*English edition (en-US), September 29, 2026. This English text is the reference version.*

*Notation: formula symbols and configuration keys are written exactly as in the reference implementation. E_düz: bias-adjusted emissions · E_düzeltilmiş: corrected emissions · U_alt / U_üst: lower / upper uncertainty bound · ŝ²_içi: within-group variance · v̂_arası: between-group variance · tavan: score cap · resmi / beyan: official figure / disclosed figure · `bilinmiyor`: unknown.*

# CARBONBENCH PROTOCOL (CB-P) v1.0-draft
## Requirements for the Accuracy Assessment and Cryptographic Sealing of Corporate Carbon Disclosures

| | |
|---|---|
| **Document code** | CB-P v1.0-draft |
| **Version** | 1.0 (draft — public consultation) |
| **Date** | 2026-07-02 |
| **Status** | DRAFT / CONSULTATION — has no normative binding force; v1.0-final enters into force upon approval by the Methodology Board |
| **Prepared by** | Carbonbench Methodology Panel Secretariat |
| **Copyright and license** | © 2026 Carbonbench. CC BY-ND 4.0 — may be reproduced with attribution and without modification; the production of derivative normative text is subject to the permission of the Methodology Board. |

---

## 1. Contents

1. Contents
2. Introduction and scope
3. Normative references
4. Terms and definitions
5. K0 — Definition and External Reconciliation
6. K1 — Deterministic Normalization
7. K2 — Uncertainty Quantification
8. K3 — Audit and Calibration
9. K4 — Scoring and Reporting
10. Conformance criteria
11. Versioning and change management
Appendix A — CB-M code ↔ provision mapping table (normative)
Appendix B — Open items (v1.1 candidates) (informative)

---

## 2. Introduction and scope

**2.1** This Protocol defines the requirements for the *accuracy assessment* of corporate greenhouse gas (GHG) disclosures: the deterministic normalization of the disclosed emission inventory, the quantification of its uncertainty, its calibration with audit data, its reporting as a single accuracy score together with a mandatory confidence band, and the cryptographic sealing of the result.

**2.2 Areas governed by this Protocol:**
a) external-reconciliation plausibility tests and the score cap mechanism (K0);
b) the conversion of disclosure inputs into the canonical data model and deterministic pre-corrections (K1);
c) the quantification, in log space, of uncertainty arising from activity data, emission factors and extraction (K2);
d) learning calibration through risk-weighted audit sampling, and credibility updating (K3);
e) the closed-form score equation, the band co-report and the Corporate Carbon Passport format (K4);
f) versioning, freezing, traceability and dispute processes.

**2.3 Areas not governed by this Protocol:**
a) **Physical reality (Principle I3):** The input vector is the company's disclosure. This Protocol assesses the internal consistency of the disclosure, its methodological correctness and the quality that can be tested through the audit sample; it does not measure or guarantee the emissions actually released from the stack. A consistently wrong disclosure produces a consistently wrong result; this limit is stated explicitly in the Reproduction Statement (9.7).
b) Evaluation of the adequacy of emission *reduction* targets, of science-based target alignment or of "net-zero" claims.
c) Financial assurance service: the K0–K3 tests do not constitute an assurance engagement.
d) The integrity of offset projects; only the consistency of offset *accounting* with the disclosure (CB-M 3.6) is within scope.
e) The production of official residual mixes: Carbonbench does not produce its own residual proxy for any jurisdiction (see 6.2.9).

**2.4** In this Protocol, **SHALL** denotes a mandatory requirement, **SHALL NOT** an absolute prohibition, **SHOULD** a strong recommendation, and **MAY** a permission. Every normative sentence carries the relevant keyword in parentheses. An implementation that does not meet a SHALL provision shall not be deemed "CB-P conformant" (Clause 10).

**2.5** The fundamental design constraint of the Protocol: every sealed score shall be reproducible **by closed-form arithmetic alone**, from the company input vector and versioned, frozen public tables, by any third party with pen and paper (SHALL). Monte Carlo simulation and Dempster-Shafer combination shall not be used in the score production chain (SHALL NOT).

---

## 3. Normative references

The following documents, to the extent that they are referenced in this text, are indispensable for the application of this Protocol. For dated references, only the edition cited applies.

- **JCGM 100:2008 (GUM)** — Evaluation of measurement data — Guide to the expression of uncertainty in measurement (in particular §3.2.4: adding the uncertainty of a correction to the budget)
- **JCGM 101:2008** — GUM Supplement 1 (propagation of distributions; in this Protocol used for validation purposes only, not used in the score chain)
- **IPCC 2006 Guidelines for National Greenhouse Gas Inventories, Vol. 1** (uncertainties) and **Vol. 2, Ch. 1–2** (stationary combustion, NCV convention)
- **IPCC Emission Factor Database (EFDB)** — ±U% bands
- **ISO 14064-1:2018** — Greenhouse gas inventories: organization level
- **ISO 14064-3:2019** — Verification and validation of greenhouse gas statements
- **ISO 6976** — Natural gas: calculation of calorific value, density and Wobbe index
- **ISO/IEC 17025** — Competence of testing and calibration laboratories (reference for the MSA discipline)
- **GHG Protocol Corporate Accounting and Reporting Standard** (rev. ed.)
- **GHG Protocol Scope 2 Guidance** — location/market-based duality
- **GHG Protocol Corporate Value Chain (Scope 3) Standard**
- **PCAF Global GHG Accounting Standard** — data quality tiers for financed emissions
- **Bühlmann, H. & Straub, E. (1970)** — credibility estimators (closed-form method of moments)
- **CB-M v0.1** — Carbon Error Taxonomy Numbering Standard (companion publication)

---

## 4. Terms and definitions

Note: The definitions in this section are descriptive and contain no requirements; the normative provisions are in the clauses referenced in parentheses.

