Limitations

What this system does not do — stated out loud.

This is not a disclaimer buried in a footer. A system that states its own limits is the one a department can trust. Every gap below is a place a real deployment would need something this pilot does not have — named plainly, with the seam where the real thing would slot in, and never faked.

Where AI is used

AI is used only where deterministic rules genuinely fail — in exactly two places. Everywhere else, the logic is explicit, versioned and testable, because a compliance decision must be explainable.

Plain-language questions (RTO “Ask”)
An officer can ask for a summary in ordinary language. The answer is drawn from the same compliance data the dashboards show — it never invents figures, and the raw tables remain the source of truth.
Suggesting a complaint category
Free-text a parent writes is hard to bucket by rule, so a category is suggested and shown as “AI-suggested — pending review”. The manual dropdown is always the fallback, and a human confirms before anything counts.

Notably, automatic face-blur is not one of these. Complaint photos use a manual blur brush that blocks upload until faces are covered — we never ship an automated safeguard we cannot guarantee.

Declared pilot gaps

01
Pilot gap — Native background location
Mobile browsers throttle or suspend GPS when the app is backgrounded or the screen is off. The PWA holds a Wake Lock and buffers fixes to IndexedDB, but a native wrapper (or a foreground-service Android build) is needed for guaranteed background tracking. Heartbeats + the coverage-gap vs tamper distinction make the gap visible rather than hidden.
Surfaces in: Driver Trip Mode
02
Pilot gap — Departmental data feeds (Vahan / Sarathi / AIS-140)
Vehicle, permit, fitness, insurance and PUC data are entered manually and marked "pending departmental verification". A DocumentSourceAdapter interface exists so a verified feed can be slotted in — but no integration is built or implied.
Surfaces in: Fleet documents, Inspection memo
03
Pilot gap — Verified per-road / school-zone speed limits
Overspeed is evaluated against a single operator-set limit and its cited source. Per-road and school-zone limit segments require a verified departmental dataset we do not have. The school_zones table is the seam; it ships empty. Until then the default limit applies and the system never asserts a zone limit on its own authority.
Surfaces in: Policy screen, Overspeed alerts
04
Pilot gap — The in-bus QR sticker can be photographed
The HMAC bind proves the driver saw the sticker; it is not unspoofable. Mitigations: rotate bind_secret, and log + geofence the bind location (a bind far from any route stop is flagged). We do not claim the sticker cannot be copied.
Surfaces in: Driver bind
05
Pilot gap — Scheduled sweeps run only on deploy
TRIP_NOT_STARTED and signal re-evaluation run on a Vercel cron in production. In local/dev there is no cron, so the sweep is triggered by the "Run schedule sweep" button in /admin. The logic is identical; only the trigger differs.
Surfaces in: Admin, TRIP_NOT_STARTED
06
Pilot gap — No Kashmiri / Urdu voice output
The UI ships in English + Hindi (Devanagari). We deliberately do NOT ship Kashmiri or Urdu TTS: usable voices do not exist and a broken voice feature would undermine trust. This is stated plainly rather than faked.
Surfaces in: Internationalisation
07
Pilot gap — Automatic face blur is not the guaranteed path
Complaint photos use a manual blur brush that BLOCKS upload until the user confirms faces are blurred. Automatic face detection is an optional enhancement; we never ship an auto-blur we cannot guarantee.
Surfaces in: Parent complaint
08
Pilot gap — Realtime + retention are pilot-scale
Live updates use Supabase Realtime and the ingest re-evaluates the whole trip each batch — fine for a pilot fleet, not tuned for thousands of concurrent buses. Retention is a manual/scheduled purge, not yet a hardened data-lifecycle job.
Surfaces in: Ingest, Retention