/index.html and every one of them is named in this file. CI fails the build if a hub is missing from it, and if the sitemap and the file tree disagree in either direction. - One fetch gets everything: https://graphs.sgit.ai/llms-full.txt is this file plus the front page plus all eleven source documents, concatenated. - The site is pre-rendered static HTML. Nothing is assembled client-side except the document reader, which always has the raw markdown behind it. ## The thesis in nine sentences 1. A node is just a node — a label is not a meaning, and a node connected to nothing is literally meaningless. 2. The same value, differently connected, means different things: the difference is not in the value, it is in the connectivity. 3. Therefore classification is a query, not a judgment: "the content of the node does not decide its type; its paths do." 4. Therefore confidence is computable, and honest uncertainty is the default posture — and the gaps are worth mapping too. 5. Schema-first breaks at every boundary; the Semantic Web made the subtle error of attaching meaning to nodes rather than deriving it from edges. 6. So don't merge vocabularies — merging erases the disagreement. Keep them intact and bridge them through anchor nodes. 7. Every edge is a verb with a distinct inverse; the generic association edge is banned because everything relates to everything; that asymmetry is what stops the graph exploding. 8. Never render the whole graph — render the result of a query; build wide, find the few, then flip. 9. And it is fractal: one grammar, one validator, one provenance rule at every altitude — zoom into any node and it expands into a graph obeying identical rules. ## Altitude 1 — start here - https://graphs.sgit.ai/start/index.html — the five-minute version. Two Python variables both hold 8080; one reaches a type, a library and a pinned version, the other reaches nothing. **The difference is not in the value, it is in the connectivity.** Also: five teams who each call something a "Review", where compatibility turns out to be non-binary, asymmetric and purpose-relative — nobody has to agree on anything for the overlap to be computable. The confidence ladder runs from no edges to rich multi-hop connectivity, and the remedy for low confidence is enrichment (add edges), never enforcement (add rules). - https://graphs.sgit.ai/why-graphs/index.html — three different things people mean by "graph": network analysis, fast joins, and semantics. **This site is only the third.** Carries the honest positioning on GraphRAG ("knowledge is traversed, not guessed" — but traversal needs edges to exist, and where the graph is thin, similarity search wins), on RDF ("both, at different layers" — the live regulation graph exports RDF/Turtle), on property graphs (properties may carry data, never meaning), and on hypergraphs (no position; the corpus does not contain the word). - https://graphs.sgit.ai/glossary/index.html — every technical term with a plain-English alternative beside it. **Concept vs term**: the concept is the language-independent unit of meaning, the term is one language's label — never store meaning in a term. **Taxonomy vs ontology**: a taxonomy points upward (broader/narrower), an ontology points outward (what types exist and how they may connect). ## Altitude 2 — the grammar - https://graphs.sgit.ai/grammar/index.html — five rules. **Every edge is a verb with a distinct, meaningfully-named inverse**, and the inverse is not the same edge walked backwards: `owned_by` and `owns` have different fan-out, and that asymmetry guarantees monotonic progress toward a peak, which is what stops the graph exploding. **The generic association edge is banned** because it constrains nothing and costs fan-out. If a path does not read as a sentence in the reader's own language, the edges are wrong. Rich nodes are good — the blob is a rendering failure, not a modelling one. **Never render the whole graph; render the result of a query.** Mermaid is unreadable past ~50 nodes; a rendered graph past ~300–400. - https://graphs.sgit.ai/grammar/edge-set.html — the concrete vocabulary, and the page to paste into a session. Fifteen established edges: connected_to, observed_on, backed_by, measured_by, grants, reaches, enables, exposes, gives_rise_to, protected_by, conditional_on, defeated_by, owned_by, accepted_by, underwritten_by. **Nine of the inverse names are proposed by this site rather than quoted from the corpus, and are marked as such in the table** — the corpus glossary that would settle them does not exist. Rules for extending the set: a new edge needs a sentence, its inverse needs a different sentence, both need a stated domain and range. ## Altitude 3 — the full argument - https://graphs.sgit.ai/depth/index.html — **"They ended up attaching meaning to nodes rather than deriving meaning from edges… This is schema-first thinking dressed in graph syntax."** The disagreement with the Semantic Web is with a practice, not a goal, and it is narrow: not with RDF as serialisation, not with shared vocabularies as reference points. Also: don't merge ontologies — three layers instead (shared facts owned by nobody / per-party formulas / declared bridges), because **parties can disagree about meaning while still agreeing about facts, which is the only stable basis for working together.** Node type formulas: `Vulnerability := a Fact that also has an upward gives_rise_to path to a Risk` — judgment does not disappear, it moves out of the classifier's head into a formula that is visible, versioned and arguable. The grounding ladder (downward grounds, upward implies) is one formula among possible others, and says so. Supersede never delete, so a correction can be asked what was resting on it. Weight by independence, not by count. - https://graphs.sgit.ai/depth/boundaries.html — **fractal is a testable claim**: if zooming into a node needs a new format or a special case, the system is hierarchical, not fractal. At a boundary, emit a graph rather than JSON-plus-prose: determinism, explainability, provenance, sovereignty and auditability are **consequences of that one decision, not features**. The model proposes a graph; a deterministic validator executes it, so untrusted input is data and never instruction and **prompt injection fails at the validator, structurally** — a reduction, not an elimination. Documents, skills and standards are projections: don't store a consolidated legal text, hold the base plus amendments and compute it — which makes consolidation and per-organisation customisation one mechanism rather than two. Twins are where the graph stops modelling; where it cannot reach, emit a **named air gap** with an owner and a frequency. ## Worked graphs, with real numbers Three artefacts are live and public; every other number is parsed from a design document and is not deployed. The two are never mixed. - https://graphs.sgit.ai/examples/index.html — ten worked applications. Live: the EU AI Act regulation graph (**1,523 nodes · 1,944 edges**, 11 views, RDF/Turtle export, every element hash-verified to source bytes), the Risk Graph Explorer (18 facts / 37 risks / 14 provisions, `permissions: {}`), agentic browser isolation (17 entry points, 5 stakeholder altitudes). Summarised here: AWS IAM `AuthorizationClosure` — "the agentic union", and **for an agent the closure is the rating floor, not the nominal grant**; browser extensions, queryable in both directions; the customisation inversion — **nothing is relevant until your facts attach**; the Permissions Bill of Materials, because permissions gate exploitability. - https://graphs.sgit.ai/examples/browser-isolation.html — **59 nodes, 75 edges.** Should an agent browse in the user's own post-MFA browser or an isolated one? Answered as a **computed closure difference a buyer can check**, not an adjective. Thirteen risks, and three of them are risks created by the mitigation itself — the structure produces that honesty rather than requiring it. Escalation is a property of the edges: a risk reaches the board because the path leads there and nobody below accepted it. - https://graphs.sgit.ai/examples/2fa.html — **51 nodes, 53 edges** in one machine-readable file that declares its own modelling principles inside the data ("meaning comes from connectivity, not properties"; "facts only in phase one"; "every edge is directed and has a named inverse"; "every change cascades to the register"). **There is no deny button**: a risk is accepted for an interval — 1h / 4h / 2d / 2w / 1m / 6m — by a named person, and then returns. The file is not yet mirrored on this site. - https://graphs.sgit.ai/examples/article-26-5.html — one EU AI Act provision carried from a running system to a board decision and back. **Nine question nodes, five unanswered — and the unanswered five are the actual output of the exercise.** A 2×2 whose bottom row is empty, because there is no mechanism by which a risk gets to be *not accepted*. And a finding that is arithmetic: 30 days retained against Article 26(6)'s six-month minimum. - https://graphs.sgit.ai/maps/index.html — a graph says these things are connected; a map adds where they sit. **Wardley coordinates are [visibility, evolution] — the reverse of the usual convention — and a transposed map renders happily and says something entirely different.** Mermaid Wardley: added v11.14.0, production-stable v11.15.0, hand-drawn look unsupported; grep for `wardley-beta`, not for the fence tag. ## Reality - https://graphs.sgit.ai/shipped/index.html — **"We ship a hand-written content-addressed object graph in the browser. We do not use a graph database, and we say so in our own architecture notes."** Ships and is code-verifiable: the vault commit DAG (object IDs are SHA-256 of the **ciphertext**, not the plaintext — a skill file in the source repo states otherwise and is wrong), multi-parent commits, a real wave-BFS merge-base, three-way merge, typed `*.link.json` cross-vault edges pinnable to a commit, a read-only DAG query API exposed to untrusted sandboxed apps, and a live typed property graph of **71 nodes / 141 edges**. Absent: any graph database, browser SPARQL/Cypher, RDF in code, the path-query language, commit signing (written, only ever null). - https://graphs.sgit.ai/origins/index.html — ten phases, February to August 2026. The first graph thinking was cryptographic, not semantic: **"revocation is the absence of trust, not the presence of a revocation entry"** (21 February 2026). And the routing failure that produced this site: the philosophy documents are referenced by four files and are not referenced from the entry-point file every agent reads, so an agent working forwards never meets them. Paths not taken are recorded too. - https://graphs.sgit.ai/network/index.html — **"A public key in isolation does not give you anything; it is the graph it is connected to."** And the reciprocal, which is the most interesting claim here: the semantic web's verification gap means **graphs need identities too** — an edge is an assertion by somebody. Bridges to pki.sgit.ai, nhi.sgit.ai, sentinel.sgit.ai and sgit.ai. ## The book The whole site is also readable as a book — Meaning Through Connectivity, an introduction and sixteen chapters in six parts, **generated from the site's own pages** so the two cannot drift (CI fails the build if a source page changes without the book regenerating). - https://graphs.sgit.ai/book/index.html — cover, about-this-book, and the table of contents. The reading order: the claim, the grammar, the full argument, the worked proof, reality, appendices. - https://graphs.sgit.ai/book/single.html — **the introduction and all sixteen chapters in one HTML page.** For an agent this is the one-fetch version of the site's rendered prose, the way /llms-full.txt is the one-fetch version of the source documents. - https://graphs.sgit.ai/book/meaning-through-connectivity-screen.pdf — the screen PDF: the single page printed at US Letter in the site's own design, made for tablet reading. Both PDF editions regenerate together from the same chapters on every release and carry the site version on their cover; the build fails if either lags. - https://graphs.sgit.ai/book/meaning-through-connectivity.pdf — the print-edition PDF: **a 6"x9" print interior in the standard technical-book format** — mirrored gutter margins, folios bottom-outside, running heads, a paginated contents computed by the typesetter, justified and hyphenated, monochrome, no bleed, fonts embedded. Ready for print-on-demand (KDP), cover included: the front cover is an SVG at /book/cover/front.svg — a true subgraph in the book's own edge vocabulary, every arrow reading as its sentence, one ghosted edge for the unanswered — and the full print wrap (back + spine + front, spine width computed from the interior's page count) is at /book/cover/meaning-through-connectivity-cover.pdf. The build fails if the interior's page count changes without the spine recomputing. A Kindle edition is deliberately deferred: a fixed-layout PDF is the wrong upload for Kindle — the right artefact is a reflowable EPUB. ## Site - https://graphs.sgit.ai/documents/index.html — the eleven source documents, readable in-page and downloadable raw at /briefs/. **The raw markdown is the source of truth; the rendered page is presentation**, and each reader page renders its own source file so it cannot drift. Three redactions applied before publication, all recorded at /documents/public.html with visible markers. - https://graphs.sgit.ai/admin/index.html — how the site is built: static HTML on GitHub Pages deployed from `dev`, with `validate → tag → deploy` on every push and a nine-check pre-release gate. Five of the checks are specific to this site: every section hub must appear in this file, no page may use the banned edge as a live edge name, every page must close every block it opens, every chapter page must match its markdown source, and the book must match the pages — one chain, markdown to pages to book, and projections must not drift at either link. - https://graphs.sgit.ai/admin/comms.html — asks and tasks, published unresolved. N1 is a one-line edit to a repository file, specified 11 June 2026 and still not done, and it is the actual cure for the problem that produced this site. N3 has been waiting since 10 June 2026. - https://graphs.sgit.ai/admin/versions.html — release history. - https://graphs.sgit.ai/about/participant.html — participant disclosure, the site-wide licence, and **four situations where this approach loses**: everyone already agrees and always will; you need the answer enforced rather than computed; the graph would be empty; you want to buy it rather than build it. ## What this site does not claim Written fresh for the site rather than sourced from the corpus, and marked as such on the page: /why-graphs/ (both halves), the GraphRAG and hypergraph positioning, /glossary/, the air-gap section, the projections synthesis, and nine inverse edge names. Hold those to a lower evidential bar. Two worked examples exist and are deliberately not published: a LinkedIn network graph built from a real export (real personal data about third parties — a data-protection question, not a licensing one), and a case study naming a real third-party product (needs a legal read). ============================================================================== == index.md — the front page ============================================================================== # graphs.sgit.ai — a node is just a node; meaning lives in the edges > "in our graph we do not use properties, because properties do not have meaning, they are > just words; **we capture meaning through connectivity.