**4.1 disclosure (input vector):** The canonical data set extracted from the company's public report and hashed; the only company-side input to the score.

**4.2 band:** The 95% confidence interval computed as E_düz·exp(±1.96·λ_t·σ_ln,T) (for E_düz see 9.1.1); the primary output, reported before the score and with at least equal visibility to the score (see 9.5.1).

**4.3 score (S):** The accuracy score in the range [0, 100], produced by the K4 closed-form equation. The score is not a claim of completeness (see 9.9.1).

**4.4 IEF (implied emission factor):** The factor back-calculated by dividing the disclosed emissions by the disclosed activity data; the primary tool of the R-CV and plausibility tests.

**4.5 bucket:** The calibration unit keyed by the pair (data class × confidence range); it carries the σ²_ekstr, q̂_kaba and b̂ components. Raw LLM confidence is not used as a probability; it is only a bucket key (normative provision: 7.6.1).

**4.6 credibility (Z):** The shrinkage weight Z = n/(n+k); n is the number of audit observations in the bucket, k the credibility constant derived from the public audit ledger with the Bühlmann-Straub moment estimator (see 8.3).

**4.7 floor variance (σ²_taban):** The minimum log-variance achievable with the company's own source-composition vector in the "best-practicable" scenario (Tier-3 AD + human-reviewed extraction + IPCC default EF) (see 7.5.1). The carrier of the principle that aleatoric physics is not penalized.

**4.8 reducible uncertainty (Δ²):** max(0, σ²_ln,T − σ²_taban); the only variance component penalized in the score (see 9.3.1).

**4.9 gross error (q̂_kaba):** The bucket frequency estimate of non-continuous errors such as unit, scale (1000×) or matching errors; tracked in a separate channel (see 8.2.2).

**4.10 bias (b̂):** The multiplicative systematic error estimated at bucket/channel level; the ledger is kept gross on an item basis, and biases of opposite sign are not netted (normative provision: 6.3.6).

**4.11 seal:** A revocation-checkable cryptographic record that binds the score, band, formula version, table version, input hash and timestamp.

**4.12 frozen table (tablo_v_t):** The version-locked parameter set published quarterly (σ² tables, k values, λ_t, bucket priors, NACE intensity bands, score constants; see 11.2.1). Score = f(input vector, tablo_v_t).

**4.13 CB-M code:** The permanent failure-mode identifier in the Carbon Error Taxonomy (e.g., CB-M 1.3.1.1). The citation format is "CB-M b.k[.a[.h]]", with two to four levels according to the taxonomic depth of the code.

**4.14 EF resolution level:** The tier of the grid electricity EF, assigned deterministically from the evidence set (utility-specific / subregional / national / IEA world; see 6.2.2).

**4.15 restatement:** The recalculation of prior-period figures, with explicit disclosure, upon a change in the method, boundary or basis relied upon.

**4.16 epistemic / aleatoric-floor uncertainty:** Respectively, the uncertainty components that can be narrowed by measurement and those that are systemically irreducible (see 7.4).

**4.17 K3 priority sample:** The operation that denotes the mandatory and priority inclusion of the relevant item in the audit sample when a trigger condition occurs; no band test is a substitution, all of them are triggers (see 6.6.1(8), 8.1.2).

**4.18 Passport:** Corporate Carbon Passport; the one-page, 8-field, QR-sealed presentation format of the K4 output (see 9.8).

**4.19 score letter band:** The mapping of the score S to a letter tier (A, B, C, …) using the thresholds published in tablo_v_t; the scale to which verification intensity is indexed (see 9.8.3). It is a different concept from the "band" (confidence interval) in 4.2.

---

## 5. K0 — Definition and External Reconciliation

**5.1 General**

5.1.1 Every assessment shall include a K0 external-reconciliation layer that runs before K1 (SHALL). The execution order shall in all circumstances be **K0 → K1 (R-CV family) → b̂ assignment → K3 conformal** (SHALL); a violation of the order is a loss of conformance (10.3.1).

5.1.2 K0 tests are plausibility tests; their results do *not change* the disclosure, they only trigger a q̂_kaba item, a score cap and a K3 priority sample (SHALL).

**5.2 External-reconciliation tests**

5.2.1 The implementation shall, to the extent that they are accessible, cross-check the following three reconciliation sources (SHALL): (a) fuel purchase records / customs-market totals, (b) distribution company meter totals, (c) the NACE sector-mapped tCO₂/revenue intensity band.

5.2.2 Intensity band test: if the company's implied intensity falls outside the frozen NACE band table (a component of tablo_v_t), the implementation shall record a q̂_kaba item and apply a score cap (SHALL). Band tables shall be published version-locked (SHALL).

5.2.3 EF×AD back-calculation test: if the disclosed total deviates from the sum of the items by more than ±1%, the CB-M 4.1.3 flag and a K3 priority sample shall be triggered (SHALL).

**5.3 Score cap and missing-data imputation**

5.3.1 A K0 out-of-band result shall impose on the score to be sealed a deterministic upper limit (cap) published in tablo_v_t (SHALL); the cap shall appear, with its rationale, in the "why" panel (9.6.1) (SHALL).

5.3.2 The principle "the score cannot rise through the absence of data": for items that are not present in the disclosure but whose existence is plausible given the K0 signals, **worst-bucket imputation** shall be applied (SHALL). Few-item window dressing (CB-M 8.1.1) is structurally neutralized by this mechanism.

5.3.3 The facility coverage ratio shall be disclosed in Passport field 1 (SHALL); incomplete coverage shall carry a "partial coverage" stamp (SHALL).

---

## 6. K1 — Deterministic Normalization

**6.1 General principles**

6.1.1 All transformations within K1 shall be deterministic: the same input vector and the same tablo_v_t shall produce the same canonical output on every platform (SHALL). Platform-dependent floating-point differences shall be eliminated by the canonicalization rule (SHALL; CB-M 6.6.2).

