CANOPY

Removal paid from escrow on an accredited verifier’s signature, each quarter released once, and every retirement signed where a second claim on the same tonnes is plain to see.

Open the live chamber in the app
The animated flow, the attack replays and the deep architecture run there; this page is the reference text.

Who this serves

• Removal project developer. Offtake money held before the first tonne and released on the verifier’s signature.
• Accredited verifier. One signed attestation per batch, and the tranche it unlocks is paid exactly once.
• Corporate buyer. Every tonne you retire cites its attestation, on a record your auditor can replay.
• Registry operator. A sovereign frame for your country’s projects, federated with the buyers’ frames.

The problem

Carbon removal is bought years before it is delivered and verified months after it happens. Between the kiln and the claim, a tonne passes through a sensor network, a verification report, a registry entry, a purchase order and a sustainability report, each kept in a different system, and the joins between them are spreadsheets. The same tonne can be sold twice, a failed batch can be quietly re-run, and a buyer’s claim rests on a reconciliation somebody performs once a year.

The system

CANOPY is a carbon removal network in which each project’s country runs its own registry frame: a cooperative running 38 biochar kilns in the Ember Hollow valley, 164 reforestation plots in the northern uplands and a mineralisation plant on a basalt coast, each checked by independent verifiers and sold to buyers who run frames of their own. At 07:40 on a Tuesday in October, verifier-07 signs Ember Hollow’s third-quarter batch: 1,240 tonnes of removal, drawn from readings that every kiln’s probes signed as they were taken. The buyer’s offtake, 4,800 tonnes for the year at 18 units a tonne, has sat in escrow since January, and the signature releases 22,320 units to the cooperative’s treasury the same morning. Every unit that leaves the escrow arrives in the treasury, and an independent auditor checks continuously that none were created on the way.

A tonne is claimed in the open. When the buyer’s claims desk retires those 1,240 tonnes, it signs the retirement under its own identity, citing verifier-07’s attestation and the carbon registry’s serial numbers, and the entry sits beside the attestation on a ledger that only appends. A second claim on the same batch cites the same attestation, so the buyer, the registry and any auditor see both at once instead of months later in a spreadsheet reconciliation. In July the second quarter’s first attestation failed on a nine-day gap in one kiln’s logs; the failure stayed where it was signed, the corrected batch without that kiln’s tonnes sits beside it, and anyone reading the quarter sees both.

The buyer is a freight line on another continent, on its own frame and in its own currency. Its offtake desk is the treasury’s own sub-agent: it holds no wallet, and every offtake it signs is checked against the mandate Sana Varga, its head of sustainability, signed for twelve months, as that mandate stands at the moment. Its capability token names three projects and a budget of 120,000 units, and a token can only narrow what its issuer holds. The year’s money crossed through an FX pool between sovereign frames and landed once, on the project registry’s frame. When an accreditation body withdraws a verifier, the registry operator suspends its agent: its identity dies in under 500ms, and nothing it signs after that reaches a release.

The cast and their ceilings

The flow, step by step

1. In January the buyer’s offtake desk funds the year from its own frame: 4,800 tonnes at 18 units a tonne.
2. The FX pool carries it across sovereign frames. The escrow lands on the project registry, exactly once.
3. All quarter, the probes on 38 kilns sign every temperature trace and every weighed load.
4. At 07:40 on a Tuesday in October, verifier-07 signs batch Q3: 1,240 tonnes, one attestation, one key.
5. The attestation unlocks the third-quarter tranche and nothing else.
6. 22,320 units release to the Ember Hollow co-op’s treasury: 1,240 tonnes at 18 units.
7. The release lands on the ledger beside the attestation that earned it.
8. The buyer’s claims desk signs the retirement of the 1,240 tonnes, citing the attestation. A second claim is plain to see.

Each need, mapped to a live primitive

The attack this chamber refuses: The withdrawn verifier

The attack. In November the accreditation body withdraws verifier-07 over a conflict of interest, and the registry operator suspends its agent. The co-op’s desk asks the old verifier to sign batch Q4 anyway, for the same buyer.

