It is a public commitment to governed operation, backed by an append-only Chandra audit chain that any auditor or examiner can pull. The cert enters you into the governed namespace. The chain is the proof of residency.
Every GABA certificate is issued by the General Reasoning Certificate Authority under IANA PEN 65823. Each cert carries six X.509 extensions under General Reasoning's registered OID arc 1.3.6.1.4.1.65823. Anyone can write those OIDs into a certificate; only certificates that chain to the GABA root are valid GABA certificates:
The Chandra CU is written before the cert is issued. The cert embeds the CU reference. This means the authorization record exists in the append-only chain before the certified entity exists. Altering or removing it breaks the chain, and once the chain head is witnessed outside General Reasoning, backdating it is detectable too. The pattern parallels Certificate Transparency, where a pre-certificate is logged before issuance and the log's proof is embedded in the final certificate (RFC 6962, RFC 9162).
gaba_chain_ref in the certificate extensionAll issued under OID arc 1.3.6.1.4.1.65823.1.
| Type | OID | Purpose |
|---|---|---|
| genesis | 1.3.6.1.4.1.65823.1.7 | Bootstrap cert. Required before any Chandra instance can write CUs. Governance precedes existence at the chain level. |
| hub | 1.3.6.1.4.1.65823.1.1 | Chandra hub deployment. Authorizes a hub to govern spokes and enforce suspension. |
| spoke | 1.3.6.1.4.1.65823.1.2 | Domain-specific Chandra spoke. Each customer deployment gets a spoke cert. |
| agent | 1.3.6.1.4.1.65823.1.3 | AI agent or skill. No agent executes without a capability manifest and a GABA cert. |
| edge | 1.3.6.1.4.1.65823.1.4 | Edge certificate for graph computation boundaries in adversarial environments. |
| human-principal | 1.3.6.1.4.1.65823.1.5 | Named human principal. Binds a person to the governed namespace as an authorized actor. |
| marshaller | 1.3.6.1.4.1.65823.1.6 | Marshaller identity. Sole authority for spoke reinstatement after Andon suspension. |
A GPD cert is a public commitment by an organization to pursue a specific governance standard. It carries machine-readable Definitions of Ready and Done, linked to a Chandra chain that either satisfies them or doesn’t. An examiner doesn’t have to trust the org — they pull the cert, read the DoR/DoD, and check the chain.
Other planned GPD classes: SOC 2, FINRA broker-dealer supervision, CMMC, and custom org-defined labels. The schema deliberation for each class is written to Chandra before the class is published — the standard itself is governed.
The General Reasoning Certificate Authority operates under step-ca at ca.gabastandard.com. The root CA fingerprint for independent verification:
Every cert issued under this CA can be verified against the Chandra chain using the gaba_chain_ref extension value.
The following information is published for independent verification and auditor review.
| Item | Value |
|---|---|
| CA software | step-ca 0.30.2 (Smallstep) |
| Infrastructure | Dedicated Linode VPS, Ubuntu 22.04 LTS |
| CA address | ca.gabastandard.com (69.164.199.5) |
| Root key type | ECDSA P-256 |
| Intermediate key type | ECDSA P-256 |
| IANA PEN | 65823 (General Reasoning, Inc.) |
| OID arc | 1.3.6.1.4.1.65823 |
| Revocation | Inside a governed deployment, every request is checked against the certificate's Chandra spoke, so a suspension or revocation takes effect at the next request. For relying parties outside the deployment, revocation is manual via step-ca; CRL/OCSP are not yet published — planned post-beta. |
| Audit trail | All CA issuance events write a Chandra CU before cert issuance. The CA’s own chain is anchored to the genesis cert. |
| GABA extensions | Defined and OID-registered. Extension payload population is in active development — values will be fully populated at general availability. |
| Beta status | This CA is in public beta. Root CA fingerprint and OID arc are stable and will not change. Cert schema may be revised before GA. |
Security inquiries, revocation requests, and CA chain audit requests: inquiries@genreason.com