Methodology
How the numbers are made — and how you check them.
Financial infrastructure asks for trust, so this page shows the discipline instead: the six-step gauntlet every number goes through, the rules we hold ourselves to, and the artifacts you can check without asking our permission.
The gauntlet
Six steps between an idea and a number you can build on.
The spec comes first
Every model begins as a written, versioned specification — exact formulas, valid input domains, assumptions, and what it deliberately refuses to model — published before the code exists. The spec is the contract; the code honors it.
Two implementations, built blind
A second implementation is built in another language, from the spec alone, by a route that never sees the production code. Two independent readings of the same contract — the strongest test a specification can face.
Concordance testing
250 deterministic cases per model — hand-picked edge cases plus seeded fill — diffed between the two implementations at one part in a billion, on every change. One disagreement stops the release. Not a target: a gate.
Facts, not folklore
Every constant — IRS brackets and limits, SSA factors and life tables, CMS tiers, HHS guidelines — lives in a registry with its primary source, its effective period, and the date a human last read the source. Models cite the facts they used, in the response.
Versioned behavior
Behavior moves only with a version bump and a public changelog entry — our own bug fixes included, described plainly. Responses pin their spec version, so your CI can hold us to it.
An evidence record on every answer
Every response carries a SHA-256 over the model, spec version, inputs, and outputs. Store it with anything you build on the numbers; recompute it years later and prove nothing moved. The proof travels with the number.
The house rules
Four rules we don’t break.
Each one closes a door a financial tool can quietly walk through. Keeping them closed is what the verification machinery is for.
Reject, never clamp.
An input outside a model's valid range is refused with a per-field error — never silently adjusted to something computable. A number produced from inputs we changed behind your back is not your number.
No house view.
We never supply a market opinion. Return and inflation assumptions are the caller's to set; until they are, results run on labeled illustrative defaults — and say so on every surface that shows them.
AI drafts; determinism executes.
No language model sits in the numeric path. Where AI helps — drafting an import mapping, explaining a result — it writes the recipe, and deterministic, Concordance-tested code executes it. Every number is reproducible from its inputs, every time.
Show the alternatives, publish the limits.
Decision surfaces show every option computed, not just a winner; charts anchor at zero; disclosures append, never replace. Each spec publishes its own exclusions, written for a skeptic — the boundary of a claim is part of the claim.
And what we keep
We publish enough to be audited, not enough to be cloned — and we’d rather say that than pretend otherwise. The production source, the full catalog’s spec texts (3 sample specs are open; the rest come with your key), and our case-generation recipes stay ours. Everything we claim, though, is checkable through the artifacts on the right — no key, no account, no permission needed.