**" > — Dinis Cruz, 26 June 2026 *Source: · site v0.3.4 · markdown twin of the front page.* **Not a graph database pitch.** The claim is that one grammar is the interface at every boundary, not that we store things in a graph. There is no graph database anywhere in the work behind this site, and [we say so on its own page](shipped/index.html). --- ## The one that needs no background Two variables in a Python program. Both hold `8080`. | | Reached by tracing outward | |---|---| | `port = 8080` | `int`. That is the whole graph. | | `port = Safe_UInt__Port(8080)` | a type carrying a range constraint → a library → a pinned version → its tests, repository, licence, maintainer | **The difference is not in the value.** The meaning is identical in the developer's head and radically different in the graph — and the graph is what another system, another team, or an agent has to work from. [The five-minute version](start/index.html). ## Three altitudes | | Section | What you leave with | |---|---|---| | **1 — the city walls** | [/start/](start/index.html) | A node alone means nothing; the same value differently connected means different things; nobody has to agree for the overlap to be computable; confidence is a function of connectivity; a named absence beats a hidden one. | | **2 — roads and buildings** | [/grammar/](grammar/index.html) | Every edge is a verb with a distinct inverse. The generic association edge is banned. Paths must read as sentences. Rich nodes are good. Never render the whole graph — render the result of a query. | | **3 — people and cars** | [/depth/](depth/index.html) | Against schema-first; merging vocabularies erases the disagreement; classification as a computed path-pattern; the grounding ladder; supersede never delete; concepts not words. Plus [a graph at every boundary](depth/boundaries.html). | The IA is the argument: *"this is just a question of altitude, like if you see something from a very high altitude you just see the city walls, and as you zoom in you start to see roads and buildings, and eventually people and cars."* ## The story that makes the case Expertise takes **10,000 hours** — from a 1993 violin study, where it was an *average*, not a threshold, and half the top group had not reached it. The original author spent his career correcting the popularisation, and **none of the corrections ever attached to the claim**: by then it had been carried through **242 papers** and more than **200,000 supporting citation paths** that lead back to nothing. A document cannot fix that. A graph can: mark the claim superseded from a date, then ask which conclusions were resting on it. [Supersede, never delete](depth/index.html#supersede). ## Real numbers | Graph | Numbers | Status | |---|---|---| | [EU AI Act regulation graph](https://sgit.ai/demos/vaults/regulation-graph/) | **1,523 nodes · 1,944 edges**; 11 views; RDF/Turtle export | live vault | | [Risk Graph Explorer](https://sgit.ai/demos/vaults/risk-graph-explorer/) | 18 facts / 37 risks / 14 provisions; `permissions: {}` | live vault | | [Agentic browser isolation](https://sgit.ai/demos/vaults/agentic-browser-isolation/) | 17 entry points; 5 stakeholder altitudes | live vault | | [Browser isolation risk graph](examples/browser-isolation.html) | **59 nodes, 75 edges** — including 3 risks *of the mitigation* | parsed from the brief | | [The 2FA instance graph](examples/2fa.html) | **51 nodes, 53 edges**, one machine-readable file | parsed from the brief | | The issue tracker's own graph | **71 nodes, 141 edges**; 12 node types, 10 edge types | measured, live repo data | [All worked examples](examples/index.html). ## What ships, and what is argued Ships and is verifiable by reading code: a content-addressed commit DAG with multi-parent commits, a real wave-BFS merge-base and three-way merge; a graph of graphs via typed `*.link.json` edges; a read-only DAG query API exposed to untrusted sandboxed apps; a live typed property graph; three published vaults. Does not exist anywhere: **any graph database**, MGraph-DB as a dependency, browser SPARQL or Cypher, RDF/JSON-LD in the code, the path-query language, commit signing (written, and only ever `null`). > *"We ship a hand-written content-addressed object graph in the browser. We do not use a graph > database, and we say so in our own architecture notes."* [The full separation](shipped/index.html). ## Why this site exists The three canonical philosophy documents sit in `library/concepts/`, are referenced by four files, and are **not referenced from the file every agent starts from**. An agent reading it and working forwards never encounters the philosophy. That is a routing failure, not a comprehension failure — so the fix is an address. [Origins, and the ten-phase arc](origins/index.html). ## Read it as a book The site's content is also a book — **Meaning Through Connectivity**, an introduction and sixteen chapters in six parts, generated from the site's own pages so the two cannot drift: - [Chapter pages, with the table of contents beside you](book/index.html) - [The whole book in one page](book/single.html) - [The print PDF](book/meaning-through-connectivity.pdf) — a 6″×9″ technical-book interior with gutters, folios and a paginated contents; print-on-demand ready — [cover included](book/cover/front.svg) - [The screen PDF](book/meaning-through-connectivity-screen.pdf) — the site's own design at US Letter, made for reading on a tablet Both PDFs regenerate together from the same chapters on every release and carry the site version on their cover — the build fails if either lags the content. ## For agents - [llms.txt](llms.txt) — every entry carries the page's single most important fact, not its topic - [llms-full.txt](llms-full.txt) — the whole document set in one fetch - [/briefs/](documents/index.html) — the raw markdown, which is the source of truth - [The edge set](grammar/edge-set.html) — the pasteable vocabulary ## Site - [Glossary](glossary/index.html) — plain English alongside every technical term - [Why graphs at all](why-graphs/index.html) — including GraphRAG and RDF positioning - [The network](network/index.html) · [Origins](origins/index.html) · [The documents](documents/index.html) - [Comms: tasks & requests](admin/comms.html) · [Release history](admin/versions.html) · [How this site is built](admin/index.html) - [Participant disclosure, including where our approach loses](about/participant.html) --- All content on this site is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0). You are free to share and adapt this material for any purpose, including commercially, as long as you give appropriate credit. ============================================================================== == briefs/00__BRIEF.md ============================================================================== # graphs.sgit.ai — Brief Pack **Pack version:** v1.0 · 21 August 2026 **Target site:** `graphs.sgit.ai` (new sibling on the sgit.ai network) **Source corpus:** `the-cyber-boardroom/SGraph-AI__App__Send` @ **v0.33.62** — read-only access assumed **Sibling sites surveyed:** sgit.ai · pki.sgit.ai (v0.1.4) · nhi.sgit.ai (v0.1.19) · sg-sentinel.sgit.ai (v0.1.1) --- ## 0. Read this first You are building a public reference site about **graphs** — specifically, about a use of graphs that is *not the common one*. The founder's framing, verbatim: > "in our graph we do not use properties, because properties do not have meaning, they are just words; **we capture meaning through connectivity.**" > — `team/humans/dinis_cruz/briefs/06/26/digital-twins-and-world-models/v0.33.35__arch-brief__sg-send-digital-twins-twin-of-anything-dimensions-discipline-of-reality-simulation-testing.md` · 26 Jun 2026 This is not "graphs make queries fast" and not "graphs model networks". It is a claim about **where semantics live**: a node carries no inherent meaning; what a thing *is* emerges from the edges traceable from it; and confidence in that meaning is proportional to how richly it is connected. The corpus itself is explicit that this is unusual and easy to miss: > "**Not a graph database pitch.** The claim is that one grammar is the interface at every boundary, not that we store things in a graph." > — `team/humans/dinis_cruz/briefs/07/12/architecture/v0.33.48__arch-brief__sg-send-fractal-semantic-graphs-agentic-operating-layer-deterministic-sovereign-open-source.md` **Your job is not to invent this material. It exists.** ~55 substantive conceptual documents (~135,000 words), ~20 worked graph applications with real node/edge counts, 13 Wardley maps, three already-published live graph vaults. Your job is to *organise, teach and render* it. --- ## 1. Why this site must exist The founder's diagnosis, in his own words: > "**a lot of the people that will use this don't know about semantic graphs, don't know about ontologies, don't know about a lot of the other terms**, so we also need to explore different UIs, and different ways to name this." > — `team/humans/dinis_cruz/briefs/08/09/graphing-text/v0.33.57__strategy-brief__sg-send-refactoring-meaning-decompilation-not-compilation-author-is-the-arbiter.md` · 9 Aug 2026 And the mechanism of the under-weighting he has noticed in agents — the Librarian found it, and it is concrete and fixable: > The three canonical philosophy documents sit in `library/concepts/`. They were **imported from a different project (Issues-FS) on 11 June 2026**. They are referenced by exactly **4 files in the entire repo**. They are **not referenced from `.claude/CLAUDE.md`** — the Phase-2 action in the import memo (`team/humans/dinis_cruz/briefs/06/10/_to-librarian/memo-to-librarian__thinking-in-graphs.md`) was never executed. An agent reading `CLAUDE.md` and working forwards **will never encounter the philosophy.** That is why agents building the other sites under-weight connectivity. It is not a comprehension failure; it is a routing failure. **Corollary for this site:** graphs.sgit.ai becomes the canonical, addressable, linkable home of the thesis. Once it exists, every other site and every future agent session can be pointed at one URL. --- ## 2. What the site is, in one paragraph A public reference site that teaches, in increasing depth, a specific discipline of graph modelling — meaning through connectivity — and proves it with real worked examples drawn from six months of applied work across security, regulation, strategy and agent operations. It is progressive: initial concepts, then more, then more. It is honest: it separates what ships from what is argued. And it is the reference the founder can point people at instead of re-explaining. --- ## 3. Audiences, in priority order | # | Audience | What they need | Where they land | |---|---|---|---| | 1 | **A smart newcomer with no graph background** | The five-Reviews example and the `port: 8080` example. No jargon before it is earned. | `/start/` | | 2 | **An agent (LLM) picking up graph work** | The concept vocabulary, the edge grammar, the node-type formulas, and one machine-readable example it can parse | `/llms.txt`, `/grammar/`, `/examples/2fa/` | | 3 | **A graph-literate practitioner** (RDF, Neo4j, GraphRAG) | The precise, respectful disagreement with schema-first practice; the blob anti-pattern; why the graph doesn't explode | `/against-schema-first/`, `/blob/` | | 4 | **A security / GRC buyer** | Real worked examples with real numbers; computed reach vs asserted reach | `/examples/` | | 5 | **The founder** | A place to point people at, and a place to keep adding to | the whole site | Audience 2 is the one most sites omit and the one this network has already learned to serve — see §6. --- ## 4. The thesis in nine sentences (the site's spine) Each is sourced. Full quote bank in `01__the-thesis.md`. 1. A node is just a node — a label is not a meaning, and a node connected to nothing is *literally* meaningless. 2. The same value, differently connected, means different things: the difference is not in the value, it is in the **connectivity**. 3. Therefore classification is a **query**, not a judgment: *"the content of the node does not decide its type; its paths do."* 4. Therefore confidence is **computable**, and honest uncertainty is the default posture — and the gaps are worth mapping too. 5. Schema-first breaks at every boundary; the Semantic Web made the subtle error of attaching meaning *to nodes* rather than deriving it *from edges*. 6. So don't merge vocabularies — **merging erases the disagreement**. Keep them intact and bridge them through anchor nodes. 7. Every edge is a **verb with a distinct inverse**; `relates-to` is banned because everything relates to everything; that asymmetry is what stops the graph exploding. 8. Never render the whole graph — render the **result of a query**; build wide, find the few, then **flip**. 9. And it is **fractal**: one grammar, one validator, one provenance rule at every altitude — zoom into any node and it expands into a graph obeying identical rules. --- ## 5. What already exists — do not rebuild it Three graph artefacts are **already live and public** on sgit.ai. graphs.sgit.ai should *link, explain and teach from* these rather than duplicating them. | Artefact | Real, verified numbers | URL | |---|---|---| | **Regulation graph** — EU AI Act (2024/1689 as amended by 2026/1744) from official Formex XML | **1,523 nodes · 1,944 edges**; 113 articles, 500 paragraphs, 417 points, 180 recitals, 13 annexes, 68 definitions; **11 views** incl. Cytoscape article graph, SQLite interface, **RDF/Turtle export**, and an **Art 9 Lab with a Graph REPL**; every element hash-verified (SHA-256) to source bytes | https://sgit.ai/demos/vaults/regulation-graph/ | | **Risk Graph Explorer** | "Exposed" preset = **18 facts, 37 risks, 14 provisions**; **7 views** recomputed simultaneously; amber = exposure, green = assurance, **ghosted edges = unanswered**; `permissions: {}` — no network, no storage, fully client-side | https://sgit.ai/demos/vaults/risk-graph-explorer/ | | **Agentic browser isolation** | **17 entry points**; 5 stakeholder altitudes L1 IT → L5 Board; acceptance-gated escalation with **no deny button**; ~70 JSON files; 104 files / 2.4 MB / 4 commits; `fs.write: []` | https://sgit.ai/demos/vaults/agentic-browser-isolation/ | **Important:** the *design documents* for all three are in the Send repo; the *built artefacts* and their counts are not. Cite the live vault for numbers and the repo brief for reasoning. Paths in `03__worked-examples-index.md`. Also already public and directly reusable: sgit.ai's `/demos/strategy-maps.md` (eight Wardley maps as inline SVG) and `/demos/sgit-maps.md`. --- ## 6. Inherit these four hard-won lessons from the sibling sites **L1 — `llms.txt` is not a convenience, it is the whole surface.