← Projects

QBO-F02 · Quobo Labs fleet

Quobo Residential

FlagshipPre-launch

The permanent record of a home, from listing to living: one append-only, consent-governed record of everything that ever happened to a house — read and written by owners, agents, contractors, and insurers, where AI drafts and a human always signs.

Explore Quobo Residential →

Chapter one

The problem

Four industries orbit the American home — real estate, home services, insurance, smart home — and none of them keeps the asset's history. Every sale wipes the house's memory: the buyer inherits a junk drawer of manuals and whatever the last owner remembered to mention. The agent's relationship dies on closing day. The contractor's finished work lives in his truck's invoice book, not in the house. The insurer prices risk on a questionnaire and settles claims on a shoebox.

You know more about your car than your house. The car has a dashboard and a service record; the most expensive thing you will ever own has neither. What color is the hallway? When was the water heater installed, and is it still under warranty? Who put the roof on? The answers exist — they're just scattered across four industries and two previous owners, and nobody wrote them down in a place that survives.

The failure underneath is structural. Each industry touches the home once, at its own transaction, then forgets it — so every industry re-learns the same home from scratch, at its own expense, forever. A house is for sale for perhaps two percent of its life. Nobody owns the other ninety-eight. Quobo Residential was built to be that owner: the home itself as the persistent entity, with one compounding record that everyone who touches it reads and writes.

The mechanics

How it works

  1. It starts with the record

    Everything that happens to the home lands as an event on one append-only timeline — who did it, what it was, and how the record knows. Every fact carries one of six trust-ranked provenance classes: a sensor reading outranks a contractor's attestation, which outranks a document extraction, which outranks a memory. Corrections supersede, never delete, and the whole chain is hash-linked so even the operator can't quietly rewrite it. Access is fail-closed and permissioned, and every access — and every refusal — lands on a ledger the owner can read, with a Revoke that actually kills reach.

    The demo home's timeline — 193 events, provenance counted at the top, the hash-linked ledger verified intact
    The demo home's timeline — 193 events, provenance counted at the top, the hash-linked ledger verified intact

  2. A record is born without waiting for a sale

    The cold start is an install visit. Booking a sensor install mints a time-boxed grant scoped to exactly the declared rooms — the paper consent form maps clause-for-clause onto the grant it creates. The technician scans nameplates, photo-walks the rooms, snaps receipts; every capture becomes a proposal, nothing lands on the record. Then the owner confirms item by item, and completing the visit revokes the grant. An hour after a stranger walked in, the home has a live, structured record — and the ledger shows the technician's access is already dead.

    The visit's closing screen — completeness delta reported, the technician's grant revoked

  3. The owner's home, finally with itself

    A dashboard with health signals. A room browser whose shareable touch-up card carries the exact paint spec for the aisle. A registry of systems and appliances with warranties and recall matches, a typed document vault, and rule-based safety automations — a leak closes the valve and drafts the mitigation request at 2 a.m. A weather watch tuned to this home turns a storm on the radar into a prep checklist, then a guided damage walk, then a claim — with the owner's own photos carrying the link back to the storm that caused them.

    The room browser — every painted room carrying its exact spec: brand, line, color code, sheen, one tap to copy
    The room browser — every painted room carrying its exact spec: brand, line, color code, sheen, one tap to copy

  4. Professionals enter through their own doors

    Each profession gets a first-class rail over the same record, not a bolt-on. A contractor's service request arrives with the house attached — the unit's make, model, and serial, the room's actual dimensions — so the estimate quantifies materials from the record, each line citing what it measured. When the job closes, the work publishes back as contractor-verified history, the new equipment auto-registering with its warranty pre-loaded. An agent prices a listing with comps that cite verified work instead of guessing; at closing, a transfer ceremony atomically hands the record over — the seller's personal inventory detaches, the buyer onboards into a loaded home, and the agent stays as an owner-revocable card on the new dashboard.

    A contractor's quote in the demo world — each line citing the record URI it was computed from
    A contractor's quote in the demo world — each line citing the record URI it was computed from

  5. Insurance reads it through a keyhole

    A claim package assembles itself from evidence already on the record — photos, inventory with receipts and serials, the roof's verified install date — each item graded for strength, with the cause attached. The adjuster opens it through a scoped, expiring link with no login: the link can reach exactly that one package and provably nothing else, and every open is logged, rate-limited, and owner-revocable.

