#商业计划书 · 提交版（英文）
内部说明（本段不提交）：正文即上传件，导出 PDF 前删除本段与各段首的
> 内部引注。 数字唯一来源 = internal/01 事实主表；空位写法[TO FILL — requirement: … — evidence: … — owner: …]，未清零不得递交。 段落序按官方四项评审标准排：§1/§9 团队 · §2/§4 研发内容 · §4/§7 创新性 · §5/§6/§8 商业营运可行性。
#1. Applicant identity, proposed entity and Hong Kong commitment
Applicant: a team applying under the team route of SPIN@HSITP.
Team members — [TO FILL — requirement: full name, role in the research topic (runtime engineering / evaluation & benchmark / data layer / compliance), and one line of verifiable evidence per person (degree, Hong Kong residence and work entitlement, a link to code, publication or shipped product); at least 2 members, each with a distinct R&D role, so that the ≥2 full-time employees required by IGNITE@HSITP next year are already identified — evidence: signed CV of one page per member plus ID copy — owner: 用户（主申请人）]
Entity plan. Upon admission, and within two weeks of the admission date, the team will incorporate in Hong Kong a private limited company under the Companies Ordinance (Cap. 622), provisionally named Agentx Limited [TO FILL — requirement: confirm the proposed company name and the incorporation agent, and confirm the shareholding structure as founders holding at least 51% of the issued shares legally and beneficially and directly (no nominee arrangements, no intermediate holding vehicle), because IGNITE@HSITP requires exactly that and shareholding fixed at incorporation is hard to unwind later — evidence: CI + BR + NNC1 after incorporation; a one-page cap table before submission — owner: 用户].
Research and administration conducted in Hong Kong. [TO FILL — requirement: one verifiable paragraph stating where the people sit, where decisions are recorded, and where the books are kept — company address in Hong Kong, board/decision records, accounting and payroll location, and where the engineers commit code — evidence: the stated arrangement plus, after admission, the tenancy/seat booking at HKSTP-iSERD / iLabs space in the park and the payroll records — owner: 用户] Cloud infrastructure used by the existing platform is hosted outside Hong Kong; that is a deployment location, not the location of the work. The due-diligence question is where the people, decisions and accounts are, and §1 answers it explicitly rather than leaving it to be discovered.
Programme and request. SPIN@HSITP, one-year incubation, cash grant of up to HK$150,000, disbursed in two equal instalments of HK$75,000 subject to the six-monthly milestone reviews, applied for under the technology domain Artificial Intelligence and Data Science.
#2. Problem and research question
The operational problem. In Hong Kong student-housing operations, an AI assistant that only produces text is worthless: the duties that matter — viewing appointments, tenant enquiries across two jurisdictions, compliance checks on tenancy documents, arrears and renewal follow-ups — must either be done or be handed to a named human with the context intact. Today that closure is done by human butlers working shifts, including night cover, and the failure mode we can already measure is that an LLM with tools claims completion without the action having happened.
The research question. On a real multi-tenant operational data plane, how can an LLM be turned from a text generator into an accountable task executor? Concretely, four sub-questions:
- Who holds the authority to declare a task complete, when the model itself is not a reliable witness to its own actions?
- What must a system produce when a request falls outside the authorised boundary — silence, refusal, or an escalation obligation?
- How can a cross-tenant leakage guarantee be falsifiable, i.e. an assertion a third party can attack, rather than a policy statement on paper?
- How can all of the above be made reproducible by a second operator on a second machine?
The student-housing domain is the validation scenario, not the subject of the research. The subject is agent reliability, containment and reproducibility.
Core hypothesis. The bottleneck is architectural — where the completion-decision authority lives — not model capability. Therefore, without changing the base model and without fine-tuning, by restricting the model to proposing actions and giving the deterministic runtime the sole authority to decide done / waiting / failed / escalated, the four measures (actual completion rate, closure rate, false-promise rate, leakage count) can be moved into an acceptable range simultaneously. If this hypothesis is wrong, the project still produces its primary artefact: a frozen task set and an open benchmark that lets anyone test it.
#3. Prior work and current state (stated proactively)
What already exists (prior work — evidence of execution capability and of the data substrate; none of it is a deliverable of this project).
| Asset | What it is | Evidence grade |
|---|---|---|
| Production platform | The operating system used for our own portfolio: 456 API routes, 133 data models, 192 automated test files [TO FILL — requirement: the case count for the same run, only as reported by the D-7 vitest execution (files / cases / passed / skipped); it must not be quoted from an earlier date's run — evidence: vitest output log dated 2026-11-23 to 25 — owner: 代理] | B (re-runnable) |
| Engineering discipline | 12 repositories under one control plane, 12 gate families plus 11 cross-repo contract checks, 21 production liveness probes, and a single-source UI kernel compiled to three client targets with a machine-enforced equality check | B |
| u6buddy | The butler's AI subordinate — read-only over business data, a single AI write domain (viewing appointments), typed action contracts carrying preconditions, risk level and permitted phrasings, 100% human gate on money and contract actions, four autonomy modes, full audit trail | B |
| Measured baseline | Under "force the model to call tools", internal production measurement recorded 45% task attainment | B — recorded at u6buddy-architecture.md:198reference/domains/buddy/u6buddy-architecture.md |
What does not exist (disclosed without being asked).