** `team/humans/dinis_cruz/briefs/08/14/sgit-site-and-hub/v0.33.58__cross-team-brief__sgit-ai-agent-access-report-markdown-is-excellent-site-is-not-indexed.md` records an agent trying to consume sgit.ai: the index fetch worked and was *"better than almost anything comparable"* — then **link-following failed**, because agent fetch tools refuse URLs a search has not already returned, and the site is not indexed. Three mitigations, in order of speed: (1) make each `llms.txt` entry carry the page's **single most important fact**, not just what it covers; (2) publish a **single-file concatenation** of the whole doc set so one fetch gets everything; (3) get indexed. pki.sgit.ai independently hit the same wall — its own site review records *"documentation that is excellent and unreachable."* **L2 — a client-side-decrypted, browser-assembled site is invisible to crawlers.** The measured hypothesis is that *"a site whose pages are decrypted and assembled in the browser is exactly the shape a crawler struggles with."* Decide the rendering strategy — server-rendered HTML or a pre-rendered mirror — **before** content, not after. **L3 — every topic section serves three readers, and the third is the one everyone omits.** Documentation (prose) · Live demonstration (embedded read-only vault) · **Agent guidance** (a recipe and a pasteable reference). Source: `.../08/14/sgit-site-and-hub/v0.33.58__strategy-brief__sgit-topic-sections-catalogue-read-keys-yes-write-keys-never-frozen-vaults.md`. **L4 — publish read keys, never write keys; and escrow the write key before publishing.** A vault whose write key is lost is not damaged, it is **frozen**: permanently readable by anyone holding the published key, never updatable, never revocable, never correctable. Same source. Plus the Mermaid trap that will bite you on day one: **Wardley coordinates are `[visibility, evolution]` — the reverse of the usual convention.** *"A map with its axes transposed renders happily and says something entirely different."* Wardley type added in Mermaid v11.14.0, production-stable v11.15.0. --- ## 7. Proposed build order Modelled on the sibling sites' own numbered build orders, so the site can publish its roadmap the way pki.sgit.ai and sg-sentinel do. | Step | What | Why this order | Sources | |---|---|---|---| | **1** | **The thesis page** — "Meaning through connectivity" in the founder's own voice | Everything else forward-references it. It is also the one page that does **not** exist and must be written fresh (see G1 in `08__gaps-and-fresh-writing.md`) | `01__the-thesis.md` | | **2** | **`/start/` — the three-example on-ramp** | `port: 8080`, the five Reviews, and the confidence ladder. Publishable near-as-is from `library/concepts/v0_4_0__thinking-in-graphs.md` | `02__concepts-index.md` steps 1–4 | | **3** | **`/grammar/` — the edge discipline** | Verbs, distinct inverses, no `relates-to`, paths that read as language, why the graph doesn't explode. Short, rule-shaped, immediately usable by an agent | `02__concepts-index.md` C10–C12 | | **4** | **`/examples/` — three worked examples with real numbers** | Proof. Start with browser isolation (59/75), the 2FA JSON (51/53, downloadable), and Article 26(5) | `03__worked-examples-index.md` | | **5** | **`/blob/` — never render the whole graph** | The most persuasive page for anyone who has seen a graph demo fail, and it justifies the site's own rendering choices | C13 | | **6** | **`/glossary/`** | The founder explicitly asked for this (G4). Must be written fresh | `08__gaps-and-fresh-writing.md` | | **7** | **`/maps/` — Wardley maps as graphs** | 8 rendered PNGs exist; 5 more are one render command away | `04__visual-assets-and-infographics.md` | | **8** | **`/depth/` — the "then more" tier** | Node type formulas, ontologies of ontologies, the grounding ladder, twins, fractality, a graph at every boundary | C7–C9, C14–C17 | | **9** | **`/reality/` — what ships vs what is argued** | Non-negotiable. Without it the site over-claims. See §8 | `06__house-style-and-conventions.md` | | **10** | **`/infographics/`** | nhi.sgit.ai's infographics page currently reads "Awaiting resources" across the estate. A graph-specific prompt library is the unlock | `04__visual-assets-and-infographics.md` Part C | --- ## 8. The honesty constraint — read this twice The sibling sites' credibility rests on separating design from delivery. **This site's subject matter is almost entirely design.** Per `team/roles/librarian/reality/`, the semantic-graph and ontology work is overwhelmingly **PROPOSED**. What actually **ships** and is verifiable by reading code: - The **SGit vault commit DAG** — content-addressed (`obj-cas-imm-` + SHA-256 of *ciphertext*), multi-parent commits, tree-per-directory, HMAC-derived deterministic refs, a real wave-BFS merge-base over all parents, three-way merge, and a working two-track DAG **visualiser** with inline-SVG fork/merge arcs. `sgraph_ai_app_send__ui__vault/v0/v0.2/v0.2.3/_common/js/lib/sg-vault/` and `.../components/vault-sgit-view/` - **A graph of graphs** — `*.link.json` typed edges between vaults, optionally pinned to a commit in the target's history. `.../lib/links/vault-links.js` - **A read-only query API over the DAG** exposed to *untrusted sandboxed apps* — `sg.history.log/list/read/readText/readBlob`. `library/guides/vault-html/AUTHORING.md` §701 - **A typed property graph as live repo data** — 12 node types, 10 verb/inverse edge types with domain/range constraints, **71 nodes / 141 edges** in `.issues/` alone, 107 `issue.json` files repo-wide. `.issues/config/node-types.json`, `.issues/config/link-types.json` - The three **published vaults** in §5 What does **not** exist anywhere in the repo: MGraph-DB as a dependency · any graph database · browser SPARQL/Cypher · RDF/JSON-LD serialisation in code · the semantic risk ontology as a schema file · the path-query language · commit signing (`commit_v2.signature` is written and only ever set to `null`). **The honest sentence for `/shipped/`:** *"We ship a hand-written content-addressed object graph in the browser. We do not use a graph database, and we say so in our own architecture notes."* Two corrections to inherit rather than repeat: - `library/skills/use_sgit-and-vaults/SKILL.md` states object IDs are *"SHA-256 of plaintext"*. **The code hashes ciphertext.** Do not republish this claim. - `.issues/config/link-types.json` ships a `relates-to` / `relates-to` pair — which the project's own ontology brief calls forbidden. One edge instance uses it. Either fix it or narrate it honestly; it is a good teaching moment either way. --- ## 9. What is in this pack | File | Contents | |---|---| | `00__BRIEF.md` | This document — mission, thesis, build order, constraints | | `01__the-thesis.md` | 35 sourced verbatim quotes; the page that must be written fresh | | `02__concepts-index.md` | 30 concepts with canonical sources, maturity, and the 18-step teaching order | | `03__worked-examples-index.md` | 20 real applications with node/edge counts, evidence quality and publishability | | `04__visual-assets-and-infographics.md` | Every visual asset, the two infographic pipelines, the render backlog | | `05__site-architecture.md` | Page-by-page IA with the source document behind each page | | `06__house-style-and-conventions.md` | Sibling-site conventions, `llms.txt` policy, redaction rules, licensing | | `07__source-manifest.csv` | Machine-readable: 100+ rows, path → tier → proposed page → publishability | | `08__gaps-and-fresh-writing.md` | The 12 pages that must be written from scratch, and why | **Every path in this pack was verified to exist at v0.33.62.** Where a filename was wrong in an earlier draft it has been corrected against the repo. --- *Prepared by the SG/Send agentic team — Librarian, Cartographer, Architect and Designer, in session, 20–21 August 2026.* --- This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0). ============================================================================== == briefs/01__the-thesis.md ============================================================================== # 01 — The Thesis: Meaning Through Connectivity **Purpose of this file.** The site's spine. 35 verbatim, sourced quotes organised into the argument they make. `[F]` = the founder's own voice (transcribed voice memo, quoted in-document as "the project lead"); `[D]` = document prose. **Critical note before you use any of this:** the founder's *own* canonical essay on meaning through connectivity **does not exist in this repo**. The canonical written statement was authored for a *different project* (Issues-FS), by a different hand, about issue tracking, on 5 February 2026. Every founder-voice statement of the thesis in the Send corpus is a fragment inside a brief about something else. His own version lives in a **LinkedIn post series** that he twice asked to be supplied (10 June 2026) and that is **still absent from the corpus**. **Therefore: the thesis page must be written fresh, from his voice, from these fragments — not lifted from Issues-FS.** This is gap G1 and it is the highest-priority page on the site. --- ## A. The load-bearing statements > **1.** "**everything is a graph, meaning is not declared but discovered through graph relationships, and confidence in that meaning is proportional to how richly connected a node is to other nodes that provide context.** … This is not a metaphor. It is a literal architectural principle." > `[D]` `library/concepts/v0_4_0__thinking-in-graphs.md` · 2026-02-05 > **2.** "**in our graph we do not use properties, because properties do not have meaning, they are just words; we capture meaning through connectivity.**" > `[F]` `team/humans/dinis_cruz/briefs/06/26/digital-twins-and-world-models/v0.33.35__arch-brief__sg-send-digital-twins-twin-of-anything-dimensions-discipline-of-reality-simulation-testing.md` · 26 Jun 2026 > *The tightest formulation in the corpus. Re-quoted as the canonical definition in the 28 Jul concepts appendix. **Use this as the site's epigraph.*** > **3.** "This is one of the key concepts of my graphs of graphs of graphs, **you get meaning through connectivity. A public key in isolation does not give you anything; it is the graph it is connected to**, the information nodes, the understanding of what connects to it." > `[F]` `.../briefs/06/04/nhi-2.0/v0.32.3__arch-brief__sg-send-nhi-2.0-semantic-knowledge-graphs-of-identity.md` · 4 Jun 2026 > *Note the direct bridge to pki.sgit.ai — a key is the canonical example of a node that means nothing alone.* > **4.** "this is where you have the graphs-of-graphs architecture, where you have meaning through connectivity, where **the more connected things are, the more you understand what they are**." > `[F]` `.../briefs/06/04/v0.32.3__arch-brief__sg-send-skill-as-projection-of-graph-forking-ecosystem.md` · 4 Jun 2026 --- ## B. The mechanism — the surprising, technical core > **5.** "A node in a graph is just a node. … **A node labelled 'Review' is not a Review in any formal sense. It is a node that someone labelled 'Review.'** … **A node connected to nothing is meaningless — literally.**" > `[D]` `library/concepts/v0_4_0__thinking-in-graphs.md` > **6.** "**The difference is not in the value.** Both scenarios have `8080`. The difference is in the **connectivity**. … The meaning is identical in the developer's head. It is radically different in the graph." > `[D]` same · *the `Safe_UInt__Port` worked example — **the single best teaching device in the corpus**, and the example is real shipped code (osbot-utils is a live dependency)* > **7.** "The content of the node does not decide its type; its paths do. **Two nodes with identical text can be different types because their edges differ.**" > `[D]` `.../briefs/06/28/ontology-and-definitions/v0.33.36__arch-brief__sg-send-node-type-formulas-classification-as-testable-path-pattern-not-judgment.md` · 28 Jun 2026 > *The formal, testable version of quote 2. **The strongest single sentence in the corpus for a technical audience.*** > **8.** "**No node is aware of how it's used.** The information about what a node means and how it participates in workflows is extracted from the surrounding graph structure, not encoded as properties of the node itself." > `[D]` `library/concepts/v0_4_0__thinking-in-graphs.md`, Principle 10 --- ## C. Against schema-first — and the respectful disagreement with the Semantic Web > **9.** "In a schema-first system, meaning is declared… In a graph-first system, meaning is discovered… **declared meaning is brittle and local.** A schema works perfectly within the system that defined it. The moment you cross a boundary — a different team, a different project, a different culture, a different language — **the schema either forces conformity or breaks.**" > `[D]` `library/concepts/v0_4_0__thinking-in-graphs.md` > **10.** "The Semantic Web community identified the right problem… But the community made a subtle mistake in practice. **They ended up attaching meaning *to nodes* rather than deriving meaning *from edges*.** … The node becomes a little document that describes itself. **This is schema-first thinking dressed in graph syntax.**" > `[D]` same, Part 4 · **the sharpest and most publishable passage in the entire corpus.** A precise, respectful, load-bearing disagreement with RDF/schema.org *practice* — not with the goal. > **11.** "**I always err on the side of understanding versus a standardized schema.** … each team, each department, sometimes each person will have its own preferences on how to map this, and **instead of folding it, you make it compatible, which is why you need an ontology of ontologies.**" > `[F]` `.../briefs/06/26/semantic-graph-and-query-paths/v0.33.35__arch-brief__sg-send-path-properties-read-as-language-ontology-of-ontologies-multigraph-creation-paths.md` · 26 Jun 2026 > **12.** "ontologies are not folded into a single shared definition, **because that erases the disagreement**, they are kept intact and connected through anchor nodes… which is **how meaning actually travels across languages, cultures, biases, and political agendas**, by maintaining translations between definitions that each side still owns." > `[D]` `.../briefs/06/28/ontology-and-definitions/v0.33.36__arch-brief__sg-send-ontologies-of-ontologies-three-layers-formulas-bridges-multiple-definitions.md` · 28 Jun 2026 > **13.** "**Compatibility is a graph computation.** Two nodes are not compatible because they share a type declaration. They are compatible to the degree that their subgraphs overlap… **Not binary… Not symmetric… Not global… Computable.**" > `[D]` `library/concepts/v0_4_0__thinking-in-graphs.md` --- ## D. Fractality — graphs of graphs > **14.** "**Fractal is a precise claim, not a decoration.** It means four things. Self-similarity… Scale invariance… Composition… Recursion: zoom into any node and it expands into a graph obeying the identical rules, with no new format and no special case." > `[D]` `.../briefs/07/12/architecture/v0.33.48__arch-brief__sg-send-fractal-semantic-graphs-agentic-operating-layer-deterministic-sovereign-open-source.md` · 12 Jul 2026 > **15.** "there might be an article that is so meaty that it requires its own ontology and taxonomy, and **that's the power of the fractal element, it's basically graphs of graphs of graphs.**" > `[F]` `.../briefs/07/28/regulation-graph-and-acceptability/v0.33.53__arch-brief__sg-send-every-paragraph-is-a-graph-eu-ai-act-definitions-as-nodes-twins-as-hooks-with-concepts-appendix.md` · 28 Jul 2026 > **16.** "the graphs can start small, can start anywhere in the organisation, and then grow from it." / "**it is kind of like a Lego structure where one feeds to the other.**" / "**you can have risk registers of risk registers.