Canadian Tax Rules Engine

Income tax is public law. Anyone can read the brackets, and nearly everyone who implements them gets something wrong, because the failure is not in the arithmetic. It is in the constants: a rate that changed last year, an amount phasing out on a threshold nobody re-fetched. This engine computes federal T1 and Quebec TP-1 obligations, and the interesting part is not the calculation. It is how it finds out that it is wrong.

Seventeen areas are implemented across both returns: federal and Quebec brackets, basic personal amounts with their phase-outs, QPP, EI at the Quebec reduced rate, QPIP, the age, pension and disability amounts, the 16.5 percent Quebec abatement, the refundable solidarity credit, the worker deduction, RRSP, union dues and child care, and withholding resolved to a refund or a balance owing. Every constant lives exactly once, in a dated parameter table carrying its source URL and the date it was fetched, so no figure sits silently in two places. A REST API exposes the engine with per-client revocable keys.

What we measured

Then a second implementation was written from scratch, one that never imports the engine, built by re-fetching the primary sources at the CRA, Revenu Québec and the Ministère des Finances. A differential gate runs the two against each other. Alongside it are property tests that need no oracle at all: monotonicity, continuity across bracket boundaries, phase-out behaviour, purity.

Why it holds

On its first pass the oracle found 8 confirmed defects, 2 federal and 6 Quebec: stale brackets, a stale basic personal amount, the wrong mechanism for the worker deduction, the wrong structure for the age and retirement credit, stale disability amounts on both returns, a stale federal medical-credit cap, wrong solidarity-credit figures, and a float rounding bug. Each was re-verified against a second round of sources before any engine code changed, and not one turned out to be an oracle error. Why had the existing tests missed all eight? They were hand-transcribed from the same tables, by the same author, at the same sitting as the engine. They proved the two transcriptions agreed with each other. They could not prove either matched the law.

That failure mode is not specific to tax. Payroll, benefits, insurance and sales tax share it: a wrong constant that every test agrees with, because the tests came from the same source as the code. A second implementation built from primary sources is how you find it.