ungovr.providers.sgit.ai / The claim ledger — every claim, with the state it earned
The claim ledger — every claim, with the state it earned
Six states, and the default is the weakest one. The join is the enforcement: a claim that appears on a page and not in this table fails the build, and a docs claim whose source is not a URL fails it too.
44verified
12measured
6vendor docs
3specified, not shipped
1written, not run
1projected
Run against the API, 9 September 2026
| Claim | State | How we know | Where it is said |
|---|---|---|---|
data.ungovr.org answers this container. GET /v1/entities/index.json returned 200 with 29,099 bytes at 01:47Z. This closes blocker B1, which the previous session recorded as an egress refusal — the refusal was our environment's, not theirs, and it is gone. | verified 9 Sep 2026 | curl, from the authoring container; the row is in the retrieval log | the report |
Santa Barbara County resolves as us/ca/santa-barbara, read from /v1/entities/us/ca.json rather than guessed. This closes blocker B4. | verified 9 Sep 2026 | /v1/entities/us/ca.json, sha256 4a4aa242a2d16941 | join |
open_records is declared in UnGovr's own published schema as a property of entity_detail, an object with one string member, law. It is not in that definition's required list. The join point is designed and optional. | verified 9 Sep 2026 | /v1/meta/schema.json, sha256 ac7ce7e32a70c65d | the report |
open_records appears in exactly one place in the API — the per-entity detail document. It is absent from every bulk surface, which UnGovr's own OpenAPI states: the full-depth index is "a compact record ({slug, name, type, parent_slug?, population?})". So the coverage of this edge cannot be computed from any bulk artefact by anyone. | verified 9 Sep 2026 | /v1/meta/openapi.yaml, sha256 5c344d97b440690d, and the retrieved index files | the report, briefs, coverage |
The detail document for Santa Barbara County carries no open_records key at all. Nor does California itself (us/ca), whose records law is in UnGovr's own corpus. | verified 9 Sep 2026 | /v1/entities/detail/us--ca--santa-barbara.json, sha256 8d5e6db9e4056b2f | the report |
The records-law corpus is sub-national: 254 of its 398 rows are, and us/ca is the California Public Records Act, Cal. Gov. Code §§ 7920.000-7931.000. Its full record carries structured obligation data — initial_response_days: 10, extension_days: 14, private_right_of_action: true, fee rates, submission methods and required elements. This is better than the brief that commissioned this work assumed, and the correction is filed. | verified 9 Sep 2026 | /v1/laws/records/us--ca.json, sha256 ce8bc4744115befd | the report, briefs |
The vault's pack named Gov. Code § 7922.535 as a candidate to verify, written from prior knowledge and therefore unevidenced by its own rule. The retrieved bytes carry it: response_deadline_notes cites § 7922.535(a) for the determination and (b)-(c) for the extension. The candidate is confirmed by the source rather than by memory. | verified 9 Sep 2026 | /v1/laws/records/us--ca.json, field response_deadline_notes | the report |
That citation is prose inside a free-text field, not an addressable node. There is no provisions array, no clause identifiers and no byte ranges, so nothing below the law can be pointed at, cited, or attached to evidence. | verified 9 Sep 2026 | /v1/laws/records/us--ca.json — the record's full key set | the report |
The CPRA has no Akoma Ntoso or other XML serialisation to retrieve. Both source URLs in the law record resolve to leginfo.legislature.ca.gov, which serves text/html from a JSF page. This closes blocker B3, and it means acceptance test 3 — rebuild the instrument byte for byte from the graph — cannot pass for this instrument. The test is recorded as unpassable here rather than weakened. | verified 9 Sep 2026 | leginfo.legislature.ca.gov, both URLs fetched; Content-Type: text/html | the report, briefs, join, vault |
The CPRA record's two source URLs point at different codifications: law_url at Division 10, Title 1 (the current §§ 7920–7931) and primary_source_url at Division 7, Chapter 3.5 — the location the CPRA occupied before the 2023 recodification. One of the two is stale. It is a small, specific, checkable thing they would probably want to know. | verified 9 Sep 2026 | /v1/laws/records/us--ca.json, fields law_url and primary_source_url | the report |
A products array is returned by 49 of 49 entity-detail documents sampled and appears nowhere in the published JSON Schema. So the schema is behind the API in one direction while open_records is ahead of it in the other. Ordinary drift in a live dataset, recorded as an observation. | verified 9 Sep 2026 | the 49 detail documents of the coverage sample | the report |
