JIL Sovereign · Internal Engineering
Technical Design Document · TDD-2026-NAI-001

Nutrition Assistance Integrity. SNAP attestation at the rail.

Document TDD-2026-NAI-001
Vertical Nutrition Assistance Integrity (#10)
Status Draft v1.0 · For internal review
Profile snap.v1
Owner J. Mendonca · CEO
Issued 12 May 2026
Pages 1 of 1 (tabloid)
Section 01

Executive Summary

What we are building

The Nutrition Assistance Integrity vertical is a new attestation profile on the existing JIL Sovereign Verdict Engine, with SNAP as the lead use case. It binds twenty-eight statutory and behavioral checks to a named policy profile (snap.v1) and produces a Court Ready Evidence Bundle anchored on CourtChain L1 for every flagged transaction, every disqualified retailer, and every skimming reimbursement claim.

The vertical is positioned as the tenth on the canonical site list. It composes alongside the Pre-Settlement Fraud Attestation pillar (real-time authorization) and the Retroactive Verification pillar (historical scan), without altering the architecture of either pillar. The verdict engine is unchanged; the rules are new; the data sources are mostly public federal feeds.

JIL posture: Detection and proof, not recovery. Flat fee, not contingency. Customer holds custody of funds in Sealed Escrow at all times. JIL produces the CREB; the agency or processor makes the disposition decision.
Section 02

Scope and Statutory Basis

Federal program surface

The vertical is SNAP-first. Phase 2 through Phase 4 expansion extends the same Verdict Engine to WIC, school nutrition, and child nutrition programs across the USDA FNS portfolio without architectural change.

In scope · Phase 1 (SNAP)

All SNAP transactions on EBT cards issued by participating state agencies. Retailer authorization, basket eligibility, trafficking detection, skimming detection, cardholder eligibility drift.

Out of scope · Phase 1

WIC (state-specific Authorized Product List handling, voucher and eWIC card flows under 42 U.S.C. § 1786). School Nutrition Programs (institutional billing model under 42 U.S.C. § 1751, not EBT card-based). Child Nutrition (CACFP and SFSP under 42 U.S.C. § 1761 and § 1766, sponsor and site-level reimbursement model).

Statutory anchors (Phase 1)

AuthoritySubject
7 U.S.C. § 2011 et seq.Food and Nutrition Act of 2008 (primary SNAP statute)
7 U.S.C. § 2012(k)Definition of "food" for SNAP eligibility purposes
7 U.S.C. § 2013Establishment of SNAP and benefit delivery via EBT
7 U.S.C. § 2024(b)Criminal penalties for trafficking
7 CFR Part 271General information and definitions, including "traffic"
7 CFR Part 278Participation of retail food stores, authorization, and disqualification
7 CFR Part 274Issuance and use of program benefits
CAA 2023 § 501Skimming reimbursement framework (state replacement of stolen benefits)
PRWORA § 824EBT system requirements, codified at 7 U.S.C. § 2016
Section 03

Rule Catalog · 28 Checks

Profile · snap.v1

Twenty-eight checks across five signal categories. Each check binds to a statutory citation, fires either pre-settlement (block, hold) or retroactively (score, audit), and contributes a documented evidence chain to the CREB output.

Category A · Retailer Authorization (6 checks)

IDCheckAuthorityAction
SNAP.A.01Retailer FNS-authorized at time of transaction7 CFR 278.1Block
SNAP.A.02Retailer not under active disqualification7 CFR 278.6Block
SNAP.A.03Retailer not under pending administrative action7 CFR 278.8Hold
SNAP.A.04Stocking depth attested across 4 staple food categories7 CFR 278.1(b)(1)Score
SNAP.A.05Authorization category matches transaction profile7 CFR 278.1(b)(1)(i)Audit
SNAP.A.06Terminal-to-retailer binding integrity verified7 CFR 274.8Hold

Category B · Basket Eligibility (7 checks)

