Eight surfaces, one honest spine
AnKampung is a community operating platform already running in its first real community pilot. Here is every surface and module, honestly tagged: what runs on live devices today, what is frozen as a tested contract, and what is still forming — plus the identity model that lets one person belong to many homes.
The platform, surface by surface
Live in pilot means running on real devices for the first community; spec & tests means a frozen event contract with contract tests in the server; in formation means designed and honestly not shipped.
The resident app
One login for every home you belong to. Malaysian owners hold a bungalow, a city condo and a family house upcountry at once — the hub-and-spoke identity carries a different role on each, and a switcher moves you between community, unit and hat without ever merging two communities' data.
The offline gatehouse
The guard verifies visitor QR and OTP passes at the gate. When the network drops, it keeps working on its local copy and says so in plain words — 'changes will not reach the spine' — then reconciles the access ledger on reconnect without losing or duplicating a single fact.
The committee console
Announcements that record acknowledgment rather than mere delivery, community polls, circulars and approvals. One hard line by design: Malaysian strata e-voting is not yet legally valid, so statutory AGM/EGM votes stay separate from app polls.
The money office
Maintenance fees, the sinking fund at its statutory rate, arrears tracking and numbered receipts — shaped around the Strata Management Act 2013 (Act 757), billed in ringgit, paid through regulated FPX / DuitNow rails. AnKampung never holds custodial funds; every payment has an audit trail.
The maintenance spine
Every work order walks a legal state machine — Raised → Acknowledged → Assigned → In progress → Closed — with priority, common-property flags and acknowledgment SLAs. The engine rejects illegal transitions and quarantines them; it repairs nothing silently and invents nothing at all.
Facilities & bookings
Function rooms, courts and halls booked against real availability, with deposits settled through the same finance ledger rather than a separate cash note — so the money a booking touches is the money the committee can already audit.
The Community Digital Twin
The one honest read-model every surface reads from. It is disposable and rebuildable from the append-only event log, hash-checkable against it, and has never invented a fact in its life — what the board shows is exactly what the ledger proves.
The multi-tenant spine
Every table carries a tenant id enforced by Postgres row-level security; editions and entitlements are a config layer, not a fork. The pilot community is tenant #1 of a platform — onboarding community #2 changes no schema. That is the whole architecture brief in one sentence.
One person, many homes
Multi-property ownership is the core model, not an edge case. A single identity fans out to every community you belong to — each a separate tenant — with its own unit and role.
One Person
a single global identity
Many Communities
each its own tenant, never merged
Many Units
the homes you actually hold
A Role on each
owner · tenant · committee · guard
visitors, bills, bookings, notices
governance, polls, circulars
billing, arrears, work orders
the gatehouse, online or off
Six small tools, one ledger
The WhatsApp-group jobs — hazard reports, borrowing, rotas, time-swaps, gardens and the school van — as real modules on the same event spine. Designed, honestly tagged in formation, and switched on a community at a time.
AnWarn — hazard reports
A blocked drain, a live wire, a dark lamp post — photographed and posted from the walk to the gate. Reports walk the same legal state machine as work orders, so nothing quietly closes; verified hotspots become the community's own risk map, and only banded, consented counts ever leave it.
AnPinjam — the lending shelf
The drill, the ladder, the camping mat — catalogued once, borrowed and returned on the same append-only log. Trust is a per-person history inside one community; it never joins across tenants, because your record in PJS 8 is nobody's business in Ipoh.
AnRot — the event rota
Kenduri shifts, gotong-royong weekends, the raya open-house roster. Volunteers sign up, the rota holds, and a shift nobody covered stays honestly grey on the committee's view — the platform never marks a roster green it cannot prove.
AnMasa — time banking
An hour of maths tuition traded for an hour of plumbing, hour-for-hour on a ledger the committee itself caps. Deliberately not money: balances are bounded, non-transferable and transparent, so a neighbourhood system never trips into e-money territory by accident.
AnKebun — urban farming
Shared plots and raised beds booked through the facilities ledger, harvests logged, surplus listed — and what a garden cannot eat flows straight onto the AnKedai surplus board instead of into a bin. The produce trail uses the same events as everything else.
AnBas — family pings
The school van and the community bus, tracked by driver check-ins as the signal — no hardware sold to a family. Parents get an honest 'five minutes out' or a plain 'no signal yet', the same refusal AnOmbak applies to grey roads: never invent the vehicle's position.
Designed for many, piloted on one
A platform, not a one-off
The first community is tenant #1, not the product. Row-level security and a tenant id on every table mean the second enclave is a config change, never a fork or a schema migration.
One real community, first
Depth before breadth: the pilot runs the resident app and gatehouse on live devices so the event contract is proven against reality before the platform is opened to many — the same design-many, pilot-few discipline across the Antrex family.
The honesty holds at the edge
Offline, illegal state, a re-delivered payment, a strata vote that isn't legally valid yet — each is met by refusing to fabricate, not by smoothing it over. The platform's value is that a committee can trust exactly what it shows.
The surfaces above are the operating system of a community. The intelligence layered on top — kept strictly optional and never load-bearing — lives on the frontier page.
See the intelligence, kept honest→Ready to build something intelligent?
Let's engineer your next product — from idea to launch.