Certification guidance
The Certification Process
A registered identity, a passing evaluation and a signed certificate are different results. Each stage has its own purpose.
What is a Certification Profile?
A Profile describes the subject, required evidence and controls used for a bounded evaluation. It makes the evaluation reproducible and specific. Passing those controls does not expand the public claim into a safety, product-quality or general-compliance guarantee.
What records make up an application?
The process separates the robot identity and authority, request, evidence revision, evaluation, signing candidate, issued artifact and later delivery or publication observations. Each answers a different question. An administrative record of progress is not itself a public certificate.
What evidence does GRRC evaluate?
The applicable Profile defines it. The demonstrated initial path binds a request challenge, robot proof, purpose-specific public keys, an implementation declaration and audit evidence to the same robot and request. Evidence revisions preserve their exact admitted bytes. Private keys and raw private records do not become public verification material.
What does an evidence or readiness check establish?
It checks that the inputs are supported, complete and consistently bound before the applicable evaluation. Missing or conflicting evidence cannot be replaced by an account flag, payment or assurance from the applicant. Readiness alone does not certify the robot.
What do PASS, FAIL and HOLD mean?
PASS means the required evaluation controls passed. FAIL means a decisive check failed. HOLD means the applicable evidence or review issue remains unresolved. None of these labels alone is a signed certificate. The result should identify the appropriate next action without exposing another applicant’s information or private security detail.
Why is there an evaluation proof before signing?
The evaluation result is bound to its candidate, Profile and evidence so the separate signing process can check what was evaluated. An evaluation-result signature protects that handoff. It is not the certifier’s certificate signature and cannot replace it.
Why is certificate signing separate from the application?
The administration application prepares and observes work. It does not hold, reach or proxy the certifier signing key. The supported offline ceremony checks the admitted candidate and produces the certifier-signed artifact. This keeps account, payment and application state from silently becoming public certificate truth.
Why do older documents use the word clearance?
The earlier trust and recovery documents describe a certifier-signed clearance bound to a specific self-decertification event. Initial certification is a distinct path and does not pretend that such a fault happened. This guidance uses “certificate” as the general reader-facing term; it does not rewrite the exact terms or scope of the documents of record.
Does issuance mean the robot has accepted the certificate?
No. Issuance produces the signed artifact. Delivery transfers it; the robot then validates and records acceptance. A durable acceptance receipt is evidence of that deposit. A separate reconstruction determines the current certificate input from the applicable history and trust material. Receipt, current validity and normal robot operation must not be collapsed into one label.
When does a result become publicly verifiable?
When the separately admitted signed public material has been published and can be observed and checked. A registration, passing evaluation, signing candidate or private acceptance receipt does not establish public publication. The public verifier never asks the Admin database to decide whether a certificate is valid.
What if delivery or publication fails?
Read the original operation, artifact and receipt before deciding how to continue. An issued certificate should not be minted again merely because an export, email or response was lost. Delivery failure and absent public material are separate problems, and the interface must report the stage that actually completed.
How long does certification take?
No public completion time is promised. Evidence, evaluation, any unresolved hold, separate signing, delivery and public observation are distinct steps. Local test timings and development exercises are not service-level commitments.
Can an old certificate be edited to renew it?
No. The renewal direction is a fresh signed certificate through the established process, with the old history preserved. Supersession identifies a successor; it does not make a terminal certificate active again. The public and native lifecycle integrations must be qualified before those services are offered generally.