X-RateLimit-Limit, X-RateLimit-Remaining and X-Quota-Remaining are advertised in the API's Access-Control-Expose-Headers but were not emitted on any of the 70 open-endpoint responses taken here. A client cannot see how much of its daily budget is left until the budget runs out. | verified 9 Sep 2026 | the saved response headers for every retrieval in the log | the report |
HEAD returns 405 where GET returns 200, so a client cannot cheaply size a file before downloading it. GET does return a strong ETag, which is the better tool anyway. | verified 9 Sep 2026 | HEAD https://data.ungovr.org/v1/entities/us.json | the report |
/v1/ai-laws/index.json answers 401 without a key, and its response advertises two different credential mechanisms: the body says X-API-Key, while the WWW-Authenticate header offers OAuth 2.0 Protected Resource Metadata — Bearer resource_metadata="…/.well-known/oauth-protected-resource", scope="opendata:read". Blocker B2 is now closed: a key was issued to this project and the corpus was read. | verified 9 Sep 2026 | /v1/ai-laws/index.json and /.well-known/oauth-protected-resource | the report, retrievals |
Only one of those two mechanisms works. The same valid key returns 200 as X-API-Key and 401 as Authorization: Bearer — byte-identical to the anonymous response. So the OAuth Protected Resource Metadata advertised in the WWW-Authenticate header is discovery for an authorization flow the Open Data API does not accept, and an MCP or OAuth client that follows it is silently treated as anonymous. Their own key page states this; the 401 header does not. | verified 9 Sep 2026 | three requests to /v1/ai-laws/index.json: none, Bearer, X-API-Key | the report |
The AI-law corpus is not a bare verdict, and the brief that commissioned this work was wrong to expect one. ungovr.ai-laws/2 carries 2,915 instruments across 271 jurisdictions — 200 national, 56 sub-national, 14 local — each with a citation, a URL, a status and an effective date; plus, per access scenario, a basis naming the controlling authority (Van Buren 2021, hiQ v LinkedIn, Ziff Davis v OpenAI 2025) and a provenance block with as_of_date, confidence and stale. A reader can check it and can disagree at the level where disagreement is useful. Correction C8. | verified 9 Sep 2026 | /v1/ai-laws/index.json and /v1/ai-laws/us.json, read under key | the report, briefs |
Two licences are in force on one API, and they disagree. The OpenAPI document declares the whole Open Data API CC BY 4.0. The AI-law payloads carry their own license block — "UnGovr Data License (non-exclusive, by agreement)" — whose grant field reads "No license is conveyed by receipt of this file." The specific term governs, so that corpus is not open data and is not redistributed by this site or its vault; it is described and measured only. A consumer reading only the OpenAPI licence would get this wrong. | verified 9 Sep 2026 | the license block in /v1/ai-laws/us.json and /v1/ai-laws/export/manifest.json | the report, briefs, retrievals |
Every representation is JSON. .md, .html, .txt, .pdf, .jsonld and .ttl on a records-law path all return 404. Content negotiation is not merely ignored — it is ignored identically: Accept: text/markdown, Accept: application/ld+json and no Accept header at all return the same document with the same sha256 b06492bfb34b9572…, 6,749 bytes. That is not a content-type header claiming JSON; it is the same bytes three times. | verified 9 Sep 2026 | eight probes of /v1/laws/records/ad.json and its extension variants, all in the retrieval log | instruments |
A records law comes back as a structured research summary, not the instrument: 31–34 top-level fields across a ten-jurisdiction sample, 29 of them present in every one. exemptions[] carries code, name, description and whether it is discretionary; appeal_process[] carries the tier, the body, the deadline in days and a contact URL. The statute's own text appears in no field and in no format. | verified 9 Sep 2026 | /v1/laws/records/{ad,ba,ci,md,mz,tg}.json — a deterministic every-40th sample of the index | instruments |
254 of the 398 records laws are sub-national and none has a reachable detail document. Their jurisdiction carries a slash (us/ms, br/minas-gerais, au/nt) and the detail route is a single path segment, so 24 of 24 sampled returned 404 while 26 of 26 national ones returned 200. Raw, percent-encoded and dash-substituted forms all fail. They are not absent from the corpus — they are in the index with citation, source URL and response days; it is the 30-odd-field document that cannot be addressed. Sub-national is exactly where jurisdictional variation lives. | verified 9 Sep 2026 | 50 probes of /v1/laws/records/{slug}.json, seeded sample plus every-40th; the decisive pair is in the retrieval log | instruments |
