Independent. No commercial relationship with UnGovr — no funding, no agreement, no conversation of any kind — checked 9 September 2026. Disclosures · how every claim here is evidenced

ungovr.providers.sgit.ai / decks / What we built on the site

What we built on the site

A provider report, a gate that enforces it, and the argument for admitting an open-data provider · 9 slides · September 2026

⇩ Download the PDF 1538 KB · 9 slidesThe markdown ↓sha256 11239acac7618f3e — checked against the vault on every build
What we built on the site · slide 1 of 9

The site, in one line

ungovr.providers.sgit.ai — an independent report on the UnGovr Open Data API, written to the nine sections of the providers contract.

Twelve pages, 39 claims in a ledger, every one carrying a state and a date. Built by build.py with no external dependencies, served from docs/, gated by validate.sh.

The vault is §7 — the named workload. The site reports; the vault is the thing reported on.

ungovr.providers.sgit.ai — the provider report, written to the nine sections.
ungovr.providers.sgit.ai — the provider report, written to the nine sections.
ungovr.providers.sgit.aiThe report →
What we built on the site · slide 2 of 9

The word "provider" did not fit

The family defines it narrowly: "a service that serves models over an API."

UnGovr serve data, not models. By the letter, they do not belong.

The resolution: that definition was a proxy for the real question — where does the credential live, and what bounds it? A provider that answers "there is no credential, and the bound is your IP address" is not an exception to that question. It is the most informative possible answer to it.

So UnGovr is the family's first open-data provider, and the extension is argued on the page rather than assumed.

ungovr.providers.sgit.ai
What we built on the site · slide 3 of 9

Three genuinely new rows

SectionA model providerUnGovr
Which patternPattern 0 is a mistakePattern 0 is the intended mode. Nothing to leak
The bounding primitiveA key scope or plan quotaA rate limit per IP, then HTTP 402. The bound is a payment protocol
What it costDollars on a workloadNothing, inside 100 requests a day

The comparison matrix gains a row shape it did not have: a provider where pattern 0 is correct.

ungovr.providers.sgit.ai
What we built on the site · slide 4 of 9

The gate, not the promise

Every claim the site makes is enforced by a check that fails the build:

  • the build is reproducible — docs/ must match content/
  • version agreement across every badge, the release history and both machine indexes
  • internal links resolve; every canonical is on the host in CNAME
  • no root-absolute internal URL — a sibling shipped one and served unstyled for a day
  • every claim cited and dated; a docs claim without a source URL fails
  • all nine contract sections present and in order
The claim ledger: every factual claim, its state, its date and where it is said.
The claim ledger: every factual claim, its state, its date and where it is said.
ungovr.providers.sgit.aiThe claim ledger →
Notes. The estate's rule from nfrs.sgit.ai: generate or date every number. A promise without a check is a sentence.
What we built on the site · slide 5 of 9

Four checks this site had to invent

check_tone — refuses the vocabulary that turns a report on a nonprofit into an audit. Scoped to our own prose; /briefs/ is exempt because those are republished verbatim.

check_not_a_defect_count — refuses to publish 0 of 49 on any page that omits the sentence saying what it is not. That sentence is: the measurement is not a defect count. This slide is subject to its own rule, which is why it says it here.

check_no_restricted_corpus — fails if UnGovr's AI-law payload enters the tree. Keyed on the corpus schema id, not on the licence sentence — quoting one sentence to report what it says is the finding, not the redistribution.

check_network_pages — exactly one page may open a connection, and only to the vault origin.

The pack reader — and the raw bytes named, hashed and linked above the text.
The pack reader — and the raw bytes named, hashed and linked above the text.
ungovr.providers.sgit.aiThe dev pack →
What we built on the site · slide 6 of 9

The key discipline

The vault's write key must never enter a public repository. So:

  • secret-scan.sh runs 16 patterns over the whole tree including docs/
  • check_site.py carries the same tripwire a second time
  • both were wired before any content was written

They deliberately do not match sgit_private_read_…. A read key is publishable — it is how this estate shares a vault — and §7 depends on carrying one.

When an UnGovr API key arrived mid-session, ung_live_ was added to both before the key was used.

ungovr.providers.sgit.ai
What we built on the site · slide 7 of 9

The site does not claim to be finished

Of 39 claims: most are verified or measured, and the honest gaps are labelled.

  • everything about the payment path is docs — no 402 was ever returned
  • the embed shipped unrun until somebody watched it work, then moved to verified
  • one acceptance test regressed on purpose when the release channel was withdrawn

A site whose ledger is all verified has stopped measuring.

Four decks, republished from the vault and rendered here as slides.
Four decks, republished from the vault and rendered here as slides.
ungovr.providers.sgit.aiThe four decks →
What we built on the site · slide 8 of 9

Twelve corrections, filed beside the briefs

The packs that commissioned this work are republished raw at /briefs/, unedited, including the parts that turned out to be wrong.

Among them: the coverage plan could not have measured anything (C3); there is no Akoma Ntoso for the CPRA, so an acceptance test is recorded unpassable rather than weakened (C5); the AI-law corpus is far richer than predicted (C8) and not CC BY 4.0 (C9); "do not iframe it" was wrong about the estate's own pattern (C11).

A pack quietly edited to match its outcome proves nothing about the method it argues for.

ungovr.providers.sgit.ai
What we built on the site · slide 9 of 9

The division of labour

The vault is where the experiments happen. A push changes what a reader sees, with no rebuild and no deploy. Two of the app's computations — the shape of the 398-law corpus, and what the 16,071 Californian bodies are — exist only there.

The site is the report. It carries the ledger that says how well each thing is known, and it is the thing with a release history and a CI gate.

The vault, running live on the page from a read key printed beside it.
The vault, running live on the page from a read key printed beside it.
ungovr.providers.sgit.aiThe vault →
Notes. This is the answer to "why not just put it all on the site". Experiments want a push; reports want a gate.

These slides are rendered from 02__what-we-built.md, republished byte for byte from the vault. The live decks — the same file, parsed by the vault's own app — are in the Decks view of the vault, which moves the moment the vault does. This page moves when the site rebuilds.

Every claim on this site, with its state → Disclosures →