**" > `[F]` `.../briefs/07/17/architecture-and-mvp/v0.33.49__arch-brief__sg-send-fractal-distributed-vault-architecture-registers-of-registers-messages-as-graph-transformations-transaction-log-pki-authorization.md` · 17 Jul 2026 --- ## E. Why this matters for AI — the loss-at-the-seams argument > **17.** "the standard version of this platform is a stack of layers… **glued together by JSON payloads and prompt instructions, which is why it ends up non-deterministic, unexplainable, unprovenanced… because at every boundary meaning is lost and re-guessed**; the alternative is to make a semantic graph the interface at every boundary, so each layer emits a graph and consumes a graph and **nothing crosses a layer as an opaque blob or a sentence.**" > `[D]` `.../briefs/07/12/architecture/v0.33.48__...fractal-semantic-graphs...md` · 12 Jul 2026 > **18.** "**Knowledge is traversed, not guessed.** … retrieval is a traversal from the intent node to grounded facts with provenance attached, **not a similarity search that returns plausible chunks.**" > `[D]` same · *the corpus's implicit answer to RAG. Note: it never uses the word "GraphRAG" — see gap G11.* > **19.** "**Not a graph database pitch.** The claim is that one grammar is the interface at every boundary, not that we store things in a graph." > `[D]` same · **put this on the site early. It pre-empts the wrong reading.** --- ## F. Language, translation, culture > **20.** "**a nuance survives translation not because a translator preserved it but because it was never stored in a word.**" > `[D]` `.../briefs/08/06/voice-debrief/v0.33.56__arch-brief__sg-send-concepts-not-words-skos-is-the-model-divergence-is-the-finding.md` · 6 Aug 2026 > **21.** "**the path should read in English, or not even in English, it should read in the language and the culture and the business context we are talking about.**" — so "**the graph explains itself to whoever is reading it, in their own terms.**" > `[F]`+`[D]` `.../briefs/06/26/semantic-graph-and-query-paths/v0.33.35__...path-properties-read-as-language...md` · 26 Jun 2026 > **22.** "with graphs of graphs **it costs almost nothing to have more nodes and edges**, and sometimes you have nodes that only exist to provide anchors for some queries, which matters once you get into multicultural and multilingual things." > `[F]` same · 26 Jun 2026 --- ## G. Edge discipline and the anti-blob argument > **23.** "the way I create graphs, they are always a two-way relationship and always to do with verbs. … **You can never have relates-to, because relates-to is meaningless, two things always relate to each other. The more granular the edge, the better the query you can write.**" > `[F]` `.../briefs/06/10/network-intelligence/v0.33.16__arch-brief__sg-send-semantic-graph-visualisation-subgraph-flip-verb-edges.md` · 10 Jun 2026 > **24.** "I see a lot of people get into semantic graphs, get excited, and **arrive at the big blob**… The weird problem is **a race to the bottom, where you start not wanting a lot of relationships because they make the graph more complicated.**" — countered by: "**the more rich a node is, the more connections it has, the better.**" > `[F]` same · **the single most contrarian and most quotable passage for a graph-literate audience.** > **25.** "**The inverse of an edge is not the same edge walked backwards; it is a different, meaningful relationship.**" — and this asymmetry "**guarantees monotonic progress toward a peak**", which is what "**prevents the explosion of nodes**". > `[D]` `.../briefs/06/26/semantic-graph-and-query-paths/v0.33.35__arch-brief__sg-send-directed-edges-inward-outward-query-paths-prevent-node-explosion.md` · 26 Jun 2026 > **26.** "**the query is almost like a story.**" > `[F]` `.../briefs/06/10/network-intelligence/v0.33.16__...subgraph-flip-verb-edges.md` --- ## H. Reality, twins, honesty > **27.** "**the power of the twin is that we always arrive at the twin, so the edges and the peaks and the endpoints of the graph continue into the twin, and then ideally into reality.**" > `[F]` `.../briefs/06/26/digital-twins-and-world-models/v0.33.35__...twin-of-anything...md` · 26 Jun 2026 > **28.** "**what I am describing is not complexity, it is reality.** This is the reality of business, the reality of the complex applications we have." > `[F]` `.../briefs/06/18/agentic-permissions/v0.33.40__strategy-brief__graphs-of-graphs-ontology-of-ontologies-permissions-mapping-reality-not-complexity.md` · 18 Jun 2026 > **29.** "**Honest uncertainty is the default.** … It never fills in the gaps with assumptions." / "**Enrichment, not enforcement.** … the remedy is adding edges, not adding validation rules. **The graph grows; it doesn't constrain.**" > `[D]` `library/concepts/v0_4_0__thinking-in-graphs.md`, Principles 7–8 > **30.** "**A bug is something that we have mapped in the graph that is not happening in reality.** … This reframes bugs from 'something is broken' to '**the reality diverges from the model**.'" > `[D]` `.../briefs/03/25/v0.16.61__arch-brief__state-machines-ontologies.md` · 25 Mar 2026 > **31.** "**Revocation is the absence of trust, not the presence of a revocation entry.**" > `[D]` `.../briefs/02/21/part-1/v0.4.27__architecture__chain-of-trust-and-key-graphs.md` · 21 Feb 2026 > *The earliest graph-native sentence in SG/Send's own corpus, and a second clean bridge to pki.sgit.ai.* --- ## I. The projection paradigm > **32.** "**The same way I talk about documents being projections of graphs, the skill is a projection of a graph**… The skills we have today are just **a photograph of what it should be**, because it is static." > `[F]` `.../briefs/06/04/v0.32.3__arch-brief__sg-send-skill-as-projection-of-graph-forking-ecosystem.md` · 4 Jun 2026 > **33.** "meaning through connectivity… the graph is the truth, the skill is a view of it." > `[D]` same *Note: "documents are projections of graphs" is invoked here as **already established** — but it is never argued anywhere in the corpus. That is gap G2, and it is load-bearing for the entire product line.* --- ## J. Why this website must exist — and how it should be structured > **34.** "**a lot of the people that will use this don't know about semantic graphs, don't know about ontologies, don't know about a lot of the other terms**, so we also need to explore different UIs, and different ways to name this." > `[F]` `.../briefs/08/09/graphing-text/v0.33.57__strategy-brief__sg-send-refactoring-meaning-decompilation-not-compilation-author-is-the-arbiter.md` · 9 Aug 2026 > The document's own gloss: *"the vocabulary problem is real and under-appreciated… which makes **naming a design problem rather than a documentation one**."* > **35.** "the graph is quite massive, and the interesting question is how much of the graph we present to the user at each moment in time, but **this is just a question of altitude, like if you see something from a very high altitude you just see the city walls, and as you zoom in you start to see roads and buildings, and eventually people and cars.**" > `[F]` same · 9 Aug 2026 **Use quote 35 to argue the site's own information architecture.** "Initial concepts, then more, then more" *is* altitude. That makes the IA a demonstration of the thesis rather than merely a navigation choice — and it is the kind of self-consistency the sibling sites are built on. --- ## K. The narrative arc — "where we came from" Ten phases, all dated from filenames and git. Use this to build an `/origins/`-style timeline page. | Phase | Dates | What happened | |---|---|---| | **0 · Pre-history** | 5 Feb 2026 | The three foundational documents are written inside **Issues-FS**, a different project. They will not reach SG/Send for four months. | | **1 · Graphs as infrastructure** | 21 Feb – 24 Mar | First graph thinking is *cryptographic*, not semantic. Trust as a key graph; *"revocation is the absence of trust"*. **Paragraph-as-file** appears (23 Feb) and then lies dormant for five months. Solid/RDF lineage engaged (24 Feb). | | **2 · Graphs as the model of the system** | 25 Mar – 2 May | *Inflection.* A graph is first proposed as **the source of truth about the product itself**. *"A bug is where reality diverges from the model."* The **Ontologist** role is created. | | **3 · Documents become graphs** | 18 – 31 May | Compliance as a living graph; rules as a fractal graph; then vault-per-standard states the **universal document-to-graph pipeline**. Graphs stop being infrastructure and become the product. | | **4 · The concept explosion** | 1 – 5 Jun | *Major inflection.* Four days produce skills-as-graph, **skill-as-projection**, **semantic KGs of identity** (first "meaning through connectivity" in the founder's own voice in this repo), trust-through-connectivity, clues-not-storage. These briefs **assume a philosophy not yet in the repo**. | | **5 · The import** | 10 – 11 Jun | An agent notices the assumption gap. Ten Issues-FS documents are imported; `library/concepts/` is created. **Phase 1 of the memo executed; Phase 2 never was** — hence the invisibility. | | **6 · Visualisation discipline** | 10 Jun | The **blob anti-pattern**, **verb edges**, the **subgraph flip**. The founder asks for his LinkedIn series as prerequisite reading; it is not provided. *It still has not been.* | | **7 · The formalisation** | 16 – 30 Jun | *Peak density.* Confidence-through-evidence, graphs-of-graphs-as-reality, then a six-brief burst 26–28 Jun: paths-read-as-language, directed-edges, twins, **Node Type Formulas**, **ontologies-of-ontologies**, **the grounding ladder**. The philosophy becomes **testable**. | | **8 · The architecture** | 12 – 24 Jul | **A graph at every boundary** (six properties from one decision). **Registers of registers**; **messages as graph transformations**. OSMM: *sovereignty computed, not claimed*. | | **9 · The regulation build** | 28 Jul – 2 Aug | Doctrine meets a real artefact. **Every paragraph is a graph.** Paragraph-as-file resolved (closing the loop back to 23 Feb). **Appendix A of the 28 Jul brief is the first and only time the corpus writes its own concepts down in one place — a direct precursor of this website.** | | **10 · Meaning itself** | 6 – 9 Aug | **Concepts, not words.** **Decompilation, not compilation.** The author as oracle; *"that is not what I meant"* reframed as success. And the diagnosis that the people who will use this do not know what an ontology is. | ### Tried and dropped — good `/paths-not-taken/` material - **The Issues-FS Lexicon as a shipped package** — proposed 5 Feb, imported 11 Jun, never referenced again. The anchor-node *concept* survived; the package did not. - **Compatibility testing across five artifact layers** — a complete design (extraction pipeline, compatibility engine, CLI) with **zero downstream references**. The most developed unimplemented idea in the corpus. - **MGraph-DB as the graph store** — repeatedly named, repeatedly deferred: *"there is even a graph database, MGraph-DB, we could use, but for now let's keep it simple"* (10 Jun). File-based won. - **The Ontologist role** — created 25 Mar, authors the 26–28 Jun briefs, then vanishes; not in the 18-role roster in `CLAUDE.md`. - **The `CLAUDE.md` cross-reference to `library/concepts/`** — specified in the import memo, never done. *This is the fix that stops agents under-weighting the philosophy.* --- This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0). ============================================================================== == briefs/02__concepts-index.md ============================================================================== # 02 — Concepts Index **30 concepts.** For each: what it is, the canonical source(s) to go and read, when it first appeared, how well developed it is, and — critically — **whether a newcomer could follow the existing document**. That last column is what tells you which pages can be published near-as-is and which need rewriting. All paths are relative to the repo root of `SGraph-AI__App__Send` @ v0.33.62 and were verified to exist. Founder briefs live under `team/humans/dinis_cruz/briefs/` — abbreviated below as `briefs/`. --- ## Tier 1 — the core twenty-two ### C1 · Meaning Through Connectivity *(the root)* A node carries no inherent meaning. What a thing *is* emerges from the edges traceable from it, and confidence in that meaning is proportional to connectivity depth and to the authority of the nodes reached. Properties are "just words"; connections are meaning. The operational corollary: identical content can be different things if their edges differ, and the same node can be classified differently by different parties without either being wrong. **Read:** `library/concepts/v0_4_0__thinking-in-graphs.md` (Parts 1–2, 5) · `briefs/06/28/ontology-and-definitions/v0.33.36__arch-brief__sg-send-node-type-formulas-classification-as-testable-path-pattern-not-judgment.md` · `briefs/06/26/digital-twins-and-world-models/v0.33.35__arch-brief__sg-send-digital-twins-twin-of-anything-dimensions-discipline-of-reality-simulation-testing.md` **First:** 2026-02-05 · **Maturity:** well-developed — the most argued concept in the corpus · **Newcomer-followable: YES** ### C2 · Confidence Is a Function of Connectivity Every assertion sits on a computable confidence spectrum: no edges → few local edges → edges to typed definitions → edges to anchor nodes → edges to external references → rich multi-hop connectivity. Default posture is honest uncertainty — *"We know X. We think Y. We cannot confirm Z."* The remedy for low confidence is **enrichment** (add edges), never **enforcement** (add validation rules). **Read:** `library/concepts/v0_4_0__thinking-in-graphs.md` (Part 5, has an ASCII confidence ladder) · `briefs/06/16/theses-and-reflections/v0.33.38__strategy-brief__confidence-through-evidence-blast-radius-graphs-mapping-the-gaps.md` **First:** 2026-02-05, extended 16 Jun · **Maturity:** well-developed · **Newcomer-followable: YES** ### C3 · Map the Gaps (Absence of Evidence Is Evidence) An honest system lists not only the evidence it has but the evidence it lacks. Knowing you hold three of ten needed pieces is itself vital information — it quantifies confidence and makes the business case for connecting the missing dots. In a regulation graph this becomes a **coverage measure**: a provision whose hooks reach no twin is a provision not actually mapped. **Read:** `briefs/06/16/theses-and-reflections/v0.33.38__strategy-brief__confidence-through-evidence-blast-radius-graphs-mapping-the-gaps.md` **First:** 16 Jun 2026 · **Maturity:** well-developed · **Newcomer-followable: YES** (short and plain) ### C4 · Compatibility Is Computed, Not Declared Two things are compatible to the degree their subgraphs overlap when traced toward common reference points. Compatibility is a spectrum, is **asymmetric**, and is **purpose-relative** — two review processes may be compatible for "did someone look at this" and incompatible for "does this satisfy BaFin". No party has to agree to anything, change its process, or adopt a shared vocabulary. **Read:** `library/concepts/v0_4_0__thinking-in-graphs.md` (Part 2 — the five-team Review example) · `library/concepts/v0_4_0__compatibility-through-connectivity.md` **First:** 2026-02-05 · **Maturity:** well-developed · **Newcomer-followable: YES** — the five-team example (Tokyo / open source / Frankfurt / Lagos / São Paulo) is outstanding and needs no technical background. **This is the site's best on-ramp.