You cannot re-run the client’s spreadsheet and get the same number.
The audit bundle re-computes the frozen plant with today’s engine and states whether chargeable and total emissions reproduce.
See how → Audit bundle- Frozen snapshot
- Layout change
- Evidence added
- Re-computed
Accredited verifier · auditor
Verify a client in one workspace — locked, logged and reproducible.
Every client who granted you access, in one place. You read their supplier submissions, the frozen plant, the evidence and its history — and the engine re-computes the figures in front of you.
1.53SEE of the test aluminium plant: verifier view = importer = supplier = engine
1 ZIPPDF · registry XML · engine data · snapshot · evidence · reproducibility check
0write paths into the client’s figures — read-only by design
Before you start
Five verifier pains — solved one by one
You must be able to stand behind your statement. These are the things that usually make that hard.
Files and figures can change while you review them.
You review a frozen, version-pinned snapshot; evidence filed is frozen with its SHA-256; the plant view is read-only.
See how → Locked plantYou cannot tell what changed, when, and by whom.
Layout changes and declaration versions are hash-chained; the history is cut off at the snapshot time and later changes are counted.
See how → Locked plantCollecting PDFs, XML, data and evidence from a client takes days.
One button per submission: everything in one ZIP with a manifest and an evidence index.
See how → Audit bundleYou need to show what you looked at — and the client wants to know.
Every open, view and download is logged against your grant; the client sees the same log.
See how → Access logSolved as you read: 0 of 5
- Reproducibility
- Locked evidence
- Tamper-evident history
- One-click audit bundle
- An access log
Step 1 of 7 · Your clients
Accept a client’s invitation with your own login
/auditor/acceptAccess is always granted by the client (importer), by e-mail. Accepting binds the grant to your login — nobody shares passwords.
- Open the link in the client’s e-mail and sign in with your own e-mail (magic link or 6-digit code).
- You see Access confirmed → Open the auditor workspace.
- A revoked, expired or invalid link says so plainly → Go to the auditor workspace.
Every tab, mode and control here
- Access confirmed
- Open the auditor workspace.
- We couldn’t accept this invitation
- Go to the auditor workspace.
Step 2 of 7 · Your clients
All your clients — and what is waiting for you
/auditorEach card is a client that granted you access, with the number of supplier submissions, how many are to review and how many you verified.
- Open Your clients. Each card shows the client, its submissions, to review and verified.
- Click a client to open its submissions; Refresh reloads.
Every tab, mode and control here
- Client cards
- Submissions · to review · verified.
- Refresh
- Reload the list.
Step 3 of 7 · Your clients · review
Open a submission: figures, evidence, bundle, outcome
/auditorA read-only view of the client’s supplier submissions. Every figure comes from the calculation engine; every action you take is logged and visible to the client.
- In the client, pick a submission and press Review / Open ….
- Read production, direct, indirect and SEE, the data tier and monitoring method.
- Open the locked plant — layout, evidence files, change history and the process model, read-only.
- Download the Audit bundle of the frozen snapshot (Bundle); with no snapshot yet, the live model is bundled and labelled so.
- Download each Evidence file. Choose the outcome — Verified, Needs revision or Rejected — add notes for the client (visible to them) and press Record outcome.
- Back to “to review” returns to the queue.
Every tab, mode and control here
- Submissions table
- Supplier / installation, CN, SEE, evidence, outcome, Review.
- Submission review (dialog)
- Figures · Open the locked plant · Audit bundle · Evidence files · Review outcome (the client's remarks shown apart) → Record outcome.
Step 4 of 7 · Your clients · locked plant
Inspect the locked plant — as frozen, or as it stands now
/auditor/plantBy default you see the latest frozen snapshot; evidence and history are cut off at the snapshot time, and later layout changes are counted. Switch to the live record if you need to.
- Inputs
- Process
- Good
- Stack
The plant you review is the one the engine computed: no palette, no save, no write path — and every view is logged (
plant_view).
- From the review press Open the locked plant. The banner says Locked for audit — read-only.
- Version: the latest frozen snapshot (default) or View the live record; changes since the snapshot are counted.
- ▦ Plant layout: objects, areas and their evidence (Evidence → download); History = the hash-chained change log.
- ⚙ Process model: the process graph with the engine SEE on each step.
Every tab, mode and control here
- Version
- Snapshot (default) / live record.
- ▦ Plant layout
- Objects, evidence (download only), change history.
- ⚙ Process model
- The graph the engine computed.
Step 5 of 7 · Your clients · evidence
One ZIP — and a reproducibility check inside
/auditorThe bundle is built from the client’s stored, frozen snapshot. Today’s engine re-computes it: chargeable and total emissions must reproduce.
- Report PDF
- Registry XML
- Engine data
- Frozen snapshot
- Evidence
Bundle contents: report PDF, registry QReport XML, engine graph + balances JSON, the frozen snapshot with version pins, an evidence index, the uploaded files, the plant layout (SVG / JSON, asset register, change history) and the MANIFEST.
- In the submission review press Bundle for the frozen snapshot (or download the live model when no snapshot exists).
- Open
MANIFEST: the version pins, the evidence index and the reproducibility result. - Compare: the figure in the PDF and XML = the engine re-computation = what the client and supplier see (live check: 1.53 for the test aluminium plant).
- Plant layout files:
layout/plant-layout.svg|json,asset-register.csv,evidence-index.csv,change-history.csv; withdrawn evidence is kept underwithdrawn/.