Why it fails. The suspension is one coordinated action: the agent’s identity is revoked over the event stream in under 500ms and its account is suspended. A suspended agent is refused at authentication, so it cannot submit an attestation or approve a milestone, and the fourth-quarter tranche releases only on an accepted verifier’s signature.

What actually happens. The Q4 tranche stays in escrow until an accredited verifier signs. Every batch verifier-07 signed before its withdrawal stays on the ledger, and so does its revocation.

The attack this chamber refuses: The quiet deletion

The attack. Before resubmitting, the co-op’s desk asks for the failed second-quarter attestation to be deleted, so the corrected batch reads as a first pass.

Why it fails. The ledger is append-only and no operation removes an entry, for the project, the verifier or the registry operator. A correction is a new signed entry beside the old one, so the corrected batch is verified on its own evidence and the failure stays readable next to it.

What actually happens. The corrected batch still settles on its own attestation. A reviewer replaying the quarter sees the failure, the gap that caused it and the correction, in order.

Deep architecture

CANOPY deployed: the project registry’s frame holds the offtake contract, its escrow and the tonne ledger; the buyer acts from its own frame and currency, and the verifier signs from its own; the kilns, the sensors and the MRV platform stay where they are, signed at the edges. The trace replays one quarter at Ember Hollow, from the buyer’s mandate to the retired tonne.

The deployment, traced

1. Sana Varga underwrites the buyer’s treasury for twelve months. Its offtake desk carries a token: three projects, 120,000 units.
2. In January the desk funds the year from the buyer’s frame: 4,800 tonnes at 18 units a tonne.
3. The FX pool carries it across frames. The escrow lands on the project registry, exactly once.
4. All quarter the probe gateways sign every reading, under certificates that live hours, not years.
5. In October the co-op desk claims the third quarter: 1,240 tonnes.
6. The verifier works the batch on its own bench, over the signed readings.
7. At 07:40 verifier-07 signs batch Q3: one attestation, under its own identity.
8. The signature crosses the fabric; the relaying peer is a courier, never the principal.
9. The offtake contract releases the third-quarter tranche, and only that one.
10. 22,320 units land in the co-op treasury, where the members vote what happens next.
11. The buyer’s claims desk retires the 1,240 tonnes, couriered home the same way.
12. The retirement lands beside the attestation it cites. A second claim on the same batch is plain to see.

Adoption, phase by phase

Discover: One past year, re-read as signed entries.

• Runs. Nothing. Last year’s offtake redrawn as four milestones, four attestations, four releases and the retirements behind them.
• Agents. None. The project, the verifier and the buyer agree what a batch attestation must reference before anyone signs one.
• Integrates. Nothing. The sensors, the MRV platform and the carbon registry stay exactly as they are.
• Deliberately not yet. No escrow and no signatures.
• Proof that gates the next phase. Last year’s four batches re-expressed as milestones and attestations, and all three parties sign off on the tonnes each one covers.

Pilot: One project, one quarter, a small offtake.

• Runs. A hosted registry seat for the project. The buyer and the verifier join as accounts, in one currency.
• Agents. Probe gateways on four kilns, verifier-07, the co-op desk, and an offtake desk and a claims desk for the buyer.
• Integrates. Kiln telemetry feeds the gateways; the MRV report’s references ride in the attestation.
• Deliberately not yet. No second frame and no FX pool. Retirements are copied to the carbon registry by hand.
• Proof that gates the next phase. One quarter settles from escrow on the verifier’s signature, and a deliberate second presentation of the same batch moves nothing.

Production: The registry runs its own frame.

• Runs. The project registry’s frame: registry, TEG, event store, identity fabric, on the registry operator’s hardware.
• Agents. Probe gateways on all 38 kilns, the verifier agents of each accredited firm, and the co-op desk with the members’ treasury votes live.
• Integrates. MRV report references in every attestation; carbon registry serial numbers in every retirement.
• Deliberately not yet. Buyers on other frames. One registry proves a full year first.
• Proof that gates the next phase. An audit replays the year from the ledger: every unit released matches a signed batch, and every retirement cites exactly one attestation.