** ### C5 · Every Artifact Is a Graph → Cross-Graph Compatibility Prose docs, diagrams, code, config and runtime traces are five *languages* describing one truth. Extract a graph from each and compare. The question stops being "does the code work?" and becomes **"do all representations of this system agree on what it is?"** Divergence is information, not failure. **Read:** `library/concepts/v0_4_0__compatibility-through-connectivity.md` (whole; Parts 2, 6, 7) **First:** 2026-02-05 · **Maturity:** well-developed (10 principles + decisions log) but **never implemented** · **Newcomer-followable: YES** ### C6 · Anchor Nodes (Reference Without Authority) An anchor node is well-connected, well-maintained, well-known — and has **no special authority**. Local nodes *link to* anchors at whatever granularity fits ("our `document_findings` step is similar to what schema.org calls `reviewBody`") rather than declaring "I am a schema:Review". The mapping is granular, honest, traversable, disputable, and can be added by a third party without touching the original node. **Read:** `library/concepts/v0_4_0__thinking-in-graphs.md` (Part 4) · `library/concepts/v0_4_0__lexicon-architecture.md` (lines 91–189 contain a 97-row ASCII ontology tree — **redraw this as SVG; it is the site's signature diagram**) · `briefs/08/09/graphing-text/v0.33.57__arch-brief__sg-send-enrichment-and-shared-anchors-research-paid-once-wikidata-is-the-concept-layer.md` **First:** 2026-02-05 · **Maturity:** well-developed conceptually; gestural on governance · **Newcomer-followable: YES** ### C7 · Fractal Graphs / Graphs of Graphs / Ontologies of Ontologies Self-similarity, scale invariance, composition, recursion — one node-and-edge grammar, one validator, one query engine, one provenance rule at every altitude, from a property to a paragraph to a person to a national estate. *"Fractal is a precise claim, not a decoration."* **Read:** `briefs/07/12/architecture/v0.33.48__arch-brief__sg-send-fractal-semantic-graphs-agentic-operating-layer-deterministic-sovereign-open-source.md` (the precise definition) · `library/concepts/v0_4_0__thinking-in-graphs.md` (Parts 3, 6 — the *readable* version) · `briefs/06/18/agentic-permissions/v0.33.40__strategy-brief__graphs-of-graphs-ontology-of-ontologies-permissions-mapping-reality-not-complexity.md` **First:** 23 Feb 2026 as "graphs of graphs of graphs" applied to signed paragraphs; formalised 12 Jul · **Maturity:** well-developed · **Newcomer-followable: PARTLY** — the 12 Jul definition is precise but wrapped in a ~400-word single-sentence abstract ### C8 · Node Type Formulas (Classification as a Testable Path-Pattern) What a node *is* is not decided by a human's judgment but by an explicit required pattern of typed, directed paths that a node either matches or does not. `Vulnerability := a Fact (grounded below) that also has an upward path to a Risk.` Judgment does not disappear — it moves out of the classifier's head and **into the formula**, where it is visible, versioned, inspectable and arguable. **Read:** `briefs/06/28/ontology-and-definitions/v0.33.36__arch-brief__sg-send-node-type-formulas-classification-as-testable-path-pattern-not-judgment.md` **First:** 28 Jun 2026 · **Maturity:** well-developed · **Newcomer-followable: PARTLY** (assumes C1) ### C9 · Three Layers: Shared Facts / Per-Party Formulas / Declared Bridges Layer 1 is a shared factual graph owned by nobody. Layer 2 is per-party formulas that classify those nodes — a CISO's, a CFO's, a regulator's. Layer 3 is declared bridges connecting formulas at specific points. **Parties can disagree about meaning while still agreeing about facts, which is the only stable basis for working together.** Merging ontologies is rejected explicitly, because merging erases the disagreement. **Read:** `briefs/06/28/ontology-and-definitions/v0.33.36__arch-brief__sg-send-ontologies-of-ontologies-three-layers-formulas-bridges-multiple-definitions.md` (1,275 words, one clean table) **First:** 28 Jun 2026 · **Maturity:** well-developed · **Newcomer-followable: YES** ### C10 · Directed Edges with Distinct Inverses (and Why the Graph Doesn't Explode) Every edge is directed and has a *distinct, meaningfully-named* inverse — `owned_by`/`owns`, `gives_rise_to`/`arises_from`. The inverse is not the same edge walked backwards. This asymmetry makes typed query paths narrow: at each hop fan-out collapses to edges matching type *and* direction, so traversals move monotonically toward natural peaks. Seed a query in a thousand places and the paths converge on a handful of peaks; result size is bounded by **peaks, not fan-out**. **Read:** `briefs/06/26/semantic-graph-and-query-paths/v0.33.35__arch-brief__sg-send-directed-edges-inward-outward-query-paths-prevent-node-explosion.md` — contains a **17-query, 5-tier path language** with real notation (`-edge->`, `<-edge-`, `*`) **First:** 22 Jun, developed 26 Jun · **Maturity:** well-developed · **Newcomer-followable: YES** ### C11 · Verb Edges, Never `relates-to` Every edge is a verb, stated in both directions. `relates-to` is banned because it is meaningless — everything relates to everything. Granularity of the verb is what makes the query precise, and precise verbs are what let a path be read as a sentence. **Read:** `briefs/06/10/network-intelligence/v0.33.16__arch-brief__sg-send-semantic-graph-visualisation-subgraph-flip-verb-edges.md` (four-row edge/reverse table anyone can read) **First:** 10 Jun 2026 · **Maturity:** well-developed · **Newcomer-followable: YES** ⚠️ **The repo violates its own rule:** `.issues/config/link-types.json` ships a `relates-to` / `relates-to` pair, and one edge instance uses it. Narrate or fix — either way it is a teaching moment. ### C12 · Paths That Read as Language A path should read as a natural sentence in the language, culture and business context of the reader: *this risk is created by this vulnerability, which impacts this system, which belongs to this entity, which has this stakeholder, who reports to this role…* Because the path reads as language, **the graph explains itself** rather than requiring a key. **Read:** `briefs/06/26/semantic-graph-and-query-paths/v0.33.35__arch-brief__sg-send-path-properties-read-as-language-ontology-of-ontologies-multigraph-creation-paths.md` **First:** 26 Jun 2026 · **Maturity:** well-developed · **Newcomer-followable: YES** — arguably the single most accessible conceptual document in the corpus ### C13 · The Blob Anti-Pattern, and the Wide-Then-Flip Method The failure mode of semantic graphs is the blob: a hairball that shows nothing — and worse, triggers "a race to the bottom" where people *remove* relationships to keep the picture clean. Inverted here: rich nodes are good, enrich rather than prune, solve the blob at **query time**. Method: (1) a wide first pass captures the universe around a subject; (2) find the few relevant nodes; (3) **flip** and re-root the query at those nodes. Never render the whole graph; render the result of a query. **Read:** `briefs/06/10/network-intelligence/v0.33.16__...subgraph-flip-verb-edges.md` · `briefs/08/02/vault-as-substrate/v0.33.55__arch-brief__sg-send-graph-canvas-repl-un-blinding-the-agent-mermaid-for-output-never-render-whole-graph.md` **First:** 10 Jun 2026 · **Maturity:** well-developed · **Newcomer-followable: YES** — and **the most persuasive concept for anyone who has seen a graph demo fail** ### C14 · Digital Twins as the Graph's Endpoint (the Discipline of Reality) A twin can be made of anything — an organisation, an inbox, a person, a behaviour, the weather, even luck — because a twin is just a system with properties, behaviours, functions, inputs and outputs. Twins are where the graph *stops modelling and continues into a real system*. Two properties: whether an endpoint actually reaches reality is itself a **measurable fact**; and everything modelled must be **real**, so the graph never fills with hypothetical risks. **Read:** `briefs/06/26/digital-twins-and-world-models/v0.33.35__arch-brief__sg-send-digital-twins-twin-of-anything-dimensions-discipline-of-reality-simulation-testing.md` **First:** 25 Mar 2026 (as "digital twin of the website"), expanded 26 Jun · **Maturity:** well-developed · **Newcomer-followable: YES** ### C15 · The Air Gap (What the Graph Cannot Reach, Named) Where the graph cannot connect to a real system, the twin holds an explicit, tracked gap — *"this needs to be manually updated once a week, but the point is we now know where that gap is."* Any risk not connected to the register is an air gap. The operational sibling of C3: a named absence beats a hidden one. **Read:** `briefs/06/26/digital-twins-and-world-models/v0.33.35__arch-brief__sg-send-digital-twins-integration-layer-real-world-tracked-air-gaps-agent-twin.md` · `briefs/06/26/risk-register-and-five-whys/v0.33.35__arch-brief__sg-send-risk-register-graph-of-graphs-facts-only-no-deny-cascade-cia-blast-radius.md` **First:** 26 Jun 2026 · **Maturity:** partially argued · **Newcomer-followable: NO** — only ever a paragraph inside longer briefs. **Gap G9: needs its own page.** The Wardley air-gap map (see `04__visual-assets-and-infographics.md` Set D) is its natural illustration. ### C16 · The Grounding Ladder (Fact → Evidence → Measure → Vulnerability → Risk) The worked instance of C8. Downward is grounding ("is it real?"), upward is implication ("what does it mean and why does it matter?"). A Fact becomes a Vulnerability the moment it acquires an upward path to a Risk. Measure is *not* the floor — the true floor is the last node where going deeper would neither improve observability nor change a decision. Explicitly framed as **one** formula among possible others. **Read:** `briefs/06/28/ontology-and-definitions/v0.33.36__arch-brief__sg-send-grounding-ladder-fact-evidence-measure-vulnerability-risk-definitions.md` **First:** 28 Jun 2026 · **Maturity:** well-developed · **Newcomer-followable: YES** for a risk-literate reader, partly otherwise ### C17 · A Graph at Every Boundary (Meaning Is Lost at the Seams) The AI-native argument. Conventional agentic stacks glue layers with JSON and prompt text; at every seam structure, grounding and provenance are flattened and re-guessed — which is *where* determinism, explainability, provenance, sovereignty and auditability die. Make a semantic graph the interface at every boundary and six properties fall out as **consequences rather than features**. The model lives at the edge and only *proposes* a graph; a deterministic validator executes it. Untrusted input is data and can never become instruction, so **prompt injection fails at the validator, structurally**. **Read:** `briefs/07/12/architecture/v0.33.48__arch-brief__sg-send-fractal-semantic-graphs-agentic-operating-layer-deterministic-sovereign-open-source.md` (with an honest-tensions table) **First:** 12 Jul 2026 · **Maturity:** well-developed · **Newcomer-followable: NO** — the abstract is one ~500-word sentence. **The ideas are highly accessible; the document is not. This is the highest-value rewrite target on the site.** ### C18 · Messages Are Graph Transformations (Everything Is a Message) Registers do not share a database; they talk. A message is not a notification *about* a change — it **is** the change: *"the command, the action that is transforming the graph."* Every mutation becomes an ordered message, making the system an eventually-consistent event stream whose by-product is a transaction log giving *"a hell of a provenance, and also determinism, explainability, but also a lot of resilience."* Because messages are structured, an LLM can produce and parse them — the same stream is the natural agent interface. **Read:** `briefs/07/17/architecture-and-mvp/v0.33.49__arch-brief__sg-send-fractal-distributed-vault-architecture-registers-of-registers-messages-as-graph-transformations-transaction-log-pki-authorization.md` **First:** 17 Jul 2026 · **Maturity:** well-developed, but flagged in-doc as needing its own brief (never written) · **Newcomer-followable: PARTLY** (interleaved with RiskMandate specifics) ### C19 · Documents (and Skills, and Standards) Are Projections of Graphs The graph is the truth; the document is a view of it, generated in the context of use. Today's artefacts — a skill file, a compliance standard, a consolidated legal text — are *"static photographs of what they should be."* The sharpest version: don't **store** the consolidated text at all — hold the base text plus amendment instructions as data and **compute** the consolidated version as a projection. Consolidation and per-organisation customisation then turn out to be **one mechanism, not two**. **Read:** `briefs/06/04/v0.32.3__arch-brief__sg-send-skill-as-projection-of-graph-forking-ecosystem.md` · `briefs/07/31/canonical-act-build/v0.33.54__arch-brief__sg-send-canonical-ai-act-paragraph-as-file-amendment-as-native-graph-operation-view-from-any-provision.md` · `briefs/05/30/v0.31.9__arch-brief__sg-send-vault-per-standard-document-to-graph-artefacts.md` **First:** referenced as *already recurring* on 4 Jun — **the origin document is not in this repo** · **Maturity:** well-developed in application, **no home document for the general principle** · **Newcomer-followable: NO** — always stated by analogy to itself. **Gap G2.** ### C20 · Every Paragraph Is a Graph (Document → Graph Pipeline) A document is not one blob but a hierarchy of paragraphs, points and definitions, each written for a reason and therefore yielding something extractable. Each provision carries its own subgraph, and those subgraphs present **hooks** the real world attaches to. A document's own definitions are the first and most valuable node layer, and three kinds of work follow: how they relate, **where they contradict** (the highest-value output, and the one nobody produces), and what the text uses but never defines (where interpretive risk concentrates). **Read:** `briefs/07/28/regulation-graph-and-acceptability/v0.33.53__arch-brief__sg-send-every-paragraph-is-a-graph-eu-ai-act-definitions-as-nodes-twins-as-hooks-with-concepts-appendix.md` — **Appendix A is the single best existing concept summary in the whole corpus** · `briefs/07/31/canonical-act-build/v0.33.54__arch-brief__sg-send-document-ontology-positional-and-content-hashes-taxonomy-upward-ontology-outward-document-agnostic.md` **First:** 23 Feb 2026 in embryo, doctrine 30 May, full 28 Jul · **Maturity:** well-developed · **Newcomer-followable: PARTLY** (body readable, abstract not) ### C21 · Concepts, Not Words (Meaning Must Not Live in a Language) The unit of meaning is a **concept**, language-independent, carrying one preferred label per language plus alternates, related by broader/narrower/related. A term is how *one* language expresses it. Once meaning lives in a concept, translation stops being word-to-word and a whole class of failures disappears by construction. The unexpected corollary the founder discovered: **a bad Portuguese rendering diagnosed a bad *English* word** — naming a concept forces a decision the source language let you avoid. And where two languages' induced graphs diverge, that divergence is either an error or a genuine lexical gap — **and it is a finding.