Sending a command is not the same as changing the world.
Almost every automation product reports its own intentions back to you as fact. Ours closes the loop.
Relay feedback, circuit current, contact state, temperature, humidity, occupancy and equipment status.
Current measurement is useful but it is not the same as knowing what a device is doing. LED leakage, standby draw, fan capacitors and mixed circuits all need explicit calibration before a reading becomes a claim. We would rather report unknown than report wrong.
Each reading is located against a model of the property: areas, equipment, endpoints, capabilities, occupants, time, established preferences, and how confident we are in each.
This model is what lets the system answer why something happened rather than only what changed.
Every action, whatever proposed it, passes through a single broker. It checks the device and capability, the severity of the action, who is asking and with what scope, whether the device is reachable, how fresh the state is, rate limits, whether a human must approve, and whether the action is prohibited outright.
There is no second path. An agent, an app, a schedule and a wall switch all arrive at the same gate.
A bounded command goes out over authenticated local transport. The system then waits for measured or explicitly inferred state, compares it against the intent, and exposes the difference honestly.
The whole chain — proposal, decision, command, outcome — is written into a history that can be reconstructed later. If the house did something you did not expect, you can find out why.
State
Never collapsed into one. This is the foundation the rest of the system rests on.
The model can suggest anything and authorise nothing.
Read approved state with its provenance. Explain why the property behaved a certain way. Identify uncertainty, faults and unusual patterns. Recommend schedules and efficiency changes. Propose reversible actions within policy. Request human approval for consequential ones.
Direct access to radios or device firmware. Changing its own permission level. Modifying the prohibited-action list. Approving its own consequential request. Claiming success before state confirms it. Turning inferred state into measured fact. Making the building depend on model uptime.
Each of these is a code path that does not exist, not a policy we intend to follow.
The current protocol runs application-layer authenticated encryption over IEEE 802.15.4 at 2.4 GHz, with per-device root keys, session keys, frame counters and replay protection. It exists because commissioning and diagnostics are easier when you own the layer.
That is a reason, not a moat. The advantage is the broker, the state model and the governance above it — none of which care which radio carries the bytes. So the protocol sits behind an abstraction and stays replaceable, and the choice between it and Thread gets settled by measurement in real properties: reliability behind masonry back boxes, coexistence with Wi-Fi, battery life, latency under simultaneous scenes, certification cost, long-term component availability.