Overview

OneSai Hospitality manages a multi-property hotel portfolio across several major brands and needed daily operations oversight that didn't depend on a human reading every general manager report by hand. I'm building this as a portfolio of specialized AI agents, and took ownership of the entire stack: architecture, self-hosted infrastructure, security, and deployment pipeline, not just the automation logic. The first agent is live in production: it reads every incoming GM report and financial email overnight, verifies the numbers, flags exceptions, and hands ownership a finished morning briefing before their day starts.

What the Agent Does

Every morning, the agent:

• Ingests overnight reports: pulls emails from a dedicated operations inbox, pulling out PDF, Excel, and ZIP attachments as well as body-only narrative reports.
• Extracts across formats: branches by file type (PDF via pdfplumber, Excel via openpyxl/pandas, Word via mammoth, plain-text email bodies) into one normalized structure.
• Classifies and routes per property: deduplicates by content hash, then uses an LLM classification step to attribute every file to the correct hotel.
• Runs deterministic audit checks: verifies occupancy math, ADR/RevPAR calculations, and flags every cash adjustment or comp room against a strict two-folio policy, before any AI summarization touches the numbers.
• Writes the narrative briefing: an AI writer agent drafts the human-readable summary only after the deterministic audit has already produced the hard numbers, so figures in the briefing are computed, never generated.
• Delivers and tracks: renders the briefing to HTML, emails it out, and logs the run so every morning's output is auditable against what was actually received.

Infrastructure I Own

This isn't a script running on someone else's platform. I designed and operate the infrastructure it runs on:

• Self-hosted orchestration on a Hetzner VPS, running the workflow engine that executes and schedules every agent.
• Reverse Cloudflare Tunnel in front of it, with Cloudflare Access gating every request: no exposed ports, token-based API access, and full audit logging of who touched what.
• Separate dev and prod environments, with schedules disabled in dev so testing never triggers a real morning briefing.
• Git as the single source of truth for every script, flow, and resource definition. Nothing is hand-edited in the production UI.
• CI/CD via GitHub Actions: pushes to the dev branch deploy manually for testing; merges to main authenticate through the same Cloudflare Access tunnel and auto-deploy straight to production.

Why It's Built This Way

Two decisions mattered most: Deterministic math, AI narrative, never the reverse. Occupancy, ADR, RevPAR, and every dollar adjustment are computed by plain code before any LLM sees them. The AI's job is to write the summary and explain what happened, not to compute what happened. This is the difference between a report you can hand to an accountant and a report that merely sounds plausible. Test phase before autonomy. The agent currently drafts every briefing and recommended response but doesn't contact GMs or vendors directly. The owner reviews and approves during the initial rollout window before automation is extended. That staged rollout was a deliberate part of the design, not a limitation.

Outcome

Agent 1 is live and producing daily briefings in production. It's the first of a larger, multi-agent roadmap covering revenue, compliance, procurement, and guest communication for the same portfolio, each one landing on the same self-hosted, audited infrastructure rather than a pile of disconnected point tools. This project reflects full end-to-end ownership: architecture, backend automation, AI system design, and the DevOps and security layer underneath it, not just "the AI part."