- No company has been incorporated yet. We are applying as a team and will incorporate within two weeks of admission (§1).
- No external customers, no signed contracts with third parties, and revenue of HK$0. Our own portfolio is a related-party environment; we do not present it as customer traction.
- No full-time employees. SPIN@HSITP sets no headcount requirement; hiring two Hong Kong-based full-time R&D employees is planned inside this project period (M7–M12) precisely so that the next stage is reachable.
- A previous application, disclosed in full (§10). We applied to HKSTP Ideation on 2026-09-14; it was not approved in October 2026 and we received HK$0. We are therefore not a current incubatee of any programme, and this application is a different, reframed research project — see §10 for what changed.
- Tenant-isolation coverage is not yet quantified in this document. We have an existing cross-repo scoping gate, but the two candidate counts in our own records use different definitions (the full set of tenant-scoped tables versus the R2 export subset). Until we reconcile them by running the gate itself, we quote neither number rather than publish a figure we cannot defend. [TO FILL — requirement: run
npm run check:cross-repo-scopesat D-7, state the reconciled figure and the definition it belongs to, or leave this paragraph as an explicit "not stated" — evidence: gate output log — owner: 代理]
#4. Technical approach: five difficulties, five methods, five verifiable metrics
Each row is written as why a wrapper cannot do it → method → the metric that decides whether the method worked → artefact. This is the R&D protocol, not a feature list.
| # | Difficulty | Method | Verifiable metric (M12) | Artefact |
|---|---|---|---|---|
| D1 Completion-decision authority | An LLM substitutes a textual promise for an executed action; our own measurement put forced tool-calling attainment at 45%. | The model only proposes actions. A deterministic duty runtime — an SOP-to-duty compiler plus a state machine — alone decides done / waiting / failed / escalated; money and contract actions pass a 100% human gate. | Actual completion rate ≥70% (from the 45% baseline, same frozen task set, same methodology); human-gate coverage on money/contract actions 100% | Duty compiler + runtime + re-measurement report publishing sample size, task types, model version, tool permissions and raw logs |
| D2 Boundary and escalation semantics | General agent frameworks delegate "what must not be done" to the prompt, and prompts fail out of distribution. | Boundary decisions live in the typed action contract (preconditions, risk level, permitted phrasings). Out-of-scope content produces no AI action, only an escalation obligation. Escalation is a system action: named owner, deadline, full context summary handed to the human butler, who continues under the same service identity. | Closure rate (completed + legitimately escalated) ≥95%, with escalated items 100% taken over and ultimately resolved; unreasonable-escalation rate ≤5%; false-promise rate <0.5% | Layering contract v1 + silent-escalation orchestration v1 + escalation obligation records that are attributable in audit |
| D3 Falsifiable cross-tenant isolation | "We have tenant isolation" is a paper claim; the attack surface is prompt injection, tool over-privileging and context backfilling, and it drifts with every model version. | Three legs tested together: an adversarial probe suite; a masked-table coverage assertion sharing its source with our existing cross-repo scoping gate; and a falsification experiment — deliberately opening one leg must make the suite fail immediately, proving the suite is not decorative. | ≥50 adversarial probes with 0 leakage events; 100% coverage assertion on the reconciled table set (see §3); 2 falsification experiments reproducible on demand | Executable probe suite + coverage report + falsification records |
| D4 Service-persona continuity vs transparency | Making a tenant unable to tell human from AI is both a product goal and an ethics trap: blanket disclosure breaks the experience, blanket concealment breaches the PCPD guidance on openness. | Engineered, not rhetorical: permitted phrasings + a service-persona specification + an evidence gate on replies. On takeover a short handover note is retained (context complete, responsible party clearly switched). AI participation and data use are stated in the terms and at the first session. The AI never impersonates a specific person and never signs as the butler. | Every promise in an audited session is attributable to a specific subject (human or runtime); zero instances of impersonation or substitute signature; PDPO notice and consent-switch state demonstrable item by item | Persona specification + receipt and takeover records + PDPO/PCPD mapping note |
| D5 Reproducible evaluation | Published LLM "performance" claims are not reproducible: task sets are not frozen, scorers are not released, raw logs are withheld. | Frozen task set covering both in-scope and out-of-scope duties, released scorer and schema, 500 tasks × 3 baseline models, and a replication run by a second operator on a second machine. | Replication produces byte-identical results on the same inputs and scorer; benchmark released under Apache-2.0 while the commercial runtime, tenant data and operator-specific rule libraries stay proprietary | ChunYue-Agent-Bench: task set + scorer + methodology report + licence |
Interpretation of the hypothesis. None of D1–D5 is solved by swapping the model or by fine-tuning; all four mechanisms (content layering, silent escalation orchestration, persona consistency, continuous accountability) live inside the runtime framework. That is where the technical content of this project sits.