The nearest thing to an ontology is the AI-law corpus's vocab.json: 4 verdicts, 6 contexts, 6 crawl-policy fields, 22 field definitions and 17 enums, with a JSON Schema at ungovr.ai-laws/2. It is a real controlled vocabulary — every enum value defined in prose. It is not a graph: no classes, no properties with domains and ranges, no relations between terms, no SKOS, OWL, RDF or JSON-LD. The schema document is public; the data behind it is key-gated and its licence states "No license is conveyed by receipt of this file." The only occurrence of the word graph in their entire OpenAPI is GeoJSON. | verified 9 Sep 2026 | /v1/ai-laws/vocab.json and /v1/ai-laws/export/manifest.json under X-API-Key; /v1/meta/openapi.yaml grepped | instruments |
Read in their documentation, 9 September 2026
| Claim | State | How we know | Where it is said |
|---|---|---|---|
| Multiple API keys on one account share a single daily allowance — "connecting a second client does not buy a second free tier". So a key is a revocation handle, not a budget: issuing one per machine limits blast radius without raising throughput, which is the right trade and worth knowing before planning around it. | vendor docs 9 Sep 2026 | https://www.ungovr.org/open-data/api-keys | the report |
Free tier, per their rate-limit table: entity data 100/day per IP; CGJ indices and county listings unlimited; CGJ report detail 50/day per key; conditional revalidation (304) free at up to 5,000 per key per day, past which the API returns 429 with Retry-After. | vendor docs 9 Sep 2026 | https://www.ungovr.org/open-data/api | the report, examples |
Above the free tier the API returns HTTP 402 with a Machine Payments Protocol challenge, paid per request from a Stripe-funded wallet: $0.001 per entity request, $0.01 per CGJ report detail, $5.00 minimum top-up, carried on WWW-Authenticate: Payment / Authorization: Payment headers. | vendor docs 9 Sep 2026 | https://www.ungovr.org/open-data/api | the report, patterns |
| An API key is free, and most Open Data endpoints need none at all. The key raises rate limits and unlocks the gated corpora. So the bound on the ungated surface is a property of the network path, not of a credential. | vendor docs 9 Sep 2026 | https://www.ungovr.org/open-data/api-keys | the report |
The Open Data API is published under CC BY 4.0, declared in the OpenAPI document's own license block. Everything this site and its vault derive from it is used under that licence, with attribution. | vendor docs 9 Sep 2026 | https://data.ungovr.org/v1/meta/openapi.yaml | the report, disclosures, examples |
eu-ai-act.standards.riskmandate.ai publishes the Act with the Digital Omnibus on AI applied by a deterministic, gated parser: 119 articles and 14 annexes, 72 amendment instructions each with a derivation page, 182 touched provisions each hash-anchored, and a provisions root hash of 77c4ca7c208d73ad…. It states plainly that the text is derived and not authentic, that only the Official Journal publications are, and that no official consolidated version existed when it was generated. | vendor docs 9 Sep 2026 | https://eu-ai-act.standards.riskmandate.ai/llms.txt, site v0.1.4, read 9 September 2026 | estate |
Measured by our own pipeline, 9 September 2026
| Claim | State | How we know | Where it is said |
|---|---|---|---|
0 of 49. In a seeded random sample of 49 entity-detail documents drawn across five strata, three countries and seventeen entity types, not one carried a non-empty open_records.law — including six US states, whose records laws are in UnGovr's own corpus. 95% Wilson interval 0.0–7.3%. A missing law reference is not an error; the number measures how far the join can currently reach and is not a defect count. | measured 9 Sep 2026 | bin/coverage-sample.py, seed 20260909, against frames whose sha256s are in the retrieval log | the report |
| The same join inferred by slug prefix reaches 96.6% of California's 16,071 entities — the longest law-corpus jurisdiction that is a path-prefix of the entity slug. The join is one derivable hop away, over data UnGovr already publish, and the rule is two lines long. | measured 9 Sep 2026 | bin/inferred-join.py over /v1/entities/us/ca/all.json and /v1/laws/records/index.json | the report |
