Methodology & provenance dossier

This document is generated on request from the responder's signed data registries — the dataset list and the reproducibility pins below are read live from the responder, not transcribed. The prose sections are written by us and dated.

§1Regulation basis

§2Earth-observation datasets

Source registry v0 — 46 live Earth-observation connectors wired at the responder. Datasets marked ◆ decide the Art. 2(13) deforestation verdict; the rest inform context and cross-checks. Each fact carries the exact dataset version below and is independently signed by the provider.

§3Content-addressed manifests (reproducibility)

Every verdict pins these content-addressed manifests. An assessor reproduces a run by resolving each CID at emem.dev and re-deriving it — the algorithm logic, the band definitions, and the source connectors are all frozen by hash.

§4Verification procedure

A statement is checkable three ways, none of which trust eudr.dev. Two of the three need nothing but the file and eudr verify. See /verify to run all three on a receipt.

1. Engine receipt — the Annex II statement, signed by eudr.dev's ed25519 key. Re-canonicalise the payload, re-derive the CID (raw codec, BLAKE3-256), verify the signature against signer.pubkey_b32. Offline: eudr verify receipt.json.
2. Transparency-log anchor — the tree head emem signed, pinned into the statement. Its ed25519 signature is checked against emem's pinned key (not the one the document carries, which would only prove the document agrees with itself), and each inclusion proof is folded to that head's root. Offline, in the same eudr verify. GET /v1/log/consistency?first=<pinned> later proves the log only ever appended.
3. Provider receipt — the satellite facts, signed by emem.dev under a different key. Re-checked at POST emem.dev/v1/verify_receipt: BLAKE3 preimage + ed25519. This one asks the signer about its own signature, which is worth less than the two above; its preimage is BLAKE3 over canonical CBOR of emem's own structures, and a second implementation that was subtly wrong would report a good receipt as forged.

Per-value integrity: each fact CID resolves at emem.dev/v1/facts/<cid> to the signed bytes, so any number can be checked against its fact.

§5Verdict logic (Art. 2(13))

The per-cell deforestation verdict runs against the JRC + Hansen forest baseline over every ~10 m cell that fits inside the plot polygon. A tree-cover-2000 reading within ±2 pp of the Art. 2(4) 10% canopy threshold is flagged borderline; sub-0.5 ha losses are suppressed by the Art. 2(4) minimum-mapping-unit floor. A forest-loss signal dated after the cut-off is treated as a liability requiring the full polygon verdict — not silently absorbed. Radar (Sentinel-1 VV drop) and embedding-change are additive cross-checks, never the sole legal basis.