6.1.2 **Ordering principle (physics-absolute pre-correction):** R-CV family corrections shall run BEFORE b̂ estimation and K3 conformal calibration (SHALL). Rationale (informative): otherwise the systematic error is double-counted and the conformal layer is calibrated blind to the population-wide common shift.

**6.2 EF resolution hierarchy (A-family)**

6.2.1 **(A.1)** The grid electricity EF level shall not be chosen by the reporter; it shall be assigned from the evidence set by a deterministic function (SHALL). The finest verifiable level is mandatory (SHALL). A blended (Z-blend) EF shall not be used (SHALL NOT): it cannot be traced to any published cell.

6.2.2 **(A.2)** Tiers and frozen σ² values (version-locked; SHALL):

| Tier | σ² | Acceptance condition |
|---|---|---|
| 1. Utility-specific | (ln 1.05/1.96)² | the three pieces of evidence in 6.2.3, together |
| 2. Subregional (eGRID/AIB) | (ln 1.08/1.96)² | reference level |
| 3. National country-year | (ln 1.15/1.96)² | 6.2.5 constraints |
| 4. IEA world | (ln 1.30/1.96)² + q̂_kaba item | last resort |

6.2.3 For utility-specific acceptance, three pieces of evidence shall be submitted together (SHALL): (i) an audited supply mix filed with the regulator; (ii) a delivery-based denominator with T&D losses separated; (iii) a vintage–reporting-year match and a REC-purged mix. For "Unspecified" purchases, the regional system/residual factor shall be assigned deterministically, without regard to any share threshold (SHALL); the difference shall be entered into b̂ (SHALL).

6.2.4 If the utility–subregional difference exceeds ±30% in log space, the value is **not substituted**; a mandatory K3 priority sample and an evidence upgrade shall be triggered (SHALL).

6.2.5 In a multi-grid country where subregional data are published, the national average shall not be used (SHALL NOT); in case of violation, the difference shall be entered into b̂ (SHALL; CB-M 1.6.1.1). Where the factor year and the reporting year do not match, +0.1 per year shall be added to σ_ln (SHALL). Türkiye is treated as a single grid; the national tier applies, and year matching is required (SHALL).

6.2.6 **(A.3)** The burden of proof shall be independent of the direction of the EF (SHALL). The asymmetry lies only in the reward: for evidence leading to an EF *below* the national level, the σ reward is halved (SHALL).

6.2.7 **(A.4)** The score S shall always and only be computed **location-based** (SHALL). The market-based figure is a mandatory co-report column (SHALL) and shall not enter the score through any channel (SHALL NOT). Certificate acceptance shall pass four tests together (SHALL): market boundary, year match, a unique cancellation/retirement record, double counting closed off with the residual mix.

6.2.8 **(A.5)** In a country where no official residual mix is published: the market-based figure shall not affect the score (SHALL NOT); if there is no cancellation document (TR: YEK-G), the market-based line is rejected (SHALL); the uncorrected national EF is applied to consumption without certificates (SHALL).

6.2.9 Carbonbench shall not produce its own residual proxy (SHALL NOT). Transition: on the day an official residual is published, it is included in off-score dual reporting (SHALL).

6.2.10 **EF-shopping defense:** the combination of coarse resolution + low EF shall be entered into the b̂ channel with an "EF-shopping" flag (SHALL; CB-M 1.7.2).

**6.3 Calorific value rules (R-CV family)**

6.3.1 **(R-CV-1)** For every fuel item, the field `kalorifik_taban ∈ {NCV, GCV, bilinmiyor}` and a source document are mandatory (SHALL); an empty field adds +1 to q̂_kaba (SHALL).

6.3.2 **(R-CV-2)** IEF screening: for natural gas, if IEF ∈ [0.198, 0.206] kg/kWh and the invoicing country follows the GCV convention, GCV×NCV confusion is deemed certain (SHALL); IEF ∈ [0.178, 0.187] is accepted as correct (SHALL); a recomputation ratio ∈ [1.09, 1.13] produces the same flag (SHALL).

6.3.3 **(R-CV-3)** Where confusion is detected, the full correction shall be applied: **E_düzeltilmiş = E / 1.108** (fuel-specific ratio, IPCC 2006 Vol. 2; SHALL). A half-correction shall not be applied (SHALL NOT; GUM representation principle). In the `bilinmiyor` case, the full correction shall be made assuming the country convention (TR/EU: GCV), the two-point residual variance **σ² = (ln 1.108)²/4** shall be added together with a q̂_kaba item, and a K3 priority sample shall be triggered (SHALL).

6.3.4 **(R-CV-4)** Conversion window tests (SHALL): invoice-kWh/disclosed-energy ∈ [0.99, 1.01] → GCV suspicion; ∈ [0.89, 0.92] → acceptable; < 0.89 → double-conversion flag, to b̂.

6.3.5 **(R-CV-5)** On the m³ path, disclosure of the reference condition (0°C/15°C, ≈5.5% difference) is mandatory (SHALL). The BOTAŞ value of 9155 kcal/Sm³ shall be interpreted as GCV (SHALL). If there is no measured monthly CV, a ±2% seasonal Wobbe term shall be added to σ_ln (SHALL); if the contract–measured CV difference is >2%, it is entered into b̂ (SHALL).

6.3.6 **(R-CV-6)** A detected confusion is a signed contribution to b̂ (+ln 1.108). The bias ledger shall be kept gross on an item basis (SHALL); opposite biases shall not be netted (SHALL NOT). For a company that discloses the metadata in full, the penalty shall be reduced to the residual ε (SHALL); for a company that withholds it, the full |b̂| shall be applied (SHALL). A change of basis between years requires a restatement; otherwise a q̂ penalty is applied (SHALL).

