Every module (Maintenance, Leasing, Renewals, Collections) now has a middle setting between Off and Live. In Supervised, Clara writes the message and the customer's team approves it before it goes out.
2026-10-03 · built 2026-10-01 to 2026-10-03 · design: gatekeeper drafts mode · board: gatekeeper-build · earlier evidence: gatekeeper prod evidence
Actions such as booking a tour or writing to AppFolio still happen right away; only the message waits. Inside Supervised there is a calls choice: Messages only (Clara still answers calls) or Everything (calls go to the team). Collections: JPCO and the test companies are Supervised, new companies start Off, and no building has Collections on Live.
Authorised by Gera on 2026-10-02/03, test buildings only. In each run:
Each building's setting was then cleared. Phone numbers and message words are left out of this page.
| Maintenance | Leasing | |
|---|---|---|
| Building | The Willows (Sandbox, test building) | Yale 25 Station (Sandbox, test building) |
| Setting during the run | Supervised, Messages only | Supervised, Messages only |
| Test text in | 17:16:12Z | 17:23:02Z |
| Reply held | eschold_87fc50f4… at 17:16:51Z, posted to the building's Slack channel | eschold_3da34e63… at 17:23:23Z, posted to the building's Slack channel |
| Nothing sent while waiting | yes | yes |
| Approved | 17:17:31Z | 17:24:16Z |
| Delivered | 17:17:31Z, carrier says delivered | 17:24:17Z, carrier says delivered |
| Same words as the held reply | yes matching content fingerprint | yes per the driver's check (no fingerprint file kept) |
| Building restored | identical snapshot before and after | identical snapshot before and after |
At The Willows, Maintenance and then Renewals were set to Supervised. Each was tried with both call choices and then cleared. After each change, the same checks the app uses were read back. The building ended byte-identical to how it started.
| Step | Maintenance calls | Renewal call transfer | Unapproved text refused |
|---|---|---|---|
| Baseline | Clara answers | available | Collections only |
| Maintenance Supervised, Everything | to the team | available | Maintenance, Collections |
| Maintenance Supervised, Messages only | Clara answers | available | Maintenance, Collections |
| Renewals Supervised, Everything | Clara answers | not available | Renewals, Collections |
| Renewals Supervised, Messages only | Clara answers | available | Renewals, Collections |
| Cleared (after) | Clara answers | available | Collections only |
| Effective Collections state | Buildings* |
|---|---|
| Live | 0 |
| Supervised | 77 |
| Off | 158 |
* Includes one row for each company that has no buildings.
| Date | Ruling | By |
|---|---|---|
| 09-29 | Three settings per module; held drafts wait 24h; a newer draft replaces the older; only PropFlow turns on Live | Gera |
| 10-01 | Named "Supervised"; every module gets it | Gera |
| 10-01 | Calls choice inside Supervised: Messages only or Everything | Gera |
| 10-01 | Actions (tour booking, AppFolio writes) happen right away; only the message waits | Gera (Leasing); driver applied it to Renewals |
| 10-01 | A message a staff member started is not re-approved | Driver |
| 10-01 | Held renewal offer and reminder texts do not expire | Driver |
| 10-01 | Collections Live sends without approval; nobody on Live, only Supervised; Off by default | Gera |
| 10-02 | Approved tour texts still send after the team takes over a thread | Gera |
| 10-02 | An approved email goes to the address the reviewer saw | Driver |
| 10-02 | Balance questions are not Collections; Clara answers them in every mode | Gera |
End-to-end: Twilio message records for the test legs (status only), the held-message rows in propflow-prod, the approve call's response, and a content fingerprint compared between the hold and the sent conversation message. Settings checks: building module writes through the same writer the admin screens use, each followed by a read-only script calling the app's own module resolver, voice-call setup and text-door decision; before and after snapshots of the building's four module rows. Collections count: each company's Collections setting folded with each building's own, read-only. Phone numbers, message words, resident names and conversation ids are left out.