# Property Operations & Resident/Vendor Handoff Desk

## Purpose

A private field desk that turns property inquiries, maintenance conditions, inspections, vendor work, documents, budgets, and incidents into evidence-complete human handoffs—without letting AI decide rights, safety, money, or messages.

**Terminal state:** `approval_ready`

## Screen 1 — Property authority card

```yaml
property_or_association_id:
ownership_entity:
management_authority_source:
governing_documents_and_versions: []
jurisdictions: []
housing_programs: []
emergency_plan_version:
fair_housing_reviewer:
legal_contact:
safety_contact:
board_or_owner_approval_matrix:
payment_approval_matrix:
data_retention_policy:
approved_systems: []
```

Missing or conflicting authority blocks action. AI never invents a policy from customary practice.

## Screen 2 — Intake and parallel gates

```yaml
intake_id:
received_at:
channel:
reporter_role:
exact_statement:
staff_paraphrase:
ai_summary:
property_unit_area:
attachments: []
preferred_contact_and_accessibility:
life_safety_flag:
fair_housing_accommodation_vawa_flag:
privacy_restricted_data_flag:
lease_governing_document_flag:
vendor_payment_flag:
routine_operations_flag:
```

Hard rule: more than one path may be active. The system never reduces the intake to one opaque priority score.

## Screen 3 — Emergency/safety handoff

```yaml
reported_hazard:
observation_state: reported_unverified | observed_by_staff | qualified_inspection
approved_emergency_plan_step:
authorized_coordinator:
official_emergency_contact:
evacuate_shelter_lockdown_authority:
utility_shutdown_authority:
affected_areas:
access_restrictions:
resident_message_draft:
external_notifications_required:
decision_log:
```

The interface displays: “If there is immediate danger, use the property’s approved emergency plan and contact local emergency services.” It does not diagnose, dispatch, enter, direct untrained intervention, or replace emergency authorities.

## Screen 4 — Fair-housing and sensitive-request route

```yaml
request_category:
resident_or_applicant_words:
protected_or_sensitive_data_present:
minimum_data_needed:
applicable_program_and_jurisdiction:
current_authority_sources: []
accommodation_or_vawa_specialist:
screening_report_involved:
adverse_action_possible:
confidential_storage_location:
human_decision_required: true
```

This screen cannot display an AI recommendation. It blocks automated screening, proxy inference, treatment differences, unnecessary medical questions, retaliation, and broad access to survivor/accommodation data.

## Screen 5 — Work-order evidence chain

```yaml
work_order_id:
source_intake_id:
asset_and_location:
condition_reported:
condition_verified_by:
priority_authority:
access_permission_and_window:
approved_scope:
assigned_worker_or_vendor:
site_hazards_and_controls: []
before_evidence: []
arrival_entry_exit_log: []
change_orders: []
parts_labor:
after_evidence: []
completion_test:
resident_manager_acknowledgment:
follow_up_date:
status:
```

Closure requires the evidence defined by the applicable standard/owner policy. An invoice, “done” message, or AI image assessment alone cannot close safety-critical work.

## Screen 6 — Inspection and remediation card

```yaml
inspection_id:
authority_and_standard_version:
inspector_and_qualification:
notice_and_access_basis:
observed_condition:
evidence_provenance: []
deficiency_criterion:
safety_classification:
response_time_source:
lead_or_environmental_flag:
repair_or_mitigation_plan:
proof_required:
reinspection_result:
closure_approver:
```

NSPIRE fields appear only when the property/program is in scope. EPA lead fields trigger a certified-firm/document review; AI cannot determine an exemption.

## Screen 7 — Vendor handoff and payment lock

```yaml
vendor_id:
legal_name:
approved_known_contact:
license_or_certification_authority:
insurance_verified_at:
tax_onboarding_state:
conflict_disclosure:
approved_scope_and_contract:
property_access_limits:
resident_data_limits:
safety_hazards:
quote_and_budget_code:
schedule:
change_order_limit:
completion_and_warranty_evidence:
invoice_id:
bank_or_remittance_change: false
out_of_band_verification_receipt:
dual_approval_receipts: []
payment_state: blocked | verified_pending_approval | approval_ready
```

Any changed payment detail or contact channel resets payment state to `blocked`. The system never pays, purchases, awards, signs, or updates a vendor account.

## Screen 8 — Communication review card

```yaml
recipient:
recipient_role:
property_unit:
purpose:
verified_facts: []
unconfirmed_items: []
draft_message:
attachment_classifications: []
accessibility_language_needs:
legal_fair_housing_safety_flags: []
promises_or_deadlines: []
reviewer:
approved_exact_payload_hash:
state: draft | needs_review | approval_ready
```

There is no send control. A change to recipient, facts, attachments, promise, or wording invalidates the review.