20.5% of those matches would need a human. Slug hierarchy is geography; records law is jurisdiction. They come apart for exactly the bodies a requester most often wants — interstate compacts, federal categories, tribal nations, regulated utilities, charter schools. That is why the edge is drawn inferred and not asserted. | measured 9 Sep 2026 | bin/inferred-join.py, the matched-but-suspect column | the report, coverage |
The entity total is 327,138 in /v1/meta/last-updated.json and 327,138+ in the OpenAPI description, against 330,000 / 321,000 / 320,000 quoted on three of their pages earlier. Ordinary for a live dataset that rebuilds. An observation, not a finding, and not a conversation worth having. | measured 9 Sep 2026 | /v1/meta/last-updated.json, built_at 2026-09-08T07:46:48Z | the report |
The whole of this report cost 70 requests to data.ungovr.org, inside a free tier of 100 entity requests a day. No 402 was ever returned, so the payment path is reported from their documentation rather than from experience. | measured 9 Sep 2026 | the retrieval log, counted | the report |
392 of the 398 records laws carry a URL to the instrument at its official publisher, across 339 distinct hosts — boe.es (17), rti-rating.org (13), lexfind.ch (9) and a long tail. Detail documents add primary_source_url and a typed secondary_sources[]. The hop out to the real source exists and is well made; what does not exist is the hop back in. | measured 9 Sep 2026 | counted over /v1/laws/records/index.json, sha256 in the retrieval log | instruments |
One field carries provision-level identifiers: exemptions[].code, with values like art11-a … art11-m, art12. Across a deterministic ten-jurisdiction sample, 58 exemptions carried 34 article-shaped codes — 59%. Every other article reference is prose: "Article 15 provides that consultation of public information is free." Readable by a person; not addressable by a graph. | measured 9 Sep 2026 | the same every-40th sample; codes matched against /^art/i | instruments |
Arithmetic, with the workings shown
| Claim | State | How we know | Where it is said |
|---|---|---|---|
| A census of the law edge — as opposed to the sample above — is one detail request per entity: 327,138 requests. At the free tier's 100 a day that is 3,271 days, about 9 years. At the metered rate of $0.001 it is $327.14. Re-do the arithmetic with your own numbers; the only input is the entity count. | projected 9 Sep 2026 | 327,138 ÷ 100 = 3,271 days; 327,138 × $0.001 = $327.14 | the report, coverage |
Specified, not shipped
| Claim | State | How we know | Where it is said |
|---|---|---|---|
| The vault's full graph viewer — fractal zoom to sentence level, a document viewer opening a byte range in the instrument's own source, and the remaining six computations — is specified and not built. What exists is the MVP: the seven-step join, filterable by type, with provenance on every node. | specified, not shipped | the vault's pack/04__the-vault.md and pack/05__the-workbench.md | the report, join |
| The acceptance node ships with no named owner, no review interval and no revocation path. An acceptance without an owner is a note. It is left open rather than filled in with a plausible name, and it is handback item 8. | specified, not shipped | data/graph.json, node sg:acceptance/unassigned | briefs, join |
The security-standards pack is specified and nothing in it is built. Thirteen acceptance tests: five pass and all five are inherited from work this vault had already done, one is asserted, seven are unevidenced. Five of the fifteen edges in the model are marked proposed rather than existing, and four blockers are open — S1 closed on the day it was written, by doing what the pack said to do first. | specified, not shipped 9 Sep 2026 | packs/security-graph/06__verification.md, republished at /packs/security-graph/ | security-graph |
About this site itself
| Claim | State | How we know | Where it is said |
|---|---|---|---|
ungovr.providers.sgit.ai answers 200, and the GitHub Pages project path now 301s to it. The domain was pointed during the session that built this site: it answered 404 at v0.1.0 and served at v0.1.1. Both states are recorded rather than the second quietly replacing the first — the canonical URL is the intent and the link is the reality, and this is the one page that can say when they stopped disagreeing. | verified 9 Sep 2026 | curl https://ungovr.providers.sgit.ai/ -> 404 then 200, both 9 September 2026 | briefs |
| No conversation with UnGovr has taken place. Every statement here about what they intend, need or would want is inference from what they publish, and is marked as such. There is no commercial relationship of any kind to disclose. | verified 9 Sep 2026 | the project lead, 9 September 2026 | the report, disclosures |