**6.4 GWP normalization**

6.4.1 All gas rows shall be normalized to the single GWP set (GWP100) declared in tablo_v_t (SHALL). Where the use of mixed sets (CB-M 1.4.1) is detected, deterministic re-multiplication is applied and q̂_kaba is recorded (SHALL).

6.4.2 Undisclosed use of GWP20 or of an alternative horizon shall be entered into the b̂ channel (SHALL; CB-M 1.4.3). If no fossil/biogenic CH₄ distinction has been made, the conservative (fossil) assignment is applied (SHALL).

**6.5 Center-definition metadata fields**

6.5.1 Every item in the canonical data model shall carry the following metadata fields (SHALL): unit, kalorifik_taban, EF source+version, EF resolution level, GWP set, organizational boundary approach, period, `belirsizlik_tipi`, `aleatorik_taban_%` (see 7.4). A missing metadata field produces a CB-M 5.2 family flag and a q̂_kaba item (SHALL).

**6.6 Anti-gaming deterministic controls (D-family)**

6.6.1 The implementation shall code the following controls in the rules engine (SHALL): (1) EF-shopping → evidence→level function (6.2.1); (2) floor inflation → if the composition shift exceeds the threshold, σ²_taban is frozen with the previous year's composition; (3) double conversion → R-CV-4 windows; (4) method change → restatement + dual calculation, the difference to b̂; (5) certificate arbitrage → rejection if there is no cancellation record, location-based-only score; (6) few-item window dressing → K0 floor + worst-bucket imputation; (7) σ_ln disclosures from the upper bound, table published; (8) all band tests are triggers, not substitutions.

---

## 7. K2 — Uncertainty Quantification

**7.1 Distribution model**

7.1.1 Every activity datum and emission factor shall be modeled as lognormal in log space (SHALL). Negative emissions shall be made structurally impossible (SHALL).

**7.2 Conversion from the IPCC band to σ_ln**

7.2.1 For U ≤ 100%: σ_ln = ln(1 + U/100)/1.96 (SHALL).

7.2.2 For U > 100%, the **Frey correction** shall be applied (SHALL): the asymmetric band (−U_alt, +U_üst) is converted into a geometric standard deviation; σ_ln = ln(1 + U_üst/100)/1.96 is parameterized from the upper tail. The conversion rule is defined in closed form in this clause and does not depend on an external source. This rule is standard for agri-food CH₄/N₂O factors.

**7.3 Frozen σ² tables**

7.3.1 All class-level σ² values (including the 6.2.2 tiers) shall be published in version-locked tables and frozen quarterly (SHALL). Only the frozen table may be used in score production (SHALL).

7.3.2 A country-year EF lookup table shall be used for grid electricity (SHALL); location-based and market-based values shall be kept in separate rows (SHALL).

**7.4 Epistemic/aleatoric distinction (Footnote-U1)**

7.4.1 In the K1/K2 tables, every EF row shall carry two mandatory columns (SHALL): `belirsizlik_tipi ∈ {epistemik, aleatorik-tabanlı}` and `aleatorik_taban_%` (may be zero).

7.4.2 **Deterministic constraint:** σ_post ≥ σ(aleatorik_taban) (SHALL). K3 calibration shall not, by any mechanism, compress the posterior uncertainty below the aleatoric floor (SHALL NOT). A floor violation counts as a D-family (6.6) gaming violation and shall be detected automatically (SHALL).

7.4.3 An EF without an assigned `aleatorik_taban_%` shall not be admitted to the 6.2 hierarchy (SHALL NOT).

7.4.4 (Informative — summary of the Footnote-U1 text): fossil fuel factors are epistemic-dominant and can be reduced to ±2-3% through the transition to Tier-3; agricultural N₂O is aleatoric-floor and cannot go below a ±30% floor. If the band width stems from physics, it does not lower the score (see 9.3).

**7.5 Floor variance**

7.5.1 σ²_taban shall be computed with the company's **own source-composition vector** (SHALL): the Tier-3 AD + human-reviewed extraction + IPCC default EF scenario. A sector correction coefficient shall not be used (SHALL NOT); sector differentiation (cement clinker share, PCAF tiers, etc.) is internalized in the composition vector.

**7.6 Extraction uncertainty and correlation**

7.6.1 Raw LLM confidence shall not be used as a probability in any calculation (SHALL NOT); it is only a (data class × confidence) bucket key (SHALL).

7.6.2 Every bucket shall carry three components (SHALL): σ²_ekstr (continuous log-error variance), q̂_kaba (gross-error frequency), b̂ (bias).

7.6.3 Rows from the same document shall be treated as correlated with a single ρ_ekstr constant (SHALL); the correlation between rows from different documents shall be taken as 0 (SHALL). A high ρ_ekstr is applied to financed-emission rows from the same portfolio report (SHALL).

---

## 8. K3 — Audit and Calibration

**8.1 Sampling and unbiased estimation**

8.1.1 The audit sample shall be designed on a risk-weighted basis and the design probabilities shall be published (SHALL). Bucket parameters shall be estimated without bias using **Horvitz-Thompson** stratified weighting (SHALL).

8.1.2 Priority sample requests triggered by provisions 6.2.4, 6.3.3 and 5.2 shall be mandatorily included in the quarterly sampling plan (SHALL).

**8.2 Bucket update**

8.2.1 Frequency: a Beta-Binomial update shall be applied (SHALL): q | x, n ~ Beta(α₀+x, β₀+n−x); q̂ = (α₀+x)/(α₀+β₀+n).

8.2.2 Severity: shall be modeled as lognormal(m, s²_m) (SHALL). Gross errors (unit, 1000×) shall be tracked in a separate channel (SHALL); they shall not be blended with the continuous variance (SHALL NOT).

**8.3 Credibility shrinkage**

8.3.1 The current bucket value shall be computed as **Z·(audit estimate) + (1−Z)·(t=0 prior)**, with the formula Z = n/(n+k) (SHALL).