IDCheckAuthorityAction
SNAP.B.01All basket UPCs on canonical SNAP-eligible food list7 U.S.C. § 2012(k)Hold
SNAP.B.02No alcoholic beverage UPC present7 U.S.C. § 2012(k)(3)Block
SNAP.B.03No tobacco UPC present7 U.S.C. § 2012(k)(2)Block
SNAP.B.04No hot-prepared food UPC present (where flagged)7 U.S.C. § 2012(k)(1)Hold
SNAP.B.05No non-food UPC present7 U.S.C. § 2012(k)Hold
SNAP.B.06No vitamin, supplement, or medicine UPC (FDA Supplement Facts panel)7 U.S.C. § 2012(k)Hold
SNAP.B.07Transaction total within remaining benefit balance7 CFR 274.7Block

Category C · Trafficking Patterns (7 checks)

IDCheckAuthorityAction
SNAP.C.01Round-dollar transaction density (retailer-level)7 CFR 271.2 · trafficScore
SNAP.C.02Manual key-entry ratio above peer benchmark7 CFR 278.6(e)(1)Score
SNAP.C.03Multiple max-value swipes within window7 U.S.C. § 2024(b)Hold
SNAP.C.04Geographic cluster anomaly (retailer + neighbors)7 CFR 278.6(b)Score
SNAP.C.05Repeat amount pattern (e.g., consistent $40 swipes)7 U.S.C. § 2024(b)Score
SNAP.C.06Basket-size deviation from stocking profile7 CFR 278.6(e)(1)Score
SNAP.C.07Cross-retailer coordinated pattern detection7 U.S.C. § 2024(b)Audit

Category D · Cardholder Behavior and Skimming (5 checks)

IDCheckAuthorityAction
SNAP.D.01Geographic anomaly vs. 90-day baseline (skim signal)CAA 2023 § 501Hold
SNAP.D.02Velocity spike (multiple swipes per minute)CAA 2023 § 501Hold
SNAP.D.03Time-of-day anomaly (e.g., 3am at convenience store)CAA 2023 § 501Score
SNAP.D.04Card not flagged as compromised in shared registryCAA 2023 § 501Block
SNAP.D.05Out-of-state usage paired with home-state activity (cloning signal)CAA 2023 § 501Hold

Category E · Recipient Eligibility Drift (3 checks)

IDCheckAuthorityAction
SNAP.E.01Household composition validated against current case file7 CFR 273.2Audit
SNAP.E.02Dual-state issuance detection (cross-state PARIS match)7 CFR 272.13Audit
SNAP.E.03ABAWD work requirement compliance, where applicable7 U.S.C. § 2015(o)Audit
Section 04

Data Sources and Loads

Public + private feeds

The SNAP profile draws from seven distinct data feeds. Four are public federal feeds available without contractual access. Three require integration agreements with state agencies, processors, or GS1 licensees. All feeds load into the customer-side Verdict Engine; raw data does not transit JIL infrastructure.

DS.01 · PublicFree
FNS Retailer Locator

Canonical list of all FNS-authorized retailers nationally. Includes FNS number, address, store category (A, B, C, restaurant), authorization status, and disqualification status.

Source: USDA FNS public data feed
Format: CSV / API
Refresh: Daily
Volume: ~258K active records
DS.02 · PublicFree
FNS Disqualification List

List of retailers under FNS administrative action, including disqualification effective date, reason code, and appeal status. Sourced from FNS Office of the Inspector General publications.

Source: USDA OIG · FNS Compliance Branch
Format: Publications + FOIA
Refresh: Weekly
Volume: Cumulative ~30K records
DS.03 · LicensedGS1
UPC / GTIN Master with Eligibility

Universal Product Code mapped to SNAP-eligible food category, including alcohol flag, tobacco flag, hot-prepared flag, supplement flag, and non-food flag. Augmented by retailer-provided eligible product lists where available.

