My Quantitative Trading Bot Runs the Lights Now

The Market Was Closed, So I Gave the Bot Another Job

The first smoke test was not subtle. I opened Telegram and asked Quantance, my quantitative trading bot, to turn every light in the house red.

It did.

The same process whose prompt begins with "You are Quantance, a quantitative trading analyst" was suddenly running the living room. This sounds like an identity crisis, but it was the cleanest way to add home control. I already talk to Quantance in Telegram. The market is closed more hours than it is open. Home control is a capability I occasionally need, not a relationship that deserves another bot and another conversation.

The stunt was fun. The lasting value is much less theatrical: asking how warm it is upstairs and turning the lights off from bed. Home Assistant already did the real work; I just put it in the interface where I was already typing.

The Integration Really Is Three Values

My agent framework has a native homeassistant toolset for entity state, service calls, and automations. Enabling it for Quantance took about twenty minutes and three configuration changes:

1. Add "homeassistant" to the enabled toolsets.
2. Set HASS_URL. I use Home Assistant's stable Tailscale address rather than homeassistant.local. My phone and server often sit on different subnets, where mDNS is not useful.
3. Provide HASS_TOKEN via an encrypted environment file. Home Assistant → Profile → Security → Long-Lived Access Tokens.

The Home Assistant token has its own encrypted environment file, separate from the Telegram token, so I can rotate either credential independently. Until both Home Assistant values are present, the toolset reports itself as disabled. A missing secret therefore looks like an unavailable capability rather than a failure halfway through a conversation.

That is the whole happy path. If Home Assistant already exists, adding a conversational front end is almost disappointingly easy.

A Small Job With a Large Credential

Quantance receives an explicit set of toolsets:

enabledToolsets = [
  "homeassistant"
  "terminal"
  "file"
  "memory"
  "todo"
  "skills"
  "cronjob"
  "session_search"
  "clarify"
];

A toolset absent from that list is not hidden by a prompt. It is not wired into the process at all. That is useful, but it is not the narrow security boundary the list initially appears to be.

terminal is on the list, and a shell is not a narrow capability. More importantly, a Long-Lived Access Token acts with the permissions of its Home Assistant user; the token is not independently limited to the task I created it for. In my setup, that gives the bot far more authority than the few sensor reads and light changes I actually use.

The integration is technically complete and the authority model is not. Those are different claims, and this is where most "I connected an LLM to my house" demos stop too early.

Two Prompt Rules Make It Behave Better

Within the small set of things I currently ask it to do, two rules matter.

Never fabricate state. Query Home Assistant first, answer with real entity data. If the API call fails, say so. Never guess what a sensor or switch is doing.

"How warm is it upstairs?" has a plausible answer whether or not the model calls a tool. Plausible is useless here. A number only means something if it came from the sensor, so an API failure must remain an API failure.

Act, don't narrate. Do not say that you will check or change something. Call the tool, then report what happened.

This removes a surprisingly common failure mode: the model describes the right sequence so convincingly that it feels like the sequence occurred. Tool output, not a well-phrased intention, is the evidence.

These are behavioral rules, not security controls. A prompt can tell the model how I want it to use a credential; it cannot reduce what the credential permits.

The Missing Piece Is a Narrow Proxy

For my media bot, I solved this properly. A small proxy owns the Sonarr credential and exposes only the operations the bot needs. The model receives capabilities, not the secret that grants every capability.

Home Assistant is not there yet. The equivalent proxy would own the token and expose a deliberately boring vocabulary: read approved sensors, set approved lights, and adjust the thermostat within explicit bounds. Quantance could choose among those operations without gaining a general Home Assistant credential.

Until that exists, I am keeping the use equally boring. This is a convenient personal interface for lights, temperature, and sensor state—not a general claim that a prompt makes home automation safe.

The Interface Is the Actual Win

Home Assistant already had dashboards, automations, and voice control. I did not invent a new way to run a house. I removed the context switch between a question in my head and the system that could answer it.

That is enough to make the integration stick. Quantance still analyzes markets. It also turns off the lights when I am already in bed, because the market is closed and apparently the bot had room in its job description.

Header photo by Jakub Zerdzicki on Unsplash.