Passive recon + public-record market intelligence · irs.gov · 2026-07-10
The first brief credited a strong public estate and found one structural gap. This pass goes further: a wider passive sweep of the taxpayer, preparer, and agent-discovery surface, and a public-record read of how the agency funds, procures, and builds software, its modernization plan, its case-management program, and the casework workflows where a tamper-evident evidence object removes mail round-trips. The aim is to make the efficiency felt before anyone adopts anything.
✎ Read this as an opportunity map, not a callout, and not an IRS project. It is an independent prototype by EcoWealth Corporation, not affiliated with, not endorsed by, and not in partnership with the IRS or any government agency, and it makes no claim of adoption, official use, or procurement. Every workpaper shown is fabricated, anonymized demo data. All IRS facts are cited from public records.First, the baseline: a wider look, and it is still good
Seven taxpayer- and preparer-facing pages were driven as a normal visitor in real Chrome (home, CP2000-series notice, the notice-and-letter hub, online-account landing, forms & instructions, Tax Pro Account, e-Services). Every one returned HTTP 200, rendered cleanly, and showed no bot wall to an ordinary browser.
x-generator), fronted by Akamai CDN with Bot Manager (_abck / bm_sz) and an application load balancer.Strict-Transport-Security, X-Content-Type-Options: nosniff, and X-Frame-Options: SAMEORIGIN are present on all seven pages, a consistent, estate-wide posture, not per-page luck.max-age=72 while the homepage carries max-age=86400. A Drupal-generated sitemap.xml was freshly rebuilt (lastmod 2026-07-08).@graph of page metadata; content is offered in seven languages; robots.txt is a maintained file, not a default.Honesty note up front: the only genuine page-level JavaScript signal across all seven pages was a single non-fatal null-read on the homepage (Cannot read properties of null (reading 'parentNode')). Every other "error" in our raw logs is our own artifact, we blocked webfonts to stabilize the headless run, and Google Analytics / Tag Manager beacons fail in a headless context by design. Those are not IRS defects, and we don't count them as findings.
The bottom line, in plain English
No jargon, and no claim of adoption, this is a concept. Here is what each opportunity below would be worth in plain terms.
People now ask an AI before they read the page, and every agent-discovery path is a 404, so it improvises; a static index points it at the authoritative answer instead.
Even after "paperless," evidence is an unstructured upload, so an examiner asks for the one missing thing and a taxpayer re-sends the wrong stack; an explicit, checkable workpaper cuts that rework for both sides.
Status today is a phone call rather than a state anyone can read, so a taxpayer (and their assistant) has to queue to find out what's open; a legible state answers it without the call.
Pages get renamed and cited URLs drift, so an AI can quote a pre-rename link; a stable index keeps every citation landing on the current, correct page.
Seven findings: deeper, evidenced, non-alarmist
Taxpayers increasingly ask an AI assistant "what does this notice mean and how do I respond?" before they open the page. The wider sweep confirms there is no machine front door anywhere an assistant would look: twelve standard discovery paths all 404, and robots.txt is a single wildcard block that neither invites nor blocks any named AI crawler.
# standard public GETs, normal-visitor requests, no probing (2026-07-10) 404 /llms.txt 404 /.well-known/mcp.json 404 /.well-known/agent-card.json 404 /.well-known/security.txt # RFC 9116 404 /.well-known/agent.json 404 /security.txt 404 /.well-known/ai-plugin.json 404 /openapi.json 404 /ai-plugin.json 404 /humans.txt 404 /.well-known/gpc.json 404 /.well-known/apple-app-site-association 200 /sitemap.xml 200 /robots.txt # present, but for search engines, not agents # robots.txt is one "User-agent: *" block. No AI crawler is named: grep -i 'gptbot|google-extended|ccbot|claudebot|perplexity|anthropic|applebot-extended' robots.txt → no matches # assistants are governed only by the generic wildcard rule
Why it matters: this is a first-mover position, not a catch-up. A small, static llms.txt + agent card, pointing to authoritative pages and, in this concept, to a structured workpaper lane, is the difference between an assistant citing the right guidance and an assistant guessing at a PDF. The Agent Kit shows the exact file shapes.