** **Read:** `briefs/08/06/voice-debrief/v0.33.56__arch-brief__sg-send-concepts-not-words-skos-is-the-model-divergence-is-the-finding.md` — **opens with a plain terminology table** (concept / term / taxonomy / ontology / semantic field / concept scheme) which is exactly what a newcomer needs **First:** 31 Jul via EuroVoc, named 6 Aug · **Maturity:** well-developed · **Newcomer-followable: YES** ### C22 · Decompilation, Not Compilation (the Author Is the Oracle) Lifting text into a graph runs *concrete → abstract*, which in compiler terms is **decompilation** — ambiguous, and impossible to do reliably without help. The point is **not absolute truth but the author's own meaning confirmed by the author**, so lifting needs an oracle, and the author is the only party who holds the answer. Therefore a reader saying *"that is not what I meant"* is **not a failure of extraction — it is the elicitation working.** Every node at every altitude carries a source map back to the span it came from. Rendering is answered by **altitude**, not by subsetting. **Read:** `briefs/08/09/graphing-text/v0.33.57__strategy-brief__sg-send-refactoring-meaning-decompilation-not-compilation-author-is-the-arbiter.md` **First:** 9 Aug 2026 — the newest major concept · **Maturity:** well-developed · **Newcomer-followable: PARTLY** --- ## Tier 2 — the "then more" eight | # | Concept | One line | Read | Maturity | |---|---|---|---|---| | **C23** | **Trust Through Connectivity** | Trust propagates like meaning: an identity is trusted to the extent it connects to nodes you already trust | `briefs/06/04/nhi-2.0/v0.32.3__arch-brief__sg-send-nhi-2.0-trust-and-identity-web-of-trust-agent-trust-scores.md` | partially argued | | **C24** | **Clues, Not Storage** | A registry is not a place that holds all the information; it holds **clues** that let you find the right information | `briefs/06/05/v0.32.4__dev-brief__sg-send-pki-public-key-registry-on-vaults.md` | partially argued | | **C25** | **Maps Are the Natural Evolution of Graphs** | A graph says these things are connected; a map adds *where they sit* — connectivity says what relates, **position says what to do** | `team/roles/cartographer/REFERENCE__from-issues-fs.md` | partially argued | | **C26** | **The Two-Dependency Invariant** | Every repo depends on exactly two things: how we build (Type_Safe) and what we can link to (the Lexicon) | `library/concepts/v0_4_0__lexicon-architecture.md` | well-developed, Issues-FS-specific | | **C27** | **Assertion vs Pointer (an Index Is Not a Source)** | Two structurally distinct node classes: pointers can be wrong without being dishonest, are regenerable, need no attribution apparatus, and are **safe to prune** | `briefs/08/09/graphing-text/v0.33.57__arch-brief__sg-send-index-is-not-a-source-caching-nodes-are-prunable-start-anywhere.md` | well-developed | | **C28** | **Attach, Never Mutate** | Contributions attach as subgraphs to an author-confirmed spine; a bad pack is discarded rather than repaired — which is what makes **abundance a feature**. Weight by **independence, not count** | `briefs/08/09/graphing-text/v0.33.57__arch-brief__sg-send-evidence-packs-attach-never-mutate-weight-by-independence-not-count.md` | well-developed | | **C29** | **Supersede, Never Delete (and Corrections Must Propagate)** | A superseded claim is marked from a date, not removed — and the graph can then **find every conclusion resting on it**, which a document cannot. Carries the corpus's best external example: the **10,000-hours claim** (242 papers, 200,000+ supporting citation paths, traced back to nothing) | `briefs/08/09/graphing-text/v0.33.57__arch-brief__sg-send-fact-does-not-exist-in-a-vacuum-agenda-is-context-corrections-must-propagate.md` | well-developed | | **C30** | **It Does Not Matter Where You Start** | The graph will be deep where the work is and absent elsewhere — not a defect, **the property that makes the project finite** | `briefs/08/09/graphing-text/v0.33.57__...index-is-not-a-source...md` | gestural (one paragraph, high value) | --- ## The teaching order — this IS the site's information architecture Ordered so each step is motivated by the previous one and **no step requires a forward reference**. Steps 1–5 are "initial concepts"; 6–12 "then more"; 13–18 "then more". | # | Page | The one thing they leave with | Primary source | Status | |---|---|---|---|---| | 1 | **A node is just a node** | A label is not a meaning. A node connected to nothing is *literally* meaningless. | `library/concepts/v0_4_0__thinking-in-graphs.md` Part 1 (`port: 8080`) | publishable | | 2 | **Meaning through connectivity** | The same value, differently connected, means different things. | Part 2 + founder quote 2 | publishable | | 3 | **The five Reviews** | Five teams, five processes, one word. Nobody has to agree on anything for the graph to tell you where they overlap. | Part 2 (Review A–E) | **the best on-ramp in the corpus** | | 4 | **Confidence is computable** | The honest answer is "we know X, we think Y, we cannot confirm Z" — with a reason. | Part 5 + `briefs/06/16/.../confidence-through-evidence...md` | publishable | | 5 | **Map the gaps** | Three of ten pieces of evidence *is* information. | `briefs/06/16/theses-and-reflections/v0.33.38__...mapping-the-gaps.md` | publishable | | 6 | **Not schema-first — and why the Semantic Web nearly got there** | RDF attached meaning *to nodes*; that is schema-first thinking in graph syntax. | Part 4 | **highest-signal page for expert readers** | | 7 | **Anchor nodes: reference without authority** | Link to schema.org, don't *become* schema.org. Partial mapping is normal. | Part 4 + `briefs/06/26/...path-properties...md` | publishable | | 8 | **Fractal: one grammar at every altitude** | Zoom into any node and you get a graph with identical rules. | `briefs/07/12/...fractal-semantic-graphs...md` | **needs rewriting** | | 9 | **Ontologies of ontologies** | Don't merge vocabularies — merging erases the disagreement. Shared facts, separate meanings. | `briefs/06/28/...ontologies-of-ontologies-three-layers...md` | publishable | | 10 | **Verbs, direction, and why the graph doesn't explode** | Ban `relates-to`. Every edge a verb with a distinct inverse. That asymmetry makes traversal converge. | `briefs/06/10/...subgraph-flip-verb-edges.md` + `briefs/06/26/...directed-edges...md` | publishable | | 11 | **The blob, and how to defeat it** | Rich nodes are good. Build wide, find the few, **flip**. Never render the graph; render a query. | `briefs/06/10/...subgraph-flip-verb-edges.md` | **most persuasive page** | | 12 | **Paths that read as language** | If your path doesn't read as a sentence in the reader's own words, your edges are wrong. | `briefs/06/26/...path-properties-read-as-language...md` | publishable as-is | | 13 | **Node Type Formulas** | Stop asking a human "is this a vulnerability?". Define the type as a path-pattern and **compute** it. | `briefs/06/28/...node-type-formulas...md` | publishable | | 14 | **Twins: where the graph stops modelling** | Every endpoint is a doorway to a real system. Whether it reaches reality is itself a fact. | `briefs/06/26/...twin-of-anything...md` | publishable | | 15 | **A graph at every boundary** | Determinism, explainability, provenance and sovereignty are *consequences* of fixing the seams. | `briefs/07/12/...fractal-semantic-graphs...md` | **needs a rewrite** | | 16 | **Everything is a projection** | The graph is the truth; the document, the skill, the standard are views. Compute them; don't store them. | `briefs/06/04/...skill-as-projection...md` + `briefs/07/31/...paragraph-as-file...md` | **needs a synthesis page (G2)** | | 17 | **Concepts, not words** | A nuance survives translation because it was never stored in a word. | `briefs/08/06/...concepts-not-words...md` | publishable | | 18 | **Decompilation, and the author as oracle** | Lifting text into a graph is ambiguous by nature. *"That's not what I meant"* is the feature. | `briefs/08/09/...refactoring-meaning-decompilation...md` | publishable | **Argue the IA from the corpus itself** using quote 35 (city walls → roads → buildings → people). Progressive disclosure *is* altitude, which makes the navigation a demonstration of C13/C22 rather than merely a choice. --- This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0). ============================================================================== == briefs/03__worked-examples-index.md ============================================================================== # 03 — Worked Examples Index **"Real world examples of what we used."** 20 applications where a graph was applied to a concrete problem. Ranked by how compelling they would be on a public site. Founder briefs abbreviated as `briefs/` (= `team/humans/dinis_cruz/briefs/`). All paths verified at v0.33.62. --- ## Calibration: what is already published vs what is only in the repo **Three graph artefacts are LIVE on sgit.ai.** Their real numbers come from the published vaults; their *reasoning* is in the repo briefs. Link to the live artefact; teach from the brief. Do not rebuild. | Live artefact | Verified numbers | Repo design source | |---|---|---| | [Regulation graph](https://sgit.ai/demos/vaults/regulation-graph/) | **1,523 nodes · 1,944 edges**. 113 articles, 500 paragraphs, 417 points, 180 recitals, 13 annexes, 68 definitions. 11 views incl. Cytoscape article graph, SQLite, **RDF/Turtle export**, and an **Art 9 Lab with a Graph REPL**. Parsed deterministically from official Formex XML via CELLAR, every element SHA-256 hash-verified to source bytes. Read key published. | Example **#4** below (11 briefs, ~36,000 words) | | [Risk Graph Explorer](https://sgit.ai/demos/vaults/risk-graph-explorer/) | "Exposed" preset = **18 facts, 37 risks, 14 provisions**. **7 views** recomputed simultaneously. Amber = exposure, green = assurance, **ghosted edges = unanswered**. `permissions: {}` — no network, no storage, all client-side. | Examples **#7, #13** below | | [Agentic browser isolation](https://sgit.ai/demos/vaults/agentic-browser-isolation/) | **17 entry points**. 5 altitudes L1 IT → L5 Board. Acceptance-gated escalation, **no deny button**. ~70 JSON files; 104 files / 2.4 MB / 4 commits. `fs.write: []`. | Example **#1** below | ⚠️ **A note on numbers.** The repo brief for browser isolation contains a **59-node / 75-edge** JSON graph. The published vault reports **17 entry points** and ~70 JSON files. These describe different things (the risk graph vs the site around it) — do not conflate them. Always cite which artefact a number belongs to. --- ## The catalogue ### 1. Agentic Browser Isolation — "Whose Session Is The Agent Using?" **Problem.** Should an AI agent that browses and acts run inside the user's own browser (with their live, past-MFA sessions, their desktop, their network position) or in an isolated browser with a scoped identity? Answered as **computed reach**, not adjectives. **The graph.** **59 nodes, 75 edges**, complete inline JSON. Node types: Reality, Twin, Asset (4), Evidence (6), Measure (4), Fact (5), Grant (2), **AuthorizationClosure (2)**, BlastRadius (2), Vulnerability (6), **Risk (13 — including 3 risks *of the mitigation*)**, PreventiveControl (3), DetectiveControl, Owner (7: IT → CISO → CFO/COO/DPO → CEO → Board), AcceptanceDecision (2). Edges: `backed_by`, `observed_on`, `measured_by`, `grants`, `exposes`, `reaches`, `impairs`, `gives_rise_to`, `owned_by`, `protected_by`, `conditional_on`, `emits`, `accepted_by`, `underwritten_by`, `connected_to`. **Read.** `briefs/07/12/worked-business-case/v0.33.48__briefing__sg-send-browser-isolation-agentic-automation-business-case-facts-vulnerabilities-risks-five-levels-graph.md` — 4,601 words **Evidence.** Designed only, but the graph is a real parseable artefact. Every claim externally sourced (7 public URLs: Brave's Comet injection research, arXiv 2505.13076, nhimg.org, vendor system cards). **Visuals.** Three ASCII diagrams: R1 walked from page to board; the convergence pyramid; a 9-row Option A vs B closure comparison. **The JSON is drop-in renderable.** **Why it teaches.** The best artefact in the corpus for *why a graph beats a slide*: the "what isolation changes" argument is a **computed closure difference a buyer can check**. And it deliberately includes three risks that the mitigation itself creates — honesty a table cannot express. **Publishability.** ✅ Clean. Vendor-anonymous, no customer, no personal data. Carries its own "not legal advice" disclaimer. CC BY 4.0. ### 2. Article 26(5) End-to-End — Creditworthiness Agent, Fact to Board and Back **Problem.** One EU AI Act provision, one concrete deployment, carried from a running system to a board decision and back down. **The graph.** Explicit inventory in-document: 1 Reality · 1 Twin · **8 Facts (one deliberately unevidenced)** · 7 Evidence (one absent) · 5 Provisions (Annex III 5(b), Art. 26(5), 26(6), 14, 27) · 3 Vulnerabilities (derived: fact + provision) · 5 Risks (four in a chain, one meta) · 4 Stakeholder altitudes · 3 Decisions (+1 deliberately absent) · **9 Questions, 5 unanswered — "the actual output of the exercise"** · 2 Projects (+1 unfunded). **Read.** `briefs/08/02/vault-as-substrate/v0.33.55__arch-brief__sg-send-end-to-end-worked-example-article-26-5-creditworthiness-agent-fact-to-board.md` — 4,272 words **Evidence.** Designed, honestly: the organisation is invented and **every invented element is marked as such**. Act provisions verified against five external sources. **Visuals.** Four ASCII diagrams incl. a 2×2 accepted/acceptable quadrant **whose bottom row is empty — that emptiness is the finding**. **Why it teaches.** Contains the corpus's best paragraph on the thesis — *"What The Graph Shows That A Register Cannot"*: derivation; absence-as-a-finding; **escalation without an escalator** (R3 reaches the CFO because *nobody accepted it*, not because anybody raised it); and recoverability as a first-class dimension (*"the money can be refunded; the customer cannot be un-declined"*). **Publishability.** ✅ Clean. Written to be published. ### 3. The 2FA Instance Graph — the only downloadable machine-readable example **Problem.** Admin accounts on two systems lack 2FA. The graph carries it from that single configuration fact through the wrong acceptor, the governance air gap, the five-whys chain, up to the Board and the ICO, blooming through Confidentiality/Integrity/Availability. **The graph.** **51 nodes, 53 edges**, plus an `acceptances` block, as a standalone parseable JSON file. Types: Risk 9, Actor 9, Evidence 6, Interval 6, Fact 5, Impact 3, System 2, Vulnerability 2, DataClass 2, Asset 1, ThreatAgent 1, Attack 1 (MITRE T1110.004), Obligation 1, Register 1, Twin 1, Agent 1. **Declared principles inside the file:** *"meaning comes from connectivity, not properties"*, *"facts only in phase one"*, *"every edge is directed and has a named inverse"*, *"every change cascades to the register"*. **Read.** - `briefs/06/26/semantic-graph-and-query-paths/v0.33.35__data__sg-send-2fa-mappings.json` — **the data** (1,253 words) - `briefs/06/26/semantic-graph-and-query-paths/v0.33.35__arch-brief__sg-send-2fa-use-case-semantic-graph-ontology-nodes-edges-instance.md` — the ontology: **22 node classes, 34 edge-type rows** (2,441 words) - `briefs/06/26/semantic-graph-and-query-paths/v0.33.35__arch-brief__sg-send-2fa-first-mappings-nodes-edges-acceptances-query-resolutions.md` — 1,764 words - `briefs/06/26/risk-register-and-five-whys/v0.33.35__arch-brief__sg-send-risk-register-graph-of-graphs-facts-only-no-deny-cascade-cia-blast-radius.md` — 3,187 words - `briefs/06/26/capstones/v0.33.35__dev-brief__sg-send-2fa-end-to-end-mvp-vault-issuefs-twins-visualise-operationalise.md` — 7-layer build, 6 phases, 10 acceptance criteria **Evidence.