Every example file offered for download was executed to produce the numbers on this site — they are the actual scripts, not illustrations of them. fetch.sh produced every row of the retrieval log; coverage-sample.py produced the 0-of-49; inferred-join.py produced the 96.6%. | verified 9 Sep 2026 | the retrieval log and data/computation-1.json are their output | the report |
The vault embed is the estate's own published component, vendored unmodified: the body of assets/vault-ui-embed.js is byte-identical to sgit.ai/assets/vault-ui-embed.js (sha256 6da5cf0a390dce25…), the markup matches the estate's sgv-uiembed block attribute for attribute, and the only origin in its executable code is dev.vault.sgraph.ai. The key it publishes is the bare 64-hex read key, which a build check enforces. | verified 9 Sep 2026 | byte diff against sgit.ai/assets/vault-ui-embed.js, fetched 9 September 2026 | briefs, vault |
The embed renders. It shipped badged unrun because the authoring container could not open a browser TLS tunnel to the vault host — curl got 200, Chromium got ERR_CONNECTION_RESET. The project lead then opened this page and the vault booted in App Mode over the embed protocol: the read-only chrome, the five views, and the join drawing. The state moved because somebody watched it work, which is the only thing that moves it. | verified 9 Sep 2026 | the project lead's browser, SG/App host, 9 September 2026 — screenshot | vault |
The vault's entry is a single self-contained index.html — not the declarative _page.json it shipped with, which failed in the SG/App host with PageLayoutRenderer is not defined. The app requests no permissions, opens no network connection, and makes one sg.* call, degrading to fetch and then to an inlined core slice. All three load paths were driven in a real browser, and the published copy was re-cloned with the public read key and rendered to confirm. | verified 9 Sep 2026 | a fresh read-only clone of dkeclt5r, served locally and driven with Playwright | vault |
The vault's two published releases were cut and then withdrawn. The vault settings UI rendered each one's commit as obj-cas-im — a 10-character prefix of the 24-character obj-cas-imm-b9c2cddb51e8 — and the published-version link was unreliable with it. A release exists to make a demonstration citable, and a channel that cannot show which commit it pins does not do that, so acceptance test 9 regressed from asserted to unevidenced rather than being left looking satisfied. Both commit ids are kept in .vault/releases.json; re-cutting is one line. | verified 9 Sep 2026 | the vault settings UI, 9 September 2026, and .vault/releases.json | vault |
The vault opens at https://dev.vault.sgraph.ai/#<read-key>:<vault-id>. The /en-gb/ form inherited from the handover brief does not work — the segment breaks the client-side fragment routing. Both return HTTP 200, because it is a single-page app whose shell is served either way, so a status-code check cannot tell them apart and did not. Only opening it in a browser does. | verified 9 Sep 2026 | the project lead's browser, 9 September 2026; curl returns 200 for both forms | briefs |
The vault carries three slide decks, 29 slides, in the style of the estate's AIUC-1 conformance vault — deck picker, slide list, speaker notes, focus and present modes, print-to-PDF, keyboard navigation. They are authored as markdown in decks/*.md and the app's Decks view is a projection parsed at build time, so they stay readable as ordinary documents and cannot drift from their source. Every claim they make about another vault is read from that vault's own published page and linked, rather than recalled. | verified 9 Sep 2026 | decks/*.md in vault dkeclt5r, and the Decks view driven in a browser | vault |
Every read key on the estate page was copied from the vault's own published page on sgit.ai, not obtained privately. A read key is 64 hexadecimal characters, is derived one-way from a vault key that is not published, and cannot become write access. tools/check_site.py refuses to build if any data-readkey on this site is anything other than a bare 64-hex string. | verified 9 Sep 2026 | sgit.ai/demos/vaults/<vault>/index.html for each of the seven, read 9 September 2026 | estate |
The same key appears under three generations of naming — sgit_private_read_…, sgit_rk1_…, and no prefix at all. sgit's own Vault__Crypto names sgit_private_read_ the read-key prefix and sgit_rk1_ the legacy one, so they are aliases for one 64-hex secret. The vendored embed component builds the legacy form, which is why it opens vaults whose pages publish the current one — including this site's own, watched booting by the project lead. | verified 9 Sep 2026 | sgit_ai/crypto/Vault__Crypto.py lines 59 and 64 (READ_KEY_PREFIX, LEGACY_READ_KEY_PREFIX) | estate |