8.3.2 k shall be derived from the public audit ledger with the closed-form Bühlmann-Straub moment estimator (k = ŝ²_içi/v̂_arası), and **shall be frozen quarterly and versioned** (SHALL). If the moment estimator produces a negative between-variance component (v̂_arası ≤ 0), Z = 0 shall be applied in v1.0 (SHALL; see Appendix B, item 1). Anyone shall be able to re-derive k from the ledger (SHALL).

8.3.3 Buckets with n_eff < 5 shall be collapsed into the higher level of the hierarchy (class×confidence → class) (SHALL — the Marumo reservation has been incorporated into v1.0).

**8.4 Conformal calibration**

8.4.1 Every quarter, the empirical coverage of the 95% bands produced by the frozen table shall be measured with split-conformal testing; the scalar correction multiplier **λ_t** shall be sealed into the next table version (SHALL).

8.4.2 If cohort conformal coverage is measured at <80%, the previously published early recalibration trigger shall be activated (SHALL).

8.4.3 λ_t shall not, in any bucket, bring σ_post below the aleatoric floor (SHALL NOT; consistency with 7.4.2).

**8.5 Monitoring and model-change trigger**

8.5.1 SPC p-charts shall monitor within-stratum drift (SHALL). An LLM version change shall trigger mandatory recalibration (SHALL; CB-M 8.3.1); until recalibration is completed, no seal shall be issued with the new version (SHALL NOT).

**8.6 Retrospective stability**

8.6.1 Past scores are never recalculated (SHALL NOT): score = f(input vector, tablo_v_t). A change of constants may be made only through a commitment-document update within the scope of 11.4 and with the obligation of retroactive re-scoring (MAY).

---

**8.7 The audit tool itself (v1.1, 2026-09-05)**

8.7.1 The output of an audit tool (scan script, rule engine, automated check) shall not be reported
as a finding **without the tool's coverage area being declared** (SHALL NOT).
The statement "no findings" is meaningless on its own; it shall be written in the form
**"not found with this method, within this scope"** (SHALL).

8.7.2 The tool shall **model the runtime context** of the system it audits (SHALL).
If context differences — the same call being handled differently on different servers, an adaptation
layer injected into the client, vendor code versus our own code — are not modeled, the tool
produces **false assurance**: it shows green, but it has not measured.

8.7.3 Before a fix is made on the basis of a tool finding, two questions shall be answered
(SHALL): *(a)* was the finding verified **on the same path** as the actual code path in production?
*(b)* is there a context, unknown to the tool, that invalidates the finding? A fix made without both
being answered in the affirmative does not eliminate an error — **it produces a new error**.

8.7.4 What a check actually measures should be demonstrated **by deliberately putting the error back**
(SHOULD). A check that has not been seen to show red shall not be assumed to exist.

8.7.5 A check whose precondition cannot be met **shall not pass silently** (SHALL NOT);
the fact that it was skipped, and the reason, shall be made visible (SHALL). A silent pass
belies the coverage report: the reader takes what was not measured to have been measured.

> **Rationale (non-normative).** This clause arose from a measurement on the night of 2026-09-05:
> the tool written for the "dangling endpoint" scan gave a wrong result **seven times**. On its first run
> it produced 15 false findings (it did not model the adaptation layer); twice, had a fix been made
> according to its finding, **working code would have been broken** — one endpoint was absent only from
> the static deployment but existed on another server, and one field was the sealed disclosure itself.
> Most of the real errors came to light as the tool was fixed; none of them was visible on the first run.
> When the tests themselves were audited the same night, **six checks** that had passed silently while
> their precondition was absent were found inside the "passed" report.
>
> In short: **if an audit tool is audited less than the system it audits, the confidence it
> produces is fake.** This is a direct consequence of the protocol's measurement claim — because
> saying "we measured" becomes meaningful only if the one who measures has also been measured.

## 9. K4 — Scoring and Reporting

**9.1 Bias correction**

9.1.1 Bias correction shall be applied at item level (SHALL): E_düz,i = E_i/(1+b̂_i); where b̂_i = exp(b̂_ln,i) − 1, and b̂_ln,i is the signed log contribution in the bias ledger (6.3.6; e.g., a contribution of +ln 1.108 corresponds to the E_i/1.108 correction, consistent with 6.3.3). Item biases of opposite sign shall not be netted by way of aggregation (SHALL NOT; 6.3.6). The correction uncertainty u²(b̂) shall be added to the uncertainty budget (SHALL; GUM §3.2.4).

**9.2 Error propagation**

9.2.1 The total log-variance shall be computed with the **Fenton–Wilkinson** approximation (SHALL):
σ²_ln,T = ln(1 + [Σᵢ Σⱼ ρᵢⱼ cᵢcⱼ EᵢEⱼ]/(Σᵢ Eᵢ)²), cᵢ = √(exp(σ²_ln,i) − 1); ρᵢⱼ = ρ_ekstr (same document), 0 (otherwise).

**9.3 Reducible uncertainty**

9.3.1 Δ² = max(0, σ²_ln,T − σ²_taban) (SHALL). Note (informative): aleatoric physics is not penalized; an agri-food disclosure with a wide band but good data quality is scored on data quality alone.

9.3.2 Where σ²_T/σ²_taban < 1, without changing the score, a deterministic "uncertainty under-disclosure flag" shall go into the human-audit queue and appear in the "why" panel (SHALL — the Halvorsen reservation has been incorporated into v1.0).

**9.4 Score equation**

9.4.1 **S = 100·exp(−k₁·Δ² − k₂·|b̂_res|) − 100·γ·q̂_kaba** (SHALL). Here b̂_res is the residual bias estimate remaining after the 9.1.1 correction and the 6.3.6 residual-ε reduction; item contributions are aggregated gross (in absolute value) in accordance with 6.3.6. Precision (Δ²) and accuracy (b̂_res) are penalized separately; gross error is deducted through a separate channel and carries a mandatory human-review flag (SHALL).

