Verifiable grid measurement
Contubernium is where the electricity market keeps its proof: a tamper-proof public record of what the grid is actually doing, hour by hour. Nobody — including us — can rewrite an entry, and anybody can check one: offline, free, no account, no trust in whoever served it.
Published specification. Source-available verifier. Two independent implementations that agree byte for byte.
The substrate
Contubernium is where the electricity market keeps its proof. Technically it is a substrate — a foundation layer laid beneath the market's numbers the way bedrock sits beneath a building: neutral, unseen, and holding up everything built on top of it.
Mechanically, it is a logbook. Entries are only ever added — never edited, never erased. Outside witnesses countersign it, so not even the operator can quietly rewrite history. And every entry comes with a receipt anyone can check, so believing the record never requires trusting the record-keeper. That is the whole idea; everything below is the machinery that makes those two promises hold.
What goes in the logbook is the third kind of grid information — the one nothing publishes checkably today. Forecasts say what is expected to happen. Settlement records say what already happened, weeks later. Contubernium records condition: what the system can actually sustain at the instant a decision is made. In this project's vocabulary, that makes it an operational substrate — a neutral measurement and verification layer beneath existing infrastructure, beginning with the electric grid.
To be usable by machines rather than lawyers, that record has to hold three properties at once. It is time-bounded — every claim names the interval it covers. It is attributable — every observation is signed by an identified instrument, so evidence has an owner. And it is deterministic — given the same signed evidence and the same ruleset version, any two independent implementations produce byte-identical output. The third one is the trust model: if determinism fails anywhere, verification collapses into "trust the publisher."
Identified instruments sign time-bounded observations. Versioned, immutable rulesets derive condition fragments from that evidence — integer arithmetic throughout, no floating point anywhere near a hash. What gets committed is a digest, never a measured value: the record proves what was said without becoming an authority on it.
Commitments anchor into an append-only transparency log. Independent witnesses fetch its checkpoints — never accept them pushed — and cosign only what is consistent with everything they have already signed. A log that rewrites history or shows different views to different readers produces, in the conflicting signatures, the evidence against itself.
A reader accepts a claim only with the proofs attached: the commitment, its inclusion in an anchored batch, consistency with the witnessed checkpoint. One file, checkable offline, with no account and no API key — against a witness policy the reader chooses, not one the operator grants.
Once such a record exists, coordination stops requiring a coordinator. Contracts can settle against measured condition instead of modelled distributions, machines can schedule against what the system can actually sustain, and disagreement is resolved by evidence and ordering rather than by authority. That is the whitepaper's argument, and the section below is careful about which parts of it are measured and which are still projection.
Records append; a correction is a new observation superseding by ordering, never an edit. There is no token, no stake, and nothing writes to a blockchain — the anchor is a witnessed transparency log, and new behaviour means a new ruleset version, never a retroactive reinterpretation of existing records.
Why this exists
The electricity market runs on published numbers, and billions of dollars settle against them every week. Three things are wrong with those numbers, and everyone in the industry knows it. They get revised — operators restate data after publication, and which version counts is settled by argument. They get deleted — grid operators purge their own history, and a record nobody kept provably is a record that no longer exists. And claims against them can't be checked — "we were available", "we produced", "we curtailed" are all take-my-word-for-it.
Every mature market solved this. Stocks have the consolidated tape; commodities have warehouse receipts; shipping has bills of lading. Electricity never built its equivalent — so every participant self-insures. Reserve margins, risk premiums, audits, and financing priced against modelled distributions instead of measured performance. That padding is paid whether or not anything goes wrong, because independent parties are each reading a different picture of the same moment.
Measured
Of the day-ahead price that turned out to be the network being wrong about itself — across 22 hubs and CAISO, MISO and NYISO, 2023–2025, from public ISO data. Not an estimate. The method is published and the arithmetic is integer throughout.
The thesis
Every mature market's record became the thing contracts name — the tape, the warehouse receipt, the index. The bet is that verified condition becomes that for electricity, and the record that gets there first is the one counterparties already accept. That is ambition, stated as one. Today's revenue is the receipts, not the reference.
