standards.sgit.ai / admin / versions
Release history
Every push to dev is a release: CI validates the site, verifies the version bump, tags the commit v{release}.{major}.{minor}, and deploys to GitHub Pages. The version is owned by admin/build/version.txt and must agree with the release commit's subject. The pipeline in detail →
| Version | Date | What shipped |
|---|---|---|
| v0.1.4 | 25 Aug 2026 | The nav dropdown caret was a Unicode glyph and it fell back to a plain dot on at least one real browser/font. ▾ (a small downward triangle) is exactly the risk of using a symbol character as a UI affordance rather than drawing it: it renders as intended, or it silently doesn't, with no signal that it failed. Replaced with a border-drawn CSS triangle in assets/site.css, which has no font dependency, and admin/build/chrome.py — the single source of the nav markup — now emits an empty <span class="caret"></span> rather than the glyph, propagated across all 43 pages by re-running it. |
| v0.1.3 | 24 Aug 2026 | The first release failed, and this is the fix — recorded rather than quietly amended. The repository started from a stock Python .gitignore carrying build/, which silently swallowed the whole of admin/build/: chrome.py, version.txt and the validator itself. git add -A skips ignored files without a word, so three releases committed cleanly and the first CI run failed on a validator that was not in the tree. Local validation had passed, because it ran against the working tree rather than against the commit — which is exactly the gap between what an author can see and what a reviewer gets, and this site argues about very little else. The fix is one negation (!admin/build/, which pki.sgit.ai already carried and this port had missed) plus a new check 0 in the validator: any file present in the tree but ignored by git now fails the build locally, with the path named. The class of failure is now caught by the gate rather than by the deploy. |
| v0.1.2 | 24 Aug 2026 | The delivery and machine surfaces, and the site's own honesty pages. The vaults — how an encrypted vault actually reaches a reader (client-side decryption, a published read key, a postMessage handshake so the key never appears in a URL), the twelve published vaults with their credentials, the instrument vault layout, and the zip and SQLite distribution that is specified and does not exist on any vault on this estate. Key discipline — read keys yes, write keys never; why escrowing a write key is a precondition of publishing rather than good practice, because a vault that is readable and unwritable is not damaged but frozen; the keys vault policy including the recursion that has to be answered outside the system; and the open question of whether the one exposed key was rotated or only removed from history. Tools outside the vault — three working precedents, the six-file contract, five rules, and five tools ranked, with T4 shipped: a sixty-line client-side citation resolver that normalises six input forms to one canonical alias and, when an input does not resolve, returns not found with the form it tried rather than a nearest match. The machine surface with three versioned JSON endpoints and the epistemic rule that an agent may report which provision a claim points at and may not report that a requirement is met. The agentic-access subset across eight instruments, with the three divergences a merged view would hide — four reporting clocks, three different things called access control, and only one instrument that is about the agent's autonomy at all. What is actually shipped, unsoftened: nine numbered gaps, eight tensions, and one of the nine gaps closed. Plus the eleven source documents published raw — with §4 of the boundaries document redacted and the redaction itself published, because its index of what must not be published is a usable summary of all of it. |
| v0.1.1 | 24 Aug 2026 | /method/ first, then the instruments. Building the meta layer before any instrument folder is counter-intuitive and correct: it makes instruments two through N cheap, and given that ISO text cannot be republished it is the only material here that is itself the product. The taxonomy/ontology split with the paragraph as the hinge; paragraph-as-folder storage where cost scales with change, not with size; two hashes per provision — one for the slot, one for what is in it — which is what makes a crosswalk survive amendment; retrieval records as provenance, justified by a probe that found three states of AI Act text in the wild including a text that never was the law; authority anchoring by deferral; and the acceptance test the method has not yet passed, published as unpassed. Then the EU AI Act — 1,523 nodes and 1,944 edges, pointing at the existing Regulation Graph vault rather than rebuilding it, with four provision pages, the worked example, and a status page stating both real weaknesses. Operative text is deliberately withheld pending re-derivation, and one disputed number is left off a page rather than resolved by guessing. GDPR and ISO/IEC 27001 as honest stubs; ISO 31000 as a single paragraph pointing at risks.sgit.ai. |
| v0.1.0 | 24 Aug 2026 | The pipeline first, and the front page it gates. .github/workflows/deploy-pages.yml ported from pki.sgit.ai — validate → tag → deploy, where a validation failure stops the release entirely: no tag, no publish. Auto-tagging reads the version from admin/build/version.txt, requires it to agree with the release commit's subject, enforces that the bump is the next minor, tags the release commit (HEAD on a direct push, HEAD's parent when a pull request lands as a merge), and backfills tags for any historical release from the commit subjects. admin/build/chrome.py owns the nav and footer as a single definition applied across every page, so a thirty-page site cannot drift. admin/build/validate.js carries five checks, two of them new for this site: the key-leak tripwire extended to write-key material — the prefix may be discussed in prose, because explaining why a write key is never published requires naming it, but eight or more key-shaped characters after it fails the build in any file, always — and the instrument-labelling check, which makes the condition for keeping this site's name mechanical rather than remembered. And the front page, which leads with the three-way LAW/STANDARD/FRAMEWORK distinction before the thesis, because the site's name overstates a third of what it holds and that is better as the opening argument than as the first error. |
The version scheme
v{release}.{major}.{minor}. Every push to dev is a minor release; CI rejects a bump that is neither the next minor nor a deliberate major. The version appears in four places and they must agree or the build fails: version.txt, every page's nav badge, this table, and the text twins (llms.txt, llms-full.txt, index.md). Only version.txt is edited by hand — chrome.py propagates it to the rest, because hand-editing it is how a sibling site silently missed it twice.