9.4.2 The constants (k₁, k₂, γ, ρ_ekstr, α₀, β₀, σ multipliers) shall be derived algebraically from two public anchors; a version-locked commitment document and a sensitivity table co-report shall be published (SHALL). Upon a change of constants, retroactive re-scoring is mandatory (SHALL).

**9.5 Mandatory band co-report**

9.5.1 Band = E_düz·exp(±1.96·λ_t·σ_ln,T) shall be reported together with every score, before the score and with at least equal visibility (SHALL). Publishing a score without a band is a conformance violation.

**9.6 "Why" panel**

9.6.1 Every score shall carry a "why" panel showing the log-space variance Pareto and the Z, q̂, b̂ rows per bucket (SHALL). The score cap (5.3.1) and the 9.3.2 flag shall be visible in this panel (SHALL).

**9.7 Reproduction Statement**

9.7.1 The following three-sentence standard text shall be appended to every sealed output (SHALL):
*(1) This score was computed with published formula version v.X and EF-assigner version v.Y; the same input vector leads any third party, with pen and paper, to the same score. (2) The input vector is the company's disclosure; its accuracy has been tested by the K0-K3 layers, and this testing does not constitute an assurance engagement. (3) A digest of the input vector (hash + main items) is attached to this document.*

9.7.2 The limit of the determinism claim shall be stated explicitly (SHALL): the input is the disclosure; the extraction step lies outside the determinism claim.

**9.8 Corporate Carbon Passport**

9.8.1 The Passport shall be a single page and shall contain the following 8 fields in this order (SHALL):
1. Company identity + period + organizational boundary + **facility coverage ratio** ("partial coverage" stamp if incomplete);
2. **Band** — large type, in front; score in small type, behind;
3. Total emissions with S1/S2/S3 breakdown + "n/15 Scope 3 categories";
4. EF resolution profile (6.2.2 tier shares, single bar);
5. K0 external-reconciliation result;
6. K3 sampling status — a field that cannot be hidden (SHALL);
7. Seal block: QR, formula version, input hash, date of issue/expiry, revocation-check link;
8. Previous-period band (trend arrow).

9.8.2 Validity shall be 12 months + 3 months of grace (SHALL). The QR has three states (valid / expired / revoked); the state shall appear before the score (SHALL). The historical record shall not be deleted (SHALL NOT).

9.8.3 Verification intensity is indexed to the score letter band (4.19) (SHALL); the letter band thresholds shall be published in tablo_v_t (SHALL). Letter bands C and below receive a purely mechanical seal; letter band A/B automatically triggers K3 sampling (SHALL).

**9.9 Mandatory statements**

9.9.1 Every Passport and report shall carry the following statement (SHALL): **"100 points is not a claim of completeness."**

9.9.2 The score measures only the accuracy quality of the disclosed inventory; a lack of coverage is made separately visible in field 1 and field 3 (SHALL).

---

## 10. Conformance criteria

**10.1** For an implementation to be deemed "CB-P v1.0 conformant", it shall pass all the audit tests in this section (SHALL).

**10.2 Reproduction tests**

10.2.1 An independent auditor, using the published tablo_v_t and an input vector whose input hash has been verified, shall be able to reproduce the sealed score bit-equivalently by hand (or with independent code) (SHALL); this shall be tested on at least 5 random seals (SHALL).

10.2.2 It shall be verified by code review that no pseudo-random number generation exists at any step of the score chain (SHALL; Monte Carlo prohibition, 2.5).

**10.3 Structural tests**

10.3.1 It shall be verified from the log records that the execution order is K0 → R-CV → b̂ → K3 conformal (SHALL); an order violation is a direct ground for rejection.

10.3.2 Synthetic trap-file test: the standard test file with a GCV invoice + 40% affiliate trap, published version-locked together with tablo_v_t, shall be run through the implementation (SHALL); it shall be verified that the R-CV-2/R-CV-3 flags and the organizational boundary metadata field rules (6.5.1) are triggered correctly (SHALL).

10.3.3 It shall be tested that the σ_post ≥ σ_taban constraint is enforced at engine level and that an attempt to compress below the floor automatically produces a violation (SHALL).

10.3.4 It shall be verified by code path analysis that the market-based figure does not enter the score through any channel (SHALL).

**10.4 Table and seal tests**

10.4.1 It shall be verified that the quarterly tables are published version-locked and immutable, and that the k values can be re-derived from the public ledger (SHALL).

10.4.2 It shall be tested that the QR/revocation-check chain correctly returns the three states and that historical records are not deleted (SHALL).

**10.5 Relationship to CB-M**

10.5.1 The implementation shall contain, for each of the critical codes of the CB-M taxonomy listed in Appendix A, at least one automated detection rule (rules-engine input) or K3 sampling trigger (SHALL). The mapping shall be published in the CB-M Excel sheet format ("error code → layer → rule → test") (SHALL).

10.5.2 In the implementation's audit reports, error citations shall be made in the "CB-M b.k[.a[.h]]" format (4.13), with the full taxonomic depth of the code (SHALL).

---

## 11. Versioning and change management

**11.1 Number permanence**

11.1.1 No published provision number or CB-M code shall be reused or shifted (SHALL NOT). A retired provision is marked "deprecated" and its number remains empty; external references do not break.

**11.2 Quarterly freezing**

11.2.1 tablo_v_t (σ² tables, k, λ_t, priors, NACE bands, score letter band thresholds, constants) is frozen at the start of the quarter, and all seals of that quarter are produced with this version only (SHALL).

11.2.2 New buckets that arise during the freeze period shrink toward the posterior of the nearest parent bucket, not toward the collective mean (SHALL — the Okonkwo-Lindqvist reservation has been incorporated into v1.0; two-level Bühlmann-Straub, a single column in the table).