The notice pages are clear and well-written, but the mechanism they describe is prose. Extracted verbatim from the rendered CP2000-series DOM:
# DOM text: "Understanding your CP2000 series notice" (rendered, visible copy) "What you need to do" • Review the entire notice and follow the instructions to resolve this issue. • Reply to the notice by the date listed. • If a response form is included in your notice, complete and sign it. # the notice-and-letter hub, same shape: "respond, act by the due date."
The modern Document Upload Tool (a real win of the Paperless Processing Initiative) lets a taxpayer upload "scans, photos, or digital copies … as JPGs, PNGs or PDFs", but that moves the stack from an envelope to an upload box. It is still an unstructured stack, not a checkable object that says here is exactly what's required, here is what's attached, here is what's still open.
Why it matters: when requirements and evidence stay implicit, casework bounces: an examiner asks for the one missing thing, the taxpayer re-sends the wrong stack, and the proof chain scatters across mail, upload, and phone. This is precisely where the Evidence Workpaper Protocol adds structure, detailed in the efficiency proof.
Content pages carry a Drupal-generated JSON-LD @graph, so a machine can reliably identify the page ("this is the CP2000 page"). But nowhere is there a structured type for a notice, an evidence requirement, or a case state. The homepage carries no JSON-LD at all.
# rendered-DOM check, 7 pages JSON-LD @graph present: cp2000-series, notice-hub, online-account, forms-instructions, tax-pro-account, e-services JSON-LD absent: home Structured case / notice / requirement type anywhere: none
Why it matters: an assistant can find the right guidance page, but it cannot read "here is what THIS taxpayer's case still needs." Page metadata answers "what is this document?"; a workpaper answers "what does this case need to advance?": the second is the object that removes the back-and-forth.
By public record, a CP2000 (Automated Underreporter) case is tracked by calling the number on the notice. There is a clock: Policy Statement P-21-3 requires a substantive reply or interim letter within 30 days of the IRS receiving a response, but no structured, machine-readable status object a taxpayer's assistant could poll.
# public IRS / practitioner guidance (cited below) respond within 30 days of the notice date (60 if abroad) IRS reply/interim letter target: 30 days after it receives your response (P-21-3) "agree" adjustment posts: ~4–12 weeks response processing: ~8–12 weeks status channel: phone the AUR unit structured status object: none
Why it matters: a readable status + a resolution receipt is the difference between "call and wait on hold" and "an assistant reads the current state and the one open item in a second." That is the felt efficiency, on both sides of the desk.
Content is well-maintained, but URLs move, and an assistant or a saved bookmark hits the old one. All resolve, which is itself a strength; the drift is the point.
# curl -IL, old, widely-cited URLs still resolve, via a rename /individuals/understanding-your-cp2000-notice → 301 /individuals/understanding-your-cp2000-series-notice 200 /payments/your-online-account → 301 /payments/online-account-for-individuals 200 /tax-professionals/e-services 404 # while /e-services is 200 /filing/irs-direct-file-for-free 404 # a plausible marketing slug, gone
Why it matters: genuinely minor, nothing 404s that a human would reach through search. But an AI citing a pre-rename URL looks stale, and a stable, agent-readable index removes the ambiguity for the tools now doing the first read.
Purely from response headers any browser receives, no testing of any kind, the same profile appears on all seven pages, so the headroom is a single systemic decision rather than a page-by-page fix.
# response headers, all 7 pages (observed, not probed) present strict-transport-security: max-age=31536000 # no includeSubDomains / preload present x-content-type-options: nosniff present x-frame-options: SAMEORIGIN absent content-security-policy · referrer-policy · permissions-policy note x-generator: Drupal 10 # version disclosed on every page (minor)
Why it matters: incremental, not urgent, the basics are in place and consistent. A CSP, a Referrer-Policy, a Permissions-Policy, extending HSTS with includeSubDomains; preload, and suppressing the generator header are the standard next rungs, and because the config is uniform, they are one change, not seven.
Analytics is third-party and standard: two Google Analytics 4 properties plus Google Tag Manager load on content pages. One benign, honestly-reported artifact: on the CP2000 page a Tag Manager script was requested with an unresolved placeholder in its id.
# request log, cp2000-series (third-party analytics, privacy/perf surface) GA4: G-ZY6FM95CS5 + G-CSLL4ZEK4L # dual-property GTM: gtm.js?id={TRACKING_ID} # literal, unresolved placeholder, a config nit, not a defect
Why it matters: almost not at all, it is third-party and harmless. We surface it only because a ruthless pass reports what it sees, and reporting the small benign thing is how you earn trust on the big structural one (findings 2–4).