Who pays
The party that needs to be believed pays; checking the claim is free, forever. A battery operator whose $40k/month rides on a 97% availability guarantee pays to have its meters file provable records — and the utility paying that invoice verifies them in seconds, for nothing. Checking was never the product: a receipt can only be created for a claim filed the moment it happened, and nothing can be backdated — so proof cannot be bought after a dispute arises, which is exactly why it is worth paying for before one.
Electricity is first because it is where the absence shows up fastest: it must balance continuously, it reacts at the speed of physics rather than human process, and a mismatch between belief and condition cannot sit quietly — it appears immediately as congestion, frequency deviation or stranded energy.
What is honest to say today: the gap is measured, the substrate runs, and the economics are not proven. Willingness to pay is unmeasured. There is no token, no stake, and nothing writes to a chain. Where this page states a figure it says whether it was measured or projected, and it will keep doing that.
Start here
A receipt is one file. It carries a condition and every proof needed to establish that it was published: the commitment, the inclusion proof, the anchored batch, and the checkpoint witnesses cosigned. The verifier is a script in the source archive, served below like everything else.
It does not phone home and has no notion of an account. Hand it a doctored receipt and it refuses — which is the only reason passing means anything.
The receipt below is a real one: a CAISO day-ahead hour at TH_NP15_GEN-APND, published, batched, anchored and cosigned. Witness signatures stay unchecked until you obtain the keys from somewhere that is not this server — a key served beside the document it defends establishes nothing.
Measured, not asserted
Before building a protocol on the claim that this gap is large and persistent, we measured it against public ISO data — 22 hubs across 3 markets, 2023–2025, integer arithmetic throughout.
divergence between day-ahead and real-time price at the same hour and place, as a share of the price level
hub-hours measured across CAISO, MISO and NYISO
of the surprise is the network part — congestion — at comparable granularity
The measurement also weakened two claims we started with. Adding a third market cut corridor rank-agreement from 73–100% to 56–71%. And congestion binds far more often in MISO (87–93% of hours) than in NYISO (30–58%), so the network story is per-market rather than general.
A control run at generator-node granularity exposed a sign-convention error in one market's published congestion data, which had inflated an earlier figure. Corrected, the finding held. Both the error and the correction are in the findings document.
Where you come in
A transparency log proves things about itself. What it cannot prove is that it showed the same history to everybody — a log operator can serve two versions to two readers, each internally perfect. Witnesses close that gap, and only if the log operator doesn't run them.
A witness that signs whatever it is handed is worse than none: a reader's policy then reports satisfaction it never earned. So the job is four refusals.
A cosign request names a log and a size. It does not carry the checkpoint — you go and get that yourself. Signing what a caller hands you makes you a notary, and the caller chooses what gets attested.
A tree smaller than the one you last cosigned. Either something broke or something is being reverted, and neither is a thing to sign.
A second, different root at a size you already signed. Both cannot be honest. Keep the conflicting checkpoint and report it.
Growth with no verifying consistency proof from what you hold. This is where tampering gets caught before publication rather than in an audit afterwards.
Two HTTP endpoints and a file that survives a restart. Run the reference implementation, or write your own from the specification — an independent one is worth more, since a bug in ours is otherwise a bug in both.
The harness stands up its own log and drives it through a rollback, an equivocation and a rewritten prefix, then offers your node a checkpoint in the request body to see whether you sign what you were handed.
It is built to fail candidates: the test suite runs it against a rubber stamp, a credulous notary, an amnesiac and a witness signing with the wrong key, and requires each to be caught. Every party that countersigns is named on the witness record — permanently, with a row held open for the first one who is not us.
What this does not claim
Every witness cosignature in this deployment attests that the mechanism works. None of them attests that an independent party checked anything, because there is no independent party yet. The same author wrote the design, both implementations and every adversary.
That is recorded as a decision with an expiry rather than a caveat, naming the three things that discharge it:
Until all three hold, no deployment under licence, and no project document describes a criterion as met without saying by whom. Nobody outside the project runs a witness today. That is the gap, stated plainly, and it is the only one that cannot be closed by writing more code.
What exists today
The determinism requirement is the trust model rather than a quality goal: given the same signed evidence and the same ruleset version, two independent implementations must produce byte-identical output. No floating point anywhere near a hash. No wall-clock reads inside verification. Records append; a correction is a new observation, never an edit.