Measurement methodology

# Reserve Board — Methodology This document is the exact methodology the public board's figures were measured under. It is landed as a hash-anchored artifact on the board's registry evidence chain; the pre-publication review (a `BOARD_REVIEW` artifact on the same chain) signs off on this document's hash. If the served methodology and the reviewed methodology ever differ, every figure route withholds itself rather than render an unreviewed figure. Nothing on the board is a solvency claim about any issuer. Tracked tokens are subjects of public data: supply figures are read from their public Ethereum contracts, and composition figures from the issuers' own published attestation reports. No tracked issuer is a customer and none has endorsed this board. ## 1. On-chain supply measurement Supply is snapshotted hourly at a finalized Ethereum block, through a quorum of independent RPC providers that must agree byte-for-byte. Each figure carries its provenance tier: - **STORAGE-PROVEN** — the total-supply storage slot is read via `eth_getProof` and the Merkle-Patricia proof is verified locally against the block's state root. The slot itself was pinned only after a probe found exactly one slot whose storage equals `totalSupply()`, and that equality is re-verified on every snapshot. - **QUORUM ETH-CALL** — a quorum-agreed `totalSupply()` call result. No storage proof is possible without a known slot, and none is claimed. Divergent quorum legs block the snapshot: the divergent responses land as evidence and an incident opens; nothing is published from a disputed read. ## 2. Issuer attestation parsing Issuer reserve reports — monthly examination/redemption-assets PDFs and quarterly ISAE 3000R consolidated reserve reports alike — are captured and hash-anchored **before** parsing. Parsing runs against pinned per-issuer templates that refuse on any layout drift: a document that does not cross-foot, or whose section anchors moved, lands nothing beyond the captured source. Line labels are stored verbatim — normalization never discards what the issuer actually said. Issuer reissues are handled by supersession: a re-parse lands a new report row pointing at the old one, and the old row remains verifiable. ## 3. Coverage ratios (the honesty core) A coverage ratio only ever divides two figures from the **same** issuer attestation at the **same** as-of date: the document's total reserve figure over its tokens-outstanding figure, both issuer-attested, quantized to six decimal places. On-chain measurements never enter a ratio — reserve USD at one date is never divided by on-chain supply at another. Reports whose stated scope is a consolidated group — one redemption value across every token the issuer issues — yield **no per-token coverage ratio** unless the document itself itemizes this token. The page labels the scope instead: the reserve composition renders at its stated scope, and no on-chain reconciliation is derived against a figure the document does not state per token. ## 4. Reconciliation (the independent cross-check) On-chain supply cross-checks the liability side of each attestation, paired only within a 72-hour window of the document's as-of date: - Documents that itemize per-chain token counts reconcile the measured Ethereum supply against the attested Ethereum figure directly, within a stated tolerance (default 0.5%). - Documents that state only a total get a bound check — the measured Ethereum slice must fit under the attested total — plus the honest Ethereum-share figure. That is a bound check, not a full reconciliation, and the page says so. - No snapshot inside the window renders as NOT MEASURED. Absence is rendered, never bridged with a stretched match or a stand-in figure. ## 5. Evidence chain and review Every artifact behind these pages — quorum logs, storage proofs, snapshot records, captured source PDFs, parsed reports, this document, and the review itself — lands on an append-only, tamper-evident hash chain that is Merkle-anchored to external timestamping services nightly. Standalone verifier scripts re-derive the chain and the storage proofs from primitives, without this product's code paths. Staleness of attestations, material composition shifts between reports, and any measured supply exceeding an attested figure open incidents automatically. ## 6. Coverage and completeness The coverage page states the board's own coverage, under the same pre-publication review as every other figure: - **Tracked set and depth.** Every tracked token is listed with its attestation series' first and last report month and report count. A token with no attestation series renders that absence — its on-chain supply shows, nothing else stands in for a composition figure. - **Cadence expectations.** Each token's staleness clock keys on its own expected publication cadence. The basis of the expectation is stated and ranked: ISSUER_STATED (the issuer's own document states the schedule) over OBSERVED (inferred from the series), over the global default (monthly) when no expectation row exists. The board and the automated watch sweep share one cadence computation, so they can never disagree. - **Two lags, both defined.