Evidence log: method & dates (all 2026-07-10, passive)
| Check | Method | Result |
|---|---|---|
| Apex & scheme normalization | curl -IL | 301 http→https→www.irs.gov (ALB), then 200 |
| 12 agent-discovery paths | GET (status only) | all 404 (llms.txt, agent-card, agent, ai-plugin ×2, mcp, security.txt ×2, openapi, humans, gpc, aasa) |
/sitemap.xml · /robots.txt | GET | 200 · 200 (sitemap Drupal-generated, lastmod 2026-07-08) |
| robots.txt AI directives | GET + grep | single User-agent: *; no AI crawler named; faceted-search + TEOS + admin/auth disallowed |
| CP2000 legacy URL | curl -IL | 301 → …cp2000-series-notice → 200 |
| online-account legacy URL | curl -IL | 301 → …online-account-for-individuals → 200 |
/e-services vs /tax-professionals/e-services | curl -IL | 200 vs 404 |
| Headers, 7 pages | response headers | HSTS + nosniff + X-Frame SAMEORIGIN on all; CSP / Referrer-Policy / Permissions-Policy on none; x-generator: Drupal 10 |
| 7 pages render (Chrome, 2× DPI) | Playwright | all 200; no bot wall; 1 non-fatal homepage null-read; other console noise = our font-block + third-party GA/GTM |
| CP2000 "what you need to do" | rendered DOM text | "reply by the date listed / complete and sign the enclosed form": document-shaped |
| JSON-LD structured data | rendered DOM | @graph present on 6 content pages, absent on home; no case/notice/requirement type anywhere |
| Third-party analytics | request log | GA4 ×2 + GTM; a gtm.js?id={TRACKING_ID} unresolved-placeholder request on CP2000 |
| directfile.irs.gov | GET (status) | no response to a passive request (status 000), treated as their infrastructure, not probed further |
Market intelligence: how the IRS actually modernizes (public record)
Before "where EWP fits" can mean anything, you have to know how a federal agency of this size funds, buys, and builds software. All of the below is drawn from public records: the IRS's own Strategic Operating Plan, Treasury press releases, GAO and TIGTA reports, federal contract news, and the Federal Register. Cited in full at the end.
The Inflation Reduction Act (August 2022) gave the IRS a historic modernization budget, roughly ~$80B originally, but it has been repeatedly rescinded: down to about $37.6B by late 2025 and, after a further ~$11.7B rescission in January 2026, to ~$26B remaining through FY2031. (Figures as of 2026-07; the funding level is actively changing.)
The IRA Strategic Operating Plan (Publication 3744, 2023) set the original direction: better service, modernized systems, stronger enforcement, but it is now in a strategic pause (announced March 2025). The IRS is re-evaluating it for AI and reprioritizing its ~23 programs into a leaner ~9-initiative draft framework, with new FY2026–2030 Treasury and IRS strategic plans set to replace it (Treasury's expected ~Feb 2026, the IRS's by ~summer 2026). What is not in transition is the "Digital First" direction it anchored, the Paperless Processing Initiative (August 2023): let taxpayers submit correspondence and notice responses digitally, and digitize incoming paper at the point of receipt.
Signal for EWP: even mid-transition, the through-line holds: remove paper, make casework digital and legible. Whatever succeeds the SOP points the same way; the plan names the destination, not yet the case-object shape.
Real, visible progress: the Document Upload Tool accepts notice responses as JPG/PNG/PDF and had taken ~900,000 responses by April 2024; the IRS estimates >94% of individual taxpayers will no longer need to mail anything. Online Account for individuals and the Tax Pro Account are live self-service surfaces. Direct File piloted in 2024 (12 states) and expanded to ~25 states for filing season 2025, though the IRS has since told states it "will not be available in Filing Season 2026," with a Treasury task force funded to study free-file alternatives.
Signal for EWP: the transport for digital casework already exists (upload + account). What rides on that transport is still an unstructured stack. EWP is the object that would ride on top, not a new portal.
