An autonomous operations system for short-term rentals, designed to connect to Hospitable; this build runs on a staged fixture world (no live Hospitable or Turno connection). Start with the first step of the operation: paste a guest message. Triage returns a category, a confidence, a draft in the operator's voice, a route, and a reason, plus the send right that category has earned so far. The urgency decision is made by the triage layer in this repo, a hackathon-built port of the operator's Jev pipeline (TypeSafe AI) to Muse Spark/Wonder; Jev's original tool, the hand-labeled dataset, and the Oct 7–14 pilot are pre-existing. The system runs on Meta's models: Muse Spark 1.3 for the fast first call, Muse Wonder 1.0 when confidence is low, and Muse Spark Open (open weights, served by Baseten) measured in the same seat.
Real decisions, graded in shadow
Dangerous false actions (truth Confirm, predicted Act) across the shipped engine's two measured eval runs, guard on (202 decisions)
Replay of the live shadow ledger. Real decisions on real guest messages. Nothing was sent — the engine is graded against what the host actually did. Property and place names are anonymized for display, and reservation codes are hidden.
A category earns send rights only from its graded record (autonomy.py). P2, send with a log, needs at least 25 decisive calls, decisive accuracy of 95% or better, and high-confidence accuracy of 98% or better. P3, send with spot checks, needs 75 decisive calls, 97%, and 98%. Charging a guest is never on the ladder, and money and safety topics never graduate: a human always decides those.
Trial view, not the rule: shadow agreement on labeled live decisions in 20-message windows. Bars show agreement; the navy line marks 95%.
| Category | Engine calls graded | Label agreed | Agreement |
|---|
Money or safety messages acted on without a human: —
Draft:
Route:
Why:
The operation at work
| Play | Description | Gate | |
|---|---|---|---|
| Guest messages | Start with the first step of the operation: paste a guest message. | Approve-first | |
| Early check-in | A guest asks to arrive early. | Held for approval | |
| Cleaner done | No guest message at all: the cleaner finishing is the trigger. | Held for approval | |
| In-stay issue | A guest who is already in the home reports something broken. | Held for approval | |
| Late checkout | A departing guest asks to check out late. | Held for approval | |
| Cameras | A supported outside camera reports motion: no message from anyone. | Held for approval |
Staged demo world. The properties, turnovers, cleaners, and arrivals below are fixture data — no real guest data anywhere. Every send in a play is simulated or held for approval: nothing real is sent and nothing real is charged. Action steps show the gate the autonomy ladder applies before anything may execute.
A guest asks to arrive early. Comfi Autopilot extracts the requested time, checks the staged calendar (is there a same-day turnover? who cleans? when is the unit actually ready?), drafts the reply, and gates the early check-in charge — the highest-stakes action — for a human. When the answer depends on the cleaner, the run waits, and the cleaner's report finishes the chain.
No guest message at all: the cleaner finishing is the trigger. Comfi Autopilot verifies the clean against the record, then the arriving guest hears the place is ready. If the cleaner flagged a problem, the guest hears nothing and a human takes over.
A guest who is already in the home reports something broken. Comfi Autopilot identifies the issue from the message, checks who is actually staying, drafts the reply in the operator's voice, and composes the handyman dispatch — the dispatch send is gated in the middle of the ladder. A safety issue (gas, smoke, flooding, no heat) skips the fix-it advice entirely, gives the guest safety guidance, and flags the operator in the same run. When the vendor sends an ETA, and later reports the work done, the guest hears about each step — every send gated. The vendor and his rates are fixtures; the dispatch is simulated or held.
A departing guest asks to check out late. Comfi Autopilot reads the staged calendar for that property and day — is a new guest arriving after them, how long is the turnover in between, what does the house allow — and drafts the answer in the operator's voice: yes for the time asked, a no that offers the latest time that does work when the ask runs into the next guest's turnover, or a question back when no time was given. The first hour past checkout is free; past that, the late checkout fee is its own step at the highest-stakes gate, held for a human, and only for a time the guest actually asked for. Same message, same day, two calendars below. Nothing is sent and nothing is charged.
Outside cameras report on their own, with no message from anyone. Motion never triggers a message to a guest: the expected guest or the scheduled cleaner is logged, and anything unexpected goes to the operator. The same checks cover the harder cases an operator actually sees: a camera that goes offline on a light switch the guest controls (the one case that drafts a guest message, held for approval), a person at a house marked closed, the door and lights after a turnover, a covered or turned camera, a guest locked out or stuck at the door, a guest who reports feeling unsafe, a dark entry at sunset, a dog when the booking lists no pet, snow at an empty home, several cameras dropping at once (one area-outage alert instead of one per camera), a periodic upkeep check that turns camera history into turnover notes, a vendor's arrival window checked for proof of service, a gathering that grows well past the booked party, and signs of a possible move-in. In the live path Muse Spark reads each frame; here the frames are staged examples with their labels attached.
Camera support has a hardware boundary. In production, the cameras need a certified connection that can supply frames and offline history: an ONVIF or RTSP camera system, UniFi Protect, or a listed powered Wyze model through Wyze Bridge. Battery-powered and app-only cameras do not qualify for the full set of checks.