question
What can be publicly verified about the AI-assisted 918TS build without exposing resident, owner, document, financial, credential, contact, or infrastructure details?
Inspect the safe workflow
Open the public 918TS Workflow Lab (archived).
The sandbox demonstrates one fictional maintenance lifecycle:
- A resident reports a sample water-heater drip.
- A manager schedules fictional access and records a fictional $680 quote.
- An owner approves the sample quote.
- The manager closes the work and preserves the event trail.
The demo displays different information for resident, manager, and owner roles. It stores state only in the visitor's browser and includes a one-click reset.
Public-demo isolation
| Boundary | Verified behavior |
|---|---|
| Data | Fictional records only; no names or values copied from production |
| Storage | One browser-local demo state; no database |
| Network | No Supabase client, production hostname, email, upload, chat, or API route in application source or its compiled page chunk |
| AI | The local Gemma 4 assistant is described but not connected |
| User action | The full resident -> manager -> owner -> manager journey works and reset returns it to the initial state |
| Delivery | Cloudflare-compatible build passes; rendered-output tests pass; dependency audit reports zero known vulnerabilities; anonymous production access returns the demo rather than a sign-in gate |
Dated build evidence
Snapshot: July 27, 2026.
| Observation | Result | What it does not prove |
|---|---|---|
| First repository commit | July 15, 2026 | When planning began or total labor |
| First live deployment recorded | July 16, 2026 | That the complete current feature set existed |
| Repository commits | 137 | Hours, quality, or model effort |
| Fable 5 co-author trailers | 46 | That Fable independently built the system |
| Opus 4.8 co-author trailers | 59 | That Opus independently built the system |
| Commits without either named trailer | 32 | Who or what contributed |
Git trailers are attribution records, not a model leaderboard. There was no matched Fable-versus-Opus-versus-Sol-versus-Codex benchmark.
What the production system contains
The private production system is a web app/PWA for one property, not a native mobile app or general SaaS. Publicly safe feature categories include:
- a public property website;
- authenticated resident, manager, and owner views;
- move-in and document workflows;
- maintenance intake, scheduling, approval, evidence, cost, and history;
- compliance deadlines and owner decisions;
- financial reporting that does not move money; and
- Ask 918, a read-only assistant using local Gemma 4 through Ollama.
The stack uses Next.js/React, Supabase Postgres/Auth/Storage with row-level security, GitHub, and Cloudflare Workers.
The privacy failure that changed the checklist
A July 27 review found contact information classified in source as signed-in-only inside JavaScript delivered to public browsers. Hiding the fields in the rendered page had not kept them out of the client artifact.
Commit ffee4cf moved the private contact boundary behind an authenticated server route and expanded the privacy gate to scan fresh compiled output for contact patterns. A clean production build, 62-file source scan, 194-file artifact scan, 13-check production runtime smoke, logged-out live page check, and re-request of both formerly exposed chunks passed after deployment.
This supports one narrow lesson: interface visibility is not a privacy boundary. It does not establish that every security or acceptance path is complete.
Cost boundary
Ali recalls about ten dollars as the new domain expense and recalls the available Fable 5 allowance being exhausted on the first day. Those are first-person recollections, not reconciled billing records.
Claude and Codex access came from existing paid plans or allowances. No complete ledger currently allocates:
- Ali's specification, review, and testing time;
- subscription cost across this project;
- existing workstation and GPU cost;
- electricity for local Gemma 4;
- hosting/database usage as it grows; or
- maintenance, backup, support, and security work.
The evidence supports "small known marginal cash expense." It does not support "a ten-dollar app."
What is not established
- Completion in a few prompts or one night.
- A complete time, token, or all-in dollar cost.
- A controlled comparison or winner among AI models.
- A second customer, public pricing, or a general SaaS product.
- Payments, legal advice, or automated emergency judgment.
- That every production acceptance check is complete.
- Search volume, indexation, traffic, or AI-answer citation.
Public data
Download the sanitized evidence table. It contains the dated facts and their limits, not private repository content.
Read the paired article: I Built Property Management Software With AI. The Prompts Were the Easy Part.
Verification sources
The private source review used the repository's dated Git history, current deployment configuration, operations record, API route, permissions implementation, fresh build output, and live logged-out responses. The public demo was reviewed separately from production. The production deployment and both formerly exposed public chunk URLs were rechecked on July 27 without publishing their private values.
External documentation establishes what the underlying tools support, not that this configuration is correct:
- Supabase row-level security
- Supabase Storage access control
- Cloudflare: Next.js on Workers
- Cloudflare Tunnel
Caught something I got wrong? Send it directly. Confirmed corrections go in the corrections log.