** Publication lag = the document's own issue date minus its latest as-of date (the issuer's delay). Capture lag = our first hash-anchored capture of the document minus its issue date (our delay). Where the document states no issue date, both render as absent. - **Document metadata is verbatim-or-NULL.** Accountant name, engagement standard citation, and engagement type appear only as literal text spans found in the captured document. Each field carries one of three outcomes: EXTRACTED (span held), NOT_FOUND_IN_DOCUMENT (a metadata-aware parse probed and the document does not state it), or NOT_EXTRACTED (the row predates metadata extraction — a re-parse, not the document, is what's missing). Nothing is inferred from outside the document. - **What is not covered, stated.** The page lists the networks ingested, the tokens without an attestation series, and the source tiers in use — and states that anything beyond them (other networks, other document classes, periods before each series' first report month) is not covered. Absence is stated rather than left to be inferred. ## 7. The disclosure score Each token's detail page carries a disclosure score for its latest active report and for its attested series as a whole. The score measures the DISCLOSURE — what a published document and its series let a reader independently verify — and nothing else. - **Counted, never graded.** The composite is "N of M verifiable dimensions", never a letter grade, a ranking, or a rating of any issuer. It is not a judgment of any figure's truth or of reserve sufficiency: a low score means the document discloses less that can be verified, not that anything in it is wrong. - **Every dimension cites its stored fact.** Each dimension renders as met/not-met beside the literal stored fact it derives from and the table, column, or artifact key that fact lives in — the score is auditable line-by-line against the same evidence chain as every other figure. - **Report dimensions** cover: accountant named, engagement standard cited, engagement type stated, document dated, publication lag measurable and within the staleness allowance, category breakdown present, position-level itemization, instrument identifiers (CUSIPs), per-chain liability itemization, arithmetic cross-footings restated by the document, and single-token scope. **Series dimensions** cover: cadence stated by the issuer (versus observed from the series), gap-freeness against the expected cadence, and series depth. - **Inputs are stored facts only.** Scoring reads the already-captured report rows, composition rows, source expectations, and the parsed report artifact's own verification-check list. It never re-opens a document, so every score re-derives from stored facts alone; metadata the document does not state scores as absent, never inferred (§6 rules). - **The rubric is versioned and frozen.** Every score row records its rubric version and lands as a hash-anchored artifact on the registry evidence chain. Re-scoring under a changed rubric — or after the stored facts change — supersedes the prior score and retains it; both results stay verifiable, and the reason for the restatement is recorded. ## 8. Regulator-filed corroboration For a token whose issuer's own attestation names a registered fund, the board shows a third evidence leg: the fund's net assets as filed with the SEC on Form N-MFP, beside the attested fund-line figure, each carrying its own provenance (accession number and dataset hash on the filed side; report hash and as-of date on the attested side). - **Mapped only from the document itself.** A fund mapping exists only when the fund is named verbatim in the attested composition. No operator-supplied guesses about where reserves sit: if the attestation does not name the fund, no mapping — and the token honestly renders NOT APPLICABLE. - **An annotation, never an input.** The filed figure never enters any ratio and never adjusts any attested figure. Ratios still divide only figures the issuer's own document states at the same as-of date. - **Compared within a stated window and tolerance.** The filed report date is matched to the nearest complete attested as-of date within a per-mapping window; the divergence is stated in basis points beside the tolerance it was compared against. Outcomes are exactly CORROBORATED, DIVERGENT, or NOT APPLICABLE. - **Divergence pages, and both figures keep rendering.** A divergence beyond tolerance opens an incident; nothing is silently reconciled and neither figure changes. - **Unchanged filings land nothing.** A re-pull that finds the same filed figure for the same period writes no new rows and no new artifacts; the evidence chain records events, not repetition. - **Most tokens are NOT APPLICABLE.** Only reserves held through a registered fund that files N-MFP can be corroborated this way; the board states that absence rather than leaving it to be inferred.