Independent. No commercial relationship with UnGovr — no funding, no agreement, no conversation of any kind — checked 9 September 2026. Disclosures · how every claim here is evidenced

ungovr.providers.sgit.ai / decks / How this composes

How this composes

With Risk Mandate, Licence to Operate, and the sgit vault family · 10 slides · September 2026

⇩ Download the PDF 1138 KB · 10 slidesThe markdown ↓sha256 9dceb805af0aa1df — checked against the vault on every build
How this composes · slide 1 of 10

The shape everything shares

Four vaults, one chain, different segments of it:

  AIUC-1        standard -> control -> requirement -> attestation -> conformance -> insurability
  LICENCE       grant -> mandate -> DELTA -> policy -> covered / not covered
  THIS VAULT    entity -> instrument -> provision -> obligation -> control -> evidence -> acceptance

They overlap at control, evidence and acceptance. That is not a coincidence — it is the same risk-acceptance grammar applied to three different sources of obligation: a standard, a mandate, and a statute.

This vault supplies the third one, which none of the others had.

Seven vaults from across the family, each opening in the page from its own read key.
Seven vaults from across the family, each opening in the page from its own read key.
ungovr.providers.sgit.aiThe estate →
How this composes · slide 2 of 10

What we take: the two-edge rule

The AIUC-1 conformance vault keeps two edges "never traversed in one query without the query naming which it used":

EdgeAnswersAbsent means
evidenced_bydoes the standard say this?a build defect
attested_bydoes this subject do this?the control is unevidenced — which is the finding

We do the same thing on a different axis. ung: is what UnGovr publish; sg: is our model; exactly one edge crosses between them and it is drawn inferred.

Their rule is enforced by a test that goes red if a layer edge reaches a source_observation. Ours is enforced by a build check that fails if any page names sg:resolvesTo without marking it inferred.

ungovr.providers.sgit.ai
How this composes · slide 3 of 10

What we take: unevidenced is a state

From the same vault: "Every control in scope gets a row whether or not anyone has looked at it, so an absent row is never quietly read as compliance."

Their first build of one subject across 53 controls: 2 evidenced, 48 unevidenced, 3 contradicted — "the designed answer, not a failure to finish."

Our evidence node ships unevidenced and our acceptance node ships with no owner. Both are the default, both stay, and both mean nobody has looked rather than nothing is wrong.

ungovr.providers.sgit.ai
How this composes · slide 4 of 10

What we contribute: a jurisdiction layer

327,138 entities. 398 records laws. 254 of them sub-national.

A policy/v1 that covers an agent acting for a public body has to know which body, and which law binds it. Neither the Licence to Operate vault nor the conformance layer carries that, and neither should have to build it.

This vault is that lookup — with the honest caveat attached, which is that the entity-to-law edge is inferred, reaches 96.6%, and hands 20.5% of matches to a human.

The jurisdiction layer this vault contributes, drawn as the graph it is.
The jurisdiction layer this vault contributes, drawn as the graph it is.
ungovr.providers.sgit.aiThe seven-step join →
Notes. The caveat is the contribution as much as the data is. A jurisdiction layer that silently guessed would be worse than none.
How this composes · slide 5 of 10

What we contribute: a clock nobody negotiates

The conformance layer's headline mechanism is that time breaks the policy: move the date to 2027-01-15, "with nothing edited by anybody", and one condition becomes 53 exclusions — because the attestations behind them expire.

Our obligations expire on a different clock, and it is not ours.

Gov. Code § 7922.535(a): the agency shall determine and notify within 10 calendar days, extendable by 14 in unusual circumstances. Calendar days — office closures do not toll it.

An attestation expiry is a policy parameter somebody chose. A statutory deadline is a fact about the world. A conformance model that can carry both is strictly better than one that can only carry the first.

ungovr.providers.sgit.ai
How this composes · slide 6 of 10

The delta, at zero

Licence to Operate's argument, made countable:

In their demo
CAN DO — the grantwhat the agent can technically reach12 capabilities
MAY DO — the mandatewhat is actually expected, and all the policy insures4
THE DELTAinside reach, outside authority. Nothing covers these8

This vault's app declares "permissions": [].

CAN DO equals MAY DO. The delta is zero — not managed down, absent. It is the smallest possible instance of their argument, and it is why a stranger can open this vault read-only and be asked for nothing.

ungovr.providers.sgit.ai
How this composes · slide 7 of 10

Where the three meet: an unowned acceptance

Our chain ends on sg:acceptance/unassigned — no named owner, no review interval, no revocation path.

Read through the conformance layer's vocabulary, that is not a gap in the diagram. It is a conformance state, and it is unevidenced.

Read through Licence to Operate's, it is not a condition on a policy. It is an exclusion — and the exclusion carries its reason in the control's own words: an acceptance without an owner is a note.

Three vaults, three vocabularies, one unfilled field, and all three agree on what it means. That is the strongest evidence so far that the grammar is real rather than a house style.

Where the three meet: the conformance layer, Licence to Operate and this vault, side by side.
Where the three meet: the conformance layer, Licence to Operate and this vault, side by side.
ungovr.providers.sgit.aiThe estate →
How this composes · slide 8 of 10

What we took from the family, concretely

FromWhat we used
Risk Graph ExplorerPUBLIC.md's three rules for a vault whose read key is published. We added a fourth: nothing whose licence forbids republication
Regulation Graphlaw-as-a-citable-graph, hash-verified to source bytes — the closest analogue to this work
AIUC-1 conformancethe two-edge rule, and unevidenced as a default rather than an absence
Licence to Operategrant / mandate / delta, and the policy/v1 shape
Risk Mandatethat a real application ships as a vault, with a release history
sgit.aithe embed protocol — the read key posted to a pinned origin after a handshake, never in a URL
ungovr.providers.sgit.ai
How this composes · slide 9 of 10

The one thing to build next

Make the obligation layer a policy/v1 producer.

This vault already has the pieces: an entity, an instrument, an addressable-enough provision, a statutory deadline as a scalar, a control, and an acceptance with a named hole in it.

The missing step is emitting the conformance row — one obligation, one control, one state, one valid_until driven by the statute rather than by an attestation — in the shape the conformance layer already reads.

Then a policy could say: this agent may file a records request on behalf of this body, in this jurisdiction, under this law, with this deadline — and say what it does not prove.

The vault's own app — six views, and the version pill that says which release you are looking at.
The vault's own app — six views, and the version pill that says which release you are looking at.
ungovr.providers.sgit.aiThe vault →
Notes. Scope discipline still applies. One county, one law, one acceptance. The point of this slide is the interface, not a second vault.
How this composes · slide 10 of 10

What this does not prove

Borrowed deliberately from the conformance layer's own does_not_prove field:

  • It does not prove Santa Barbara County complies with anything. The evidence node is

    unevidenced because nobody has observed the county.

  • It does not prove UnGovr intend any of this. No conversation has taken place; every

    statement about their intentions is inference from what they publish.

  • It does not prove the inferred edge is right for any particular entity. It reaches 96.6%

    and hands 20.5% of those to a human.

  • It does not make anything citable by version. That release channel was withdrawn, and

    acceptance test 9 regressed to unevidenced rather than being left looking satisfied.

ungovr.providers.sgit.ai

These slides are rendered from 03__how-it-composes.md, republished byte for byte from the vault. The live decks — the same file, parsed by the vault's own app — are in the Decks view of the vault, which moves the moment the vault does. This page moves when the site rebuilds.

Every claim on this site, with its state → Disclosures →