Independent. No commercial relationship with UnGovr — no funding, no agreement, no conversation of any kind — checked 9 September 2026. Disclosures · how every claim here is evidenced

ungovr.providers.sgit.ai / The claim ledger — every claim, with the state it earned

The claim ledger — every claim, with the state it earned

Six states, and the default is the weakest one. The join is the enforcement: a claim that appears on a page and not in this table fails the build, and a docs claim whose source is not a URL fails it too.

24verified
5measured
5vendor docs
2specified, not shipped
1projected

Run against the API, 9 September 2026

ClaimStateHow we knowWhere it is said
data.ungovr.org answers this container. GET /v1/entities/index.json returned 200 with 29,099 bytes at 01:47Z. This closes blocker B1, which the previous session recorded as an egress refusal — the refusal was our environment's, not theirs, and it is gone.verified 9 Sep 2026curl, from the authoring container; the row is in the retrieval logthe report
Santa Barbara County resolves as us/ca/santa-barbara, read from /v1/entities/us/ca.json rather than guessed. This closes blocker B4.verified 9 Sep 2026/v1/entities/us/ca.json, sha256 4a4aa242a2d16941join
open_records is declared in UnGovr's own published schema as a property of entity_detail, an object with one string member, law. It is not in that definition's required list. The join point is designed and optional.verified 9 Sep 2026/v1/meta/schema.json, sha256 ac7ce7e32a70c65dthe report
open_records appears in exactly one place in the API — the per-entity detail document. It is absent from every bulk surface, which UnGovr's own OpenAPI states: the full-depth index is "a compact record ({slug, name, type, parent_slug?, population?})". So the coverage of this edge cannot be computed from any bulk artefact by anyone.verified 9 Sep 2026/v1/meta/openapi.yaml, sha256 5c344d97b440690d, and the retrieved index filesthe report, briefs, coverage
The detail document for Santa Barbara County carries no open_records key at all. Nor does California itself (us/ca), whose records law is in UnGovr's own corpus.verified 9 Sep 2026/v1/entities/detail/us--ca--santa-barbara.json, sha256 8d5e6db9e4056b2fthe report
The records-law corpus is sub-national: 254 of its 398 rows are, and us/ca is the California Public Records Act, Cal. Gov. Code §§ 7920.000-7931.000. Its full record carries structured obligation data — initial_response_days: 10, extension_days: 14, private_right_of_action: true, fee rates, submission methods and required elements. This is better than the brief that commissioned this work assumed, and the correction is filed.verified 9 Sep 2026/v1/laws/records/us--ca.json, sha256 ce8bc4744115befdthe report, briefs
The vault's pack named Gov. Code § 7922.535 as a candidate to verify, written from prior knowledge and therefore unevidenced by its own rule. The retrieved bytes carry it: response_deadline_notes cites § 7922.535(a) for the determination and (b)-(c) for the extension. The candidate is confirmed by the source rather than by memory.verified 9 Sep 2026/v1/laws/records/us--ca.json, field response_deadline_notesthe report
That citation is prose inside a free-text field, not an addressable node. There is no provisions array, no clause identifiers and no byte ranges, so nothing below the law can be pointed at, cited, or attached to evidence.verified 9 Sep 2026/v1/laws/records/us--ca.json — the record's full key setthe report
The CPRA has no Akoma Ntoso or other XML serialisation to retrieve. Both source URLs in the law record resolve to leginfo.legislature.ca.gov, which serves text/html from a JSF page. This closes blocker B3, and it means acceptance test 3 — rebuild the instrument byte for byte from the graph — cannot pass for this instrument. The test is recorded as unpassable here rather than weakened.verified 9 Sep 2026leginfo.legislature.ca.gov, both URLs fetched; Content-Type: text/htmlthe report, briefs, join, vault