  6. The AI drafts; a human always signs

    Assistants never touch the database. Context reaches them only through a permission-filtered assembly service that walks registered chains — a furnace fault reaches the manual page, the warranty clause still in force, and the installer of record in one motion — and every citation must resolve to a source the assistant was actually given. Writes exist only as proposals waiting for a human signature. This is enforced at runtime, not promised by a prompt: the test suite includes a deliberately compromised assistant that obeys any injected instruction, and the rails hold anyway.

    The assistant's answer, every claim carrying a provenance-badged source chip

Field notes

Would this fit your life?

A homeowner with a storm on the radar

The moment
A severe-weather alert scoped to their home's geography lands on the record.
What they do
The weather watch becomes a prep checklist tuned to this house — its roof age, its trees, its sump pump. After the storm, a guided damage walk; each photo carries the link back to the storm that caused it. The claim package then assembles itself from evidence already on the record — the ceiling photos, the room's contents with receipts and serials, the roof's verified install date — every item graded for strength.
The payoff
The claim isn't a shoebox scramble after the loss; it's a one-tap assembly of proof that was logged years before.

A general contractor quoting a water-heater swap

The moment
A service request lands with the house attached — the unit's make, model, serial, install date, and the utility room's actual dimensions.
What they do
Quotes in minutes without a site visit: the takeoff quantifies materials from the room's real measurements, each line citing the record it came from. The job runs with photo protocol and a signed change order when the flue turns out to be corroded; on completion, a work record drafts itself and publishes.
The payoff
The finished work is now contractor-verified history under their name, in the house, forever — and the new heater registered itself with the warranty pre-loaded.

A real-estate agent selling a documented home

The moment
An offer is accepted on a listing whose renovations are record, not recollection.
What they do
The comp analysis prices the home with adjustment lines that cite verified work history. At closing, the transfer ceremony flips ownership atomically: the seller's belongings detach from the record, the buyer onboards into a loaded home, and the agent's access downgrades to a persistent, owner-revocable agent-of-record card on the new owner's dashboard.
The payoff
Closing day became onboarding day — and the agent stays in the home's life until it sells again, through them.

An insurance adjuster who has never had a login

The moment
A claim package arrives as a link.
What they do
The link opens exactly one claim package — the claim, its items, its proofs, the causal chain back to the storm, that claim's policy — and provably cannot reach a second claim or an unreferenced coverage line. Every open is logged, expiring, and revocable by the owner. Substantiation arrives pre-graded: receipt plus serial plus photo beats photo alone.
The payoff
A complete, causation-attached package in one click — while the owner can answer, from the consent ledger, exactly who saw their home and when.

No varnish

From the lab notebook

Where it stands

Feature-complete and counting down. The whole substrate is built and real: the append-only timeline, the permission and consent machinery, the ownership-transfer state machine, the hash chain, the deterministic AI fabric, all four persona rails, the operator install-visit flow, and two full deployment topologies. What the Explore link opens is the live deployment running a seeded demo world — a fictional cast, fictional houses, a fictional contractor — behind real auth. Wander it freely; nothing in it is a real customer, because there aren't any yet.

Verified to an unusual standard

Roughly 270 tests, rerun in full against a throwaway Postgres container before release. A browser gate logs all twelve seeded principals in through the real form, typing live one-time codes. A 2,184-check sweep hunts for data leaking across personas and found zero. The red-team suite includes a deliberately compromised assistant that obeys any injected instruction — proving the permission rails hold even against a hostile model. Two hostile cold audits have run, and every finding was converted into a permanent regression test. The live store's hash chain verifies clean.

What's honestly still gated

The assistant runs live only in a capture harness; demos and tests replay recorded turns. Weather, recalls, OCR, and vision extraction run behind deterministic stand-ins with real adapters gated but pending. Payments and e-signing are honestly-labeled simulations — no real money, no real PII, no real sending is a standing rule of the current build. The interface is mid-migration between two design languages. None of this is painted over in the product; the seams were built for cutover.

What's next

The first real house. The pilot runbook walks an operator from a fresh deployment to a first technician install visit, and a day-zero drill has rehearsed that exact first hour on both data stores. Beyond the pilot, the roadmap runs toward live data providers and a fuller real-estate desk — but it is roadmap, and this page claims nothing that isn't built.

Next in the fleet

QBO-A01

Quobo Labs Done

Live

A catch-all inbox for your life: capture anything, and Done files it, finds every deadline, and walks you through the few things that actually need you.

Continue the tour →