Modernization is bought through Blanket Purchase Agreements and task orders, usually preceded by a public Sources Sought notice. The flagship applications-development vehicle is EDOS (Enterprise Development, Operations Services), a $2.6B-ceiling, seven-year BPA that pulls 400+ IRS systems under one contract; awardees include Accenture Federal Services, Booz Allen Hamilton, IBM, and Maximus. The program most relevant here is Enterprise Case Management (ECM): a business-driven effort to consolidate 60+ legacy case-management systems onto one cloud platform (AWS, using the Pega COTS engine). ECM has migrated processes such as the Exempt Organizations Correspondence Unit and spent $190M+, and per TIGTA, as of April 2025 none of the legacy systems had yet been decommissioned.
Signal for EWP: the IRS is already building a case/packet primitive with an audit trail. A vendor-neutral evidence-workpaper shape isn't a competing platform, it is a candidate packet format and resolution-receipt layer that could sit inside an ECM-style system or a modernization vendor's task order. It is proposed as a concept, and is not procured, adopted, or affiliated.
The casework shapes that generate the most avoidable round-trips are well-documented, and each maps onto one of the seven demo packets:
Automated Underreporter / CP2000: an automated match of third-party info returns against the filed return; resolution is a substantiation exchange on a P-21-3 clock. Deduction & credit substantiation: contemporaneous records of the right type. Preparer due diligence: Form 8867 under IRC §6695(g) / 26 CFR §1.6695-2 requires preparers to contemporaneously document the questions asked and records relied on, and to retain them, on penalty of ~$500 per failure. Exempt-organization correspondence and amended-return adjustments round out the set.
Signal for EWP: every one of these is "prove the item with the right evidence, without losing the chain." That is exactly the packet the demo lane already walks, on fabricated data.
Where the Evidence Workpaper Protocol fits: honestly
The efficiency proof: the friction removed, made concrete
A notice arrives. The taxpayer reads prose, guesses what "supporting documentation" means, mails or uploads an unstructured stack, and waits 8–12 weeks for it to be processed.
The item is packetized with explicit requirements, each checkable, so the right evidence is attached the first time, not guessed at.
If one thing is missing, a new letter goes out asking for "documentation," restarting a 30-day response window and another multi-week processing cycle. Status is a phone call to the AUR unit.
The reviewer names exactly the one open item; the checklist shows in real time what's left; status is a readable object, not a hold queue.
"Resolved" is an outcome with the proof scattered behind it across mail, upload, and notes, hard to reconstruct, harder for an AI to verify.
A resolution receipt issues: outcome, evidence summary, and the machine-readable proof chain in one replayable object an examiner's AI can verify in a single pass.
Quantified on the fabricated demo library: every resolved packet closes after exactly one precisely-named "needs more info" step, never an open-ended "send supporting documentation." That single, scoped bounce is the difference between one round-trip and several:
| Demo packet (fabricated) | Requirements | "Needs more info" bounces | Bounce precisely scoped? | Status channel |
|---|---|---|---|---|
| CP2000-style notice-response | 3 | 1 | Yes, the one open item named | Readable object |
| Clean-energy credit substantiation | 3 | 1 | Yes, basis summary only | Readable object |
| Deduction substantiation | 3 | 1 | Yes, proof-of-payment only | Readable object |
| Preparer due-diligence | 2 | 1 | Yes, documented basis only | Readable object |
| Amended-return evidence | 3 | 1 | Yes, reconciliation only | Readable object |
| Correspondence routing (answer is "no") | 2 | 1 → routed | Yes, reason recorded, chain kept | Readable object |
Reading the table honestly: the timing figures (8–12 weeks, 30-day windows) are public facts about today's process; the packet counts are fabricated demo data. We deliberately do not assert a specific "X% faster" adoption number, we have no production data and would not invent one. The structural claim is the honest one: each avoided, imprecise bounce is one fewer weeks-long mail cycle and one fewer phone-status call, and the demo shows the packet making that bounce precise and rare by construction.
Public sources (all facts above)
irs.gov/about-irs/irs-inflation-reduction-act-strategic-operating-planirs.gov/newsroom/irs-launches-paperless-processing-initiativeirs.gov/help/irs-document-upload-toolThe hand-off
The operator is an IRS taxpayer every year, this concept comes from that seat, not a vendor pitch. The ask is fifteen minutes and one working demo: a CP2000-style notice resolved as a structured workpaper, on fabricated data, with a proof chain an examiner's AI could verify. No claim of adoption, no system access, nothing touching real taxpayer data, a leave-behind for if and when a modernization team, a tax clinic, or a gov-tech vendor is in the room.