#5. Twelve-month milestones and acceptance criteria
Two evaluation points, each releasing HK$75,000. Every criterion below is binary — we do not report "partially achieved".
Phase A (M1–M6) — mid-term review artefacts
| ID | Milestone | Binary acceptance |
|---|---|---|
| A1 | Baseline re-measurement report | Given the frozen inputs and scripts, a second person reproduces the same number |
| A2 | Frozen task set v1 (≥120 tasks, in-scope and out-of-scope both represented, with schema and scorer) | Task set and scorer in the repository, executable, full run completed |
| A3 | Content-layering contract v1 (typed actions + preconditions + risk level + permitted phrasings) | Contract covers every action type in the pilot; spot-checked out-of-scope samples produce escalation obligations only, no actions |
| A4 | Silent-escalation orchestration v1 (named owner + deadline + takeover context summary) | End-to-end traceable escalation: obligation record → takeover → final resolution |
| A5 | Adversarial probe suite v0 (≥25 probes) | Suite executable and two falsification experiments turn it red on the spot |
| A6 | Pilot #1 live (may be a related-party operation), logging and PDPO notice in place | 30 consecutive days of real session logs in the database, sampleable on request |
Mid-term submission: artefacts A1–A6, a financial statement reflecting how the funds moved, and measured numbers only — no claimed achievement before measurement.
Phase B (M7–M12) — final review artefacts
| ID | Milestone | Binary acceptance |
|---|---|---|
| B1 | Metric family measured (§4 targets) | Each metric reported with value, sample size and raw-log location; unmet items reported as unmet with cause analysis |
| B2 | Probe suite v1 (≥50 probes, 0 leakage) + coverage assertion on the reconciled table set | Suite report + coverage report + falsification records archived |
| B3 | ChunYue-Agent-Bench released (500 tasks × 3 baseline models, Apache-2.0) | Publicly reachable repository, complete licence and README, replication instructions included |
| B4 | Replication experiment (second operator, second machine) | Byte-identical results; if not identical, reported as not achieved |
| B5 | ≥1 unrelated pilot paying (small amount acceptable) + first-response latency before/after | Contract or invoice plus logs; if not obtained, reported as not obtained with the live pipeline listed |
| B6 | IGNITE-readiness: 2 Hong Kong-based full-time R&D employees, cap table as in §1, park move-in plan | Employment contracts + cap table + move-in plan |
Latency metric, stated with its method. Target: −30% in first-response latency for routine requests, defined as the median minutes from request to first substantive action. Resolution time is reported separately and never merged into this figure; a claim requires at least 30 samples on each side of the comparison.
#6. Market, customers and commercial viability
Demand (external, official or published sources; two different counting bases are kept apart and never averaged or summed).
- Survey basis: 92,000 non-local students in 2024/25 (+25% year on year), with an additional 18,400 students identified — Knight Frank, Student Living Revisited, November 2025, p.5.
- Registration basis: 54,500 (2022/23) rising to 79,300 (2024/25) — Legislative Council paper CB(3)1279/2025(03), 5 September 2025.
- Policy: the non-local student quota moved from 20% to 40% (effective 2024/25); the self-financing ceiling moves from 40% to 50% from 2026/27 — policy gazette of 9 October 2025.
- Supply: under the City Polytechnic University Halls / commercial-building conversion programme announced in July 2025, as of 28 October 2026 there were 52 applications, 45 eligible (about 11,450 places), 4 projects already operating about 700 places, and a further 5 approvals of about 740 places due within a year — Development Bureau LC reply, 28 October 2026.
How we use the market numbers. We deliberately do not present a TAM. The customer pool above is a named call list for pilots, not a software market size. Our revenue arithmetic is bottom-up and labelled as planning assumptions: at an assumed HK$10–15 per bed per month, 1,000 beds is roughly HK$120,000–180,000 ARR; nothing in this application claims a market share.
Who pays and why. The buyer is the operator (a hall manager or a small portfolio owner), not the tenant. The purchase is service continuity across shift gaps and provable accountability, priced per bed or per property. Because the operator is the payer, our pilot design measures what the operator cares about: whether duties closed, whether escalations were caught, whether a promise in a chat log can be traced to an executed action.
Commercial evidence status, stated honestly. At the time of application we hold no signed pilot commitment [TO FILL — requirement: at least one written commitment whose elements are complete — named operator, which building and how many beds, which duty list, term, and either an amount or an explicit "paid pilot intention with amount"; a commitment from an unrelated third party is worth materially more than one from a related party — evidence: signed letter of intent or email thread as PDF (verbal interest does not count) — owner: 用户（约谈）]. The outreach list and the letter template are prepared; the signature itself is the user's action and is a blocking item for submission.