Every tab, mode and control here
- Bundle (frozen snapshot)
- Default; reproducibility checked.
- Download bundle (live model)
- When no snapshot exists yet — labelled.
Step 6 of 7 · Your clients · accountability
Everything you open is logged — for you and the client
/auditor/enterprise/verifiersEvery client read runs inside the granting client’s scope and is written to the verifier access log: workspace opens, plant views, evidence and bundle downloads, outcomes.
- Work normally — nothing to switch on.
- The client opens Activity on their Verifier Access page to see the same log.
- Access ends on the date the client set, or when they press Revoke access.
Every tab, mode and control here
- Activity (client side)
- The access log for your grant.
- Revoke access (client side)
- Ends your access immediately.
Step 7 of 7 · Method
The method behind every figure
/helpHow the engine calculates and where every figure comes from: SEE, precursors and the system boundary, defaults and the mark-up, free allocation, Article 9 (claim-only), waste gases.
- Open Method & guides (Help). Search, or filter by category: Getting started, The modules, Compliance & deadlines, Data & accuracy, FAQ.
- Read Why the numbers are trustworthy, What is SEE?, Precursors & system boundary, Default values & the mark-up.
- Sector plant guides are generated from the same templates the engine uses — 25 routes in 6 sectors.
Every tab, mode and control here
- Search + categories
- All · Getting started · The modules · Plant models by sector · Compliance & deadlines · Data & accuracy · FAQ · Troubleshooting.
- Guides
- Illustrated guide, tutorials and these role guides.
Trust
Why the numbers can be trusted
What you verify is what the engine computed — and you can prove it independently from the bundle.
Every role sees the same figure
Importer, supplier, verifier and the engine show the identical result — checked live: the Anatolia Light Metals aluminium plant is SEE 1.53 for all four. All 25 Annex I routes recompute byte-identically, in any entry order.
tests/test_reproducibility.py
Reproducible audit bundle
One ZIP: report PDF, registry XML, engine data, the frozen snapshot with version pins, evidence files and a reproducibility check — today’s engine must give the same figures from the frozen plant.
twin.build_audit_bundle · verifier_workspace.py
Tamper-evident history
Filed declaration versions and every plant-layout change are hash-chained: each entry seals the one before it, and the check names the first altered entry. A filed version is never rewritten.
DeclarationVersion (prev_hash → entry_hash) · twin_layout_events
Every verifier action is logged
A verifier sees a client only through a grant the client issued; every read and download is written to an access log the client can open, and access can be revoked at any time.
VerifierGrant · verifier_access_log
Numbers only from the engine
Every emission, certificate and euro figure is computed by one calculation engine. The AI assistant explains and guides, and is blocked from stating a figure — it routes you to the calculator.
api/app/services/cbam_engine.py · AI number guard (support_guide.py)
Geo-grounded, locked meter photos
A meter reading carries its photo, the EXIF read by the server and a 50 m geo check against the meter’s registered location. Once locked, the flow it feeds cannot change.
api/v1/meters.py · geo.py · photo_exif.py
It fails closed, never guesses
If official reference data cannot be read, the app answers “nothing was calculated” (503) instead of substituting a value. An unknown country or unit is a reported row error, never a best effort.
app/core/reference.py · customs_import.py · iso_countries.py
Official EU annexes, read cell by cell
Default values come from the Official Journal, extracted cell by cell (plain text extraction shifts rows). Example: Türkiye grey cement 1.36 + 0.08 = 1.44 tCO₂e/t; “NA” is Namibia (0.89), never “missing”.
scripts/import_annex_ii_iii.py · default_values_repo
What we do not claim: the app prepares and validates your declaration XML — it does not file in the EU CBAM Registry for you, and it is not itself an accredited verifier or a certification. Forecast prices are assumptions, never certified figures.
Nothing missed
Coverage checklist
Every screen, tab, mode and drawer of the verifier workflow, mapped to the section that explains it — 5 screens, 16 items, 100 % covered. The same list is checked by an automated browser test against the app.
Route + tab → guide section (16 items)
| Route | Tab / mode / control | Section | |
|---|---|---|---|
| /auditor/accept | Access confirmed / invalid link | Accept access | ✓ |
| /auditor | Client cards | Your clients | ✓ |
| /auditor | Refresh | Your clients | ✓ |
| /auditor | Client submissions table | Review a submission | ✓ |
| /auditor | Submission review dialog | Review a submission | ✓ |
| /auditor | Evidence files: Download | Review a submission | ✓ |
| /auditor | Outcome: Verified / Needs revision / Rejected + notes → Record outcome | Review a submission | ✓ |
| /auditor/plant | Locked for audit banner | Locked plant | ✓ |
| /auditor/plant | Version: snapshot / View the live record | Locked plant | ✓ |
| /auditor/plant | Tab: ▦ Plant layout (objects, evidence, history) | Locked plant | ✓ |
| /auditor/plant | Tab: ⚙ Process model | Locked plant | ✓ |
| /auditor | Audit bundle (frozen snapshot / live model) | Audit bundle | ✓ |
| /auditor | Reproducibility check in the MANIFEST | Audit bundle | ✓ |
| /enterprise/verifiers | Activity: verifier access log (client side) | Access log | ✓ |
| /help | Search + categories | Method & guides | ✓ |
| /help | Guides links (role guides) | Method & guides | ✓ |