Aldar Estates | 2025Asteco Community Management
Reply Tool
A reply writer for community managers answering one resident at a time. The draft cannot be copied out of the tool until every promise inside it has been read back and confirmed by the person about to send it.
3
Model Stages
Claude Sonnet drafts, Claude Opus sets the voice, GPT-4o checks the promises
0
Models in the Gate
The lock is pure code. It recomputes on every keystroke and costs nothing to run
4
Enforcement Points
In the browser, on the server, between the model stages, and again before Arabic
201
Tests Passing
132 offline, 16 against the real route, 53 driving the real UI and clipboard
The Problem
The Risk Is Not a Bad Draft. It Is a Good One.
EDM Gate, the first tool in this platform, writes one notice to thousands of residents. This is the opposite job: a community manager answering a single resident from their own mailbox, under their own name. There is no approval chain between them and send.
A model that writes fluently will fill a gap it has no business filling. A date nobody confirmed, a policy nobody wrote, a refund nobody approved. The output is not obviously wrong, which is exactly the problem: it reads well, so it gets sent, and it commits Asteco to something in writing.
The principle the tool is built on: a clumsy honest reply is safer than a polished one that commits Asteco to something it cannot honour.
What I Built
What I Built
I designed and built the tool with Claude Code: the reply schema, the model pipeline, the confirmation checklist, and the gate that stands between a draft and a resident's inbox. The model is allowed to write the prose. It is not allowed to supply a fact.
The Approval Gate
Built the lock as a pure function over the exact text the clipboard would receive, so the button, the keyboard, the right-click menu and the drag handler all read one boolean and cannot disagree
Made a blocked Ctrl+C write a warning onto the clipboard instead of doing nothing, because a copy that silently fails gets pressed again and pasted on faith
Re-ran the same gate on the server, where the browser cannot reach it, with no model call and therefore no cost
Keeping Facts Out of the Model
Separated the resident's email from the manager's notes in the payload itself: one is a set of claims, the other is the only source of facts the reply may use
Had the drafter mark every gap with a visible placeholder rather than fill it, and treated writing around a gap as the same defect as inventing one
Derived every date from what the manager typed, formatted in code and copied word for word, so the model never authors a date
Checks a Model Cannot Suppress
Computed the confirmation checklist in code from five deterministic sources, so an empty or broken model response degrades to the code floor and never to "nothing to check"
Ran the checklist stage on GPT-4o, the opposite house to the model that wrote the draft, so no model grades its own work
Blocked the tone stage in code from quietly smoothing away a placeholder, by comparing placeholder counts before and after the rewrite
Where Facts Come From
A Claim and a Fact Are Different Things
The two inputs reach the model labelled as different kinds of thing. A system that flattens them writes “as you were overcharged, we will refund you” off the back of an assertion nobody checked.
Where the reply needs a fact the manager has not given, it inserts a visible marker instead of guessing. Writing around the gap is treated as the same defect: “we will look into this and be in touch” is not the safe option, it is a commitment to act and to follow up that nobody authorised.
Claims
The resident's email
Read verbatim, never believed. The reply can acknowledge what a resident has told us. It can never assert it as verified, and it can never act on it.
Facts
The manager's notes
The only place facts enter the system. Anything left out of this box is something the reply will not claim. That box is the manager’s own confirmation.
Nothing
Everything else
No policy, no date, no refund and no follow-up commitment comes from the model’s own knowledge. Where a fact is missing, the reply marks the gap and asks.
The Lock
Two Conditions, Both Independent
The draft stays locked until both conditions clear. Keeping them apart is deliberate. If the gap check were simply another line on the checklist, a manager clearing the list on autopilot could tick straight past an unfilled placeholder and paste it into a resident's inbox.
Condition one
No unfilled gaps left in the text
Every placeholder the drafter inserted must be typed over with a real fact. This is a property of the text itself, so it cannot be ticked past.
Condition two
Every item on the checklist confirmed
Each promise, date and commitment the reply makes is read back to the manager, who confirms it individually before the draft clears.
What Ctrl+C gives you
A disabled button that Ctrl+C walks around is not a gate, it is a suggestion. One value drives the button, the keyboard, the right-click menu and the drag handler, so they cannot fall out of step with each other. This is not DRM, and it does not pretend to be: the draft stays editable, so anyone determined could retype it. The person being designed for is not a malicious manager. It is a rushed one, on autopilot, at 5pm.