The CPRA record's two source URLs point at different codifications: law_url at Division 10, Title 1 (the current §§ 7920–7931) and primary_source_url at Division 7, Chapter 3.5 — the location the CPRA occupied before the 2023 recodification. One of the two is stale. It is a small, specific, checkable thing they would probably want to know.verified 9 Sep 2026/v1/laws/records/us--ca.json, fields law_url and primary_source_urlthe report
A products array is returned by 49 of 49 entity-detail documents sampled and appears nowhere in the published JSON Schema. So the schema is behind the API in one direction while open_records is ahead of it in the other. Ordinary drift in a live dataset, recorded as an observation.verified 9 Sep 2026the 49 detail documents of the coverage samplethe report
X-RateLimit-Limit, X-RateLimit-Remaining and X-Quota-Remaining are advertised in the API's Access-Control-Expose-Headers but were not emitted on any of the 70 open-endpoint responses taken here. A client cannot see how much of its daily budget is left until the budget runs out.verified 9 Sep 2026the saved response headers for every retrieval in the logthe report
HEAD returns 405 where GET returns 200, so a client cannot cheaply size a file before downloading it. GET does return a strong ETag, which is the better tool anyway.verified 9 Sep 2026HEAD https://data.ungovr.org/v1/entities/us.jsonthe report
/v1/ai-laws/index.json answers 401 without a key, and its response advertises two different credential mechanisms: the body says X-API-Key, while the WWW-Authenticate header offers OAuth 2.0 Protected Resource Metadata — Bearer resource_metadata="…/.well-known/oauth-protected-resource", scope="opendata:read". Blocker B2 is now closed: a key was issued to this project and the corpus was read.verified 9 Sep 2026/v1/ai-laws/index.json and /.well-known/oauth-protected-resourcethe report, retrievals
Only one of those two mechanisms works. The same valid key returns 200 as X-API-Key and 401 as Authorization: Bearer — byte-identical to the anonymous response. So the OAuth Protected Resource Metadata advertised in the WWW-Authenticate header is discovery for an authorization flow the Open Data API does not accept, and an MCP or OAuth client that follows it is silently treated as anonymous. Their own key page states this; the 401 header does not.verified 9 Sep 2026three requests to /v1/ai-laws/index.json: none, Bearer, X-API-Keythe report
The AI-law corpus is not a bare verdict, and the brief that commissioned this work was wrong to expect one. ungovr.ai-laws/2 carries 2,915 instruments across 271 jurisdictions — 200 national, 56 sub-national, 14 local — each with a citation, a URL, a status and an effective date; plus, per access scenario, a basis naming the controlling authority (Van Buren 2021, hiQ v LinkedIn, Ziff Davis v OpenAI 2025) and a provenance block with as_of_date, confidence and stale. A reader can check it and can disagree at the level where disagreement is useful. Correction C8.verified 9 Sep 2026/v1/ai-laws/index.json and /v1/ai-laws/us.json, read under keythe report, briefs
Two licences are in force on one API, and they disagree. The OpenAPI document declares the whole Open Data API CC BY 4.0. The AI-law payloads carry their own license block — "UnGovr Data License (non-exclusive, by agreement)" — whose grant field reads "No license is conveyed by receipt of this file." The specific term governs, so that corpus is not open data and is not redistributed by this site or its vault; it is described and measured only. A consumer reading only the OpenAPI licence would get this wrong.verified 9 Sep 2026the license block in /v1/ai-laws/us.json and /v1/ai-laws/export/manifest.jsonthe report, briefs, retrievals