Source: GS1 US licensed feed + retailer overlays
Format: Database extract / API
Refresh: Daily delta
Volume: ~14M active UPCs
DS.04 · PrivateProcessor MOU
EBT Authorization Stream

Live ISO 8583 authorization messages from the EBT processor. Includes FNS number, transaction amount, terminal ID, card identifier (hashed), basket detail where supported by terminal, time, and geolocation.

Source: Conduent, FIS, FNIS, or state EBT switch
Format: ISO 8583 over Kafka or MQ
Refresh: Real-time
Volume: ~6B transactions/year nationally
DS.05 · PrivateState agency MOU
State EBT Case File Extract

Household composition, income recertification status, work requirement applicability, issuance status, and benefit balance per case. Used for Category E (eligibility drift) checks. Strictly retained in customer-side enclave.

Source: State SNAP agency (eligibility system extract)
Format: Encrypted batch
Refresh: Daily delta
Volume: Varies, ~22M cases nationally
DS.06 · PublicFree
PARIS Cross-State Match File

Public Assistance Reporting Information System file for dual-state issuance detection. Quarterly cross-state matching of SNAP rolls operated by HHS/ACF.

Source: HHS ACF PARIS Project
Format: Encrypted batch
Refresh: Quarterly
Volume: ~22M case records
DS.07 · PublicFree
USDA Food Data Central

Supplementary source for product categorization, ingredient classification, and FDA Supplement Facts panel attestation. Used to resolve ambiguous UPCs to SNAP eligibility category.

Source: USDA Agricultural Research Service
Format: API + CSV downloads
Refresh: Quarterly
Volume: ~1.9M food records
DS.08 · Cross-CustomerSCN-mediated
Compromised Card Registry

Cross-state shared registry of cards reported as skimmed, cloned, or compromised. Maintained as a privacy-preserving Bloom filter on the SCN, surfaced only on positive match.

Source: SCN-mediated, cross-customer
Format: Privacy-preserving filter
Refresh: Real-time delta
Volume: Cumulative, redacted
Section 05

Integration Architecture

Three deployment topologies

The Verdict Engine deploys in three topologies depending on the customer surface: directly inside the EBT processor (Pattern A, lowest latency), inside the state agency Snowpark or JIL Cloud enclave (Pattern B, retroactive primary), or as a federal channel deployment supporting USDA OIG (Pattern C, forensic primary).

Pattern A · EBT Processor In-Line

The Verdict Engine runs as a sidecar to the processor's authorization switch. ISO 8583 authorization messages branch on a tap, the Verdict Engine returns a verdict within the latency budget, the processor decisions based on the verdict (allow, hold, block). Verdict roundtrip is fully synchronous with authorization. Production target: 99.95th percentile under 800ms end-to-end.

Pattern B · State Agency Enclave

The Verdict Engine runs in the state's Snowpark Container Services environment or JIL Cloud EKS environment. Authorization data streams from the processor under a state agency data sharing agreement. Verdicts are produced asynchronously, with retroactive scan as the primary mode and quasi-real-time alerts as the secondary mode. Used where state owns the data but does not own the rail.

Pattern C · Federal Forensic

The Verdict Engine runs in a JIL Cloud federal-cleared environment (FedRAMP Moderate or High, depending on data classification). Historical EBT data from USDA FNS or USDA OIG is loaded for forensic scan. Used for trafficking case development and administrative disqualification packages. Air-gap variant available for OIG sensitive cases.

# Pattern A · EBT Processor In-Line (high level)

processor_switch
    │
    ├──→ authorize()            # normal path, returns to terminal
    │
    └──→ tap ──→ VerdictEngine
                    │
                    ├── load: DS.01, DS.02, DS.03, DS.07, DS.08
                    ├── evaluate: snap.v1 (28 checks)
                    ├── score: trafficking + skim
                    └── emit: {verdict, evidence_chain, anchor_ref}
                                │
                                ├──→ PoCS receipt          # cleared
                                ├──→ CREB.issue()          # held or blocked
                                └──→ CourtChain.anchor()   # 14/20 BFT seal
Section 06

Verdict Flow and Latency Budget

Sub-800ms target

End-to-end verdict roundtrip from ISO 8583 message arrival to verdict emission, decomposed across five stages. Total latency budget is 800ms at the 99.95th percentile. Production target is 350ms median.