The estate page opens no connection at all until a reader picks a vault, and then exactly one, to dev.vault.sgraph.ai. Driven in a browser rather than reasoned about: on load, zero frames and zero embeds; after one pick, exactly one embed and two frames, the first at ?embed=1&parent=… with no credential anywhere in the URL; after a second pick, still exactly one of each, because the stage is emptied before each mount. check_network_pages pins the exception to this page and /vault/, and to the vendored component as the only file that may open anything. | verified 9 Sep 2026 | Chromium 1194 against a local server, 9 September 2026 — 7 cards, 0/0 before, 1 embed after, 1 after the second pick, no console errors | estate |
No vault has been watched decrypting on the estate page. The boundary is exact: the picker itself is verified — the frames are created and pointed at the right origin — but what happens inside them is not, because the authoring container reaches the vault host with curl and not with a browser. Chromium gets ERR_CONNECTION_RESET through the tunnel and the relay logs the TLS handshake dying after 1,729 bytes sent, 39 received. This is the same limit that held /vault/ on unrun until a person opened it, and the same thing will move this. | written, not run 9 Sep 2026 | Chromium 1194 through the authoring container's proxy, 9 September 2026; the relay's own failure log | estate |
The vault carries packs/security-graph/ — eight files: the anchor-node thesis, a model of five node classes and fifteen edges each with a distinct inverse, the standards map with its working, a worked example, the integration surface, and thirteen tests of which five pass and all five were inherited, one is asserted and seven are unevidenced. The pack shipped saying two of twelve, which was wrong in both numbers — a summary line that had drifted from its own table, caught by parsing the rows rather than reading them, and corrected in the vault with the old line quoted rather than replaced. Five of the fifteen edges are marked proposed rather than existing, and the blockers are listed as open rather than described as risks. | verified 9 Sep 2026 | packs/security-graph/ in vault dkeclt5r @ obj-cas-imm-e23f0cecfccf | vault |
The pack shipped saying "Two of twelve pass". Both numbers were wrong: the table had thirteen rows and five at programmatic-inline. A test was added when a blocker closed without the total moving, and three rows were upgraded after the summary line was written. It was caught by parsing the table with a script rather than reading it — the same failure the pack warns about in file 03, where a framework's label had to be checked against its members. The old line is quoted in the corrected file rather than replaced, and this site's three copies of the wrong number were corrected with it. | verified 9 Sep 2026 | a script counting the rows of 06__verification.md; the correction is vault commit obj-cas-imm-e23f0cecfccf | security-graph |
Every pack file gets a rendered reader with the rest of the pack beside it and the raw bytes named, hashed and linked above the text. Built to the contract in sgit.ai's markdown and file viewers brief — raw always available, the reader an addition rather than a replacement, the tree from a build-time manifest. It renders at build time rather than fetching, because this site's claim is that its pages contact nothing and exactly two are allowed to; a client-side reader would have made every pack file a third. check_packs_verbatim fails the build if a rendered page and its raw file are not the same bytes, or if any pack file has no reader. Both negative-tested. | verified 9 Sep 2026 | build.py pack_pages(); tools/check_site.py check_packs_verbatim | security-graph |
The pack's model claimed eight of graphs.sgit.ai's fifteen established edges were reused unchanged. Six came from there, not eight — and four of the six were not unchanged: observed_on carried the inverse observation_of where the published set says bears_observation, and backed_by/accepted_by/conditional_on had all been renamed too. Renaming another vocabulary's inverses and calling it reuse is a fork — the exact failure the pack's own rule 6 exists to prevent, committed by the file that states the rule. Caught by fetching the published edge set and comparing row by row. The four are now theirs. | verified 9 Sep 2026 | https://graphs.sgit.ai/v1/grammar/edge-set.html, read 9 September 2026, against packs/security-graph/02__the-model.md | security-graph |
