Technical disclosure: methods for reproducible, declinable verification of private-credit figures

UMFR · version 1 · published 2026-10-12 · SHA-256 of this text: 69ab82be6f9c1e5635aa81cf1fec31fe9072738c6ce3ac1ed674478e5ab70e9b

This page describes methods. It is published so that the methods are on the public record with a date. What UMFR serves today is stated on the Methodology page; a method described here is not a statement that it is served.

1. Recomputability classification of a covenant definition. A credit agreement and its amendments are resolved to the operative text of a defined term (for example, a covenant EBITDA definition). Entries are read where the agreement defines them ("means", "shall mean"); where an entry ends is established by rule, and an entry whose end cannot be established is declined by name. Each term the definition sends outside the agreement is classified as recomputable from reported line items, or not; a term that is not is recorded with a reason from a closed, versioned list of reasons, a quotation cut from the text, and the page it sits on or the reason a page cannot be given. The share of counted terms that are not recomputable is reported per agreement; agreements are never pooled into one rate.

2. Decline-first output. Every figure lands in one of a closed set of states (verified, mismatch, disclosed, inferred, declined, absent), and a check of a claimed figure returns one of three: verified, mismatch with both values, or not recomputable with its reason. Silence is never reported as a pass, and nothing is estimated in place of a figure that cannot be read or computed.

3. Stated-precision comparison. A claimed figure is compared with the source figure rounded to the precision the claim itself states; no tolerance is chosen by the verifier.

4. Print beside, never subtract. Where a figure plausibly explains a residual (for example shares repurchased and retired beside a retained-earnings residual), it is printed beside the residual in words and is not subtracted; the check itself is unchanged.

5. Receipts. The result is a canonical object (deterministic serialization, no wall-clock time). Its SHA-256 digest is printed and the object is attached inside the delivered PDF, so a recipient recomputes the digest without the issuer. The digest is signed (Ed25519) under a key identified in the receipt; a public key file lists every key with its validity window, keeps retired keys and marks revoked keys with a date. A verifier anyone can run offline recomputes the digest and checks the signature.

6. A transparency log of receipts. Receipt digests, each combined with a salt held by the recipient, are appended to an append-only Merkle tree; signed tree heads are published at intervals in at least two independent places, and independent witnesses may countersign them. A recipient can prove that a receipt existed at a time and that the log has not been rewritten. The log never holds names, figures or documents.

7. A verification oracle for software agents. A caller submits a claimed figure with its identifiers (for example CIK or LEI), concept and period; the oracle returns verified, mismatch or not recomputable, with a receipt. A decline is never priced above a confirmation, so the incentive never favours "verified". Claims are supplied in structured form; the oracle does not extract claims from free text.

8. Certificate-as-data. A compliance certificate is supplied alongside its PDF as structured data in which each figure carries the identifier of the definition clause that governs it, the input line items, the operation, and a flag for whether it is recomputable with the reason if not; a validator recomputes every figure from its inputs. The verifier validates; it never prepares the certificate.

9. Headroom with stated add-backs set aside. Beside a covenant's headroom, the headroom that remains when the add-backs the certificate itself states are set aside is computed from the certificate's own figures, without mapping any other line to an add-back.

10. Proof of absence. A signed statement that a defined set of delivered documents does not contain an item the governing agreement cites (for example a schedule), with the citing quotation and its page.

11. Pledge-exclusivity commitments. At each funding a borrower signs a salted Merkle commitment over the identifiers of the assets pledged to that facility, and the commitment's root is logged (method 6). No operator matches commitments. When two lenders later compare, or a court or administrator does, an asset present under two commitments is shown by inclusion proofs signed by the borrower and dated by the log; a refusal to commit is itself information to a lender that made the commitment a condition.

12. A portable verification credential. A credential (W3C Verifiable Credentials data model) issued for a facility, keyed to the borrower's legal entity identifier and the facility's identifier where one exists, records the agreement version, the period, the share of the definition that is not recomputable, the terms verified and declined with reasons, the receipt digest and its log position. It carries a validity window tied to the reporting cadence and is marked stale through a status list when a new amendment arrives or a certificate is late. It states facts; it carries no grade.

13. Committed-protocol measurement. A sampling rule and the hash of the complete candidate list are committed before the random seed exists; the seed is a public randomness value published after the commit; the order is a hash of the seed and each candidate's identifier; the measuring code is fixed at a named commit before the draw; results are published within a stated window whatever they show.