ungovr.providers.sgit.ai / Release history
Release history
admin/build/version.txt owns the version and data/releases.json owns the history. bin/bump.py moves both, and every row links to that version's own page — a reader who clicks v0.1.7 wants to know what v0.1.7 was, not to land on a generic changelog. The release commit's subject repeats it, and CI refuses to tag if the two disagree — which is how a site avoids shipping two versions of itself.
| Version | Date | What changed | Commit |
|---|---|---|---|
| v0.1.18 | 2026-09-10 | Two decks on the site's own machinery: how it publishes, and what its build refuses — with the gates firing on screen. | 43f417bcd2 |
| v0.1.17 | 2026-09-09 | Every release now has a page naming the git commit it was built from, the history is generated from data/releases.json rather than hand-kept beside it, and the nav pill links to the current version rather than to a generic changelog. The same convention in the vault: versions/index.json plus one file per version, and a Versions view in its app. | 3a745ff92e |
| v0.1.16 | 2026-09-09 | The decks become real 16:9 slides with screenshots of this site, and each one downloads as a PDF whose links point back here. | 49906b42f4 |
| v0.1.15 | 2026-09-09 | A vault document could run script on this origin, through the pack and deck readers. Confirmed in a browser, closed, and gated — plus link schemes restricted and a literal entity caught. | 01e68f28f6 |
| v0.1.14 | 2026-09-09 | A fourth deck — what we plan to build — and all four on the site at /decks/: stacked and printable by default, present mode and deep links on top, markdown one click away. | 6d9014f056 |
| v0.1.13 | 2026-09-09 | What you get when you reach a law: JSON only, no instrument text, no graph — and 254 of the 398 records laws, every sub-national one, with no reachable detail document. | ac016c2101 |
| v0.1.12 | 2026-09-09 | The vault app names its own release in its header, and the pill opens a table of what each one changed — the same pattern as this nav, reaching a view instead of a page. | b0b21f920a |
| v0.1.11 | 2026-09-09 | A reader for the pack files: the rest of the pack beside every document and the raw bytes one click above it. Two corrections it surfaced, one of them the pack forking a vocabulary it said it reused. | d39dab4a54 |
| v0.1.10 | 2026-09-09 | The security-standards dev pack, published raw at /packs/ — byte for byte from the vault, hash-checked on every build. Its test count was wrong in both numbers and is corrected. | 25c196580e |
| v0.1.9 | 2026-09-09 | The estate page: seven published vaults from across the family, each opening in the page from its own published read key, one at a time and nothing fetched until asked. | 41f1cf4a2c |
| v0.1.8 | 2026-09-09 | Three markdown-sourced slide decks in the vault: what we learned, what we built, and how it composes with the other vaults. | e97d2f279b |
| v0.1.7 | 2026-09-09 | The vault link drops the /en-gb/ segment, which broke the fragment routing; a check now refuses it. | c9ad13bc01 |
| v0.1.6 | 2026-09-09 | The vault leads the vault page, with an open-in-a-new-tab button; the release channel is withdrawn and test 9 regressed with it; the embed is verified. | e827b7d7e5 |
| v0.1.5 | 2026-09-09 | The vault's entry is now a real HTML app with five views; the site says so, and two of its computations exist only there. | 4017ebe833 |
| v0.1.4 | 2026-09-09 | The vault is pushed: 9 of 13 acceptance tests pass, release @2026-09-09-retrieval pinned, and the site names the commit it reports on. | 70d3fb0388 |
| v0.1.3 | 2026-09-09 | The vault runs live on the site, embedded through SG/Vault's own embed protocol from the published read key. | 49948af74e |
| v0.1.2 | 2026-09-09 | The domain was pointed mid-session: 404 at v0.1.0, serving at v0.1.1. Both states recorded. | 6c2ed4bcce |
| v0.1.1 | 2026-09-09 | The AI-law corpus, read under a key: 2,915 instruments, and a per-corpus licence that is not CC BY 4.0. Blocker B2 closed. | c2fe990ca5 |
| v0.1.0 | 2026-09-09 | First release. All nine contract sections; the coverage measurement and the inferred-join computation with their queries; the seven-step join; the retrieval log; the vault linked by read key. | 4fef420081 |
Why the newest release has no commit beside it yet
Every row above names the git commit it was built from, except the newest — and that is not an oversight, it is arithmetic. A commit cannot contain its own hash. Recording the sha and amending the release commit produces a different sha; recording that one and amending again produces another. It does not converge.
So the sha is written by the following commit, and two things stop "later" becoming "never": check_version_agreement requires a commit on every release but the newest, and bin/bump.py refuses to move to the next version while the current one is still blank.
This was found the honest way — by running the workflow, watching the recorded sha and git rev-parse HEAD disagree, and noticing that fixing it once would not fix it twice.
The pipeline
validate → tag → deploy, in that order, a failure at any stage stopping the release.
| Stage | What it does |
|---|---|
| validate | The build is reproducible against content/; the version agrees everywhere; internal links resolve; every canonical is on the host in CNAME; the key-shape scan is clean over the whole tree including docs/; every claim is cited and dated; all nine sections are present and in order |
| tag | Reads admin/build/version.txt, finds the commit whose subject carries the same version, refuses if they disagree or if the bump was not the next minor, then tags it |
| deploy | Rebuilds from content/ and publishes docs/. Never when validation failed, never from a pull request |
It also runs on pull requests, so branch work is gated before it reaches the release branch.