The vault app carries a version pill in its header that opens its Provenance view at a table of seven releases, naming what each one changed and which of them moved this site around the vault rather than the vault itself. The number is the site release that shipped the app change, so one number reaches a page with the pipeline behind it. It is a <button>, not a link: a vault app must never assign location.hash and an internal fragment href lands on the host's broken-link overlay, so it switches the view and scrolls instead. | verified 9 Sep 2026 | app/index.src.html in vault dkeclt5r @ obj-cas-imm-e23f0cecfccf; driven in Chromium — the pill reads v0.1.12, opens Provenance, and marks the current row | vault |
The vault carries four decks, 39 slides: what we learned about UnGovr, what we built on the site, how this composes with the estate's other vaults, and what we plan to build — ten slides on the security-standards dev pack, ending on what would make it wrong rather than on a roadmap. All four are authored as ordinary markdown in decks/*.md, and the site's parser is a port of the vault app's, so both render the same slides from the same bytes. | verified 9 Sep 2026 | decks/*.md in vault dkeclt5r @ obj-cas-imm-760fee6127a2, republished and hash-checked here | decks |
The decks here are rendered at build time, not read live from the vault — a deliberate departure from sgit.ai's decks-from-a-vault brief, which specifies a host that fetches deck sources with a read key and runs them in sandboxed opaque-origin frames. That architecture exists because vault bytes are untrusted input to a host page; this site's constraint is different: every page is static and contacts nothing, with exactly two named exceptions, and a live viewer would have made every deck page a third. The cost is liveness — when the vault moves ahead, this site is behind and says so. The live decks are the vault app's own Decks view, one click away on /vault/ and /estate/. | verified 9 Sep 2026 | https://sgit.ai/briefs/vault-decks-on-a-site.md, read 9 September 2026; build.py deck_pages() and tools/check_site.py check_network_pages | decks |
Each deck ships a 16:9 PDF at the estate's deck geometry, one slide per page, printed by a browser from the same markup the page renders — so a slide cannot look one way on the site and another in the file somebody forwards. Three defects were found and fixed getting there: every slide spilled its footer onto a blank second page (20 pages for 10 slides); Chromium evaluates media queries against the page box, so a 1300px breakpoint stacked every split slide and clipped its screenshot to a nav bar; and main.doc h2 out-specified .slide h2, giving the page a serif title with a rule above it while the PDF had neither. check_deck_pdfs fails the build if a deck's bytes have moved since its PDF was printed. | verified 9 Sep 2026 | tools/make-pdfs.js; files/decks/*.pdf; data/deck-pdfs.json records the deck sha256 each was printed from | decks |
Eleven screenshots of this site's own features are captured from a real build by tools/shots.js and placed on eighteen slides, each with a caption and an absolute link back to the page it shows, so the links resolve wherever the PDF is opened rather than against the localhost it was printed from — which is what the first run produced. The screenshots and links are the site's addition and never the vault's: the words on every slide are the vault's, republished byte for byte, and data/deck-extras.json states that in its own header. | verified 9 Sep 2026 | files/shots/*.png captured by tools/shots.js; data/deck-extras.json; link targets checked by check_links | decks |
Every read key on the estate page is printed in full where a person can select and copy it, not only carried in a data-readkey attribute for the embed. sgit.ai's brief for this surface requires it — "put it in the markup where a human can copy it, not only in a script" and "the read key on the page should be enough for anyone to bypass your site entirely. If it is not, something is being withheld that should not be." The page previously showed truncated keys in a table and the full ones only in the markup, which failed that test. | verified 9 Sep 2026 | https://sgit.ai/docs/briefs/sgit-ai-site-pages.md, read 9 September 2026; content/estate.md | estate |