While locked
This reply is not ready — resolve the highlighted items in Comms Engine before copying it.
The keystroke is not swallowed. The warning replaces the reply on the clipboard, because a copy that appears to do nothing gets pressed again and pasted on faith. This text cannot be mistaken for a reply.
Once cleared
The reply itself, exactly as the manager approved it.
The draft stays editable the whole way through, because typing over a placeholder is the only way out of the gate. Editing a promise away removes its item; typing a new one in adds an unconfirmed item and locks the button again.
And again on the server
The browser is not trusted to be the only guard. The lock step re-runs both conditions server-side against the text the manager actually approved rather than the draft they were shown, and it calls no model, so the safety-critical stage of the pipeline is also the one stage that costs nothing. The Arabic reply can only be transcreated from a locked English, which means the two languages cannot carry different commitments. That is true by construction, not by policing.
Why the Gate Is Code
A Prompt Is Not Enforcement
This platform has five incidents on record where a model ignored an explicit written instruction. The rule that came out of every one of them is that a recurrence gets fixed in code, never by strengthening the wording.
The tone stage is the clearest case. It is a style pass, and its brief forbids it from touching a gap marker. But “the paragraph read awkwardly with a placeholder in it, so I smoothed it” is exactly the kind of helpfulness that ends in a confident sentence nobody verified. So the code counts the markers before and after, and refuses the rewrite if one went missing. The prompt says do not. The code makes sure.
The same reasoning drives the model choice. The checklist stage judges the drafting stage's output, so it runs on the opposite house's model. No model grades its own work.
The Checklist Floor
Five Sources a Model Cannot Shorten
The list a manager confirms is computed in code and recomputed on every keystroke. The model stage can add to it and can never take from it, so a broken or empty response degrades to the code floor rather than to an all-clear.
Every gap marker
Each placeholder the drafter left behind becomes an item that cannot be dismissed.
The date you typed
Read back as a formatted calendar date, so you confirm the day and not your own typing.
A date the draft lost
If the model dropped or reworded the date you entered, the reply now says something other than what you gave it. That gets caught.
Promises in the prose
Thirty-three rules over timelines, policy and approvals, matched against the text as assembled.
Invented contact details
A phone number or address that came from neither you nor the resident is flagged before it ships.
The floor over-fires on purpose.
A false positive costs one tick. A false negative is a wrong promise in a resident's inbox on Asteco letterhead. The two are not comparable, so every rule leans toward firing.
The date you typed is not self-verifying
This one is a descendant of a real incident: a manager typing a date day-first on a machine set to a US locale put the wrong day in front of residents. So the date is parsed, formatted in code, and read back as a calendar date for confirmation. The manager confirms the day, not their own typing. In the same spirit, month names are matched case-sensitively, so a reply saying “we may replace it” does not trip the rule looking for May.
How a Reply Runs
Three Model Stages, Then a Gate
Every stage is its own request, with the running cost shown per stage as it goes.
Draft
Claude SonnetWrites the reply from the resident’s email and your notes, and marks every gap it cannot fill
House voice
Claude OpusA style pass for the Asteco register, forbidden in code from resolving a gap while it tidies the prose
Checklist
GPT-4oAdds to a list whose floor is already computed in code. It cannot approve anything and it cannot shorten the list
Lock
Code onlyThe gate re-runs on the server against the text you approved. No model, no cost
Arabic
Claude OpusTranscreated only from a locked English, so the two languages cannot carry different commitments
Where It Stands
Built, Tested, Not Yet Shipped
The tool is built and sitting on a branch. The safety core is covered by 201 passing tests: 132 offline, 16 driving the real lock route, and 53 driving the real interface, including a check that presses Ctrl+C and reads back what actually landed on the clipboard.
That proves the code enforcement. It does not prove the model behaviour. Whether the drafter reliably marks a gap instead of filling it is a question only a live run can answer, and that verification is still open. The gate is designed on the assumption that it will not: every check treats the model as something to be caught, which is why the enforcement sits in code on both sides of it.
Built With
Built With
The model writes the prose. It never supplies a fact, and nothing it writes reaches a resident until the person signing it has confirmed every promise in it, one by one.