Stage 01
Ingest

ISO 8583 tap, parse, normalize. Cache warm-up.

≤ 40ms
Stage 02
Hydrate

Lookup retailer, cardholder baseline, UPC eligibility, compromised registry.

≤ 180ms
Stage 03
Evaluate

Run 28 SNAP checks in parallel. Aggregate to verdict.

≤ 260ms
Stage 04
Seal

Quorum signing across SCN validators (async path for CREB).

≤ 220ms
Stage 05
Emit

Return verdict to processor. PoCS or CREB queued.

≤ 100ms
Note: The 14-of-20 BFT quorum signing for CREB issuance is decoupled from the in-line verdict path. Verdict returns immediately on local evaluation. The CREB seal is finalized asynchronously and anchored on CourtChain within the next block (target: ≤ 4 seconds from emission). The verdict is binding regardless; the CREB simply becomes court-admissible once anchored.
Section 07

CREB Structure for SNAP

FRE 902(14) self-authenticating

The Court Ready Evidence Bundle issued under the SNAP profile follows the canonical CREB anatomy, with three SNAP-specific extensions: the statutory citation chain, the FNS-anchored retailer identity, and the state agency disposition routing slip. Sample structure:

CREB {
  "creb_id": "CREB-2026-SNAP-7F4A2D",
  "profile": "snap.v1",
  "issued_at": "2026-05-12T14:33:21Z",
  "subject": {
    "transaction_id": "EBT-CONDUENT-X8843921",
    "fns_number": "0153729",
    "retailer_name": "[REDACTED PER 7 CFR 272.1(c)]",
    "amount": 78.42,
    "cardholder_hash": "sha3-256:..."
  },
  "checks_executed": 28,
  "checks_failed": [
    {"id": "SNAP.B.02", "statute": "7 U.S.C. § 2012(k)(3)",
     "evidence": "UPC 0123456789012 flagged ALCOHOL"},
    {"id": "SNAP.C.01", "statute": "7 CFR 271.2",
     "evidence": "Round-dollar density 0.84 retailer trailing 30d"}
  ],
  "verdict": "HOLD",
  "anchor": {
    "chain": "CourtChain L1",
    "block": 8843921,
    "tx_hash": "0x9347e...971e8"
  },
  "quorum": {
    "scheme": "14-of-20 BFT",
    "validators_signed": 17,
    "jurisdictions": ["US","CH","UAE","SG","BR","..."]
  },
  "crypto": "Ed25519 + Dilithium-III (ML-DSA-65)",
  "retention": "15+ years, customer Secure Document Vault",
  "admissibility": "FRE 902(14)",
  "disposition_routing": {
    "state_agency": "TX HHSC",
    "processor": "Conduent",
    "fns_region": "Southwest"
  }
}
Section 08

POC Plans

Two production paths

POC.01 · Retroactive Forensic Scan

ElementSpecification
CustomerState EBT agency or USDA OIG
Duration30 to 60 days, kickoff to delivery
Data scope90 days to 4 years of historical EBT transaction data
DeploymentCustomer-side Snowpark Container or JIL Cloud enclave
Scan rate100M records in 10 to 20 minutes
Coverage100% scan, not sample
DeliverableCREB library, retailer dossier, cardholder dossier, executive summary
PricingTier 1 flat fee, $150K to $750K by program size
Success criteriaDocumented trafficking patterns at retailer-level, CREBs delivered for each pattern, OIG-ready referral packages where applicable

