OID Registry

OID reconciliation notice

The directive's requested top-level structure (.1 certificate policies, .2 certificate profiles, .3 extensions, .4 algorithms, .5 organizational units, .6 products/services) collides directly with arcs 1-6 of the ALREADY-PUBLISHED, hardware-signed sanctum-oid-registry v2.0: arc 1 = PKI & CERT INFRASTRUCTURE (includes sanctum-root-ca-g1 = .1.1), arc 2 = CERTIFICATE POLICIES (already has DV/OV/HV/PQC-only/hybrid/CNSA2 etc. at .2.1-.2.12), arc 3 = DYNASTIC TRUST & GOVERNANCE, arc 4 = SOFTWARE SIGNING, arc 5 = LICENSING & IP, arc 6 = SILICON APEX & HARDWARE. None of these were renumbered. All new OIDs required for this build's CP/CPS/profiles/extensions/algorithms/org-units/products were placed under arc 23, which the published registry explicitly reserves with the comment 'RESERVED FOR FUTURE EXPANSION -- allocate as new lines of business launch.' Additionally, this build's naming CN 'sanctum-root-ca-g1' for the LAB/TEST demo hierarchy is a plain string label / Common Name only; it does NOT reuse or claim the already-assigned OID 1.3.6.1.4.1.65953.1.1, which belongs to the real production root CA per the published registry. This naming overlap (identical label, different meaning: demo CN vs. real OID-bearing entity) should be flagged to Brian to avoid confusion in future documentation.

External source of record: https://github.com/Sanc-Admin/sanctum-oid-registry — v2.0, hardware-signed (YubiKey 5C NFC serial 37290121, PIV slot 9c, ECDSA-P384), 2026-07-09

• Confirm arc 23 is acceptable for the new CP/CPS/profile/extension/algorithm/org-unit/product identifiers, or direct a different unused arc.
• Confirm whether the LAB/TEST demo CA common name 'sanctum-root-ca-g1' should be renamed to avoid confusion with the real, OID-bearing production sanctum-root-ca-g1 (1.3.6.1.4.1.65953.1.1) in the published registry.
• The published registry's arc 2 (CERTIFICATE POLICIES) already defines sanctum-policy-pqc-only (.2.4) and sanctum-policy-hybrid-composite (.2.5) -- CP.md and CPS.md in this build cross-reference those existing OIDs rather than redefining PQC/hybrid policy OIDs from scratch.
• No existing published assignment was renamed, renumbered, or altered by this build. This registry.json includes a read-only mirror of all 272 published assignments for browsability alongside the new arc 23 entries; the external repo (Sanc-Admin/sanctum-oid-registry) remains the sole authoritative source for arcs 1-22.