#7. Innovativeness and differentiation
Against published alternatives (classification-level only; no unverified user or funding figures; competitor pages re-checked and archived before submission).
| Name | Public positioning | Why it is a different problem |
|---|---|---|
| KeyChain | Hong Kong "AI rent collection agent"; AI-driven collection (99.6% on-time rate claimed by the company) plus a generative-AI property concierge; FCA-regulated payment institution, PCI DSS; partners include Swire, Hang Lung and The Landmark | It automates a money action. Our subject is who decides a task is complete and how containment is proven. Different layer, not a competing feature set. |
| uhomes.ai | Global student-housing platform with AI matching, covering Hong Kong | Optimises customer acquisition and matching; publishes no cross-tenant isolation test and no closure metric. |
| 港专租 / iRent | Local student-housing listing platforms | No AI execution surface claimed. |
The two axes on which we believe we can be independently checked.
- Completion-decision authority sits in the runtime, not the model. Most agent products treat model output as the record of what happened. We treat it as a proposal, and keep the decision, the gate and the receipt outside the model. This is measurable (D1) and does not improve or degrade with the choice of vendor model.
- A public, reproducible benchmark for contained task closure. We release the frozen task set, the scorer and the methodology under Apache-2.0 while keeping the runtime and tenant data proprietary. A third party can therefore falsify our claims — which is the only form of credibility available to a pre-revenue team.
Novelty claim, scoped. We do not claim a world first or a unique capability in general agent research. We claim: (a) a specific combination — typed action contracts carrying permitted phrasings, escalation obligations instead of refusals, adversarial isolation tests with a falsification leg — applied to a real multi-tenant operational data plane; and (b) that this combination is delivered as a falsifiable evaluation, which published operational agent products in our segment do not provide.
#8. Use of HK$150,000
| Line | HK$ | Bound to | Notes |
|---|---|---|---|
| R&D engineering hours (in Hong Kong) | 78,000 | A1–A5, B1–B4 | The runtime, orchestration and evaluation harness are all newly built |
| Model API and compute | 24,000 | A2, A5, B1, B3 | The 500-task × 3-model evaluation runs are the main compute cost; no fine-tuning budget |
| Evaluation corpus and annotation | 18,000 | A2, B3 | Frozen task set construction, external labelling, scorer test cases |
| Legal and PDPO advisory | 12,000 | A3, A6, B2 | Data-use notices, review of permitted phrasings, third-party confirmation of the "assistive check, not legal advice" boundary |
| Open-source benchmark and documentation | 10,000 | B3, B4 | Apache-2.0 harness, licence and third-party notices, replication guide, second-machine environment rental |
| Park move-in and review-panel travel | 8,000 | B6, interview | Commute to Shenzhen-Hong Kong Park, management-fee share, interview preparation |
| Total | 150,000 | Two equal instalments of 75,000 |
Self-consistency of the manpower line. HK$78,000 over 12 months is HK$6,500 a month: this is explicitly a partial subsidy of in-Hong-Kong engineering hours, not a claim of full-time salary, and we do not present HK$150,000 as funding two full-time staff. Full-time employment cost (milestone B6) is borne by the company from its own resources, separate from this grant.
#9. Team, IP and compliance
Team. [TO FILL — requirement: same roster as §1, expressed against the four assessment criteria — who writes the runtime, who builds the evaluation, who owns the data layer, who reviews compliance — evidence: CVs plus one verifiable artefact each (repository, publication, shipped feature) — owner: 用户]
Skills gap and how it is closed. [TO FILL — requirement: name the one capability the team genuinely lacks (for example academic-grade evaluation methodology, or PDPO-specific counsel) and state how it is procured — advisor, external labelling vendor, retained counsel — evidence: advisor confirmation email or engagement note — owner: 用户]
Intellectual property. The software copyright filing package for the underlying property management system (ChunYue PMS V1.0) is prepared. [TO FILL — requirement: if an acceptance notice has been issued, give its document number and date and attach the scan; if not issued, delete this sentence — we do not describe work as protected when it is only filed — evidence: acceptance notice scan — owner: 用户] All new layers produced by this project (duty runtime, contracts, probe suite, benchmark) accrue to the applicant entity. The benchmark, scorer and methodology are released under Apache-2.0; the commercial runtime, tenant data and operator-specific rule libraries remain proprietary.
Ethics and data compliance (red lines we hold ourselves to in this project).
- Compliance-difference outputs are labelled "assistive check, not legal advice", and the rule set is documented so that a reviewer can audit individual entries.
- PDPO assessment precedes any pilot data collection. Behavioural data already collected for marketing is not repurposed for credit or risk scoring in this project; any such new purpose would require the data subject's explicit consent under PDPO Data Protection Principle 3, and we do not reserve language implying it becomes automatic later.
- AI participation and data use are disclosed in the service terms and at the first in-app session.
- Money, contract and identity actions are completed only by a named human and leave a receipt.
- We do not claim that a tenant cannot tell whether the person they are talking to is human or AI, and we do not describe the service as unattended. The claim we make is narrower and testable: a single continuous butler service — the same register, the same accountable owner, takeovers carrying a short handover note with complete context.
#10. Disclosure of previous programme applications
- HKSTP Ideation: submitted 2026-09-14; not approved in October 2026; funds received HK$0. The reviewers' stated concerns were, in substance, insufficient technical content, unpersuasive business development potential, and the existence of similar AI assistants serving mainland students in rental housing.
