The platform
The method, written as software.
One system is built to run every part of the programme and to keep the record of building it: proving grounds and gates, mandates, evidence, claims, the desk, governance and capital.
It is built so that the programme cannot say more than it can prove. Every figure carries its source, its revision and its status. Inside the platform, no document is released to an outside reader without a red-line check and two approvals.
Today it runs a demo world of invented data, in which every lot, claim and price is a SHADOW record.
01Modules
Twenty modules, M00 to M19.
Each module owns its records, its permissions and its tests. None writes another’s records. They work together only through declared services and events.
- 1The core M00
- 2Rules M01–M02
- 3Building the programme M03–M04 · M15–M17
- 4Evidence M05–M08
- 5Desk and institutions M09–M14
- 6Oversight M18–M19
- M00
Core
Identity, roles and segregation of duties; the approvals engine; immutable revisions; the hash-chained audit log; signed daily journals; files, parameters, calendars, units and events. Every other module stands on it.
- M01
Framework
The Energy Framework as the chart of accounts and tagging schema: seven pillars, the energy carriers, and the admission gate a carrier must pass before it can have a unit.
- M02
Governance
The constitution as software: entities and their licences, ownership traced to the natural person, related parties, committees, conflicts and recusals, and the red-line registry with its lint engine.
- M03
Roadmap
Proving grounds, the gate ladders, stop rules and clocks, the decision log, the founder’s open decisions, and the risk register in the order each risk would fire.
- M04
Mandates
The acts everything rests on: sponsors by role name, what was asked of them and when, what they signed, what each document permits, legal opinions and data licences.
- M05
Physical
Sites, tanks and tank registers; lots with their title chain, custody arrangement and encumbrance table; and the tier of every lot, set by whether a private holder can attach it.
- M06
Evidence
Write-once evidence records; the interface to accredited inspection bodies; attestations admitted only with their standard and certificate; data certificates and the reserve evidence pack.
- M07
Index
Units per carrier and grade, energy-content conversions as a disclosure column, quality adjustments settled in cash, benchmarks and differentials, and the fix engine of an index administration kept behind information barriers.
- M08
Registry
Claim classes, issues and holders, and a ledger that balances separately for each carrier, grade, place and period. In the design, cash moves only through a settlement bank, never through the registry; no settlement bank has been engaged.
- M09
Trade House
The origination desk: counterparties and know-your-customer files, screening of parties, vessels and origins, the parcel pipeline and its control points, and a log of every refusal.
- M10
Arranging function
The arranging function: the instrument catalogue with its readiness tests and exclusion rules, new-product approval, term sheets, payoff engines and determinations.
- M11
Reserve Custody
The reserve as evidence: tiers, haircuts, the borrowing base, the reserve ladder, the cash floor, matching carrier by carrier and tenor by tenor, and stress tests.
- M12
Credit
The lawful forms of lending and the gate at which each may begin; applications, decisions, facilities, covenants and margin calls in cash. No lending takes place today. In the design, until a programme entity holds the licence that lending requires, any loan is made by a licensed bank as lender of record. No bank has been engaged.
- M13
PRISM
Methane and flaring measurement as a data service, carbon attributes on every lot, and the carbon desk with its buffer pool. Verification is kept outside.
- M14
Markets
Issuance books and the census of which institutions could lawfully hold a claim; venues and clearing members used as a client; market-making agreements; insurance with published triggers.
- M15
Capital
Capital planning against gates: the bridge and its stop date, burn and runway, and tranches released only at gates. The module keeps records; it is not used to offer anything.
- M16
Data room
The only door to outside readers: the redaction gate, publication approved by two people, and access grants for invited reviewers.
- M17
Library
The governing documents as immutable versions, parsed, cross-linked and searchable, with a glossary of the programme’s language.
- M18
Reports
An overview of the programme’s state, and a report engine. SHADOW figures never reach an external report, and every external report passes the red-line check before it goes out.
- M19
Admin
Users and roles, segregation-of-duties rules, health, jobs, imports and exports, parameters, the hardening register, releases and signing keys.
02Controls
Built to be checked.
The controls are not a layer on top. They are how every record is made.
Maker and checker
Every change that matters is proposed with a reason and takes effect only when someone else approves it. No one decides their own request. Segregation of duties is enforced at every decision: the founder cannot pass a gate, the administrator proposes and never approves, and the auditor only reads.
Hash-chained audit log
Every change writes an audit entry that carries the hash of the entry before it, so the log can be verified from its first line. Append-only journals close each day into a signed root and are to be notarised each quarter outside the platform.
Immutable revisions
A governed record is never overwritten. Each change is a new revision, and each approval is bound to the exact content its checker saw.
SHADOW record mode
Until a proving ground passes the gate that makes them live, its lots, claims, reserve figures and index values are SHADOW records. They can be worked with, but they are never presented as live, and every external report leaves them out.
Red-line lint
One engine checks every outgoing text against the red lines, the names it must never print, and the confidential terms and figures, which it holds only as keyed hashes. A blocking finding stops publication until it is fixed or, where the rule allows, waived on the record by the compliance officer.
Redaction gate
Every document the platform releases to an outside reader passes the gate: parties replaced by role names, confidential figures removed, a clearance line added. The platform then requires the compliance officer’s approval and, separately, counsel’s.
Two-person key rotation
A signing key is rotated only when a second person approves. An emergency rotation is possible, but a second person must ratify or dispute it afterwards.
The AI boundary
AI may classify, detect anomalies, forecast, draft and review. It never makes a final regulatory, credit, reserve or valuation decision. A person does, and the record shows who.
03Demo
By invitation.
A demonstration instance runs at app.energinko.com. It holds a synthetic world: every party, figure and document in it is invented.
Access is by invitation only, and credentials are never published. To ask for access, write to hello@energinko.com.
The demo shows how the method works. Nothing in it is an offer, and nothing in it can be bought, sold, held or subscribed for. It is not evidence of any transaction, asset, agreement or relationship.