v0 previewGrades are draft or provisional: produced under Methodology v0.2.1 from public evidence, pending re-verification and issuer right-of-reply. Nothing here is investment advice, and these are not credit ratings.

Evidence packs — every number re-derivable

A collateral review here is not a PDF you have to trust. It is an evidence pack: a human-readable report plus a machine-readable manifest in which every figure — haircuts, adjusted values, policy verdicts — derives mechanically from two sha256-pinned inputs (the published ratings data and your portfolio file). Anyone can re-run the open-source generator and reproduce the pack, hash for hash.

What's inside a pack

  • report.html — printable review: positions, grades, haircut derivations, policy checks, falsifiers, evidence links.
  • manifest.json— every number plus the sha256 of both inputs, the pack's own manifest_sha256, and a hash_scope field stating the preimage rule, so a verifier needs nothing but the artifact itself.

Sample pack (demo book, synthetic)

report.html →manifest.json →

Portfolio: Demo book (synthetic) · generated 2026-07-19T03:07:48+00:00 · methodology v0.2.1

manifest_sha256: 2a4268ba977b617a3f4c2e75097a35a7d64aa917016f3ba9347ac0a7b30db203

Verify it yourself — three steps

bash
# 1. Hash the two inputs; they must equal the manifest's input hashes.
shasum -a 256 ratings/site/ratings.json ratings/data/portfolio_demo.json
#    -> inputs.ratings_json_sha256   e50b5dbfc3337a5d712d974802bee8389672889f5c45584251c938003d3c94a3
#    -> inputs.portfolio_json_sha256 ecda53a92879db16be24fc58eec337f3281dc8758e21a79a8231cd3d7e2d34fb

# 2. Re-run the generator on those exact inputs.
python3 ratings/engine/audit_pack.py ratings/data/portfolio_demo.json

# 3. Compare your pack to this one: manifest_sha256 and every derived
#    figure must be identical. generated_utc (the run timestamp) is the
#    only field that varies, and it is excluded from the hash preimage.
#    expected manifest_sha256: 2a4268ba977b617a3f4c2e75097a35a7d64aa917016f3ba9347ac0a7b30db203

The preimage rule as stated in the manifest: sha256 over this manifest serialized with Python json.dumps(manifest, sort_keys=True) — default separators, ensure_ascii — after removing the volatile generated_utc field and the manifest_sha256 field itself

Why this matters

Grades are research opinions — but the arithmetic applied to them is not. Reproducibility means an auditor, a counterparty, or a regulator can check every number without trusting us, under Methodology v0.2.1 with no issuer fees. Packs for your own book: export the portfolio JSON from the monitor and run the generator against it.