Products · Indian statutory income tax
CLAVIS
The reference instrument for Indian statutory income tax.
CLAVIS computes a return under the Income-tax Act, then computes it again with a separately written engine that shares no code with the first. Where the two disagree, it says so. Where it cannot establish a figure, it says that too, rather than reporting a confident zero.
What a silent failure looks like
A tax certificate states salary NET of the exemptions an employer has already applied. Read as gross, and taxed under a regime that allows neither of two of those exemptions, the return charges tax on income the exemptions had already removed. Nothing throws. No figure looks odd. The test suite is green.
₹49,920
undercharged on a single return · found by the second engine
Why it exists
This domain met all four conditions.
The fourth is the one that disqualifies most software.
- 01The answer matters
- A wrong figure is money, and a chartered accountant signs for it.
- 02Nothing independent checks it
- Every incumbent is a single engine marking its own work. The department’s own calculator is one engine too — and check 0030 found it applying the wrong standard deduction.
- 03A different second computation is possible
- The statute is a specification. It can be implemented twice, by different means, without sharing a line.
- 04The failure is silent
- A wrong tax figure arrives on time, in the right format, inside the expected range. Nothing throws.
Built for
Chartered accountants and CA firms computing returns for clients.
Not for
Individual taxpayers filing their own return.
Filing on another person’s behalf requires ERI registration, and CLAVIS is not an ERI. That is a legal boundary, not a roadmap item.
Four things it will not do.
Design decisions with reasons, not missing features. Each one is a thing the instrument could do and will not.
- It does not draft replies to notices.
- Representing a taxpayer is professional work under the CA Act.
- It does not rank investments or assess suitability.
- That is investment advice, and it requires registration CLAVIS does not hold. It states facts about statutory instruments and computes their tax effect exactly.
- It does not report a figure it cannot establish.
- Where evidence is incomplete the result is an upper bound labelled as one — never a number presented as final.
- It does not compute a year under a statute written for another.
- A year with no compiled ruleset for the Act that governs it is refused by name, rather than computed under the nearest available rules.
The machinery
Eight layers, and the part of each that is actually hard.
None of this is specific to one domain. It is the same machinery we build into somebody else’s system, in whatever domain their expensive answer lives.
01
Rules are data, and every result is pinned to them
Two statutes are compiled from rule files rather than written into code — 30 files for one Act, 29 for its successor. The compilation is digested to a hash, and that hash, the engine version and the Act travel with every stored computation.
The hard part
A change to provenance alone moves the hash. That is correct and it is not free: every ruleset has to be archived, or a result computed two years ago can no longer be replayed under the rules it was actually computed under.
02
A second engine that shares nothing
A clean-room implementation of the same statutes — plain per-year tables, whole-number arithmetic, no rules engine, no solver. Every result is computed twice and the two are compared at runtime.
The hard part
It has to be able to disagree, so it may not import a single helper, table or constant from the engine it checks. Measured from the import graph: zero edges. A mirror that shares a table verifies the table, not the answer.
03
A formal certificate, not a sample
The risk model carries an SMT proof that a stated bound holds across the entire input space, re-proved in CI. Where it fails it returns the specific inputs that break it.
The hard part
The proof is only true over the slice it was proven on. Stating it more broadly than that — which is the tempting thing to do in marketing — makes it worthless, so the scope travels with the claim.
04
Extraction anchored on legal identity, not wording
A row on a document is resolved by the statutory reference it cites rather than by the words around it, so a vendor’s phrasing cannot move it. Roles and section references are parsed as a grammar rather than enumerated as synonyms.
The hard part
A section alone is ambiguous: the same reference appears on a row stating what was paid and a row stating what was exempted. Getting that wrong overcharges a taxpayer, and it took a rule about what a citation without a role word means to settle it.
05
A temporal graph of the law
Roughly 1,570 nodes and 5,000 edges connecting sections, amendments and the forms they require, each carrying a validity window.
The hard part
Auditing those windows found 93 repealed provisions reporting themselves as still in force, with their repeal dates printed on the page and never parsed. A system that models only current law cannot explain any earlier answer.
06
Integer arithmetic, end to end
No floating point anywhere in the computation. A native hot path runs the scalar arithmetic, with a differential test proving it matches the same computation in the host language across swept inputs and every boundary.
The hard part
Rounding is statutory: it applies at exactly two points and nowhere else, and applying it to a component instead of a total changes the answer. The parity test caught a bridge defect that would have mis-computed an entire band.
07
Records that can be defended later
Tenancy lives in the storage key rather than in a query filter. Computations are append-only: a correction is a new record that supersedes its predecessor, and a filed record can never be superseded at all.
The hard part
A filter fails open — one forgotten clause leaks a firm’s entire client book. A key fails closed. The difference only shows up under a case no test fixture builds, which is how a key that omitted the tenant was eventually found.
08
Three states, all the way to the screen
Established, divergent and unestablished are carried from the producer to the consumer with the reason and the remedy attached, rather than collapsed at the response boundary.
The hard part
The collapse happens at the last inch. One audit found seven defects that were all the same shape — a three-state fact flattened to two on its way to a screen — and fixing them at the producer exposed five more nobody had reported.
How it is checked
Every figure is computed twice, by engines that share no code.
A checker that imports the model verifies that the solver ran. It does not verify that the answer is right.
A clean-room reference implementation
Plain statutory tables, whole-rupee arithmetic, no shared code with the rules engine. Every result is computed twice. On a real certificate the two engines came within ₹4 — and the ₹4 was the statute: the engine floored where the Act rounds to the nearest ₹10.
A solver checking both against stated invariants
Properties are proven over the whole input space rather than sampled at a few points, so a class of error is ruled out instead of being looked for.
Every stored result pinned to what produced it
The Act, the ruleset digest and the engine version travel with each computation, so any figure can be recomputed exactly as it was — including years whose law has since changed.
Defects published, including our own
Several entries in the register are CLAVIS disagreeing with itself. A laboratory that concealed its calibration failures would be worthless.
Published checks involving CLAVIS.
Including the ones where it was wrong.
Starting
What you need before the first run.
- An account
- CLAVIS is behind a sign-in. The data inside belongs to whoever signed in, and it is not shared between accounts.
- One real case
- Not a sample. The instrument is only interesting on something you already have an answer for, because the first useful result is the two engines agreeing — or not — on a figure you can check yourself.
- Somewhere to disagree
- If the second engine contradicts you, that is the product working. It is worth deciding in advance who looks at a disagreement, because an alert nobody owns is an alert nobody reads.