LETTER — Legislation-Encoded, Tested, Traceable, Executable Rules
An integrated eligibility determination engine.
One household. Many programs. One determination.
Rules you can trace back to the sentence that made them.
Medicaid, CHIP, the Exchange, the Basic Health Program, SNAP, WIC, school meals, Summer EBT and the Medicare Savings Programs — assessed together, on one household model. The method underneath it is not eligibility-specific. It encodes legislation.
The problem
Rules engines are usually trusted because of who built them. This one is built to be trusted because of what you can check.
Three things go wrong in legislation-to-code projects, every time. LETTER is five mechanisms aimed squarely at them, plus a machine that enforces all five.
The rule drifts from the law
Someone encodes a threshold from a summary, a training deck, or memory. Nobody can later say which sentence of which provision produced it.
Ambiguity is resolved silently
The text is genuinely unclear. A developer picks the reading that compiles. Nobody with policy authority ever sees the question.
The interpretation is undefended
Even where a ruling was made properly, nothing stops the next change from quietly reversing it.
How it works
Five mechanisms, and a gate that refuses to be argued with.
The work is declared before it is done
Every rule document is authored under a written contract: what it may touch, what it must produce, what it is forbidden to do, and what conditions require it to stop and ask a human. The forbidden list matters as much as the required list.
The work is done with less authority than the reviewer
The agent that executes a contract cannot commit, cannot approve its own work, and halts with the tree untouched when a stop condition fires. That has happened repeatedly — and one such halt exposed a circular definition in a federal regulation that compiled clean and passed every test. It would have shipped invisibly under any normal process.
One machine gate, one definition of done
A single command compiles the model, checks attribute integrity, and runs every regression test. The exit codes encode policy rather than convenience: no tests found is a failure, not a warning; an undeclared attribute is a failure; a rule loop is a hard failure even where the compiler merely warns.
Ambiguity is escalated to humans and written down
Wherever encoding the law required a reading the text does not state outright, the work stops and a row is recorded: the provision, the question, the adopted reading, why, where it is encoded, and its review status. Nothing in that record is settled agency policy — each row stands until a real policy analyst confirms or overrules it. Rows are never deleted.
Every run leaves evidence anyone can audit
The change plan written before anything was touched, the gate before and after, probe results, and a validation read-back taken from live compiled state rather than from the report's own prose. Predictions are published whether or not they held — two in this portfolio were wrong, and both are still on the record with the reason.
Why believe it
Ordinary practice, and what this method does instead.
| Ordinary practice | This method |
|---|---|
| Thresholds typed from a summary or a training deck | Rules authored from a cached provision, byte-verified against the source, with the quoted text seeded into the document itself — and the resulting citation coverage published and measured, not asserted |
| Ambiguity resolved by whoever is writing the rule | Ambiguity halts the work and goes to a named human; the ruling is recorded for analyst review |
| Genuine legal conflicts resolved by picking one side | Neither side imposed: answer where the texts agree, return uncertain where they diverge, both cited |
| Interpretations documented in a comment | Interpretations defended by tests that go red if reversed |
| “It passed QA” | A machine gate with a published exit code, plus an evidence folder anyone can audit |
| Sources assumed current | Freshness is tested, never assumed — the corpus is re-verified on a cadence and a horizon watch tracks pending rulemaking |
| Surprising results smoothed over | Surprising results witnessed and published as questions, each one carrying a passing test that reproduces it exactly |
| Defects discovered by the customer | Defects published by the builder, with dated deadlines |
| Programs integrated later, by an interface | One household, a methodology per member — integration is the architecture, not a layer bolted on afterwards |
Two examples of the freshness row, both from this work: a widely used federal “official dataset” for state standards was measured five years stale and divergent from the same agency's own published tables. And the core federal regulations were proved byte-identical to the live electronic register at the time of build. The federal foundation is proven, not assumed.
One household, not five systems
A mixed household is the native shape — not an integration project.
A grandmother assessed on one basis, a working parent on another, everyone on food assistance. That is the architecture's default, decided structurally before most of those programs existed in the model, because the federal regulation itself builds a household per individual.
Program families
Medicaid and CHIP, the Exchange and Basic Health Program, SNAP, the child nutrition programs, and the Medicare Savings Programs — plus the non-MAGI Medicaid pathways behind long-term care.
Answers that carry reasons
A determination comes back with a decision report showing, provision by provision, which rule drove which conclusion. Not a score. Not a black box.
It will say “uncertain”
Where two authoritative texts genuinely conflict, nothing is encoded. The model answers where they agree and returns uncertain where they diverge, citing both. That is the model saying a human must decide here rather than guessing on your behalf.
What the model does not contain
Zero personal identifiers — measured on every attribute, not asserted.
Across every attribute in the compiled model, on eight tested patterns: no social security number in any form, no person-name field, no postal address, no case, programme, licence, passport, immigration or tax identifier, no email, no phone.
The model holds no instance data of any kind — no applicant, no case, no record. It is rules, and the shapes that facts have to take.
This is not tidiness. It is the property that lets the rules be hosted centrally — shared across agencies, or across states — without inheriting the security surface of personal data. The thing that usually stalls an architecture review is simply not in the artifact.
Disclosed in the same breath
Five date-of-birth definitions exist in the schema. They hold no value for anybody — but they mean a real deployment would hold personal data in those five fields. That is a data-protection question about the deployment, not about this artifact, and we would rather state it than have it found.
And an honest note on the measurement
An earlier run asserted “no addresses” without having tested for addresses. The pattern was added and the measurement re-run. The answer was still zero — but the claim was not evidence until it was tested.
Beyond eligibility
The method is not eligibility-specific. It encodes legislation.
Eligibility is where LETTER was proven, because eligibility is where the law is densest, the interactions are cruellest and the cost of being wrong lands on a household. Nothing in the method depends on it. Any body of legislation that produces decisions — entitlements, levies, licensing, compliance obligations, permitting — can be put through the same pipeline: pin the source, author under contract, gate every change, record every reading, publish the evidence.