Verifiable grid measurement
Measurement you don't have to take anybody's word for.
A verifiable record of electrical grid condition. Every published claim carries the proofs needed to check it — offline, with no account, and without trusting whoever served it.
Open specification. Two independent implementations. Nine processes you can run on a laptop this afternoon.
The Contubernium substrate is owned by © Quantum Ridge Systems, Inc.
Why this exists
Automation outran the thing it was supposed to agree on
Software now places load, routes energy and schedules compute at machine speed. It does it against forecasts, prices and institutional signals — never against a shared account of what the system can presently sustain. Condition is not a forecast and not a settlement record; it is capability at the instant a decision is made, and nothing publishes it in a form two parties can check independently.
Lacking that reference, every participant self-insures. Reserve margin, risk premium, basis risk, conservative protection settings, interconnection queues evaluated against modelled peaks rather than observed condition. Uncertainty gets priced, and infrastructure gets financed against modelled distributions instead of measured performance. The waste is not a failure of optimisation — independent optimisers interfere because each one is reading a different picture of the same moment.
Measured
Of the day-ahead price that turned out to be the network being wrong about itself — across 22 hubs and CAISO, MISO and NYISO, 2023–2025, from public ISO data. Not an estimate. The method is published and the arithmetic is integer throughout.
The thesis
When contracts and financing settle against measured condition rather than modelled distributions, variance narrows and the cost of capital follows. The whitepaper puts that at 150–200 basis points of WACC on large infrastructure assets. That is a projection. Nobody has measured it, including us.
Who pays
Charge the party who needs to be believed. Never charge the party doing the believing. A verifiable record is hard to sell precisely because it is verifiable — so the scarce thing is the signed evidence and the obligation to serve it, never the derivation.
Electricity is first because it is where the absence shows up fastest: it must balance continuously, it reacts at the speed of physics rather than human process, and a mismatch between belief and condition cannot sit quietly — it appears immediately as congestion, frequency deviation or stranded energy. Anchoring the record costs almost nothing to run, which rules out one business and points at the others: there is no revenue in metering publication.
What is honest to say today: the gap is measured, the substrate runs, and the economics are not proven. Willingness to pay is unmeasured. There is no token, no stake, and nothing writes to a chain. Where this page states a figure it says whether it was measured or projected, and it will keep doing that.
Start here
Check a claim before you believe anything else on this page
A receipt is one file. It carries a condition and every proof needed to establish that it was published: the commitment, the inclusion proof, the anchored batch, and the checkpoint witnesses cosigned. The verifier is a script in the repository.
It does not phone home and has no notion of an account. Hand it a doctored receipt and it refuses — which is the only reason passing means anything.
The receipt below is a real one: a CAISO day-ahead hour at TH_NP15_GEN-APND, published, batched, anchored and cosigned. Witness signatures stay unchecked until you obtain the keys from somewhere that is not this server — a key served beside the document it defends establishes nothing.
Measured, not asserted
The gap between what the grid was expected to do and what it did
Before building a protocol on the claim that this gap is large and persistent, we measured it against public ISO data — 22 hubs across 3 markets, 2023–2025, integer arithmetic throughout.
divergence between day-ahead and real-time price at the same hour and place, as a share of the price level
hub-hours measured across CAISO, MISO and NYISO
of the surprise is the network part — congestion — at comparable granularity
The measurement also weakened two claims we started with. Adding a third market cut corridor rank-agreement from 73–100% to 56–71%. And congestion binds far more often in MISO (87–93% of hours) than in NYISO (30–58%), so the network story is per-market rather than general.
A control run at generator-node granularity exposed a sign-convention error in one market's published congestion data, which had inflated an earlier figure. Corrected, the finding held. Both the error and the correction are in the findings document.
Where you come in
A witness is worth running because of what it refuses
A transparency log proves things about itself. What it cannot prove is that it showed the same history to everybody — a log operator can serve two versions to two readers, each internally perfect. Witnesses close that gap, and only if the log operator doesn't run them.
A witness that signs whatever it is handed is worse than none: a reader's policy then reports satisfaction it never earned. So the job is four refusals.
A cosign request names a log and a size. It does not carry the checkpoint — you go and get that yourself. Signing what a caller hands you makes you a notary, and the caller chooses what gets attested.
A tree smaller than the one you last cosigned. Either something broke or something is being reverted, and neither is a thing to sign.
A second, different root at a size you already signed. Both cannot be honest. Keep the conflicting checkpoint and report it.
Growth with no verifying consistency proof from what you hold. This is where tampering gets caught before publication rather than in an audit afterwards.
Two HTTP endpoints and a file that survives a restart. Run the reference implementation, or write your own from the specification — an independent one is worth more, since a bug in ours is otherwise a bug in both.
Check yourself before anybody names you
The harness stands up its own log and drives it through a rollback, an equivocation and a rewritten prefix, then offers your node a checkpoint in the request body to see whether you sign what you were handed.
It is built to fail candidates: the test suite runs it against a rubber stamp, a credulous notary, an amnesiac and a witness signing with the wrong key, and requires each to be caught.
What this does not claim
One operator runs every node
Every witness cosignature in this deployment attests that the mechanism works. None of them attests that an independent party checked anything, because there is no independent party yet. The same author wrote the design, both implementations and every adversary.
That is recorded in the repository as a decision with an expiry rather than a caveat, naming the three things that discharge it:
- An independent implementer passes the conformance vectors working only from the specification. Any divergence is a specification defect until shown otherwise.
- An independent adversary attacks a running deployment, with the authority to publish what it finds and no briefing on where to look.
- Independent witnesses — parties who are not the log operator and not each other.
Until all three hold, no deployment under licence, and no document in the repository describes a criterion as met without saying by whom. Nobody outside the project runs a witness today. That is the gap, stated plainly, and it is the only one that cannot be closed by writing more code.
What exists today
Built to be joined, not only to be run
The determinism requirement is the trust model rather than a quality goal: given the same signed evidence and the same ruleset version, two independent implementations must produce byte-identical output. No floating point anywhere near a hash. No wall-clock reads inside verification. Records append; a correction is a new observation, never an edit.