Why Territory View can't "hallucinate" a bad recommendation

A one-page answer to: "An AI killed 25 acres in China — how do I know yours won't?"

The short version

That incident happened because a generative AI wrote a recommendation as free text, and someone acted on it. Our system is built the opposite way on purpose: no language model ever produces a flag, a number, or a recommendation. Every output is arithmetic on a measured satellite value against a fixed threshold. If you can read the number, you can check the advice.

The five safeguards

1. No AI in the decision path. Recommendations come from agronomy_rules.py — a fixed set of if value < threshold rules. It is deterministic: the same field data always yields the same result. There is no model that can invent, drift, or "confidently guess."

2. Full traceability. Every flag on the dashboard carries the raw measured index and the exact threshold that triggered it (e.g. NDMI = 0.159, rule fires when NDMI < 0.20). A human can verify any recommendation in seconds. Nothing is unsourced.

3. A confidence gate that refuses to guess. Imagery older than 14 days, or more than 20% cloud over the field, returns INSUFFICIENT DATA — no recommendation. The China failure was an AI acting on bad input. This system's default on bad input is silence, not a guess.

4. Human-in-the-loop by design. The tool ranks and flags which fields to look at. It never prescribes a rate and nothing is ever applied automatically. The agronomist drives out, ground-truths, pulls a tissue test, and makes the call. The expert is the verification layer — and that is sold as a feature, not a disclaimer.

5. Calibrated, conservative, and labelled. Thresholds are conservative starting points that get calibrated per crop/region against your own ground truth before any dollar figure is trusted. Dollar amounts are explicitly wide call-prioritisation estimates, never guaranteed returns or prescriptions.

What the satellite data itself is

The indices (NDVI, NDMI, NDRE, etc.) are computed directly from ESA Sentinel-2 imagery — public, calibrated, government-operated satellite data. They are measurements, not predictions. The only interpretation layer is the transparent rules engine above.

The one-line pitch

"It doesn't tell your farmers what to do. It tells your reps which farmers to call this week — and shows the measured number behind every call, so your agronomist confirms before anyone touches a field."

Don't take our word for it — audit it in one command

./verify.sh

That runs three independent proofs and prints PASS or FAIL. It is meant to be run in front of you, on your laptop, before you buy anything.

Proof	What it establishes	Scale
test_agronomy_rules.py	The engine cannot invent advice	35 safety invariants, 23,000+ evaluations
test_engine_parity.py	The web page runs that exact engine, not a lookalike	4,047 cases compared field-by-field
test_page_integrity.py	The page contains no AI model, and the map cannot misplace a field	65 static + headless checks

The invariants that are mechanically enforced — not promised, tested:

• Determinism. The same field data produces a byte-identical result every time, across 1,000 repeat runs.
• Traceability. Every flag's own recorded value is verified to genuinely breach its own recorded threshold. A flag that displayed evidence not supporting it would fail the build.
• The confidence gate holds. Stale, cloudy, or missing imagery can never produce a recommendation or a dollar figure — tested at the exact boundary (14 days, 20% cloud) from both sides.
• No phantom spend. A dollar figure can only attach to a nitrogen flag. Moisture stress and low vigour alone are proven to stay at $0 — because there is nothing honest to sell against them.
• Strict thresholds. A value sitting exactly on a threshold does not fire. Verified on all six bands.
• Monotonicity. A worse field is never ranked healthier or cheaper.
• Fuzz. 20,000 randomly generated readings — including nonsense ones, nulls and zero-acre fields — break none of the above and raise no exception. Seeded, so you can reproduce this exact run.

Why the parity test matters most

The audited engine is Python; browsers can't run Python, so the dashboard carries a JavaScript copy of the same rules. That duplication is the one place this system could quietly start lying — a drifted copy would display flags and dollar figures the audit never approved, while every "traceable" claim on the page stayed printed there. So the parity test extracts the JavaScript straight out of the live page and fails if the two engines disagree on any status, any threshold, any dollar figure, or any word of suggested action.

It has already caught one real defect: Python's int() truncates where JavaScript's Math.round() rounds, so fields with fractional acreage would have printed a dollar figure off by one from the audited engine. Found and fixed before it ever reached a grower's card.

It also checks itself in your browser

The dashboard runs seven of these invariants live, on page load, against the same engine that built the table you're looking at — not against saved results. The badge in the top-right shows the outcome; click it to see every check. If the engine were ever edited into producing an unjustified flag, that badge turns red before you read a single recommendation, and the failure panel opens on its own.

The engine, on one real field

python3 agronomy_rules.py

Runs the engine on the real Homestead reading (2026-08-02) and prints the flag, the triggering value, and the threshold — the whole decision, fully auditable.

The map draws pictures, not conclusions

The dashboard shows each field on a satellite basemap. Two things are worth stating plainly, because a map is the easiest place for a tool to look more certain than it is:

• The basemap is imagery only. Aerial tiles are the one thing on the page that comes over the network, and they are pictures behind the data — they never touch a status, a threshold, a dollar figure or a word of advice. Every flag is computed on your device from the satellite indices, before a single tile loads. The mapping library (Leaflet 1.9.4) is served from our own machine, not a CDN, and the test suite verifies its checksums against Leaflet's official published hashes on every run, so nothing third-party can be swapped in underneath it.
• If the basemap can't load, the page still works. On a tablet with no signal in the field, the map falls back to a schematic layout and says so. The priorities below it are unaffected, because they were never computed anywhere but on that device.

Field outlines are drawn from legal land descriptions to the real township grid, and the suite checks that geometry rather than trusting it: every field must land inside the county, no two fields may share a location, and each drawn rectangle's true ground area must match the acreage printed beside it to within 1%. A quarter section drawn at double size would be a confident wrong answer, which is the failure this whole project exists to prevent.

What we are still honest about

• Thresholds are not yet ground-truthed. All three crops currently run on default bands; the test suite prints that fact every run rather than hiding it. Dollar figures stay estimates until an agronomist calibrates one crop against real ground truth. That is the first conversation, not a footnote.
• The demo territory is placed, not surveyed. Two fields are real and measured; the rest are sample growers, and every field's position is a plausible placement on the real survey grid rather than a surveyed quarter — good to a few hundred metres, since it ignores road allowances. The page labels this on the map itself, and the suite fails if that label is ever removed while the placements are still demo data. Real legal descriptions from a retailer replace it as a data edit, not a code change.
• These are whole-field averages. The list tells a rep which field to open first. It is not a variable-rate prescription and does not pretend to be.