** Designed, but **the most build-ready artefact in the corpus** — the Librarian's own debrief calls the JSON *"the immediate starting point for implementation"*. **Why it teaches.** The only artefact that is **both a complete narrative and a machine-readable file** — hand a visitor the JSON and let them query it. And its **"no-deny" mechanic** (a real risk is accepted for an interval — 1h / 4h / 2d / 2w / 1m / 6m — never denied) is novel and immediately graspable. **Publishability.** ✅ Clean. Generic org, generic roles. Carries `"license": "CC BY 4.0"` inside the JSON. ### 4. The EU AI Act Regulation Graph — **already live** **Problem.** Turn a legal instrument into a citable, queryable graph where **nothing is relevant until your facts make it so** — the inversion of every compliance tool that hands you the whole text and asks you to strike out what doesn't apply. **The graph.** Live: 1,523 nodes / 1,944 edges (see table above). Design: paragraph-as-file; definitions as the first node layer; **amendments as native graph operations**, not migrations; repealed provisions marked `repealed_from`, never deleted; attaches to reality through Twins ("hooks") — which makes **hook-coverage a measurable coverage metric over the instrument**. Ontology locked at **7 node types + 8 edge types + an `AcceptableLevel` node**. **Read (11 briefs, ~36,000 words).** All under `briefs/07/28/regulation-graph-and-acceptability/` and `briefs/07/31/canonical-act-build/`. Start with: - `briefs/07/28/regulation-graph-and-acceptability/v0.33.53__arch-brief__sg-send-every-paragraph-is-a-graph-eu-ai-act-definitions-as-nodes-twins-as-hooks-with-concepts-appendix.md` (3,854 w) — **and its Appendix A, the best concept summary in the corpus** - `briefs/07/28/regulation-graph-and-acceptability/v0.33.53__arch-brief__sg-send-customised-standard-eu-ai-act-graph-nothing-relevant-until-facts-attach-browser-query-layer.md` (3,371 w) - `briefs/07/31/canonical-act-build/v0.33.54__arch-brief__sg-send-canonical-ai-act-paragraph-as-file-amendment-as-native-graph-operation-view-from-any-provision.md` (3,078 w) - `briefs/07/31/canonical-act-build/v0.33.54__research-brief__sg-send-no-canonical-ai-act-consolidated-version-absent-article-10-probe-three-states-of-staleness.md` (3,072 w) **Why it teaches.** The **customisation inversion** is the most immediately gettable idea in the corpus: a compliance standard that starts empty and grows only as your facts attach. And the arithmetic finding (**30 days retained vs Article 26(6)'s 6-month minimum**) demonstrates a graph *computing* a compliance breach rather than asserting it. **Publishability.** ✅ Clean — legal text is public, every citation carries a URL. ### 5. AWS IAM Configuration Risk Ontology **Problem.** Compute — rather than assert — whether an AWS configuration is a risk, by making "vulnerability" a **path pattern** instead of a label. **The graph.** 6 layers, ~31 node types, **20 directed edge types each with a named inverse (40 readings), 7 Node Type Formulas**. Worked instance: **24 nodes / 18 edges** (public regulated S3 bucket + over-broad EC2 role). Standout types: **`AuthorizationClosure`** (transitive union of every Grant reachable over assume-role/pass-role/wildcard edges — *"the agentic union"*), `CostCeiling`, `DamageWindow`, `LethalTrifectaStatus`. The formulas are the payload: `Fact := a node with a downward backed_by path to Evidence.` `Vulnerability := a Fact with an upward gives_rise_to path to a Risk. A PublicExposure becomes a Vulnerability only once contains reaches a DataClassification above public and exposes reaches a real BlastRadius.` **Read.** `briefs/07/05/aws-configuration-risk-engine/v0.33.44__arch-brief__sg-send-aws-iam-config-risk-ontology-taxonomy-nodes-edges-formulas-bridges.md` (2,968 w) · `briefs/07/05/aws-configuration-risk-engine/v0.33.44__dev-brief__sg-send-aws-iam-config-risk-engine-context-not-configuration-python-twins-json.md` (2,039 w) · precursor `briefs/05/15/v0.27.43__dev-brief__iam-graph-visualisation-and-lockdown.md` (1,788 w) **Why it teaches.** *"A public bucket is a Fact and becomes a Vulnerability only when an upward path to a real Risk exists"* is the cleanest demonstration in the corpus that a graph replaces a rules engine. **Every security practitioner recognises the false-positive problem it solves.** **Publishability.** ✅ Clean (the ontology brief uses no real account IDs — but see redaction note in `06__house-style-and-conventions.md`). ### 6. The Wardley Map Series Covered in full in `04__visual-assets-and-infographics.md`. Summary: **8 rendered PNGs** (the only rendered graph images in the repo), **12 mermaid `wardley-beta` source blocks**, **8 more text-first agent-mandate maps**, and one drawn air-gap map that is the corpus's sharpest sales artefact. ✅ Clean; highest visual readiness of anything here. ### 7. Fractal Risk Registers + Distributed Vault Architecture **Problem.** One register per accepting role, in that role's own language, with relevance fading as you move away from the reader's altitude — plus the messaging architecture that lets registers talk **without sharing a database**. **The graph.** Two graphs, both structurally validated: fractal registers **18 nodes / 31 edges**; distributed architecture **18 nodes / 26 edges** — *zero dangling edges, zero orphan nodes* in both. **Read.** `briefs/07/17/registers-mandate-and-intervals/v0.33.49__arch-brief__sg-send-fractal-risk-registers-one-per-accepting-role-domain-language-relevance-fade.md` (2,674 w) · `briefs/07/17/architecture-and-mvp/v0.33.49__arch-brief__sg-send-fractal-distributed-vault-architecture-registers-of-registers-messages-as-graph-transformations-transaction-log-pki-authorization.md` (3,191 w) · validation record `briefs/07/17/v0.33.49__index__2026-07-17.md:117` **Why it teaches.** The day index flags an **honest self-declared defect**: *"Neither grounds to a Reality node through a Twin. Both are structural topology graphs rather than evidence-grounded risk graphs… a departure from the standing convention."* That admission is itself a great teaching moment about graph discipline. And this is where **messages as graph transformations** lives: every action is a JSON transformation command, the filesystem stores them, and the transaction log is a **by-product** giving provenance, determinism, explainability and eventual consistency. **Publishability.** ✅ Clean. ### 8. Fractal Semantic Graphs as the Agentic Operating Layer **The graph.** **30 nodes, 38 edges**, inline JSON. The connective-tissue document — good for a "how it all fits" page. **Read.** `briefs/07/12/architecture/v0.33.48__arch-brief__sg-send-fractal-semantic-graphs-agentic-operating-layer-deterministic-sovereign-open-source.md` (3,862 w) **Publishability.** ✅ Clean — but see C17: **the document needs a rewrite before publication.** Its abstract is one ~500-word sentence. ### 9. The Agent Mandate Ontology — the shared backbone **The graph.** **16 core entities** — Principal, Agent, Mandate, Capability, Tool, Action, Asset, Party, Harm, Risk, RiskAcceptance, Evidence, Environment, IntegrationMode, Control, Provenance — plus **8 taxonomies**, layered as ontology-of-ontologies (stable core + per-company + per-audience). **Read.** `briefs/06/20/ontology-and-naming/v0.33.30__arch-brief__sg-send-agent-mandate-ontology-and-taxonomy-entities-relationships-parties-assets-harms-risk.md` (1,421 w) · `briefs/06/22/market-cases-and-graph/v0.33.32__arch-brief__sg-send-agent-mandate-graph-path-driven-lenses-two-pass-crown-jewels-blast-radius.md` (1,687 w) **Why it teaches.** The "here is the vocabulary" page every graph site needs — **small enough to render on one screen.** **Publishability.** ✅ Clean. ### 10. Published Agentic Incidents Mapped to the Ontology **Problem.** Turn real, sourced, published AI-agent incidents into graph instances — the empirical grounding layer. **The graph.** A per-incident mapping schema: the capability that made the harm possible · the control present or bypassed · who authorised the access and when · the blast radius opened · the worst case the same access allowed · malicious vs non-malicious intent · confidence · and **evidence gaps**. Written deliberately self-contained for a downstream agent with no other context. **Read.** `briefs/06/22/market-cases-and-graph/v0.33.32__research-brief__sg-send-published-incidents-mapped-to-agent-mandate-ontology-self-contained-for-downstream-agent.md` (2,712 w) · `briefs/07/28/agentic-risk-research/v0.33.53__research-brief__sg-send-has-it-happened-before-catalogue-of-agentic-incidents-classified-by-direction-only-one-outbound.md` (3,561 w) **Why it teaches.** **Real incidents are the most persuasive content a public graph site can carry** — "here is a thing that actually happened, drawn as a graph." **Publishability.** ✅ Clean, sources public. Names real products (WhatsApp, Odysseus) from public reporting only. ### 11. Odysseus Agent-Mandate Case Study — a named real product **The graph.** Mandate map across shell, files, web, email (IMAP/SMTP), persistent memory, MCP connectors, self-evolving skills, autonomy → lethal-trifecta status → blast radius. **Read.** `briefs/06/20/odysseus-mandate-analysis/v0.33.30__research-brief__sg-send-odysseus-agent-mandate-case-study-privacy-vs-safety-prompt-injection-blast-radius.md` (1,854 w) **Why it teaches.** *"Privacy is confidentiality, not safety"* landed on a named, real, admired product is the most quotable line in the security half of the corpus. **Publishability.** ⚠️ **Needs a legal read** — it names a third-party product and analyses its security posture. Sources are public and the tone is fair (explicitly complimentary about the target's privacy engineering), but this is the one entry where an external party could object. ### 12. Browser Extensions — The Read-Content Closure **Problem.** *"Allow this extension to read the content of the pages you visit"* quietly grants the **authorization closure of every site you are logged into**. **The graph.** Bidirectional and queryable both ways: walk *out* from the extension to the AWS console / email / Salesforce it reaches; walk *back in* from "how can my email be attacked?" to the extensions that expose it. **Read.** `briefs/07/04/risk-cards-and-visualization/v0.33.42__arch-brief__sg-send-browser-extension-risk-cards-read-content-closure-agent-escalation-bidirectional-evidence-graph.md` (1,436 w) **Why it teaches.** **The highest relatability-to-length ratio in the corpus.** Everyone has browser extensions. The bidirectional query is exactly the thing a graph does that a list cannot — and it fits on one screen. **Publishability.** ✅ Clean. **Strong candidate for the site's first "aha" page.** ### 13. The Personal Risk Acceptance Scenario — the live demo candidate **Problem.** An individual running an LLM on their desktop is walked through a curated **question graph**; the answers populate a per-user graph; the graph generates the risks they must accept. **The graph.** Six questions, each answer typed as **fact / opinion / hypothesis / evidence**. Two generated chains: the **lethal trifecta** (reads untrusted content ∧ internet-connected ∧ can act autonomously → exfiltration, corruption, destruction) and the **email-access chain** (email access → every account that resets through it). First-pass storage: browser localStorage, **no vault, no backend, runs without an LLM**. **Read.** `briefs/06/24/risk-acceptance-and-reviews/v0.33.34__dev-brief__sg-send-personal-risk-acceptance-scenario-local-llm-question-graph-evidence-trifecta-delegation.md` (1,993 w) **Why it teaches.** **This is the best candidate for a live interactive demo on graphs.sgit.ai**: answer six questions in the browser, watch your own risk graph build itself. No server, no account, no key. **Publishability.** ✅ Clean. ### 14. Compliance Standards Intersection — The Relevant Subset Graph **Problem.** Build a subset graph of *only* the controls from NIST, GDPR, ISO 27001, HIPAA, EU AI Act, NIS2 and DORA that the agent-authorisation blast radius actually touches — *"almost a small standard of its own."* **The graph.** Read from four angles: (1) the binary one — if you cannot answer the blast-radius questions you already cannot demonstrate compliance; (2) the boxes you can check once you know; (3) the **new** breaches that appear once you know the side effects (knowing and not acting is a failing); (4) the controls you recover as you reduce privileges. Core claim: **much of this is breached before the agent does anything, at the moment of authorisation.** **Read.** `briefs/06/19/standards-compliance-supply-chain/v0.33.28__arch-brief__sg-send-compliance-standards-intersection-subset-graph-binary-breach-before-the-agent-acts.md` (1,782 w) · `briefs/05/22/sg-sentinel/v0.27.58__arch-brief__sg-sentinel-compliance-as-living-graph.md` (3,175 w) · `briefs/05/30/v0.31.9__arch-brief__sg-send-vault-per-standard-document-to-graph-artefacts.md` (2,534 w) **Why it teaches.** *"Compliance is not a checkbox, it is a computed function of your actual deployment"* — the sharpest anti-checkbox argument here, and the intersection-subset construction is a genuinely graph-shaped operation. **Publishability.** ✅ Clean. No standard's text is reproduced. ### 15. The Permissions Bill of Materials (PBOM) **Problem.** SBOM for permissions. Permissions gate exploitability — a vulnerability doesn't matter if the account lacks the permissions to weaponise it. **The graph.** Carries intent, blast radius, compounding and reachability — the four things the SBOM misses. Designed to **augment** CycloneDX/SPDX/VEX/AIBOM, not replace them. **Read.** `briefs/06/18/agentic-permissions/v0.33.40__arch-brief__permissions-bill-of-materials-augmenting-sbom-permissions-gate-exploitability.md` (1,712 w) · `briefs/06/19/standards-compliance-supply-chain/v0.33.28__research-brief__permissions-bill-of-materials-adjacent-standards-vex-cyclonedx-spdx-aibom-agent-identity.md` (1,719 w) **Why it teaches.** SBOM is a concept the security world already accepted. *"Now do it for permissions"* needs no setup. Appears in **38 files** — one of the most cross-referenced concepts in the corpus. **Publishability.** ✅ Clean. ### 16. NHI 2.0 — Semantic Knowledge Graphs of Identity **The graph.** Taxonomy of identity types; the authorization/authentication matrix; **per-API-method permission graphs across clouds**; the action-vs-resource mismatch; the explosion of identities when every node needs one; temporal permissions and time travel. **Read.** `briefs/06/04/nhi-2.0/v0.32.3__arch-brief__sg-send-nhi-2.0-semantic-knowledge-graphs-of-identity.md` (3,319 w) · `briefs/06/04/nhi-2.0/v0.32.3__arch-brief__sg-send-nhi-2.0-cloud-permissions-per-api-graphs-hyperscalers.md` (3,415 w) **Why it teaches.** The **reciprocal insight** — *the semantic web's verification gap means graphs need identities too* — is the most intellectually interesting claim in the corpus, and it directly justifies pairing graphs.sgit.ai with pki.sgit.ai and nhi.sgit.ai. **Build the cross-site bridge page from this.** **Publishability.** ✅ Clean. ### 17. Graphing Text — Meaning Extraction as Decompilation **The graph.