One person is not one home
The single requirement that decides the whole data model is embarrassingly local: Malaysian owners hold property in several places at once. The same person can be an owner at a gated enclave in the suburbs, a tenant in a KL condo, and on the committee of their upcountry family estate — three different roles, three different sets of money and rules. Most property software makes you open three accounts and remember three passwords. AnKampung inverts it: one Person, a membership per community, a role on each, and a switcher that scopes every call to the community you are standing in. Identity never leaks across the boundary.
The same one rule, a new domain
Antrex already has a spine. AnOmbak refuses to colour a road it has not measured; AnTIE will not fuse a crowd too thin to trust; AnTeraju keeps a topic grey until you prove it. AnKampung carries that refusal into community operations. Its State Engine has one rule, written into the frozen event contract: it never invents facts. A maintenance request cannot jump from Raised to Closed — an illegal transition is rejected and quarantined with a reason, not quietly repaired. The board you look at is a deterministic projection of an append-only ledger; if the projection is lost, it is rebuilt from the log, never the reverse.
That discipline shows up in the interface, too. When the gatehouse loses network it keeps verifying passes on its local copy — and says so in plain words on the guard's screen: “Offline — showing the local copy. Changes will not reach the spine.” Degradation is a disclosed state, not a silent lie.
Grounded in a real pilot, honestly scoped
This is not a slide. The Resident and Gatehouse app run on real devices for the pilot tenant, and the test build is candid about itself — its own login screen states “local sample data, no real payments are processed.” The event contract is frozen as code with 87 curated events and a single authoritative producer each; the projection and reconciliation engine is a written spec with contract tests already in the server. What is still in formation, we say plainly, is the multi-tenant platform around it: the billing wedge, the guard reconciliation loop, and the row-level-security tenancy that lets community number two onboard without touching the schema. Design many, pilot one — the family strategy, applied to the kampung.