Report what you
can prove.

A workbook is hashed on arrival and stored exactly as received. The hash is taken BEFORE parsing, because a hash taken afterwards proves only that the parser is consistent with itself.

Upload the same bytes twice and it is one artifact, not a month of production counted again. A file nothing can read is quarantined with its reason rather than rejected, because the evidence that somebody submitted something broken is itself evidence.

Nothing deletes a raw artifact. The chain from any reported tonne ends at one of these files.

Headers change every month and units hide in brackets. The mapper proposes a mapping from the shape of the header row and saves it, so the second month is a confirmation rather than a chore.

Any unit or date ambiguity is a visible choice. The original value and unit are kept beside the converted one for the life of the record, because once the original is gone a wrong conversion and a right one look identical.

Every conversion step is recorded on the row, including the standard conditions a gas volume was measured at.

Duplicated periods, a unit mismatch, a gap in a record the regulation requires to be daily, a step change no operation explains. Each is raised against the row that caused it, with the context needed to judge it.

A blocker stops the dataset being approved, and clearing one takes a disposition and a reason. Accepted with no reason is how a blocker becomes a rubber stamp, and the trail of who decided what is the product.

A dataset with an open blocker cannot be calculated from, and a run that was never approved cannot be issued.

A line shows the activity in the unit the factor was published for, the factor value and which end of its published range was taken, the conversion path, and the uncertainty.

Source state propagates downward and never upward. A measured volume through a global average factor yields an ESTIMATED emission, because the volume was measured and the emission was inferred. That distinction is the whole Tier 2 to Tier 3 journey.

Where a factor version changes mid-period the period is split, and each part uses the factor that was in force.

A run fixes its methodology version, factor set, warming potential basis and every assumption, and stores them rather than resolving them later. The pack that produced a 2026 filing may be superseded by the time anyone asks, which is exactly when the question gets asked.

The engine is a pure function: no network, no database, no clock. Run it twice on the same frozen inputs and the manifest hash matches. A test parses the package and fails if any line of it reads the clock.

Two runs sharing a manifest hash computed the same thing from the same inputs under the same rules. That is the property the verifier rests on.

The chain is a typed graph: report line, calculation line, methodology version, factor version, dataset snapshot, raw row, and the file hash underneath all of it.

Any figure on any screen opens it. The promise is bounded rather than best effort: a small, fixed number of hops from any number to the bytes it rests on.

An auditor's first question is where a number came from. This is the answer itself, not a description of it.

The obligations are data, not code: a versioned rule pack where each requirement carries its instrument, its section and the text it came from. Change the pack and every screen moves with it.

The quarterly inventory, the monthly gas return inside 21 days, LDAR frequency rising from one inspection a year to four, repair clocks on leaks and unlit flares, and the annual report a responsible official has to sign.

Where the primary instruments disagree, the system shows the disagreement rather than choosing. The 60 per cent methane target appears with three different dates across two documents, and none of them is picked silently.

Measured coverage is the share of your material emissions that an instrument actually reports. Everything else is inference, however carefully done.

Each unmetered source is listed with what closing it would move from estimated to measured, so the register reads as a purchase order in priority sequence rather than a score. Flare and vent meters also need Commission approval before installation, and that gate is part of the plan.

January 2027 is the full transition date. The question by then is not whether you have a number, it is whether an instrument produced it.

The GHG Emissions Management Plan and the inventory return, including the summary workbook, using the Commission's own controlled vocabulary and the AR5 100-year warming potentials carried in the header of the file it issued.

Issuance is gated: not from an unapproved run, not from a run containing synthetic data, and not by the person who ran the calculation. A correction becomes a new revision and the previous one is marked superseded.

A responsible official is defined in the guidelines. That definition is why approver is a distinct role here rather than a permission bolted onto an existing one.

The issued document is hashed after rendering, and the code on it resolves to a public page showing whether the file in front of you is the file that was issued, a later revision, or neither.

It exposes nothing beyond what the document already states. Change one byte and the answer is MISMATCH. A superseded document says superseded rather than saying nothing.

The point of a verifier is that it works for somebody who has no account and no particular reason to trust you.

It calls the same endpoints the workspace calls, and the calls are shown alongside the answer, so anything it says traces back to the calculation that produced it.

It cannot change a calculation, dismiss a blocker or approve anything, and it cannot state a regulatory requirement that is not in the rule pack. Insufficient evidence is a valid and preferred answer.

A model that influences a reported number makes it unreproducible. This one sits beside the engine and never inside it.