Leitungstreu
Provable Istwerte. The EMS stays.
Leitungstreu is the German/EU product on the Cadenza verification fabric: signed Istwerte at the gateway, verify-only core, Merkle provenance, RFC 3161 anchor. Payload profile de.grid.telemetry.v1. It sits beside existing Leittechnik.
What EMS means here
Energy Management System — grid control beside SCADA, not emergency medicine. The slogan “the EMS stays” means Leitungstreu does not replace Leittechnik. A tamper demo changes only an EMS copy of the Istwert, not the signed leaf.
The gap
Anlage, Vermarkter and VNB decide Redispatch and flexibility from Istwerte that pass through gateways and historians. The shared question is: did this plant report exactly that quarter-hour — and did nobody rewrite the history afterwards?
Four steps — the EMS stays
- Sign at the gateway — A Go agent signs the canonical payload hash (Ed25519). Private keys stay at the edge. Tag: Cadenza-Attestation-v1.
- Verify only — The Spring Boot core never mints source signatures. It verifies, then stores append-only.
- Merkle + RFC 3161 — Leaves are sealed; roots go to an independent RFC 3161 timestamping authority. Not a blockchain.
- Ampel and Akte — GRUEN / GELB / ROT on the Quellenkarte. Three-party room: Anlage, Vermarkter, VNB; ISB reads.
What we do not claim
- Not NIS2-certified and not a KRITIS fulfilment statement.
- Not a statutory meter and not an SMGW replacement (MessEG / MsbG).
- Not a blockchain, token, or extra chain process.
What we may say
- Supports evidence and incident duties under the new BSIG (NIS2).
- Checkable origin for Istwerte in Redispatch data exchange.
- On-prem; no third-country model API is required.
Reference
Architecture snapshot (CC-BY-4.0), recorded after deposit — not invented, not a grant award: doi:10.5281/zenodo.21820827