What's real here, and what's made up

The core citizen flow in English, हिन्दी and தமிழ்

The filing path, its facts, status messages, and the main dashboard surfaces use the typed dictionary rather than a translated veneer over an English skeleton. A missing Hindi or Tamil key fails the build; the separate engineering disclosures remain English by declared design. Your choice survives a reload.

Indian number formatting

Lakh and crore grouping via the platform's own Intl support with en-IN, hi-IN and ta-IN locales, forced to Latin digits. ₹4,20,000 groups correctly in all three languages — we did not hand-roll this.

The refund state machine

An actual state machine with named holds. Clearing a hold advances the state through legal transitions only; you cannot reach 'credited' with an unresolved bank failure. This is the part of the product we most want judged.

Provenance on every figure

Each income fact carries its reporting entity, that entity's registered identifier, and the date it was filed. The data behind it is invented; the modelling of it is not, and it is the structure the real portal is missing.

Your progress surviving a closed tab

Journey state is mirrored into your browser's local storage under wapsi_active_id, wapsi_active_data and wapsi_lang. Close the tab, come back, and you are where you left off. The reviewer console can clear it.

Dictation, where the browser has it

The microphone on the dispute and reply fields uses the browser's own speech recognition, in Indian English, Hindi or Tamil to match your chosen language, with text appearing as you speak. Where the browser has no recognition — Firefox for Android, Opera Mini, roughly one browser in eight — it falls back to a worked example and says on screen that what you are seeing is an example rather than your voice. Worth knowing: Chrome's implementation sends audio to a remote service, so this is a no-API-key choice, not an offline one.

A reproducible demo

Sandbox identities come from a seeded generator, so the same seed produces the same person, figures, and bank details — a reviewer's identity screenshot can match ours. Mock dictation text and browser event IDs are intentionally interaction-local, not evidence of a live service.

Reduced-motion and keyboard support

prefers-reduced-motion: reduce collapses every animation. Focus is visibly outlined throughout.

Every PAN begins DEMP

The fourth character of a real PAN encodes the holder's type, so DEMP cannot occur naturally. The custom sandbox generator is constrained to the same prefix, which means an auto-generated identity can never collide with a real person's PAN.

Bank routing codes

Format-valid IFSC strings that correspond to no real branch — KAVC0001183, GOMT0000714, GODG0004417, DECU0834471. Bank names are real institutions because the scenario needs to be recognisable; no account number, real or masked, belongs to anyone.

The three people

Sunita Devi, Rakesh Kumar and Priya Sharma do not exist. Their employers, brokers, salaries, notices and grievances are written to embody documented failure modes — a mis-tagged intraday trade, a set-off against a demand never served, a stale routing code after a bank merger.

Verification codes and reference numbers

The one-time code is printed on screen because there is nothing to send it to. Document reference numbers are invented but correctly shaped, because the fact that a letter without one is officially void is a real and under-known protection.

No Aadhaar number appears anywhere

Not a real one, not a fake one, not a masked one. Mobile numbers use a reserved-looking 90000 000NN pattern. No payment details and no health data.

UIDAI — identity verification

Real e-verification uses an Aadhaar one-time code or a bank-issued electronic verification code. We show the flow, the waiting state, and the crucial fix: the session is held open while a code is outstanding instead of expiring underneath you.

TRACES and the reporting chain

The annual information statement, the taxpayer information summary and the tax-credit statement are where prefilled figures actually come from. Ours are compiled into the page.

NPCI — bank account validation

Whether an account can receive a refund is a live check against the banking network. We simulate both outcomes, including the one the real portal handles worst: a branch absorbed by a merger, leaving a routing code that validates but cannot be paid.

Notice issuance and the reference registry

Letters are modelled, not fetched. Nothing we display was issued by anyone.

Voice anywhere except the two free-text fields

Dictation works on the dispute reason and the notice reply. It does not fill in an amount, navigate a screen, or complete a return end to end by voice — which is what a citizen who cannot read the form would actually need, and is the largest single gap between this prototype and the product it argues for.

Any language model

Notice explanations and draft replies are deterministic templates written by hand, not generated. The code puts them behind a single interface so a model could be dropped in without touching a screen, but today there is no model, no key and no inference.

A connected production server, database, or account

The citizen UI is deliberately browser-only: its demo return state lives in per-browser storage, so reviewers cannot watch one another's refund advance. An additive local Spring Boot service and load harness now live under backend/ and loadtest/ for exact-money, asynchronous submission, idempotency, and owned-load evidence. They are not connected to this Next.js UI, do not persist production data, and do not contact official systems.

Real filing, in any sense

Nothing is submitted anywhere. Sending a return in this prototype writes a value to your own browser.

A canonical store of income facts, with provenance as a first-class field

The department already holds every figure it asks citizens to retype. What is missing is one authoritative record per fact carrying who reported it, under which identifier, when, and which correction supersedes it. Almost everything this prototype does well follows from that one structure.

Authorised intermediary status

Identity verification, account validation and return submission are all gated. This is a permissions and audit problem, not an engineering one.

Consent, retention and audit obligations

Handling real records means a lawful basis for processing under the Digital Personal Data Protection Act, defined retention, and an audit trail per access. None of that is modelled here, because we hold no one's data.