** A ladder — letters → original text → summary → concepts/claims/entities → user stories & business functions — where **every node at every altitude carries a source map** pointing at the span it came from. Anchored to **Wikidata** as the global concept layer (language-independent identifiers, tens of millions of entities, free). Evidence packs **attach, never mutate**. Corrections propagate with supersede semantics. Confidence weighted **by independence, not by count**. **Read (all in `briefs/08/09/graphing-text/`, v0.33.57).** `...__strategy-brief__sg-send-refactoring-meaning-decompilation-not-compilation-author-is-the-arbiter.md` (3,558 w) · `...__arch-brief__sg-send-enrichment-and-shared-anchors-research-paid-once-wikidata-is-the-concept-layer.md` (3,590 w) · `...__arch-brief__sg-send-evidence-packs-attach-never-mutate-weight-by-independence-not-count.md` (2,991 w) · `...__arch-brief__sg-send-fact-does-not-exist-in-a-vacuum-agenda-is-context-corrections-must-propagate.md` (3,352 w) · `...__arch-brief__sg-send-index-is-not-a-source-caching-nodes-are-prunable-start-anywhere.md` (3,325 w) **Why it teaches.** Carries the corpus's best **external** worked example: the **10,000-hours claim** — a 1993 violin study where the figure was an average, not a threshold; half the top group hadn't reached it; the original author spent his career correcting the popularisation and **none of it ever attached to the claim**. Traced through a citation network of **242 papers carrying 200,000+ supporting paths that lead back to nothing.** The perfect illustration of why corrections must propagate through a graph. **Publishability.** ✅ Clean. **This is the site's best non-technical, non-security story — use it on the front page.** ### 18. The Graph Canvas as a REPL — "Never Render The Whole Graph" **Problem.** When an agent manipulates a graph it acts blind; when a person sees the graph they cannot manipulate it at the same speed. The canvas closes the gap. **The graph.** A closed operation vocabulary in the established node/edge grammar; render the *result of a query*, never the whole graph; **mermaid as the print step** (text, diffable, committable, unreadable beyond ~50 nodes) and an interactive library as the **canvas**; the session transcript is already the specification. **Read.** `briefs/08/02/vault-as-substrate/v0.33.55__arch-brief__sg-send-graph-canvas-repl-un-blinding-the-agent-mermaid-for-output-never-render-whole-graph.md` (3,471 w) **Why it teaches.** *"A diagram of everything is rarely useful; one node with its neighbours is always readable"* — **the single most useful design rule you could put on a public graph site**, and it justifies the site's own rendering choices. **Publishability.** ✅ Clean, needs light editing (dense memo style). ### 19. Thinking in Graphs — the foundational essay **The graph.** The `Safe_UInt__Port` example: two nodes both holding `8080`, one typed and connected through `extends → Safe_UInt → part_of → osbot-utils@3.63.4`, one typed `int`. *"The difference is not in the value. The difference is in the connectivity."* **Read.** `library/concepts/v0_4_0__thinking-in-graphs.md` (5,013 w) · sequel `briefs/06/16/theses-and-reflections/v0.33.38__strategy-brief__confidence-through-evidence-blast-radius-graphs-mapping-the-gaps.md` (1,834 w) **Why it teaches.** It is the "why graphs at all" page, and **its example is a concrete piece of Python, not a metaphor** — osbot-utils is a live dependency of this repo. **Publishability.** ⚠️ **Licence blocker.** Carries **no CC BY 4.0 line** and is attributed to Issues-FS. Resolve before launch — see gap G8. ### 20. Shorter entries worth a line each | Name | Path | Words | The graph | Quality | |---|---|---|---|---| | **RAMM — Risk Acceptance Maturity Model** | `briefs/07/02/authorization-and-maturity-model/v0.33.40__arch-brief__sg-send-risk-acceptance-maturity-model-ramm-graph-native-levels-agentic-crosswalk.md` | 2,265 | Five maturity levels expressed as **Node Type Formulas** — a level is a *fact about the graph*, not a questionnaire claim. Crosswalks to OWASP Risk Rating, RIMS RMM | Designed; "first pass live". ✅ | | **Who Can Pull The Plug** | `briefs/07/24/who-can-pull-the-plug/v0.33.51__strategy-brief__sg-send-who-can-pull-the-plug-ability-to-stop-an-ai-system-fractal-maturity-model-detection-authority-blast-radius-reversibility-intersect-in-time.md` | 3,940 | Four-way Venn (detection ∧ decision ∧ blast radius ∧ reversibility) that must intersect **in time**. Hard number: **hyperscaler cost reporting is 12–18h late = the detection floor** | Designed. ✅ | | **SG/Sentinel control-flow graphs** | `briefs/05/24/sg-sentinel-batch2/v0.27.60__arch-brief__sg-sentinel-control-flow-graphs-business-logic.md` | 2,812 | Nodes = application states, edges = permitted transitions; *"the universe of what is possible is determined by the current state, not by everything the app technically allows"* — the WAF Achilles heel | Designed. ✅ Bridges to sg-sentinel.sgit.ai | | **Chain of trust & key graphs** | `briefs/02/21/part-1/v0.4.27__architecture__chain-of-trust-and-key-graphs.md` | 3,152 | Key/identity graph, layered identity. **The earliest graph document in SG/Send's own corpus** | Designed. ✅ Bridges to pki.sgit.ai | | **Fractal document signing — PKI-signed paragraphs** | `briefs/02/23/part-3/v0.6.14__architecture__fractal-document-signing-pki-paragraphs.md` | 1,598 | Paragraph-as-signed-unit — the direct ancestor of the Act-as-paragraph-graph five months later | Designed. ✅ **Great provenance story: Feb idea → July product** | | **Skills as a graph** | `briefs/06/04/v0.32.3__strategy-brief__sg-send-skills-as-graph-capturing-how-business-works.md` | 3,244 | A skill is a graph of skills, not a static document; built-in error correction because it is used daily | Designed. ✅ | | **Provenance / decision graph per article** | `briefs/06/13/vault-platform-and-commercialisation/v0.33.26__arch-brief__sg-send-agentic-content-website-provenance-decision-graph-research-publish.md` | 2,346 | Every article carries source docs, analysis, transformations, human+agent verifications as a graph; review as a decision graph with ownership per step | Designed; *"~90% of the stack already built"*. ✅ | | **SGit commit/branch graph visualiser** | `briefs/03/30/v0.19.7__dev-brief__sgit-visualisation.md` | 886 | `sg-git-graph` renders both real SGit vaults **and LLM conversation structures** — *"each commit is an LLM interaction, the branch is the agent, the merge is the consolidation"* | Designed; screenshot exists. ✅ | | **Issues-FS link-type graph** | `.issues/config/node-types.json` + `.issues/config/link-types.json` + 107 `issue.json` files | 320 lines of schema | **ACTUALLY RUNNING.** 12 node types, 10 verb/inverse edge types with domain/range constraints, **71 nodes / 141 edges** in `.issues/` alone. Edges stored bidirectionally | **SHIPPED & demonstrable.** ✅ **Ship the actual JSON — cheapest credibility on the whole site** | | **LinkedIn network → outreach CRM** | `briefs/06/10/network-intelligence/v0.33.16__dev-brief__sg-send-linkedin-semantic-knowledge-graph-crm-outreach-workflow.md` | 2,828 | Real LinkedIn export loaded into a vault, processed as graphs-of-graphs | Built (vault exists). ❌ **INTERNAL ONLY — contains real network data** | --- ## Domain map — what a graph buys you here **Security & agent risk** *(#1, #5, #12, #13, #15, #16, #11)* 1. **Reach is computed, not asserted.** A table can list permissions; only a transitive closure over `can_assume` / pass-role / wildcard edges tells you what they actually reach. Named `AuthorizationClosure` — *"the agentic union: for an Agent, the closure is the rating floor, not the nominal grant."* 2. **Type becomes a query result, not a label** — the corpus's answer to security-tool false positives, and only expressible as a path. 3. **Bidirectionality.** Walk out from the extension to what it reaches, *or* walk in from "how can my email be attacked?". Two different tables; one graph. **Regulation & compliance** *(#4, #2, #14)* 1. **Subtraction.** The customised standard starts from *nothing being relevant* and accretes as your facts attach — impossible to express as a document. 2. **Findings become arithmetic.** *"Thirty days against six months is clean"* — fact + provision produces a vulnerability **by computation**, "which makes it the most defensible finding in the graph." 3. **Absence is a first-class node.** *"A register has empty cells. The graph has unanswered question nodes and unevidenced facts, which can be counted, queried and assigned."* 4. **Consolidation and customisation are the same operation** — maintenance burden and flagship feature share one engine. **Strategy (Wardley)** *(#6)* 1. **A map is a falsifiable claim, not a picture** — which is why maps belong in the same family as risk graphs. 2. **The shape is the argument.** The air-gap map works because *a gap has no evolution*, so you map the labour that fills it. 3. **Maps as text = maps that survive** the meeting. **Agent ops** *(#7, #18)* 1. **One structure, many views.** Article 26(5) renders four stakeholder registers from one chain: *"nothing is duplicated; each view is a query over one structure."* 2. **Escalation without an escalator** — a property of edges, not of a workflow rule. 3. **The transaction log is free** — provenance, determinism, explainability and resilience as by-products. **Engineering & knowledge** *(#19, #17)* 1. **Confidence is proportional to connectivity** — `Safe_UInt__Port` vs `int`, same value `8080`, radically different certainty. 2. **Source maps make lifting reversible** — the mechanism that lets a reader say *"that is not what I meant"* and have it be **success**. 3. **Weight by independence, not count** — grounded in a real 242-paper citation network. --- ## The numbers — every citable graph statistic Public sites live on real numbers. All sourced. | Statistic | Value | Source | |---|---|---| | **Regulation graph (LIVE)** | **1,523 nodes · 1,944 edges**; 113 articles / 500 paragraphs / 417 points / 180 recitals / 13 annexes / 68 definitions; 11 views | sgit.ai published vault | | **Risk Graph Explorer (LIVE)** | 18 facts / 37 risks / 14 provisions in the "Exposed" preset; 7 views; `permissions: {}` | sgit.ai published vault | | **Browser isolation site (LIVE)** | 17 entry points; 5 altitudes; ~70 JSON files; 104 files / 2.4 MB / 4 commits | sgit.ai published vault | | Browser-isolation risk graph | **59 nodes, 75 edges** | `briefs/07/12/worked-business-case/v0.33.48__briefing__...` (parsed) | | 2FA instance graph | **51 nodes, 53 edges** | `briefs/06/26/semantic-graph-and-query-paths/v0.33.35__data__sg-send-2fa-mappings.json` (parsed) | | Fractal semantic graphs graph | **30 nodes, 38 edges** | `briefs/07/12/architecture/v0.33.48__arch-brief__...` (parsed) | | AWS IAM worked instance | **24 nodes, 18 edges** | `briefs/07/05/aws-configuration-risk-engine/v0.33.44__arch-brief__...` | | Fractal registers graph | **18 nodes, 31 edges, 0 dangling, 0 orphans** | `briefs/07/17/v0.33.49__index__2026-07-17.md:117` | | Distributed vault architecture graph | **18 nodes, 26 edges, 0 dangling, 0 orphans** | same | | Issues-FS live graph in repo | **71 nodes, 141 edges**; 12 node types, 10 edge types; 107 `issue.json` files | `.issues/` (measured) | | Semantic graph engine ontology | **22 node classes, 35 edge types with named inverses** | `debriefs/06/29/v0.33.34__debrief__briefs-processing-24-26-june-2026.md:63` | | Path query set | **5 tiers, 17 queries** | same | | AWS IAM ontology | **6 layers, ~31 node types, 20 edge types (40 readings), 7 Node Type Formulas** | `briefs/07/05/...v0.33.44__arch-brief__...` | | Agent Mandate ontology | **16 core entities, 8 taxonomies** | `team/roles/librarian/reality/ai-agents/proposed/risk-mandate.md:62` | | EU AI Act graph ontology | **7 node types + 8 edge types + AcceptableLevel** | `debriefs/08/01/v0.33.47__debrief__briefs-processing-28-july-2026.md:50` | | Acceptance interval ladder | **6 intervals: 1h / 4h / 2d / 2w / 1m / 6m** | `briefs/06/23/risk-mandate-product-and-workflow/v0.33.33__arch-brief__...` | | Risk altitudes | **5 levels** (L1 endpoint → L5 governance) | `briefs/07/12/worked-business-case/v0.33.48__briefing__...` | | Hyperscaler cost-reporting delay | **12–18 hours** — the detection floor | `briefs/07/24/who-can-pull-the-plug/v0.33.51__strategy-brief__...:68` | | Harm taxonomy | **8 categories** | `reality/ai-agents/proposed/risk-mandate.md` (P-392) | | Citation-network case study | **242 papers, 200,000+ supporting paths, traced back to nothing** | `briefs/08/09/graphing-text/v0.33.57__arch-brief__...fact-does-not-exist-in-a-vacuum...:114` | | Wikidata concept layer | tens of millions of entities, language-independent IDs, free | `briefs/08/09/graphing-text/v0.33.57__arch-brief__...wikidata-is-the-concept-layer.md` | | **Mermaid graph readability limit** | **~50 nodes** before mermaid becomes hard to read | `briefs/08/02/vault-as-substrate/v0.33.55__arch-brief__...graph-canvas-repl...md` | | **Visualisation legibility ceiling** | **~300–400 nodes** | `briefs/06/10/network-intelligence/v0.33.16__arch-brief__...subgraph-flip-verb-edges.md` | | Tree-render performance gate | **500 nodes in <100 ms** | `briefs/03/29/from-agent__architect/v0.19.11__architect-review__sg-tree-api-contract.md:600` | | Wardley maps rendered | **8 PNGs**, Mermaid CLI v11.14.0 + Playwright Chromium | `briefs/05/24/sg-send-thread/wardley-maps/` | | Wardley mermaid source blocks | **12** | `grep 'wardley-beta'` | | Corpus size | **3,317 md files · 5,415 tracked files · 4,335 commits** | `git ls-files`, `git log` | | Corpus timespan | **2026-02-08 → 2026-08-20** (~6.5 months) | `git log --reverse` | | Documents formally catalogued | **956** | `team/roles/librarian/reality/index.md` | | Graph-term reach across corpus | graph **2,715 files** · semantic **545** · ontolog\* **311** · connectiv\* **102** · MGraph **89** · knowledge graph **111** · Wardley **210** · blast radius **321** · infographic **337** | measured by `grep -ril` | **Deliberately NOT claimed** (searched, absent from the repo): "seven views" as a repo artefact · "three recorded videos" as repo files · any sgit-positioning Wardley map count. --- ## The shortlist — if you can only ship five 1. **Browser isolation** (#1) — 59/75 JSON, drop-in renderable, vendor-neutral, real public sources 2. **Article 26(5)** (#2) — the full fact-to-board chain, with five unanswered questions as the output 3. **The 2FA graph** (#3) — the only machine-readable file a visitor can download and query 4. **The Wardley air-gap map + the 8 rendered PNGs** — the only rendered visuals in the corpus 5. **The personal risk question graph** (#13) — six questions, localStorage, no backend: a live demo the site can actually run Plus, for the front page: **the 10,000-hours story** (#17). It needs no security or legal background and it makes the case for corrections propagating through a graph better than any diagram. --- This document is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0). ============================================================================== == briefs/04__visual-assets-and-infographics.md ============================================================================== # 04 — Visual Assets and Infographics **The headline finding: the gap is rendering, not raw material.** Measured, not estimated: **81 binary visual assets · 13 Wardley maps (8 rendered) · 2,846 fenced ASCII diagram blocks across 591 markdown files · 20 inline `