It is a public commitment to governed operation, backed by an append-only Chandra audit chain that any auditor or examiner can pull. The cert enters you into the governed namespace. The chain is the proof of residency.
Every GABA certificate is issued by the General Reasoning Certificate Authority under IANA PEN 65823. Each cert carries six X.509 extensions registered under OID 1.3.6.1.4.1.65823 that no other CA in the world can issue or validate:
The Chandra CU is written before the cert is issued. The cert embeds the CU reference. This means the authorization record exists in the append-only chain before the certified entity exists. It cannot be backdated, altered, or removed.
gaba_chain_ref in the certificate extensionAll issued under OID arc 1.3.6.1.4.1.65823.1.
| Type | OID | Purpose |
|---|---|---|
| genesis | 1.3.6.1.4.1.65823.1.7 | Bootstrap cert. Required before any Chandra instance can write CUs. Governance precedes existence at the chain level. |
| hub | 1.3.6.1.4.1.65823.1.1 | Chandra hub deployment. Authorizes a hub to govern spokes and enforce suspension. |
| spoke | 1.3.6.1.4.1.65823.1.2 | Domain-specific Chandra spoke. Each customer deployment gets a spoke cert. |
| agent | 1.3.6.1.4.1.65823.1.3 | AI agent or skill. No agent executes without a capability manifest and a GABA cert. |
| edge | 1.3.6.1.4.1.65823.1.4 | Edge certificate for graph computation boundaries in adversarial environments. |
| human-principal | 1.3.6.1.4.1.65823.1.5 | Named human principal. Binds a person to the governed namespace as an authorized actor. |
| marshaller | 1.3.6.1.4.1.65823.1.6 | Marshaller identity. Sole authority for spoke reinstatement after Andon suspension. |
A GPD cert is a public commitment by an organization to pursue a specific governance standard. It carries machine-readable Definitions of Ready and Done, linked to a Chandra chain that either satisfies them or doesn’t. An examiner doesn’t have to trust the org — they pull the cert, read the DoR/DoD, and check the chain.
Other planned GPD classes: SOC 2, FINRA broker-dealer supervision, CMMC, and custom org-defined labels. The schema deliberation for each class is written to Chandra before the class is published — the standard itself is governed.
The General Reasoning Certificate Authority operates under step-ca at ca.gabastandard.com. The root CA fingerprint for independent verification:
Every cert issued under this CA can be verified against the Chandra chain using the gaba_chain_ref extension value.
The following information is published for independent verification and auditor review.
| Item | Value |
|---|---|
| CA software | step-ca 0.30.2 (Smallstep) |
| Infrastructure | Dedicated Linode VPS, Ubuntu 22.04 LTS |
| CA address | ca.gabastandard.com (69.164.199.5) |
| Root key type | ECDSA P-256 |
| Intermediate key type | ECDSA P-256 |
| IANA PEN | 65823 (General Reasoning, Inc.) |
| OID arc | 1.3.6.1.4.1.65823 |
| Revocation | Manual revocation via step-ca. CRL/OCSP not yet published — planned post-beta. |
| Audit trail | All CA issuance events write a Chandra CU before cert issuance. The CA’s own chain is anchored to the genesis cert. |
| GABA extensions | Defined and OID-registered. Extension payload population is in active development — values will be fully populated at general availability. |
| Beta status | This CA is in public beta. Root CA fingerprint and OID arc are stable and will not change. Cert schema may be revised before GA. |
Security inquiries, revocation requests, and CA chain audit requests: inquiries@genreason.com