| Six decks, 60 slides, and 38 of them carry a screenshot of this site. Deck 05 covers the machinery added in a day — the pack reader, the deck viewer, the PDFs and the version convention. Deck 06 covers the gates, and its screenshots are the build actually refusing a bad change: real terminal output captured by breaking the tree on purpose, running the check, and putting it back. Nothing in those images is typed to look convincing. | verified 10 Sep 2026 | decks/05__how-this-publishes.md and 06__what-the-build-refuses.md in vault dkeclt5r @ obj-cas-imm-ca05faec37fd; files/shots/gate-*.png built by tools/gate-shots.py | decks |
Measured in the estate's vaults, 9 September 2026
| Claim | State | How we know | Where it is said |
|---|---|---|---|
The AIUC-1 conformance vault's graph holds 11,610 edges, of which 1,126 are maps_to crosswalks from AIUC-1 controls out to 489 distinct external control items across exactly thirteen frameworks. The 1,126 and the 489 differ because a control item is reached by more than one AIUC-1 control; both were counted, not inferred from the other. | measured 9 Sep 2026 | graph/edges.json in vault 2wzct4k7, 2,293,236 bytes, sha256 984d297a971bfbed | estate |
| 95 of those 1,126 crosswalks point at law: EU AI Act 62, Colorado AI Act 18, California SB 53 9, NYC Local Law 144 6. Three of the four are sub-national United States jurisdictions — precisely the axis UnGovr's Atlas is keyed on, and the reason the join is one edge rather than a project. | measured 9 Sep 2026 | graph/edges.json in vault 2wzct4k7 — maps_to targets joined to their in_framework parent | estate, security-graph |
| All thirteen frameworks are AI-specific. No NIST CSF, no SP 800-53, no ISO/IEC 27001 or 27002, no SOC 2, no CIS Controls, no PCI DSS, no HIPAA, no FedRAMP appears among them. That is the right scope for an agent standard and not a defect in it — but it means the general-security half of a security-standards map is absent from this estate, which is worth knowing before anyone assumes otherwise. | measured 9 Sep 2026 | the thirteen framework nodes in vault 2wzct4k7, listed in full | estate |
One framework node is labelled "OWASP Top 10", which reads as the web application list — a general security artefact. Its members are not: LLM01:25 — Prompt Injection through LLM10:25 — Unbounded Consumption, the OWASP Top 10 for LLM Applications. The finding above survives only because the ten members were listed rather than the label believed. | measured 9 Sep 2026 | the ten in_framework members of framework:owasp-top-10 in vault 2wzct4k7 | estate |
Crosswalks do not point at frameworks; they point at anchor: nodes reached by an anchors_to edge, of which there are 489 — one per distinct external control item. The anchor pattern is already established in this estate, so the dev pack proposes a different axis of anchor rather than the mechanism, and the pack's first file was corrected to say so. | measured 9 Sep 2026 | the 489 anchors_to edges in vault 2wzct4k7 | estate |
How to read the states
| Chip | Means | What you may do with it |
|---|---|---|
verified | Somebody ran it and watched it work, on that date, in a named place | Treat as fact for that date and that setup. Read it narrowly |
measured | Our own pipeline produced this number on a named workload | Treat as fact about our workload; yours will differ |
docs | Read in the vendor's documentation on that date; never executed by us | The honest debt. Check it against the vendor before relying on it |
spec | A written specification for something that does not exist | Never plan around it. Future tense only |
unrun | Code we wrote and have never executed | The invitation. Run it and find out |
projected | Arithmetic, with its workings shown | Re-do it with your own numbers |
Read verified narrowly. On this site it mostly means one container, one afternoon, one IP address, on 9 September 2026. The API is live and rebuilds nightly; several of these claims have a shelf life measured in weeks.
The one state this site never uses about UnGovr's compliance with anything is any of the vault's six. Those are a different vocabulary answering a different question, and merging them would lose both.
What is honestly thin
docsclaims about the payment path. No402was ever returned here, so everything about the wallet, the price and the challenge headers is read rather than run. It is the largest block of unexercised claims on the site.- One gated corpus is still unread. CGJ report detail needs the same key and was not fetched; only the indices were. Blocker B2 is otherwise closed.
- One number is a sample, not a census, and says so with an interval.
- One page opens a network connection. The vault page runs the vault live from its published read key, against
dev.vault.sgraph.ai. It is the only one, the component that does it is vendored into this site, andcheck_network_pagesfails the build if any other page or file gains the ability.