Read in their documentation, 9 September 2026

ClaimStateHow we knowWhere it is said
Multiple API keys on one account share a single daily allowance — "connecting a second client does not buy a second free tier". So a key is a revocation handle, not a budget: issuing one per machine limits blast radius without raising throughput, which is the right trade and worth knowing before planning around it.vendor docs 9 Sep 2026https://www.ungovr.org/open-data/api-keysthe report
Free tier, per their rate-limit table: entity data 100/day per IP; CGJ indices and county listings unlimited; CGJ report detail 50/day per key; conditional revalidation (304) free at up to 5,000 per key per day, past which the API returns 429 with Retry-After.vendor docs 9 Sep 2026https://www.ungovr.org/open-data/apithe report, examples
Above the free tier the API returns HTTP 402 with a Machine Payments Protocol challenge, paid per request from a Stripe-funded wallet: $0.001 per entity request, $0.01 per CGJ report detail, $5.00 minimum top-up, carried on WWW-Authenticate: Payment / Authorization: Payment headers.vendor docs 9 Sep 2026https://www.ungovr.org/open-data/apithe report, patterns
An API key is free, and most Open Data endpoints need none at all. The key raises rate limits and unlocks the gated corpora. So the bound on the ungated surface is a property of the network path, not of a credential.vendor docs 9 Sep 2026https://www.ungovr.org/open-data/api-keysthe report
The Open Data API is published under CC BY 4.0, declared in the OpenAPI document's own license block. Everything this site and its vault derive from it is used under that licence, with attribution.vendor docs 9 Sep 2026https://data.ungovr.org/v1/meta/openapi.yamlthe report, disclosures, examples

Measured by our own pipeline, 9 September 2026

ClaimStateHow we knowWhere it is said
0 of 49. In a seeded random sample of 49 entity-detail documents drawn across five strata, three countries and seventeen entity types, not one carried a non-empty open_records.law — including six US states, whose records laws are in UnGovr's own corpus. 95% Wilson interval 0.0–7.3%. A missing law reference is not an error; the number measures how far the join can currently reach and is not a defect count.measured 9 Sep 2026bin/coverage-sample.py, seed 20260909, against frames whose sha256s are in the retrieval logthe report
The same join inferred by slug prefix reaches 96.6% of California's 16,071 entities — the longest law-corpus jurisdiction that is a path-prefix of the entity slug. The join is one derivable hop away, over data UnGovr already publish, and the rule is two lines long.measured 9 Sep 2026bin/inferred-join.py over /v1/entities/us/ca/all.json and /v1/laws/records/index.jsonthe report
20.5% of those matches would need a human. Slug hierarchy is geography; records law is jurisdiction. They come apart for exactly the bodies a requester most often wants — interstate compacts, federal categories, tribal nations, regulated utilities, charter schools. That is why the edge is drawn inferred and not asserted.measured 9 Sep 2026bin/inferred-join.py, the matched-but-suspect columnthe report, coverage
The entity total is 327,138 in /v1/meta/last-updated.json and 327,138+ in the OpenAPI description, against 330,000 / 321,000 / 320,000 quoted on three of their pages earlier. Ordinary for a live dataset that rebuilds. An observation, not a finding, and not a conversation worth having.measured 9 Sep 2026/v1/meta/last-updated.json, built_at 2026-09-08T07:46:48Zthe report
The whole of this report cost 70 requests to data.ungovr.org, inside a free tier of 100 entity requests a day. No 402 was ever returned, so the payment path is reported from their documentation rather than from experience.measured 9 Sep 2026the retrieval log, countedthe report

Arithmetic, with the workings shown

ClaimStateHow we knowWhere it is said
A census of the law edge — as opposed to the sample above — is one detail request per entity: 327,138 requests. At the free tier's 100 a day that is 3,271 days, about 9 years. At the metered rate of $0.001 it is $327.14. Re-do the arithmetic with your own numbers; the only input is the entity count.projected 9 Sep 2026327,138 ÷ 100 = 3,271 days; 327,138 × $0.001 = $327.14the report, coverage

Specified, not shipped

ClaimStateHow we knowWhere it is said
The vault's full graph viewer — fractal zoom to sentence level, a document viewer opening a byte range in the instrument's own source, and the remaining six computations — is specified and not built. What exists is the MVP: the seven-step join, filterable by type, with provenance on every node.specified, not shippedthe vault's pack/04__the-vault.md and pack/05__the-workbench.mdthe report, join
The acceptance node ships with no named owner, no review interval and no revocation path. An acceptance without an owner is a note. It is left open rather than filled in with a plausible name, and it is handback item 8.specified, not shippeddata/graph.json, node sg:acceptance/unassignedbriefs, join

