The weekend plan is blocked: Alexa names all 4 broken house rules while the house replays the plan.
The live demo: a 3D twin of the house beside a simulated Echo Show and Alexa's chat.
With the 4 fixes every rule holds and the garage stays above 4 °C. The house compares both runs.
Can't confirm: the dishwasher latch battery is at 4%, so Shadow Home won't call the plan safe.
A house rule in plain words: read back exactly, with its clash against an existing rule and which one comes first.
One yes runs the safe version. Undo puts back exactly what changed.
House only: orbit, zoom and pan the 3D twin while Alexa's chat stays docked in the corner.

Inspiration

Alexa+ doesn't just switch one light on. It makes plans with many steps: "I'm away for the weekend" turns into heating down, lights off, doors locked and devices off, all at once. Research we cite (DESPITE) found even the best AI planner produces a dangerous plan 28.3% of the time. Nobody checks those plans before they reach real devices, and a frozen garage pipe or a coffee maker running in an empty house is a bad way to find out.

What it does

Shadow Home is an MCP server Alexa calls before she changes anything.

Alexa drafts a plan and sends it to preview_plan.
Shadow Home runs it forward three days on a digital twin of the home: its devices, rooms, routines, who is home, and the weather forecast, three times (expected, colder, warmer).
It checks the family's own house rules ("Never turn off the garage freezer" is Om's rule; "Keep the aquarium heater on" is Maya's).
It answers SAFE, UNSAFE or UNPROVEN, names every broken rule with what causes it and when, and offers a fixed plan.
Nothing reaches the real devices until a signed, checked plan is committed. "Undo" puts back exactly what changed.

Example: "I'm away for the weekend, set the house to away." Shadow Home finds that the Coffee at 7 routine would turn the coffee maker on Saturday at 7 AM with nobody home, and that with the garage heater off the garage drops below 4 °C on Saturday night, so the pipes could freeze. Alexa says so, rule by rule, and offers the fixes: pause Coffee at 7 until you're back, and hold the garage at 5 °C. One "yes" runs the safe version.

Three answers, never a guess. UNPROVEN means it can't confirm: a sensor is low on battery, or the plan sets away mode without saying who is away, so Alexa asks "Who's away, and until when?" before anything can run. Families add rules in plain words ("Never unlock the front door between 10 PM and 6 AM unless I'm home"), and three different models must agree on what a rule means before it is kept.

How we built it

MCP server (TypeScript, MCP SDK v2, Streamable HTTP): 7 tools (preview_plan, commit_plan, undo, get_home_state, get_activity_log, add_house_rule, approve_plan), output schemas, read-only annotations, signed plan IDs and an MCP App view for the Echo Show screen. It serves the protocol version Alexa+ sends (2025-03-26) and newer ones.
Deterministic engine: pure TypeScript with no network, no clock and no randomness, so the same plan always gets the same verdict. No LLM anywhere in the check path; models only draft plans, compile rules and talk.
ShadowBench: 120 hand-labelled plans. Shadow Home matches 120 of 120, catches 60 of 60 unsafe and invalid plans, blocks 0 of 40 safe ones, and answers in 5 ms at p50 and 50 ms at p99.
A simulated Echo Show (Next.js 15.5) as the MCP client, because the Alexa+ add-on toolkit isn't open to entrants. Claude Haiku 5.5 drafts plans and talks; answers stream as they're written, with live steps. The verdict and every broken rule are always the engine's words. ElevenLabs speaks each sentence as soon as it's ready and transcribes the mic button; hands-free mode wakes on "Alexa".
A 3D twin of the house (three.js, React Three Fiber, CC0 Poly Haven assets) that replays the engine's own run: the plan acts out step by step, a timeline marks where rules break, rooms cool and warm, and the household walks out and back in. You can orbit, zoom and pan it.
Deployed on Google Cloud Run with Firestore, on our own domain. The AWS path (Lambda, DynamoDB, CDK, Bedrock, Polly) is built and tested on DynamoDB Local.

Challenges we ran into

The Alexa+ MCP toolkit and web simulator are limited to select partners, so we built our own Alexa-like host as the MCP client.
Keeping an AI honest about safety: the engine states the verdict and every broken rule itself, and the model only explains.
A live test showed the model could set away mode without saying who was away, so the twin assumed everyone stayed home. We made that deterministic: no presence, no verdict, just "Who's away, and until when?".
Turning the coffee maker off isn't enough, because the routine turns it back on. Only simulating forward in time catches that.
Making the 3D simulation smooth on a Retina laptop (10 to 35 frames a second) while still passing on CI's software renderer.

Accomplishments that we're proud of

120 of 120 on ShadowBench, zero false blocks, verdicts in milliseconds.
A safety check that can't be talked into a different answer.
A live end-to-end experience: talk to Alexa, watch the plan play forward in a 3D house, accept the fixes, undo.

What we learned

The safest place for an LLM in a home is beside the safety check, not inside it. Deterministic checks, plain-language rules from the family, and an assistant that explains them make a system people can trust.

What's next for Shadow Home

Run as a real Alexa+ add-on once the toolkit opens.
A per-call preflight hook for add-ons (like the draft MCP proposal SEP-1862), so every home action can be checked.
One twin per visitor on the public demo, more device types, and real sensor data through Home Assistant.