Eight surfaces, one honest spine
AnKampung is a community operating platform already running in its first real community pilot. Here is every surface, honestly tagged — what runs on live devices today, what is frozen as a tested contract, and what is still forming — plus the identity model that lets one person belong to many homes.
The platform, surface by surface
Live in pilot means running on real devices for the first community; spec & tests means a frozen event contract with contract tests in the server; in formation means designed and honestly not shipped.
The resident app
One login for every home you belong to. Malaysian owners hold a bungalow, a city condo and a family house upcountry at once — the hub-and-spoke identity carries a different role on each, and a switcher moves you between community, unit and hat without ever merging two communities' data.
The offline gatehouse
The guard verifies visitor QR and OTP passes at the gate. When the network drops, it keeps working on its local copy and says so in plain words — 'changes will not reach the spine' — then reconciles the access ledger on reconnect without losing or duplicating a single fact.
The committee console
Announcements that record acknowledgment rather than mere delivery, community polls, circulars and approvals. One hard line by design: Malaysian strata e-voting is not yet legally valid, so statutory AGM/EGM votes stay separate from app polls.
The money office
Maintenance fees, the sinking fund at its statutory rate, arrears tracking and numbered receipts — shaped around the Strata Management Act 2013 (Act 757), billed in ringgit, paid through regulated FPX / DuitNow rails. AnKampung never holds custodial funds; every payment has an audit trail.
The maintenance spine
Every work order walks a legal state machine — Raised → Acknowledged → Assigned → In progress → Closed — with priority, common-property flags and acknowledgment SLAs. The engine rejects illegal transitions and quarantines them; it repairs nothing silently and invents nothing at all.
Facilities & bookings
Function rooms, courts and halls booked against real availability, with deposits settled through the same finance ledger rather than a separate cash note — so the money a booking touches is the money the committee can already audit.
The Community Digital Twin
The one honest read-model every surface reads from. It is disposable and rebuildable from the append-only event log, hash-checkable against it, and has never invented a fact in its life — what the board shows is exactly what the ledger proves.
The multi-tenant spine
Every table carries a tenant id enforced by Postgres row-level security; editions and entitlements are a config layer, not a fork. The pilot community is tenant #1 of a platform — onboarding community #2 changes no schema. That is the whole architecture brief in one sentence.
One person, many homes
Multi-property ownership is the core model, not an edge case. A single identity fans out to every community you belong to — each a separate tenant — with its own unit and role.
One Person
a single global identity
Many Communities
each its own tenant, never merged
Many Units
the homes you actually hold
A Role on each
owner · tenant · committee · guard
visitors, bills, bookings, notices
governance, polls, circulars
billing, arrears, work orders
the gatehouse, online or off
Designed for many, piloted on one
A platform, not a one-off
The first community is tenant #1, not the product. Row-level security and a tenant id on every table mean the second enclave is a config change, never a fork or a schema migration.
One real community, first
Depth before breadth: the pilot runs the resident app and gatehouse on live devices so the event contract is proven against reality before the platform is opened to many — the same design-many, pilot-few discipline across the Antrex family.
The honesty holds at the edge
Offline, illegal state, a re-delivered payment, a strata vote that isn't legally valid yet — each is met by refusing to fabricate, not by smoothing it over. The platform's value is that a committee can trust exactly what it shows.
The WhatsApp-group jobs, one ledger
Bring your community onto its own spine.
One gated enclave at a time — identity, money, gatehouse and governance that a committee can actually trust.