POC.02 · Pre-Settlement Integration Pilot

ElementSpecification
CustomerEBT processor or state EBT switch
Duration90 days, integration + cohort run
CohortDefined pilot retailer subset (suggest: convenience-store cohort, ≤ 500 stores)
DeploymentPattern A · in-line sidecar at processor switch
LatencySub-800ms p99.95, sub-350ms median verdict
IntegrationISO 8583 tap, Kafka or MQ adapter, response channel
DeliverablePoCS receipts for cleared, CREB for held or blocked, dashboard, weekly trafficking reports
PricingPer-attestation SKU + one-time integration fee
Success criteriaVerdict SLA met, false positive rate ≤ 1.5%, ≥ 3 documented trafficking blocks per pilot week at scale
Section 09

Privacy, Compliance, and Security

Customer-side enclave
Privacy and Data Handling
  • All cardholder data, case file data, and PII remain in customer-side enclave. JIL Sovereign infrastructure never sees raw PII.
  • Card identifiers hashed (SHA3-256) before any feature extraction or cross-customer signal. Re-identification requires customer-side key material.
  • FNS recipient data handling complies with 7 CFR 272.1(c) confidentiality requirements.
  • State-level data sharing executed under formal agreement compliant with state-specific PII statutes.
  • HIPAA does not apply. SNAP is not health information under 45 CFR 160.103.
  • Cross-customer signals (DS.08 compromised card registry) use privacy-preserving Bloom filters; raw data never crosses tenant boundaries.
Security and Compliance Posture
  • FedRAMP Moderate baseline available for federal channel deployments. FedRAMP High path identified for OIG sensitive workloads.
  • NIST CSF 2.0 self-assessment on file. SOC 2 Type II in progress.
  • Cryptography: hybrid Ed25519 + Dilithium-III post-quantum, NIST FIPS 204 ML-DSA-65 compliant.
  • 14-of-20 BFT quorum across 13+ jurisdictions for CREB attestation seal.
  • 15+ year retention of CREB records in customer-controlled Secure Document Vault. Vendor-independent verification path.
  • JIL never custodies funds. Disputed transactions remain in Sealed Escrow under customer custody.
Section 10

Decisions Required

Owner sign-off needed

The following decisions require founder-level sign-off before the Nutrition Assistance Integrity vertical page goes live on jilsovereign.com and before the technical scope is socialized with prospective channel partners.

ID
Question
Options
Owner
D.01
Vertical name on site LOCKED
"Nutrition Assistance Integrity" confirmed. Mirrors USDA FNS naming convention. Expansion-ready across the FNS nutrition portfolio.
CEO · closed
D.02
Canonical vertical count
Update from 9 to 10 across jilsovereign.com Company menu, MCO deck, and Infrastructure Valuation Memo in one coordinated pass
CEO + Content
D.03
Pre-Settlement and Retroactive page scope
Add SNAP scope language as additional coverage (recommended) vs. new SKU on Pre-Settlement and Retroactive pages
CEO
D.04
Primary buyer for first paid engagement
State EBT agency (longer cycle, deeper relationship), USDA FNS/OIG (federal channel partner), or EBT processor (faster cycle, B2B)
CEO + BD
D.05
Federal channel partner for FNS/OIG path
Reuse existing federal partners from VA Integrity GTM (Accenture Federal, Leidos, SAIC, Peraton, Booz Allen, GDIT) vs. dedicated FNS-experienced firm
CEO + BD
D.06
UPC eligibility feed (DS.03) sourcing
GS1 US licensed feed (canonical, paid) vs. retailer-overlay-only (free, gappy) vs. hybrid (recommended, scope budget required)
CIO
D.07
FedRAMP authorization timing
FedRAMP Moderate already on roadmap; confirm whether to accelerate for USDA OIG engagement readiness in Q3 2026
CIO + COO
D.08
Check count canonical update
If 28 SNAP checks added to the published 175-check catalog, new total is 203 across 17 signal categories. Update all canonical surfaces.
CEO + Content