ungovr.providers.sgit.ai / decks / How this site publishes
How this site publishes
Four mechanisms added in a day — the reader, the slides, the PDFs, and the version convention · 11 slides · September 2026
The dev pack, published raw — and readable
Eight files from the vault, at /packs/security-graph/, byte for byte and hash-checked on every build.
The reader is the addition: a rail with the whole pack, the document rendered, and the raw bytes named, hashed and linked above the text rather than in a footnote under it.
Every .md URL still serves the file exactly as it always did.
The manifest is what makes "byte for byte" a fact
data/packs-manifest.txt records the sha256 of every file. Two paths carry each one — the raw copy, and the markdown twin beside its rendered page — and both are checked.
Edit a published pack file here instead of in the vault and the build stops and names it.
A correction belongs in the vault, where the original lives. Making it here would leave two documents that disagree and no way to say which is the source.
The decks: a document first, slides on request
Four decks, 39 slides, written as ordinary markdown in the vault.
Stacked, numbered, notes visible, printable — with JavaScript off it is a document. Present mode, the notes toggle and #s7 deep links are the enhancement, about forty lines.
The site's parser is a port of the vault app's, so both render the same slides from the same bytes.
And each deck prints to a PDF worth sending
16:9, one slide per page, at the estate's deck geometry. Printed by a browser from the same markup the page renders, so a slide cannot look one way here and another in the file somebody forwards.
Every link in a PDF is absolute. The first run pointed all of them at the localhost the build was printed from — worthless in a file that travels.
Eighteen slides carry a screenshot of this site, each with the URL of the page it shows.
Reaching a law: the finding that earned its own page
Follow the evidence to an instrument and UnGovr hands you a structured summary and a link to the publisher — on 392 of 398 laws, across 339 hosts.
Not the text, in any format. And 254 of the 398 — every sub-national one — have no reachable detail document at all.
Versions get a page of their own
Make it a link, and make the link go to that version's own details — not to a generic changelog. A reader who clicks
v0.1.7wants to know what v0.1.7 was.
sgit.ai/docs/guidance
Eighteen releases, each with a page naming the git commit it was built from. The history is generated from data/releases.json, and served as JSON beside it.
Seventeen of the eighteen say they were reconstructed
The words are contemporaneous — each release commit's own message, and its row in the old table. The structure around them was assembled afterwards.
Say when a version is reconstructed rather than recorded. A history assembled after the fact is still useful, but only if it is labelled.
So it is labelled, and each entry names what it was assembled from.
The same convention inside the vault
versions/index.json plus one file per version — data, so an agent can read the history without running anything.
The app gained a Versions view rendered from those files, and the header pill opens it at the current release.
The hand-kept release array in the app source is gone. The files are the source.
A commit cannot contain its own hash
The workflow was: commit, record the sha, amend. The amend changes the sha. Record that one and amend again, and it changes again. It does not converge.
So the sha lands in the following commit, and two things stop "later" becoming "never": the gate requires a commit on every release but the newest, and bin/bump.py refuses to move on while the current one is blank.
git rev-parse HEAD disagree — then noticing that fixing it once would not fix it twice. It is written on the versions page rather than left as a quirk somebody rediscovers.Four features, one shape
| The reader | shows the bytes it rendered | | The slides | are a projection of a file that stays readable | | The PDFs | are printed from the markup the page shows | | The versions | name the commit they were built from |
None of it is a promise. All of it is a check — which is the next deck.
These slides are rendered from 05__how-this-publishes.md, republished byte for byte from the vault. The live decks — the same file, parsed by the vault's own app — are in the Decks view of the vault, which moves the moment the vault does. This page moves when the site rebuilds.