This fleet is large on purpose. Chandra Enterprise is not a generic compliance bolt-on. Each deployment is configured to a specific industry personality — mining, Medicaid, NERC CIP, CMMC, FDA, G-SIB, and the rest — so the same protocol can speak the terms, authorities, and evidence an examiner in that industry already uses.
The point is to show that governed attestation is not one vertical. A mine site, a state Medicaid agency, a hospital system, and a defense program do not share a schema. They share a requirement: prove what was done, by whom, under what authority, at the moment it happened. The beta is the set of industry spines that makes that requirement concrete.
The value is the immutable chain. Every governed act appends a context unit: attributed, policy-bound, hash-sealed to its predecessor. That is the record an examiner can reconstruct. It is not a receipt after the fact.
People reach for a blockchain when they hear “immutable.” Chandra does not. Blockchain answers how mutually distrustful parties agree on a shared ledger without a central authority. That is not the problem a regulated enterprise has. Chandra answers how an organization proves what a governed human, agent, system, or process did — under named authority — without miners, gas, or global consensus. Blockchain tries to eliminate the need to trust an institution. Chandra makes the institution’s actions provable. Chandra vs. blockchain.
This is also not only attestation after a human click. It is meant to chronicle everything the organization does digitally, including work that happens at agent speed. Agent stacks become ant farms of ant farms: nested tools, nested authorities, nested write paths. One shared surface is a giant attack surface. Chandra is built for multiple isolation surfaces — Levels, domains, hubs, spokes, instances — so governance and security constraints stay bounded as the agents multiply.
How many principals sit behind one signing credential is a CRC question. The CRC Minimum Surface Standard sets the optimal isolation-surface size as
S* = √((cr + cc · f) / (p · v̄))
That is how many isolation surfaces a deployment should have once a key is stolen — not how small the front door is. Formula and worked notes: crcstandard.org/isolation-surface.html. Scoring: crcstandard.org/scoring.html.
Every deployment on this page is tracked by Marshaller, Chandra's fleet registry. It is not a database of your deployments — it is a list of addresses. Instance name, build version, environment, running personality: none of that is stored. It is fetched live, at the moment someone asks, straight from the deployment itself.
That is a deliberate application of the same isolation logic above, one layer up: Marshaller holding a cached copy of every fleet's state would itself be a single surface worth attacking. Holding nothing but an address means there is nothing there to steal except a pointer to somewhere you'd have to attack anyway. A stale cache never happens, because there is no cache — only a question, asked again, every time.
This is also what makes the deployment count on this page trustworthy rather than aspirational: it did not come from a spreadsheet someone updates when they remember to. It came from asking each deployment, live, right now. Full writeup: Chapter 7 of the User Manual.
Newmont already writes production-close and MSHA inspection records. Chandra does not replace that system. You add one column and one append. The operational write and the attestation are the same act.
Three calls cover a first site. The same pattern scales to every plant, agent, and examiner path.
# 1. Resolve the spoke for a mine site (once per site)
GET https://newmontcorp.chandrahub.net/v1/spokes?site=boddington
# 2. Append the governed act to that spoke's chain
POST https://newmontcorp.chandrahub.net/v1/cu
{
"spoke_id": "spoke:boddington",
"actor": "site.manager@newmont.com",
"authority": "MSHA inspection response",
"subject": "citation-2026-0419",
"predecessor": "cu:7f3a…",
"payload": { "finding": "abatement complete", "shift": "night" }
}
# 3. Confirm the chain head (examiner or job)
GET https://newmontcorp.chandrahub.net/v1/cu/cu:9ab2…
Agents use the same append. They do not get a second, faster path. If the append is refused, the act is not governed — and should not proceed.
Beta addresses are the deployment subdomain on chandrahub.net. Company sites are the organization's public page. Spine built means the Level spine has been committed on that deployment's spine instance.
Two ways in. We can help you set up a closed beta: use the Industry Configurator to generate a custom personality for your organization. Email the resulting JSON as an attachment to inquiries@genreason.com, and include the subdomain you want for an unpublished test site. We can also provide integration assistance.
Or explore first: Chandra Marshaller is public-facing, with a number of companies already populated. No setup required to look around.