Skip to main content
GRACE FLEX PASSPORT

Portable, offline-verifiable evidence for flexible AI load.

The Flex Passport is a portable evidence packet, verifiable offline, that binds who authorized each curtailment, what was ordered, and what the meter statement reported. Interconnection, payment, and audit decisions stay with the utility, the program, and the auditor.

EMILIA makes the authorization and evidence behind AI compute flexibility verifiable.

Where it stands: the reference circuit runs end to end in software. Its actuator and meter adapters are reference simulations, and no physical measurement has been run. Physical evidence starts with a facility pilot.

Request a Flex Passport pilotHow Proof-of-Curtailment works
WHY NOW

Flexibility is proven. Verification is the missing piece.

Grid-responsive AI compute is no longer theoretical: 2026 research demonstrates a real 130 kW GPU cluster delivering rapid load reduction and sustained curtailment in deployment while preserving priority jobs. Schedulers can shed. Meters can measure. What is missing is evidence a utility, aggregator, regulator, or auditor can check offline instead of relying only on the operator’s application logs. The Flex Passport is built to be that evidence.

WHAT A PASSPORT CONTAINS

Nine artifacts. One verifiable packet.

01
Bounded curtailment order
A bounded, reversible grid.curtailment order (target ΔkW, window, hard expiry), digest-bound and checked fail-closed against the season’s human-authorized flex envelope before anything is dispatched.
02
Named-human / quorum authorization
The accountable decision captured as device-bound signoffs from a pinned approver roster, checked against the fixed number of approvals the roster profile requires. The action request route refuses a target at or above the hard-cut threshold (25,000 kW by default) unless at least two approvals are required. Who said yes, to exactly what, before anything shed.
03
Scheduler acknowledgment
The facility’s signed acknowledgment that it entered curtailment posture against the verified order, not against a spoofed or stale one. In the reference it comes from a simulated COSA adapter, and the shipped verifier accepts only simulated acknowledgments.
04
Separately keyed meter statement
Power samples signed under the meter’s own pinned key, separate from the actuator’s key, and bound to the exact event and window. In the reference the meter is simulated and derives its readings from the order. The samples are not anchored: the Action State record is a signed statement that is not registered in any transparency log.
05
Pinned baseline method
The hash of the program’s prescribed baseline methodology, bound into the order and the bundle, so a method swap is evident. GRACE does not execute the method: the baseline value arrives as a number in the meter statement and is not derived from the pinned method.
06
Delivered-load calculation
Delivered = baseline − average interval load, in average MW, with compliance at 95% of the ordered reduction by default. Deterministic from the signed meter statement, which the bundle carries by digest. The reference admits settlement only when the result is compliant and in bounds.
07
Replay & tamper refusals
The negative evidence: forged orders, tampered telemetry, and replayed authorizations are refused with a stated reason, and the reference tests exercise each path. Refusals are returned as unsigned verdicts today; they are not signed events.
08
Offline bundle check
The bundle carries an Ed25519 signature that verifies offline with the open-source reference library (JavaScript). The JavaScript, Python, and Go EMILIA verifiers cover EMILIA receipts; none of them verifies the GRACE bundle yet.
09
Proof-of-Curtailment Bundle
One signed bundle binding the order, authorization, acknowledgment, meter statement digest, and computed result, portable and verifiable offline for as long as the pinned keys are trusted. The reference keys expire on 2027-01-01.
ONE ARTIFACT, FIVE PROBLEMS

Everyone at the table needs the same proof.

Datacenter / neocloud operator
“Help me get connected faster.”
Portable evidence of who authorized each curtailment, what was ordered, and what the supplied meter statement shows, in a form a utility can check instead of discount.
Utility / ISO
“Prove this load will actually curtail when dispatched.”
Signed, digest-bound records of the authorized dispatch and the supplied meter statement, checkable offline instead of relying only on the operator’s application logs. Meter truth still depends on the meter.
Regulator
“Show me this AI facility will not wreck ratepayers.”
A third-party-checkable record of which curtailments were authorized, ordered, and reported under the program’s pinned method.
DR aggregator
“Give me evidence I can take into settlement review.”
A portable, tamper-evident M&V artifact for large, fast flexible loads, carried into the program’s existing review and settlement process.
Public / policymaker
“Can AI give power back during grid stress?”
Receipts for each authorized curtailment, not press releases. Proving physical delivery still needs a metered facility pilot.
HOW A FACILITY GETS ONE

A 90-day pilot, then a living evidence practice.

1
Integrate
One facility or GPU cluster, with the facility controller wired to verify orders offline, fail-closed. A real smart-PDU or meter needs its own adapter and verifier, which GRACE does not ship yet: today’s verifiers accept only simulated meter and actuator statements.
2
Drill
Three simulated curtailment drills, each emitting a Proof-of-Curtailment Bundle. A live curtailment, where the program and facility allow, needs real meter and actuator adapters and verifiers, which do not exist yet.
3
Verify & report
Every bundle signature checked offline; adversarial paths exercised (forged order, tampered telemetry, replay: all refused). A utility/aggregator-facing report packages the result.
4
Keep it current
Ongoing managed evidence: repeat drills on an agreed schedule, key registry, audit exports, and the settlement archive. Drill scheduling is a service step run with the facility; it is not shipped code.
HONEST POSTURE

Verified means verifiable: by you, not just by us.

The Flex Passport is evidence-based, not authority-based: the bundle signature verifies offline with the open-source reference library, so its value does not depend on trusting EMILIA as a certifier. The baseline methodology belongs to the applicable program or tariff. GRACE pins its hash so a method swap is evident; it does not invent the method, execute it, or derive the baseline. EMILIA proves authorization, execution acknowledgment, and integrity of the supplied evidence: a necessary, not sufficient, condition for trustworthy demand response. It does not prove that meter readings are physically true. The shed side is scheduler-agnostic: COSA is the first actuator profile, through a simulated reference adapter today, and any scheduler that can acknowledge a verified order can hold a passport.

Request a pilotGRACE overviewVerify a receipt