Federation: Buyers and registries bring their own frames.

• Runs. Unchanged. Buyers run frames in their own currencies; registries in other countries federate bilaterally.
• Agents. Offtake desks under named mandates; verifiers’ track records travel with their identities.
• Integrates. Each new buyer or registry is a signed card and a licence, and money crosses through FX pools between sovereign frames.
• Deliberately not yet. The private-threshold circuit is designed, not written. Batches settle on signed readings without it.
• Proof that gates the next phase. A buyer on another continent funds, receives and retires its first batch in its own currency, and the ledger shows one attestation per batch across both frames.

Sizing

One batch, signature to retirement

sequenceDiagram
  participant Buy as buyer desks (their frame)
  participant Ver as verifier-07 (its frame)
  participant Off as offtake contract
  participant TEG as offtake escrow
  participant Co as co-op treasury
  participant ES as tonne ledger
  Buy->>TEG: the year funded via the FX pool, 4,800 t at 18
  Ver->>Off: batch Q3 attested, 1,240 t, signed
  Off->>TEG: release the Q3 milestone
  TEG-->>Co: 22,320 units, exactly once
  TEG-->>ES: the release, beside the attestation
  Buy->>Off: retirement of 1,240 t, signed, citing the attestation
  Off-->>ES: the retirement, append-only
  Note over Off: the Q3 milestone releases once#59; a retry moves nothing
  Note over ES: a failed batch stays#59; its correction sits beside it

Topology, as declared

flowchart LR
  P["kiln-probes<br/>signed readings"] -->|"readings"| V["verifier-07<br/>one attestation per batch"]
  V -->|"batch Q3, signed"| G{"release gate"}
  B["offtake-desk<br/>buyer frame"] -->|"via the FX pool"| E["offtake escrow<br/>project registry"]
  E -->|"Q3 tranche"| G
  G -->|"22,320 units"| C["co-op treasury"]
  E --> L[("tonne ledger<br/>append-only")]
  D["claims-desk"] -->|"retire 1,240 t"| L

Standing it up

• Infrastructure. A frame per national registry, and one for each buyer that wants its own, booted from the free licence and pre-built images. Projects and verifiers can start as accounts.
• Agents. Probe gateways, one agent per verifier, a co-op desk, and an offtake desk and a claims desk per buyer. The methodology stays with the verifier; the SDK carries identity, payment and attestation.
• Integration. Kiln telemetry, the MRV platform, the carbon registry’s serial numbers and the buyer’s procurement and claims systems. This is where the real time goes, and it stays theirs.

Runs beside what you already have

• MRV platforms. Each batch attestation carries the MRV report’s references. The platform stays the verifier’s working view.
• Carbon registries. A retirement carries the registry’s serial numbers, so the registry’s book and the ledger join on a key instead of a reconciliation.
• Sensor networks and kiln telemetry. Probe gateways sign what the sensors already report. The sensors keep doing the sensing.
• Buyer procurement and claims systems. Offtakes are funded inside a mandate; procurement reads settlements and the claims team reads retirements instead of chasing certificates.

A full sovereign frame is nine containers and boots in about two minutes, on anything from a Raspberry Pi to a rack. That is cheap enough to run the whole system in parallel with the legacy stack: the old system keeps running, real work mirrors onto the rails, and you compare ledgers until the evidence settles the argument. Nothing is ripped out.

Planned: a public proxy library. Free, ready-made connectors for the systems above and whatever else a merge needs, so the bridge is an import, not an integration project.

What this does not claim

• CANOPY does not measure carbon, set methodologies or certify removals. It keeps the record of who attested what, who paid and who retired it on a ledger nobody can edit.
• No claim is made about any carbon standard, registry scheme or accounting rule. Accreditation, methodology approval and what a buyer may say about its tonnes stay with the standard setters, regulators and operators who own them today.
• An attestation is as true as the measurements under it: a probe that reads wrong signs a wrong number, and the ledger keeps it faithfully. Proving a sensor threshold without revealing the series needs a circuit that is not yet written; it is badged DESIGNED and nothing here depends on it.