- We are not currently an incubatee of any programme (HKSTP Ideation, Incubation, Acceleration, Elite; Cyberport CCMF or Cyberport Incubation), so there is no parallel-participation conflict with SPIN@HSITP.
- What is different in this application. The 2026 submission was a solution narrative — a platform plus an AI butler, described as four workstreams. This application is a single research topic with a stated hypothesis, a frozen task set, a metric family, an adversarial isolation test with a built-in falsification leg, and a public benchmark. Scope, structure (difficulty → method → verifiable metric → artefact), deliverable list and evaluation protocol were all rebuilt, and the commercial claims were reduced to what a pre-revenue team can actually stand behind. The item-by-item difference list is available for the interview panel.
- No identical resubmission. Consistent with the programme FAQ, this is not a re-typed copy of a previously submitted version.
#11. Evidence index (what the panel can ask to see in the room)
| Claim | Artefact |
|---|---|
| 45% baseline | u6buddy-architecture.md:198 entry plus the T-08 raw logs; re-measured at M1 with public methodology |
| Platform scale (456 / 133 / 192) | Generated inventories in u6docs/reference/generated/, re-run at D-7 |
| Read-only + single write domain + human gates | u6buddy architecture document and code, shown live |
| Cross-repo tenant scoping gate | npm run check:cross-repo-scopes output (and the reconciled coverage figure) |
| Reproducible benchmark | Repository URL after B3; replication logs after B4 |
| Pilot | Letter of intent / contract / invoice / 30-day session logs (A6, B5) |
#12. 繁體中文對照（內部核對件 · 不上傳 · 語義以英文正文為準 · 導出 PDF 前本節整段刪除）
本節逐節對應 §1–§11，含同一組空位要求；任何一節的數字、判據或口徑與英文正文不一致，以英文正文為準並立即修正本節。
§1 申請身份、擬設主體與在港承諾。 申請人＝以 SPIN@HSITP 團隊通道申請的團隊。成員＝【待填 · 要求：全名、在課題中的分工（運行時工程／評測與基準／數據層／合規），每人一條可驗證證據（學位、在港居留與工作權利、代碼或論文或已上線產品連結）；每位年滿 18（H1-8）；建議 ≥2 名且分工各不相同，使明年 IGNITE 的「≥2 名全職」已有人選 · 證據：每人一頁連署履歷＋證件副本 · 提供方：用戶（主申請人）】。主體安排＝獲錄取起兩週內，根據《公司條例》（第 622 章）在港註冊私人股份有限公司，暫定名 Agentx Limited；股權須按「創辦人法律上及實益上直接持有 ≥51% 已发行股份」落位，不代持、不設中間控股層（IGNITE 逐字要求，且註冊時定稿後極難回改）。【待填 · 證據：註冊後的 CI＋BR＋NNC1；遞交前的一頁股權表】。在港研發與行政＝【待填 · 要求：一段可核查的安排，寫明人在哪、決策記在哪、賬開在哪（公司地址、決策記錄、記賬與出糧地、工程師代碼提交地）· 證據：上述說明＋錄取後的園區工位／租約記錄與出糧記錄】。既有平台的雲端基礎設施在境外部署，那是部署位置不是工作位置；盡調查的是人、決策與賬目，本節主動答覆而非等對方來挖。計劃與金額＝SPIN@HSITP，一年期培育，現金補助最高 港幣 150,000 元，按每 6 個月裡程碑評估分兩期等額發放（各 75,000 元），技術領域選 人工智能與數據科學。
