Independent. No commercial relationship with UnGovr — no funding, no agreement, no conversation of any kind — checked 9 September 2026. Disclosures · how every claim here is evidenced

ungovr.providers.sgit.ai / packs / security-graph / 06__verification.md

06 — Verification

View the raw file ↓06__verification.md — rendered here, and served unrendered at /packs/security-graph/06__verification.md. sha256 04e4a83a19f3a805, checked against the vault on every build. The reader is an addition; the bytes are the document. The rendering drops the document's own title line, because this page already carries it as its heading, and rewrites intra-pack links so they resolve here.

version v0.1 · 9 September 2026

← 05 Integration [link removed: 05__integration.md:] · 00 Start Here [link removed: 00__START-HERE.md:]


The rule this file enforces

Every claim carries a state, and the default is the weakest one. That applies to this pack about itself: nothing it specifies is built, and the status column below says so.

The acceptance tests

#TestWhy it existsState
1A named body resolves from its published slug, and the jurisdiction it is governed_by resolves tooThe anchor is real rather than illustratedprogrammatic-inline — inherited. Done in this vault
2The governed_by edge is drawn inferred everywhere, and its measured reach and its needs-a-human share ship beside itUnGovr do not make this claimprogrammatic-inline — inherited. 96.6% / 20.5%
3A standard's control is forked byte for byte, and a test proves the fork is identical to its sourceThe AIUC-1 layer's own discipline, applied to usunevidenced
4The addresses edge names who drew it, and ours are inferredA crosswalk without an author is an assertion nobody ownsunevidenced
5A query traversing evidenced_by and attested_by names which it used, and a test goes red if a layer edge reaches a source observationTaken whole from the conformance layerunevidenced
6unevidenced is emitted for every control in scope, whether or not anyone lookedAn absent row must never read as complianceunevidenced
7Origin is carried by shape and assertion class by colour, and neither borrows the other's channelThe thing a reader checks firstprogrammatic-inline — inherited. The app does this
8Every node claiming a retrieved source carries response_sha256 and a retrieval date; every node that is ours carries a note insteadA hash nobody earned is worse than no hashprogrammatic-inline — inherited
9No whole-graph render exists anywhere in the appNever render the whole graph — render the result of a queryunevidenced
10Every proposed edge has a sentence, an inverse with a different sentence, a domain and a rangeThe grammar's own rule for extending the setasserted — the five proposed in 02 [link removed: 02__the-model.md:] each do; not yet tested
11No standard's text is redistributed where its licence forbids it, and the check runs over the whole treeThis vault learned this the expensive wayprogrammatic-inline — inherited. check_no_restricted_corpus
12The composite query in 05 [link removed: 05__integration.md:] returns an answer, and the answer names which links were inferredThe reason to build any of thisunevidenced
13The estate's existing anchor pattern (anchors_to, 489 edges in AIUC-1) is reused rather than reinventedDiscovered while closing S1. Two anchor axes must compose, not competeunevidenced

Five of thirteen pass, and all five are inherited from work already done in this vault rather than earned by this pack. One more (10) is asserted; the remaining seven are unevidenced. That is the honest state of a specification published before its implementation.

**This line said two of twelve until 9 September. Both numbers were wrong: test 13 was added when S1 closed and the total was never moved, and three rows had been marked programmatic-inline — inherited after the count was written. It was caught by counting the table with a script rather than reading it, which is the only reason it was caught at all — and it is the same failure mode this pack warns about in 03 [link removed: 03__the-standards-map.md:], where a framework's label had to be checked against its members. A summary of a table drifts from the table.** The count is now derived by parsing the rows.

Blockers

#BlockerCloses when
S1AIUC-1's thirteen crosswalk targets are not known hereCLOSED, 9 Sep, by doing what this pack said to do first. They are AI-specific — no general security control set among them — and four are laws, three of those sub-national US. Counted from graph/edges.json in vault 2wzct4k7. See 03 [link removed: 03__the-standards-map.md:]
S2The licence position of every candidate standard is unknownEach is checked before its text is parsed, never after
S3Entity id stability across UnGovr releases is unmeasuredTwo snapshots are compared. If ids churn, the anchor thesis fails
S4No standards body is known to publish machine-readable jurisdiction scopeSomebody looks. If one does, their binding replaces our inference
S5The AI-law corpus, which carries jurisdiction-level AI-law verdicts, cannot be redistributedNot closeable by us. It is described and measured, never stored

What would make this pack wrong

Stated in advance, because a specification that cannot be refuted is not one.

If this turns out to be trueThen
AIUC-1 already crosswalks most of the candidate listChecked and false. The general-security half is absent. But a second prediction did land: AIUC-1 already uses anchor: nodes and an anchors_to edge, so this pack does not introduce the pattern — it proposes a different axis for it, and 01 [link removed: 01__the-anchor-node-thesis.md:] says so
UnGovr entity ids are not stable between rebuildsThe anchor thesis fails outright. Everything here depends on it
A standards body publishes its own jurisdiction bindingsOurs are deleted in favour of theirs, and the pack is better for it
Practitioners need the merged control vocabulary after allThen merging belongs in a layer above the bridge, and the bridge still has to exist first
The addresses edge turns out to be many-to-many and unstableLikely. It is why exactly one is drawn by hand in the worked example before any of it is automated
The two EU AI Act graphs in this estate disagreePublish the disagreement. Two independent parses of one law diverging is a finding

Honest tensions

TensionNote
A graph that spans regulation and standards invites being read as compliance adviceIt is not. Every layer states what it does not prove, borrowed from the conformance layer's own field
The anchor is somebody else's data, and it can moveIt is a dated snapshot with a hash, and the live source is named. Stale and honest beats fresh and unattributed
Inferring governed_by at 96.6% is useful and 20.5% of it needs a humanBoth numbers ship together, always
This pack cites five vaults and two sites it did not buildWhich is the argument. The value is the connective tissue, not re-typing corpora that exist
Nothing here is builtAnd the pack is published before the work anyway, which is the method this estate argues for, demonstrated on itself

This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).

← 05__integration.md

This is the site's rendering of a vault document. Intra-pack links are rewritten so they resolve on this host; the raw file keeps every link exactly as the vault wrote it, including the breadcrumbs that point into the vault's own tree.