What is real

This is a prototype built for a hackathon. This page lists what is real, what is simulated, and what is not built. It is deliberately unflattering where that is the truth.

• Diagnosis engine

  Real

  Deterministic rules, fixed B1 to B6 precedence, evidence-carrying. No model involved.

• Mock government systems and fault injection

  Real

  Seven independently modelled, independently failing systems.

• Case create, read and event log

  Real

  Real append-only events. The log lives in server memory only, so it does not survive a restart or reach a second instance.

• AI or language model

  Not used

  No language model runs in this build and none is present in the code. There is no model library, no key is read, and no request leaves the app. Every sentence you see is a pre-authored string in a committed file.

• Languages

  Partly shipped

  The selector lists every language the official portal offers. English, Hindi, Marathi and Tamil are fully resolved; the rest are labelled as coming, and choosing one keeps the interface in English rather than showing you a half-translated screen. The Indic translations were written for this build and have not been reviewed by a native speaker, so where they differ from the English, the English is the wording we stand behind.

• Input checking on our own routes

  Hand-written

  Our own specification asks for a validation library at the boundary. Adding a dependency the day before submission was judged the larger risk, so inputs are checked by hand. Same coverage, less machinery.

• Mock endpoint isolation

  Weaker than specified

  A request from another website is refused. A request that sends no Origin header at all - curl, or another server - is served, because inside a single deployment there is no network boundary to enforce. There is a rate limit in the code and it works, but this host starts a fresh instance for almost every request, so the count rarely accumulates: measured on the live site, fourteen rapid requests all succeeded. It would hold on a single-instance deployment, or behind a shared counter this build does not have. What actually protects this is that every field it returns is invented.

• Aadhaar and identity checks

  Simulated

  No real identity system is contacted.

• Payment, bank, land record and tax systems

  Simulated

  Synthetic modules with deliberately inconsistent records and injectable faults.

• One-time code

  Simulated

  No message is sent to any phone. The demo code is shown on the screen that asks for it.

• The people

  Synthetic

  Eight invented people. Every identifier is structurally invalid as a real credential, so nothing here could be mistaken for or reused as real.

• Fix path progress

  Real, on your device

  Kept in this browser. It survives a reload and never leaves your phone.

• Offline queue and background sync

  Not built

  There is still no service worker and no replay queue, so nothing is re-sent for you after a disconnection. What does survive is more than it was: fix-path progress, a filed complaint and every action you complete are all written to this browser before any network attempt, so a lost connection cannot lose them and a second press cannot duplicate them.

• Complaint filing, deadline clocks, escalation

  Real, with one difference

  Filing is real, the deadline is real, and the escalation ladder is real: 15 days to your block officer, then the state officer, then the PM-KISAN Division, with the appeal opening at 30 days. The one difference from our specification is how escalation happens. It describes an hourly job that promotes overdue complaints; there is no such job here, so the same rows are worked out when the page is read. Because every row carries a fixed key, reading a hundred times builds the same list a scheduler would have, not a hundred rows.

• Case timeline

  Real

  Every line on the timeline is an event recorded when it happened, in the same list an officer auditing the case would read. Nothing on that screen is written for the screen.

• Read aloud

  Available

  Read aloud is available through your browser or device's built-in speech synthesis. Voice input through Bhashini is not enabled.

• Voice input

  Planned

  The microphone button is visible and disabled. It requests no permission and loads no speech library.

• Identity check by camera

  Real camera, simulated check

  The camera is real: a real browser permission prompt, your own video, real instructions to follow. The verification is simulated - no real Aadhaar system is contacted and the result comes from our mock records. The picture is drawn to a canvas in memory, checked, and discarded in the same step. It is never uploaded and never stored, and our own security policy sends connect-src 'self', so your browser would refuse an upload even if this page tried one. You can check that header in your browser's developer tools.

• Browser security headers

  Mostly set

  Content-Security-Policy, Referrer-Policy, Permissions-Policy, nosniff, frame-deny and HSTS are all sent. One gap, deliberately: our specification asks for a policy that forbids inline script, and the framework streams its own payload through inline script tags. Honouring it needs a check on every request that would stop these pages being cached, and that costs seconds on a slow connection. Nothing here loads third-party script, and the policy does forbid this page from sending anything anywhere.

• Where a filed complaint lives

  On your device

  The date you filed is kept in this browser, not on our server. That is not laziness: this host starts a fresh copy of the app for almost every request, which is the same behaviour that stops our rate limit working, and a filing held only on the server would vanish between two page loads. For a feature whose whole subject is a thirty-day wait, that would be worse than not building it. The cost is that clearing your browser data clears the filing, and it does not follow you to another phone.

• Where completed actions live

  On your device

  Same as the filing above, for the same reason. The server records that an action happened so the audit trail is real while that copy of the app is alive, but the record you can rely on is the one in this browser.

• Change your mobile number

  Real form, simulated change

  The form, the checking and the entry on your timeline are real. Nothing is written to any Aadhaar or PM-KISAN record, and no message is sent to any phone. The number you type is not stored on our side at all - we record that you did it, not what you entered.

• Ask your bank to link your Aadhaar again

  Real request, simulated sending

  The request is generated from your own record and is the same wording the printed slip carries to a bank counter. No real bank and no real payment system is contacted.

• Correct a spelling of your name

  Real, and mostly ruled out

  The action works, and for most of our made-up people it refuses to run - which is the honest outcome rather than a fault. It only offers itself when two records hold two spellings of one name. When they hold two different people, as they do for our land-record case, it says so and sends you to the revenue office instead of giving you a form that would change nothing.

• What the demo people can show you

  One gap, stated

  Every land-record mismatch we invented is a genuine one - two different people, not two spellings - because that is the case worth showing. The consequence is that the name-correction action has no demo person who can complete it: on all eight it only ever shows why it cannot help. The action is real and the rule behind it is the same rule the diagnosis uses. We would rather tell you that than invent a ninth person so a button had somewhere to lead.

Known limitations

• No real integration. A real deployment would need sanctioned access from the agriculture department and from each state.
• The blocker list is derived from public documentation, not from operational data.
• Land record rules vary by state. This models one generic state.
• Four languages are complete, and none of the Indic translations has been checked by a native speaker. A real deployment needs the full set, professionally translated.
• No SMS or phone-line channel, which the least connected people would need most.
• Escalation is described, not executed. We cannot verify whether an officer acted, only whether money arrived in the mock bank record.
• The refund, voluntary surrender and revocation flows on the official portal are deliberately out of scope. They are the opposite of “my instalment did not arrive”, and this build answers one question.