§2 問題與研究課題。 運營事實：在香港學生公寓運營裡，只會產文字的 AI 沒有價值——真正要緊的職務（看房預約、跨兩地的租客諮詢、租約文件合規核對、欠租與續租跟進）要嘛被完成，要嘛帶著完整上下文交到具名的真人手上。目前靠真人管家排班（含夜更）完成閉環；而我們已能測量的失敗形態是：帶工具的 LLM 會宣稱已完成，而動作根本沒有發生。研究問題：在真實多租戶營運數據面上，如何把 LLM 從文字生成器變成可問責的任務執行體？四個子問題：① 誰持有宣告任務完成的權限（模型本身不是自身動作的可靠證人）；② 請求超出授權邊界時系統必須產生什麼（沉默、拒絕，還是升級義務）；③ 跨租戶洩漏保證如何可證偽（第三者可攻擊的斷言，而非紙面政策）；④ 以上如何讓第二操作者在第二台機器復現。學生公寓是驗證場景不是課題本體；課題本體是代理系統的可靠性、約束與可復現性。核心假設：瓶頸在架構（完成判定權住在哪裡），不在模型能力 ⇒ 不換模型、不微調，把模型限為「只提議動作」、判定權獨歸確定性運行時，即可把四項度量（實際完成率／閉環率／虛假承諾率／洩漏數）同時推入可驗收區間。假設若錯，項目仍產出主要產出物：凍結任務集與公開基準，任何人都能據此檢驗。
§3 既有工作與現況（主動披露）。 已存在（prior work，只證執行力與數據底座，沒有一件是本課題的交付物）：① 生產平台＝自有物業在用的營運系統，456 條 API、133 個數據模型、192 個自動化測試檔【待填 · 要求：同批執行的用例數，只取遞交前複核批次的 vitest 輸出（檔案／用例／通過／跳過四值），不得引早先日期的讀數 · 證據：該批輸出日誌 · 提供方：代理】；② 工程紀律＝12 個倉同屬一個總控、12 道門禁族加 11 道跨倉契約檢查、21 條線上可達性探針，且單一真源編譯出三端 UI 內核並有機器強制的一致性核對；③ u6buddy＝管家的 AI 下屬：對業務資料唯讀、AI 寫域僅看房預約、類型化動作契約攜帶前置條件／風險等級／允許話術、錢與合同 100% 人工閘門、四檔自治、完整審計軌跡；④ 實測基線＝「強制模型呼叫工具」內部生產實測 45% 任務達成（記於 u6buddy-architecture.md:198）。尚不存在（不被問也主動寫）：未註冊公司（團隊申請，錄取起兩週內註冊）；無外部客戶、無第三方簽約、收入 HK$0（自有物業屬關係方環境，不作客戶進展呈報）；無全職員工（SPIN 未設人手門檻；本期 M7–M12 內安排 2 名在港全職研發，正是為了下一階段可及）；先前的申請全盤披露（§10）；租戶隔離覆蓋率本件不給數——我方記錄中兩個候補數採不同定義（租戶作用域表全集 ⇄ R2 導出子集），在跑入門禁本身對齊口徑之前，兩個數都不引用，以免寫出無法辯護的數字。
§4 技術路線：五個難點、五種方法、五組可驗證指標（每行＝為什麼套殼做不到 → 方法 → 判定方法是否有效的指標 → 產出物；這是研發協議，不是功能清單）。
- D1 完成判定權：LLM 用一句文字承諾代替一次真實呼叫（自測強制工具呼叫達成率 45%）⇒ 模型只提議；由確定性義務運行時（SOP→義務編譯器＋狀態機）獨占
完成／等待／失敗／升級裁決權；錢與合同 100% 真人閘門。指標：實際完成率 ≥70%（同凍結集、同方法學）、閘門覆蓋 100%。產出：編譯器＋運行時＋復測報告（公開樣本量／任務類型／模型版本／工具權限／原始日誌）。 - D2 邊界與升級語義：通用框架把「什麼不能做」交給提示詞，提示詞在分布外必然失效 ⇒ 邊界判定住在類型化動作契約；越界內容不產生 AI 動作，只產生升級義務；升級是系統動作——具名負責人＋期限＋完整上下文摘要交給真人管家，以同一服務身份接續。指標：閉環率 ≥95%（升級件 100% 被接管並最終解決）、不合理升級率 ≤5%、虛假承諾率 <0.5%。產出：分層契約 v1＋編排 v1＋可歸因的升級義務記錄。
- D3 可證偽的跨租戶隔離：「我們做了隔離」是紙面主張；攻擊面在提示注入、越權工具呼叫、上下文回填，且隨模型版本漂移 ⇒ 三條腿同測：對抗探針套件＋遮蔽表覆蓋斷言（與既有跨倉作用域門禁同源）＋反證實驗（故意放開一條腿，套件必須當場報紅，證明它不是擺設）。指標：≥50 探針、洩漏 0；對齊口徑後的覆蓋 100%；2 例可當場復現的反證。產出：可執行探針套件＋覆蓋報告＋反證記錄。
- D4 連續服務人格 ⇄ 透明度：讓租客分不出人與 AI，既是產品目標也是倫理陷阱；一刀切披露打斷體驗，一刀切隱瞞踩 PCPD 公開原則 ⇒ 工程化而非話術：允許話術＋服務人格規範＋回覆證據門；接管時保留一條簡短交接提示（上下文完整、責任主體切換清楚）；AI 參與與資料用途寫進服務條款與首次會話；AI 不冒充具體真人、不代管家署名。指標：審計會話中每條承諾可歸因到具體主體；冒充與代署名 0 件；PDPO 告知與開關狀態逐條可展示。產出：人格規範＋回執與接管記錄＋PDPO/PCPD 對照說明。