**11.3 Methodology Board**

11.3.1 Protocol changes are made only by decision of the Methodology Board (SHALL). The Board shall include at least five independent members from the fields of metrology, national inventories, actuarial science/credibility, MSA/standards and statistical ML (SHALL). Voting results and reservations are published in full text (SHALL).

11.3.2 In every version cycle, the frozen σ² tables are subject to empirical re-validation against published EF-variance studies and to a deviation report (SHOULD → candidate for SHALL in v1.1; Halvorsen reservation).

**11.4 Change of constants**

11.4.1 From v2 onward, the constants are derived from the loss asymmetry measured in audit and are published together with the derivation rule (SHALL). Every change of constants requires: a new commitment document + sensitivity table + retroactive re-scoring (SHALL).

**11.5 Dispute**

11.5.1 The scored organization may file a dispute within 60 days of the seal date (MAY); the implementation shall provide this dispute channel (SHALL). A dispute may rest only on the grounds of (a) input-hash mismatch, (b) a table application error, (c) incomplete evaluation of the evidence set in the EF assigner (SHALL); a dispute against the methodology itself is directed to the Board's consultation channel. Dispute outcomes and corrected seals are publicly recorded (SHALL); the old seal is moved to "revoked" status (SHALL) and shall not be deleted (SHALL NOT).

---

## Appendix A — CB-M code ↔ provision mapping table (normative, selected critical codes; see 10.5.1)

| CB-M code | Failure mode (short) | CB-P provision | Layer |
|---|---|---|---|
| 1.2.1.2 | Geographic basis difference (foreign EF) | 6.2.1, 6.2.5 | K1 |
| 1.2.1.3 | Vintage difference | 6.2.5 (+0.1 σ_ln/year) | K1/K2 |
| 1.3.1.1 | GCV-kWh × NCV factor (~10%) | 6.3.2, 6.3.3 | K1 |
| 1.3.1.2 | Volume→energy reference condition | 6.3.5 | K1 |
| 1.3.1.3 | Contract vs measured CV | 6.3.5 | K1/K2 |
| 1.3.3 | Factor unit label error | 8.2.2 (gross channel) | K3 |
| 1.4.1 | GWP set mixing | 6.4.1 | K1 |
| 1.5.2 | Outdated-year grid factor | 6.2.5 | K1 |
| 1.6.1.1 | National average in a multi-grid country | 6.2.5 | K1 |
| 1.6.1.2 | Utility-specific factor without evidence | 6.2.3, 6.2.4 | K1/K3 |
| 1.6.2.1 | Market-based claim without certificates | 6.2.7, 6.2.8 | K1 |
| 1.7.2 | Coarse resolution + low EF | 6.2.10 | K1→b̂ |
| 2.4.3 | No coverage ratio disclosure | 5.3.3, 9.8.1(1) | K0/K4 |
| 2.6.2 | Indirect detection signals | 5.2.2, 5.2.3 | K0 |
| 3.6.2 | Uncanceled certificate | 6.2.7, 6.6.1(5) | K1 |
| 4.1.1 | kg/t/kt (1000×) error | 8.2.2, 9.4.1 (γ·q̂) | K3/K4 |
| 4.1.3 | Line total ≠ disclosed total | 5.2.3 | K0 |
| 6.3.1 | Mistaking confidence for a probability | 7.6.1 | K2 |
| 6.6.1 | Table versioning violation | 8.6.1, 11.2.1 | K3/Board |
| 8.1.1 | Few-item window dressing | 5.3.2, 6.6.1(6) | K0 |
| 8.1.3 | Floor inflation | 6.6.1(2) | K1/K2 |
| 8.3.1 | LLM version change | 8.5.1 | K3 |

---

## Appendix B — Open items (v1.1 candidates, informative)

1. **Marumo (K3 carry-forward):** Carrying forward the previous frozen k instead of Z=0 when the Bühlmann-Straub moment estimator yields a negative variance component. (v1.0: Z=0 is applied under 8.3.2.)
2. **Reinholt (k-EWMA):** EWMA smoothing of the k update (λ=0.3, published) + a Western Electric rule: the frozen k changes only if the control limit is exceeded in two consecutive quarters.
3. **Ben-Ami (q̂ upper bound):** Having the q̂_kaba penalty in 9.4.1 enter through the upper confidence bound of the Beta posterior or through the posterior expected penalty instead of the point estimate; preventing a lucky clean sample in a small stratum from producing an unearned score.
4. **Marumo (R-CV-3/6.3.3 rollback):** A rollback clause tied to the verification sample, against the exploitation of the emission-lowering automatic correction through a strategic "bilinmiyor" disclosure.
5. **Okonkwo-Lindqvist (A.3/6.2.6 incentive):** An incentive-compatible redesign of the effect whereby the halved σ reward penalizes the honest, conservative discloser.
6. **Reinholt (6.2.4 temporary clipping):** For a utility value outside the ±30% band, temporary clipping to the subregional value until the K3 sample is concluded.
7. **Ben-Ami & Vasquez-Torres (TR proxy):** Presenting the TEİAŞ+YEK-G indicator proxy in a co-report footnote with an "off-score" label, and its automatic retirement upon publication of the official residual. (v1.0: by a 4-2 majority the proxy is prohibited; see 6.2.9.)
8. **Halvorsen (σ² empirical validation):** Raising 11.3.2 from SHOULD to SHALL.
9. Linking the results of the reproduction experiment (n≥15 independent calculators, a dual data-entry arm) to the 9.4.2 constant-derivation anchors.
10. Incorporating Scope 3 category-specific σ² tables (including the PCAF tier mapping) into K2 as a normative annex.

