Replay
The exact authorization is presented a second time.
not_runLIVE GRID CURTAILMENT DEMO
The grid needs 18 MW back. Which agent is allowed to act?
When demand spikes, the grid may ask one facility to use less power for a fixed window. If an agent changes the site, amount, or timing, the wrong equipment can move and the settlement can be wrong.
GRACE binds one reference request to one facility, a 18 MW reduction, a 90-minute window, two distinct reference approver signatures, a separately keyed meter statement, and one settlement admission.
Wrong siteWrong amountBlind retry
Grid asks→Two roles approve→Gate admits once→Meter checks→Admit settlement once
Signed reference simulation. No physical grid event is claimed.
REFERENCE CURTAILMENT90 MINUTES
GRID STRESSReduce this facility now
Before64 MW
Requested−18 MW
Target46 MW
facility:us-west-dc-17 · exact window · reference only
Ready to run the reference curtailment.
01 / Authorize
Two roles approve
Pending
02 / Verify
Gate checks the order
Pending
03 / Dispatch
Adapter acknowledges
Pending
04 / Measure
Meter reports
Pending
05 / Record
Receipt seals
Pending
06 / Settle
Settlement admission consumed
Pending
Reference load
Awaiting meter--.--- MW
Preparing signed meter evidence...
Ordered-- MW
Delivered-- MW
Compliance--
Evidence packet
BuildingWhat the customer can prove
- Action
- not available
- Authorization
- pending
- COSA acknowledgment
- pending
- Meter statement
- pending
- Action State
- pending
- Settlement
- pending
Hostile replay
Now try to cheat it.
Each refusal is generated by the same implementation that produced the positive proof.
Action substitution
18 MW authorization is reused for a different target.
not_runMeter rule smuggling
A meter tries to inject the settlement rule it is supposed to measure.
not_runHonest boundary
COSA and meter integrations on this page are signed reference adapters, not production grid connections. GRACE proves authorization, adapter acknowledgment, evidence integrity, and one-time settlement admission in the reference state machine. It does not prove sensor truth, physical payment, or that no bypass path exists.