- D5 可復現評測：公開的 LLM「效果」主張不可復現（任務集不凍結、評分器不公開、原始日誌不釋出生）⇒ 凍結任務集（含清單內與越界兩類）＋公開評分器與 schema＋500 例 × 3 個基線模型＋第二操作者於第二台機器的復現實驗。指標：復現結果逐字節一致；基準以 Apache-2.0 釋出，商業運行時、租戶資料與運營方專屬規則庫保持專有。產出：ChunYue-Agent-Bench（任務集＋評分器＋方法學報告＋許可證）。 假設的解釋：D1–D5 沒有一條靠換模型或微調解決；四項機制（內容分層／靜默升級編排／人格一致／責任連續）全部住在運行時框架內——這就是本課題的技術含量所在。
§5 十二個月裡程碑與驗收判據。 兩個評估點各發放 HK$75,000；以下判據全部二元（達成／未達成，不報「部分達成」）。Phase A（M1–M6，期中）：A1 基線復測報告（第二人取凍結輸入與腳本跑出同一數）；A2 凍結任務集 v1（≥120 例，兩類齊備，附 schema 與評分器，入庫可執行全量跑通）；A3 內容分層契約 v1（覆蓋試點全部動作類型；抽檢越界樣本只生升級義務不生動作）；A4 靜默升級編排 v1（義務記錄→接管→最終解決端到端可追溯）；A5 對抗探針套件 v0（≥25，且 2 例反證當場報紅）；A6 試點 #1 上線（可為關係方自營），日誌與 PDPO 告知就緒（連續 30 天真實會話日誌入庫、可抽樣展示）。期中提交＝A1–A6 工件＋反映資金流轉的財務報表＋只報實測數（未測不宣稱達成）。Phase B（M7–M12，結項）：B1 指標族實測（每項給值＋樣本量＋日誌位置，未達項如實報未達並給原因）；B2 探針套件 v1（≥50、洩漏 0）＋對齊口徑後的覆蓋斷言；B3 ChunYue-Agent-Bench 公開發布（500 × 3，Apache-2.0，倉庫公開可達、許可證與 README 完整、含復現指引）；B4 復現實驗（第二人第二機，逐字節一致，否則報未達成）；B5 ≥1 家非關聯試點實付（金額可小）＋首響時延前後對比（合約或發票＋日誌；未取得如實報並附在談清單）；B6 IGNITE 準備（2 名在港全職研發、§1 股權落地、進駐計劃）。時延指標連方法一併寫明：目標常規請求首響時延 −30%，定義為「請求→首個實質動作」的中位分鐘數；解決時長另行報告、永不併入；前後各 ≥30 例方可宣稱。
§6 市場、客戶與商業可行性。 需求（外部公開來源，兩種統計口徑分開，不相加不相平均）：調查口徑＝2024/25 非本地學生 92,000 人（+25% YoY），另有 18,400 人（Knight Frank《Student Living Revisited》2025-11，p.5）；註冊口徑＝2022/23 的 54,500 升至 2024/25 的 79,300（立法會文件 CB(3)1279/2025(03)，2025-09-05）；政策＝非本地名額 20%→40%（2024/25 起），自資上限 40%→50%（2026/27 起，2025-10-09 公報）；供給＝2025-07「城大宿舍／商業樓宇轉換」計劃，截至 2026-10-28 共 52 宗申請、45 宗合資格（約 11,450 個名額）、4 項已營運（約 700 個名額），另有 5 宗獲批將於一年內提供約 740 個名額（發展局立法會答覆，2026-10-28）。用法：刻意不做 TAM 敘事；上述是試點外聯名單不是軟件市場規模。收入按由下而上並標為規劃假設：假設價 每床每月港幣 10–15 元，1,000 床約 年經常性收入 12 萬–18 萬元；本件不主張任何市佔率。誰付錢、為什麼付：買方是運營方（宿舍經理或小型物業持有人），不是租客；買的是排班空档的服務連續性與可證明的問責，按床或按物業計價。因為付錢的是運營方，試點設計量的是運營方在意的事：職務是否閉環、升級是否被接住、聊天記錄裡的一句承諾能否追溯到真實執行的動作。商業證據現況（如實）：遞交時我方未持有任何已簽署的試點承諾【待填 · 要求：≥1 份要素書面承諾——可指名運營方、哪棟物業與床位數、哪個職務清單、期限、金額或「付費試點意向＋金額」；非關聯第三方的承諾價值遠高於關係方 · 證據：簽署的意向書或電郵串 PDF（口頭興趣不作數）· 提供方：用戶（約談）】。外聯名單與承諾函模板已備；簽署本身是用戶的動作，且為遞交阻斷項。