## Screen 9 — Document and decision ledger

```yaml
document_id:
document_type:
property_entity:
jurisdiction_program:
effective_date:
version:
signed_or_approved_by:
controlling_clause:
access_classification:
retention_rule_source:
supersedes:
conflicts: []
ai_summary:
summary_verified_by:
```

The original document is controlling. Expired, unsigned, withdrawn, or conflicting sources route to the owner/counsel instead of producing a confident answer.

## Screen 10 — Budget and reserve packet

```yaml
request_id:
asset_project_work_order:
operating_or_reserve:
approved_budget_line:
approved_amount:
committed_amount:
invoice_amount:
paid_amount:
remaining_amount:
quotes_and_scope: []
forecast_assumptions: []
reserve_study_reference:
governing_restrictions:
approval_authority:
board_owner_accounting_receipts: []
state: draft | variance | blocked | approval_ready
```

AI may perform arithmetic on supplied values and flag mismatches. It cannot choose a funding source, transfer money, assess owners, approve a variance, or claim financial savings.

## Screen 11 — Incident and recovery timeline

```yaml
incident_id:
opened_at:
classification:
timeline:
  - timestamp:
    actor:
    observation_or_action:
    evidence_state:
    source:
affected_locations:
people_safety_accounting:
restricted_information_location:
emergency_responder_handoffs: []
insurer_authority_notice_requirements: []
recovery_tasks: []
resident_communication_packets: []
after_action_findings: []
closed_by:
```

Timeline entries are append-only. Corrections add a new entry rather than rewriting history.

## Screen 12 — Exact approval packet

Every packet binds:

1. property/entity and jurisdiction;
2. triggering intake and original evidence;
3. current authority sources;
4. exact decision requested;
5. exact scope, recipient, vendor, amount, or action;
6. safety/fair-housing/privacy/legal/payment flags;
7. alternatives and unresolved facts;
8. attachments and restricted-data locations;
9. approver role and authority;
10. expiration, rollback, and follow-up.

The desk stops at `approval_ready`. Approval is recorded but does not send, dispatch, sign, pay, file, publish, access property, or update an external system.

## AI behavior contract

AI may:

- transcribe and summarize supplied nonrestricted intake;
- extract dates, assets, clauses, amounts, and missing fields;
- draft work scopes, checklists, resident/vendor messages, and board packets;
- compare document versions and calculate supplied budget figures;
- flag potential safety, fair-housing, privacy, legal, payment, or evidence gaps;
- prepare handoff and approval packets.

AI may not:

- determine eligibility, accommodation, protected status, fault, liability, habitability, code compliance, eviction, enforcement, or emergency response;
- prioritize service based on identity, sentiment, payment history, protected data, or proxies;
- reveal sensitive resident/applicant/survivor/vendor data or place it in an unapproved tool;
- engage vendors, dispatch workers, grant access, change scopes, approve invoices, alter bank data, transfer funds, or purchase;
- send resident/vendor/board messages, issue notices, write portals/accounts, file reports, post publicly, or change an account.

## Acceptance tests

1. A disability-related request routes to trained human review with no AI recommendation.
2. A VAWA-sensitive note is excluded from broad incident and work-order views.
3. A report of fire, gas, electrical flooding, or structural movement displays the approved emergency path and blocks routine routing.
4. A vendor invoice cannot prove work completion.
5. A changed bank account freezes payment and requires known-channel verification plus dual approval.
6. A resident message has no send control and invalidates on payload change.
7. A lease or governing-document summary cannot override the signed source.
8. Withdrawn HUD guidance is visibly marked and cannot support a current-policy claim.
9. NSPIRE fields cannot be labeled universally applicable.
10. Lead-disturbing work in a potentially covered property triggers EPA/certified-firm review.
11. A budget variance cannot become approved through arithmetic alone.
12. Every external write, payment, dispatch, access, filing, message, and public/account action is absent or disabled.

## Pilot artifact

Using synthetic data only, generate:

- one authority card;
- one leak/electrical-risk intake with parallel gates;
- one emergency handoff prompt;
- one work-order evidence chain;
- one inspection/remediation card;
- one vendor packet with payment lock;
- one resident communication draft;
- one budget authorization packet;
- one incident timeline;
- one exact approval packet.

No real resident data, dispatch, communication, payment, property access, account write, deployment, or public action is included.