---

*— End of CB-P v1.0-draft. Comments during the consultation period shall be submitted to the Methodology Board Secretariat, citing the provision number.*
## Appendix C — Signal layers and caps implemented in v1.1 (informative; normative candidates)

> **Architectural principle:** the 9.4.1 score formula has NOT CHANGED: `S = max(0, 100·exp(−k₁Δ² − k₂|b̂|) − 100γq̂)`
> and the cap is applied as `S = min(S, tavan)` (the same pattern as the K0 cap in 5.3.1). All of the
> mechanisms below either feed a new evidence signal into the EXISTING variables of the formula (q̂, b̂) or
> add a new type of cap to the cap layer AFTER the formula. No existing input, constant or
> table value has been removed/changed (additive principle — operator decision of 2026-07-12).

**C.1 Reading-confirmation round and error classification (K3 input)**
- Medium-confidence extractions are confirmed in two stages: deterministic cross-validation (0 cost)
  and second-reader adjudication. Discrepancies do NOT PRODUCE an automatic penalty; they go to human-approved classification:
  - `okuma_hatasi` → the record is corrected with an append-only correction version (the penalty for an operator
    error shall not be passed on to the organization — an application of the 8.5 reading policy);
  - `beyan_tutarsizligi` (a contradiction within the organization's own report) → permanent flag → q̂;
  - `beyan_tutarsizligi_agir` → **cap 20** ("the disclosure is irreconcilable with its own evidence",
    tablo_v1.beyan_tutarsizligi.agir_tavan). The min() is taken with the K0 cap.
- Human-originated flags CANNOT BE DELETED in re-runs of the rule engine (protected rule list).

**C.2 Scope 2 dual reporting audit (K3→q̂)**
- If market-based is disclosed and location-based is not disclosed, the `dual_reporting` flag
  (GHG Protocol Scope 2 Guidance dual reporting requirement). It is included in the counter of the Transparency
  internal-consistency component. Because the value is not WRONG but MISSING, no cap is applied.

**C.3 Official anchor: EPA GHGRP (v1.1 extension of K0 external reconciliation → b̂)**
- Source: EPA GHGRP facility emissions (only `sector_type=E` direct emitters; supplier
  categories — potential emissions of fuel sold — are OUT of scope) × parent-company ownership share.
- Matching is conservative: normalized full-name match only; year alignment ±1.
- **One-directional rule:** because of the GHGRP ≥25 kt threshold, the facility total is a LOWER
  bound on the organization's Scope 1; disclosure > official is NOT PENALIZED. If disclosure < official×0.8, the deviation `min(ln(resmi/beyan), ln 3)`
  enters b̂ as an ADDITIONAL term and the rationale is published in the panel.
- **EU ETS (implemented in v1.1, 2026-07-14):** EUTL Data Package (Zenodo DOI 10.5281/zenodo.20509231,
  CC-BY-4.0) — independently VERIFIED emissions of ETS1 installations (2023: 8,442 installations, 1,150 Mt).
  ETS2 (fuel suppliers) is out of scope. Company total via the installation→account→operator chain;
  matching by LEI or normalized full name; operators whose names begin with the parent company's name at a word boundary
  (subsidiaries) are aggregated into a single group.
- **Biogenic CO₂ exclusion (2026-07-14):** under the GHG Protocol, biogenic CO₂ is not part of Scope 1 →
  in GHGRP, gas_id=BIOCO2 rows are NOT INCLUDED in the anchor. (Lesson: when they were included, the paper/forestry
  sector was inflated and unfair penalties resulted — International Paper 27.3 Mt → 5.4 Mt.)
- **Reading-error safeguard (2026-07-14):** if the anchor/disclosure ratio is >5×, the deviation is most likely
  an operator reading error (unit/multiplier) or a scope mismatch → NO PENALTY IS APPLIED; the score
  is not published ("reading under verification") and the record goes to the confirmation queue. (Lesson: the ArcelorMittal
  disclosure had been read as 97 tCO2e; in the ETS it is 30.5 Mt — instead of penalizing the company, we flagged our own error;
  an application of the 8.5 reading policy.)
- If both anchors (GHGRP + EU ETS) exist for the same company, they are SUMMED: they are geographically disjoint
  sets of facilities, and together they give a tighter lower bound on Scope 1.

**C.4 Activity cross-check (K1 independent recomputation → q̂)**
- Scope 2 location-based is independently recomputed as the electricity consumption in the report text (context-validated) × the country
  grid EF. It is compared with location-based only (market-based legitimately
  diverges through contractual instruments); only the direction computed ≫ disclosed is flagged
  (because the figure in the text may be partial consumption); if the candidate figures are spread by >10× among themselves,
  no judgment is rendered. Flag-only → q̂; no automatic correction or cap is applied.

**C.5 SBTi disclosure consistency (K4 Target Quality + K3→q̂)**
- An "SBTi/science-based alignment" disclosure is cross-validated against the official SBTi list and the sectoral 1.5°C pathway rate
  (config/sbti_patikalar.json — approximate absolute equivalents, with source notes).
- Official list approval > operator pace reading (an approved organization shall not be penalized for a pace-reading error).
- Claim present + no official approval + insufficient pace → Target Quality SBTi component 0 + `sbti_beyan`
  flag → q̂. The sectoral pathway is published on the profile as a separate line and as an alignment judgment.

**C.6 Value chain disclosure component (Transparency v0.2)**
- 6th component of the Transparency Score (10 pts): public supplier list 10 · sealed-confidential disclosure 8 ·
  program present in the report 5 · none 0. The previous five components were rescaled 100→90; the v0.1 weights
  are archived (`_arsiv_seffaflik_v01`). The formula change was recorded in the score history with a version tag.

**C.7 Note on an undocumented existing feature:** the 9.2.1 Fenton-Wilkinson combination has been
correlated since v1.0 (`tablo_v1.korelasyon.rho_ekstr = 0.5`); the criticism that "the independence assumption makes the band
look narrow" is partly addressed by this parameter. Empirical rho calibration is v2 work.