§7 創新性與差異化。 與公開替代品比較（只到分類級，不用未核驗的用數與融資數，競品頁遞交前重查並存檔）：KeyChain＝香港「AI 收租代理」，自動化的是金錢動作（公司自稱準時率 99.6%）＋生成式物業客服，FCA 監管支付機構、PCI DSS，合作夥伴含太古、恒隆與 The Landmark ⇒ 與我們「誰判定任務完成、約束如何被證明」不同層，不是競爭功能集；uhomes.ai＝全球學生住宿平台配 AI 配對，優化獲客與配對，未公開跨租戶隔離測試與閉環指標；港專租／iRent＝本地學生住宿樓盤平台，未主張 AI 執行面。可被獨立檢驗的兩條軸：① 完成判定權在運行時不在模型（多數代理產品把模型輸出當成「已發生的記錄」；我們當成提議，判定、閘門與回執都在模型之外）——可測量（D1），且不隨供應商模型變好變壞；② 針對「受約束任務閉環」的公開可復現基準（任務集、評分器、方法學 Apache-2.0 釋出，運行時與租戶資料專有）——第三者據此可證偽我們的主張，這是零收入團隊唯一可行的可信度形式。主張範圍克制：不自稱全球第一或通用代理研究上的獨有能力。我們主張：(a) 一個特定組合——攜帶允許話術的類型化動作契約、以升級義務取代拒絕、附反證腿的對抗隔離測試——套在真實多租戶營運數據面上；(b) 該組合以可證偽的評測交付，而本分類内的公開營運型代理產品未提供此事。
§8 港幣 150,000 元用途。 在港研發工時 78,000（A1–A5、B1–B4，運行時／編排／評測 harness 全部新造）｜模型 API 與算力 24,000（A2、A5、B1、B3；500 × 3 評測跑批為主要算力開銷，不設微調預算）｜評測語料與標註 18,000（A2、B3）｜法務與 PDPO 顧問 12,000（A3、A6、B2；資料用途告知、允許話術審閱、「輔助檢查非法律意見」紅線的第三方確認）｜開源基準與文檔 10,000（B3、B4；Apache-2.0 harness、許可證與第三方聲明、復現指引、第二機環境租用）｜園區進駐與評審差旅 8,000（B6、面談）⇒ 合計 150,000，兩期各 75,000。人力行自洽說明：78,000 ÷ 12 = 每月 6,500，明確是在港工程工時的部分補貼，不是全職薪資主張；我方不寫「15 萬養 2 名全職」，全職成本（B6）由公司以自有資源承擔、與本補助分列。
§9 團隊、智財與合規。 團隊＝【待填 · 要求：與 §1 同一份名冊，並對照四項評審標準寫出誰寫運行時、誰建評測、誰負責數據層、誰審合規 · 證據：CV ＋ 每人一件可驗證產出（倉庫、論文、已上線功能）· 提供方：用戶】。技能缺口＝【待填 · 要求：點名團隊確實缺少的一項能力（例如學術級評測方法學，或 PDPO 專門法律意見）並寫明如何取得（顧問、外包標註商、聘用律師）· 證據：顧問確認電郵或委任意向 · 提供方：用戶】。智財＝底層物業管理系統（ChunYue PMS V1.0）軟著材料包已備【待填 · 要求：若已獲受理通知書，給文件編號與日期並附掃描；未獲則刪除此句——僅「已申請」不得寫成「已受保護」 · 證據：受理通知書掃描 · 提供方：用戶】；本課題新造各層（義務運行時、契約、探針套件、基準）歸申請主體；基準、評分器與方法學以 Apache-2.0 釋出，商業運行時、租戶資料與運營方專屬規則庫保持專有。倫理與資料合規紅線：合規差異輸出標「輔助檢查，非法律意見」且規則庫文件化供逐條稽核；任何試點資料採集前先做 PDPO 評估；既有的營銷行為資料不在本課題轉用於信用或風險評分，任何新用途需按 PDPO 第 3 原則取得資料當事人明示同意，且我們不預留「以後自然能做」的表述；AI 參與與資料用途寫進服務條款與首次會話；錢、合同與身分類動作只由具名真人完成並留回執；不主張租客分不出對方是人或 AI、不把服務描述成無人值守；我們的主張更窄且可測：統一的連續服務——同樣的談吐、同樣的責任主體、接管帶一條簡短交接提示且上下文完整。
§10 先前計劃申請的披露。 HKSTP Ideation：2026-09-14 遞交，2026-10 未獲批准，收款 HK$0；評審實質關切為技術含量不足、商業發展潛力欠說服力，以及「已有類似 AI 管家服務內地生租房」。我方現時不是任何計劃的培育公司（HKSTP Ideation／Incubation／Acceleration／Elite；數碼港 CCMF 或數碼港培育計劃）⇒ 與 SPIN@HSITP 無并行衝突。本件有何不同：2026 年那版是「方案敘事」——平台加 AI 管家，寫成四條工作線；本件是單一研究課題，有明示假設、凍結任務集、指標族、附反證腿的對抗隔離測試與公開基準；範圍、結構（難點→方法→可驗證指標→產出物）、交付清單與評測協議全部重做，商業主張收斂到零收入團隊真正能負責的幅度。逐條差異清單可在面談時指認。不是原樣重遞：與計劃 FAQ 一致，本件並非先前提交版本的重新打字。
§11 證據索引（面談現場可要求展示之物）：45% 基線＝u6buddy-architecture.md:198 條目＋T-08 原始日誌，M1 以公開方法學復測；平台規模（456／133／192）＝u6docs/reference/generated/ 生成物，遞交前重跑；唯讀＋單一寫域＋人工閘門＝u6buddy 架構文件與程式碼，可當場演示；跨倉租戶作用域門禁＝npm run check:cross-repo-scopes 輸出（與對齊後的覆蓋數）；可復現基準＝B3 後的倉庫 URL、B4 後的復現日誌；試點＝意向書／合約／發票／30 天會話日誌（A6、B5）。
本節空位總表（與英文正文逐條對應，不得有一處只在中英任一侧存在）：§1 名冊（含年滿 18 核對）／公司名與註冊代理／股權表／在港安排；§3 同批用例數；§3 遮蔽表對齊口徑；§6 試點書面承諾；§9 名冊與技能缺口／軟著受理回執。