Earned by coverage, signed by math

The ladder

Tiers are per-discipline (except Distinguished, which is cross-discipline). You can hold different tiers in different disciplines at the same time. “Coverage” is the share of a discipline’s skill graph you’ve reached with passed, distinct graded labs.

Every graded lab you pass becomes a signed entry in your evidence record. When your coverage of a discipline’s skill graph crosses a tier threshold, our promotion service automatically issues a credential in the W3C Verifiable Credentials format (the signing format, not the Verified checkpoint), which also records its own method (AI-assisted, lab-graded, no live defense) so the claim is never ambiguous.

The credential is signed with an Ed25519 key held in Google Cloud KMS, and the matching public key is published at genbodha.ai/.well-known/did.json. Each credential names the key version that signed it, so the key can rotate without invalidating earlier credentials. Tiers are awarded by an automated rule engine from your evidence — no one hand-assigns a tier. And because every credential carries a public, signed revocation status, a credential we pull (or re-issue) fails verification against our published revocation status from the moment we revoke it — revocability is the feature that keeps the signal trustworthy, not a loophole.

A recruiter, ATS, or LinkedIn integration pastes your credential URL into our verifier widget. The check doesn’t ask anyone to take our word for it: the credential JSON, our public signing keys, and the signed revocation status are all public endpoints, and the signature check runs in your browser — not on a server we control. One honest caveat: that check runs through our verifier today, not a generic W3C VC library; standard-library interop is on the roadmap.

• They fetch our public key once from /.well-known/did.json.
• They verify the Ed25519 signature in the browser against that key.
• They check revocation against a public, signed status list, or hit /api/credentials/{id}/verify for a one-shot active/expired/revoked answer.
• They get a yes/no in seconds — the only calls to us are the public key and the status list, both public, signed endpoints.

If a credential is altered after signing — by you, by us, by anyone in between — the check fails. That’s the point.

Coverage credentials (Foundational through Advanced) are valid for 24 months. The Frontier-earned Expert and the cross-discipline Distinguished tier are re-checked sooner — 18 months — so the highest claims stay the most current. GenAI skills move fast, so coverage is re-checked rather than assumed permanent — a credential reflects what you can do now, not five years ago.