The demo works. Someone still has to make it survive Monday.

Reads the contractor’s own job history and pricebook, then drafts a priced quote into their job-management system within minutes of a lead landing. A human reviews and sends every one.

Runs on a five-minute cron against the live system of record, so the hard problem is not generation — it is never double-quoting a job. The completion marker can be stripped by an ordinary edit in the vendor UI, so idempotency is held in a separate state database rather than inferred from the record itself. Re-running the full pass skips every job it has already seen. A guardrail clamps labour estimates against the pricebook, and the whole thing stops dead on a single file touch.

Turns a private document store into an assistant that answers with citations — and shows each person only the material they are cleared to see.

Scope is enforced server-side at the retrieval layer, not asked for in a prompt, so a determined question cannot talk its way past it. I verified it by trying to break it: queries aimed at out-of-scope material return zero sources rather than a refusal message, which is the difference between a filter and a guardrail. Provisioning a new tenant — access policy, scoped service, DNS, proxy — is one command.

Instead of returning a wall of text, the assistant returns working interface — project cards, comparison tables, a mortgage calculator the buyer can drag.

The model never emits UI. A deterministic TypeScript composer builds the component tree, which means the expensive part happens once and every subsequent interaction is free. Dragging the mortgage term from 25 years to 10 recomputes the repayment with zero calls back to the model. That property is what makes agent-grade surfaces affordable to put on a page that gets real traffic.

Overflow calls are answered, transcribed, qualified, and written onto the right job — plus a one-time link that pulls the customer’s photos and plans straight onto that job.

Most of the work here was diagnosis, not generation. The intake was silently locked to a single phone extension, so calls answered by anyone else never became jobs at all — that was found by reading the data, not the code. The upload path sniffs file types from magic bytes instead of trusting the browser, because customers send HEIC from an iPhone and CAD plans from a builder. Outbound SMS is a polled outbox relayed through the PBX, because the carrier only accepts sends from that host. A prompt change was validated in memory against fifteen real recorded calls before it went anywhere near production.

A grounded answer agent, a cost-audit agent reading live billing data, and a policy check — deployed to Google’s managed Agent Engine and registered into the enterprise search app.

The guardrails are code callbacks, not instructions. A save is refused until a search has actually run; anything that looks like outbound is refused until the policy preflight has run. That distinction matters because a prompt-level rule degrades quietly under pressure and a callback does not — it either ran or it did not, and you can see which in the trace.

An API an AI agent can pay for by itself — it receives a price, settles on-chain, and the call is metered and billed. Listed in a public agent directory.

The interesting part is reconciliation. An agent paid 0.25 RLUSD on-chain and the metering system billed $0.25 — matched to the cent, which is the whole question anyone sensible asks about machine payments. Built and proved as rails, not as a business: the buying wallet was mine, so this demonstrates that settlement and metering agree, and nothing about demand.