About this site itself

ClaimStateHow we knowWhere it is said
ungovr.providers.sgit.ai answers 200, and the GitHub Pages project path now 301s to it. The domain was pointed during the session that built this site: it answered 404 at v0.1.0 and served at v0.1.1. Both states are recorded rather than the second quietly replacing the first — the canonical URL is the intent and the link is the reality, and this is the one page that can say when they stopped disagreeing.verified 9 Sep 2026curl https://ungovr.providers.sgit.ai/ -> 404 then 200, both 9 September 2026briefs
No conversation with UnGovr has taken place. Every statement here about what they intend, need or would want is inference from what they publish, and is marked as such. There is no commercial relationship of any kind to disclose.verified 9 Sep 2026the project lead, 9 September 2026the report, disclosures
Every example file offered for download was executed to produce the numbers on this site — they are the actual scripts, not illustrations of them. fetch.sh produced every row of the retrieval log; coverage-sample.py produced the 0-of-49; inferred-join.py produced the 96.6%.verified 9 Sep 2026the retrieval log and data/computation-1.json are their outputthe report
The vault embed is the estate's own published component, vendored unmodified: the body of assets/vault-ui-embed.js is byte-identical to sgit.ai/assets/vault-ui-embed.js (sha256 6da5cf0a390dce25…), the markup matches the estate's sgv-uiembed block attribute for attribute, and the only origin in its executable code is dev.vault.sgraph.ai. The key it publishes is the bare 64-hex read key, which a build check enforces.verified 9 Sep 2026byte diff against sgit.ai/assets/vault-ui-embed.js, fetched 9 September 2026briefs, vault
The embed renders. It shipped badged unrun because the authoring container could not open a browser TLS tunnel to the vault host — curl got 200, Chromium got ERR_CONNECTION_RESET. The project lead then opened this page and the vault booted in App Mode over the embed protocol: the read-only chrome, the five views, and the join drawing. The state moved because somebody watched it work, which is the only thing that moves it.verified 9 Sep 2026the project lead's browser, SG/App host, 9 September 2026 — screenshotvault
The vault's entry is a single self-contained index.html — not the declarative _page.json it shipped with, which failed in the SG/App host with PageLayoutRenderer is not defined. The app requests no permissions, opens no network connection, and makes one sg.* call, degrading to fetch and then to an inlined core slice. All three load paths were driven in a real browser, and the published copy was re-cloned with the public read key and rendered to confirm.verified 9 Sep 2026a fresh read-only clone of dkeclt5r, served locally and driven with Playwrightvault
The vault's two published releases were cut and then withdrawn. The vault settings UI rendered each one's commit as obj-cas-im — a 10-character prefix of the 24-character obj-cas-imm-b9c2cddb51e8 — and the published-version link was unreliable with it. A release exists to make a demonstration citable, and a channel that cannot show which commit it pins does not do that, so acceptance test 9 regressed from asserted to unevidenced rather than being left looking satisfied. Both commit ids are kept in .vault/releases.json; re-cutting is one line.verified 9 Sep 2026the vault settings UI, 9 September 2026, and .vault/releases.jsonvault

How to read the states

ChipMeansWhat you may do with it
verifiedSomebody ran it and watched it work, on that date, in a named placeTreat as fact for that date and that setup. Read it narrowly
measuredOur own pipeline produced this number on a named workloadTreat as fact about our workload; yours will differ
docsRead in the vendor's documentation on that date; never executed by usThe honest debt. Check it against the vendor before relying on it
specA written specification for something that does not existNever plan around it. Future tense only
unrunCode we wrote and have never executedThe invitation. Run it and find out
projectedArithmetic, with its workings shownRe-do it with your own numbers

Read verified narrowly. On this site it mostly means one container, one afternoon, one IP address, on 9 September 2026. The API is live and rebuilds nightly; several of these claims have a shelf life measured in weeks.

The one state this site never uses about UnGovr's compliance with anything is any of the vault's six. Those are a different vocabulary answering a different question, and merging them would lose both.

What is honestly thin

Every claim on this site, with its state → Disclosures →