The citation scheme
No stable permalink scheme for an individual provision exists anywhere on this estate today. That is table stakes for a site whose entire value is being citable, so it is designed here, before the second instrument lands, and there is a working resolver rather than a promise of one.
A standards site that cannot be cited has failed at its one job.
The URL
https://standards.sgit.ai/<instrument>/provisions/<alias>.html https://standards.sgit.ai/eu-ai-act/provisions/art-026-para-05.html
| Segment | Rule |
|---|---|
| Instrument slug | Lowercase, hyphenated, no version — eu-ai-act, gdpr, iso-27001, nis2, owasp-asvs. The version lives in MANIFEST.json and in the dist/ filenames, never in the citation, because a citation should survive a consolidation |
| Alias | The human-readable positional address, zero-padded so it sorts: art-026-para-05, art-009-para-05-pt-d, rec-060, anx-III-pt-05-b. Zero-padding is not cosmetic — art-9 and art-99 sorting adjacently is how a list of provisions becomes unreadable |
| The canonical id | Is the positional hash, not the alias. The alias is a projection of it, and if an instrument renumbers, the alias moves and the hash does not. Every provision page prints both |
What a citation resolves to
Four things, always, or it is not a citation:
The text, or a stated reason there is none
For EU law, the operative text. For ISO, an explicit absence with the licensing reason — never a paraphrase standing in for text that cannot be published.
Both hashes
The positional hash — what a crosswalk attaches to — and the content hash of the text currently in the slot.
Every crosswalk touching it
Bridges in and out, with basis and strength. Currently empty on every provision, and the page says so rather than omitting the section.
Content negotiation, without content negotiation
GitHub Pages serves static files and cannot negotiate on Accept. So the JSON twin is a sibling path rather than a header, which is less elegant and considerably more durable:
/eu-ai-act/provisions/art-026-para-05.html the page /eu-ai-act/eu-ai-act.json the instrument, every provision, as one document
The per-instrument JSON endpoint is deliberate: agents are half the audience, and an agent that has to scrape thirty HTML pages to answer one question will scrape them wrong. The machine surface →
Citation precision — the rule, and the self-correction that produced it
The rule came out of a correction the project made against itself. A reading of AI Act Article 9(5) initially described it as referring back to paragraph 2 — where the text refers back to “paragraph 2, point (d)”. One point, not a whole paragraph. The difference is the difference between a broad obligation and a narrow one, and it is exactly the kind of error that a graph makes permanent and a prose summary hides.
What this scheme does not fix
The vault viewer and the ciphertext API both live on dev.-prefixed hosts. A production standards site whose delivery layer depends on infrastructure named dev is a durability risk, and citing something for ten years is the whole proposition here.
Mitigated in one direction already: the repo, not the vault, is canonical for URLs, and this site is plain files under a custom domain with a git history behind it. Not mitigated in the other: the dist/ zip and SQLite downloads that would let a third party archive an instrument independently do not exist yet on any of the twelve published vaults. Until they do, third-party archival is a claim rather than a capability. Distribution →
The resolver
Paste a citation in any of the accepted forms and it resolves to the provision page, entirely client-side against the instrument's own JSON — no backend, no lookup service to go down. Open the resolver →