Track record
A tool that tells you how confident it is owes you a record of how well that confidence has held up. This page carries three things, all computed from data that already exists: every correction we have logged, what the review pipeline did with challenges, and the calibration promise — whether claims we marked provisional really do get corrected more often than the ones we called robust. Where there is not enough data yet, this page says so instead of showing a number.
Corrections ledger
A correction is only real once it is public. Every line below is a change we made to a claim we had previously published, taken verbatim from the release it shipped in — including the 12 weaknesses our own pilot audit found in this graph.
| Release | Date | What was corrected |
|---|---|---|
| v2.21.0 | 2026-08-27 | DENOMINATOR CORRECTION, NOT A REGRESSION. The duty to cite applied to four relations (triggers, imposes, requires, classified_as). Five further relations assert something legal and were entirely outside the model, uncounted and uncited: applies_in (scope, e.g. AI Act Art. 2(1)), implemented_by, evidenced_by, supported_by, operationalized_by — plus the three crosswalk relations, whose mandatory rationale/confidence is a stated reason, not a source. They now count wherever the from-side is a statute (regulation/article/standard). The denominator grows from 412 to 763 obligation-bearing edges and overall coverage reads 45% instead of 72.3%. The lower number is the honest one; the ratchet floor is repinned on the wider base and now pins every relation individually, so a relation at 0% cannot sit there while the overall share is propped up elsewhere. |
| v2.19.2 | 2026-08-28 | WAY A CHOSEN OVER A BUNDLED EMBEDDER. `src/data/concept-lexicon.json` is a curated everyday-language synonym field per index concept — 42 lexica across use-case profiles and statutory elements — folded into the build-time index by `scripts/generate-semantic-index.ts`. It stays exact arithmetic (no weights, no inference, no latency in the reasoner path), it is reviewable phrase by phrase like any other authored evidence, and it is versioned in its own right (`meta.lexiconVersion` in the generated index). A fixed-weight ONNX embedder would have bought the same recall at the cost of bundle size, inference latency and an unreviewable artefact — it was not needed. A lexicon key that matches no index document now fails the build, so a stale entry cannot sit there reading as if it were in force. |
| v2.19.0 | 2026-08-28 | DEPLOYER PRECEDENCE CORRECTED. A catalog profile is a template for a kind of system, not a statement about who runs this one, so a deployer named in the description ('a court uses the system') now outranks the profile's default. An explicit answer still governs both. |
| v2.17.0 | 2026-08-26 | SHAPE IS ENFORCED, COVERAGE IS RATCHETED. The integrity report gains a `sources` group: a citation without an article-level provision, without an https URL or without a real ISO retrieval date is an error, and a citation on a non-obligation relation is a warning. Coverage is reported as a number per relation, and `edge-source-floor.test.ts` pins the achieved share the same way the mutation floor pins kills — the share can rise, never fall. |
| v2.15.2 | 2026-08-18 | The prohibited-interlock regression test guarded the WRONG module. Surfaces (b) and (c) imported buildDossier/dossierMarkdown from src/lib/kg/dossier.ts — the evidence dossier, which never carried productClasses. The defect fixed in 2.15.1 lived in src/lib/workflow/dossier.ts, whose Markdown is a user-facing download, so the code fix was correct but unguarded. The workflow dossier JSON and Markdown are now asserted through the same shared helper (src/testing/vendor-silence.ts) on a prohibited fixture that still pulls controls into scope, so the assertion is not vacuous. Revert-check performed: temporarily removing the `!prohibited &&` gate in workflow/dossier.ts fails the new test ("where": "workflow dossier JSON") and passing it again requires the gate — a guard that cannot fail is not a guard. |
| v2.15.2 | 2026-08-18 | Deleted the committed scratch directory tmpchk/ (desc.ts, meta.ts, mkcheck.ts, fix.ts). tmpchk/fix.ts rewrote src/data/knowledge-graph.json in place and bumped meta.version — a foot-gun on any re-run. Nothing in it was worth keeping under scripts/. |
| v2.15.2 | 2026-08-18 | NOTED, NOT ACTED ON: market.entryShape was relaxed in 2.15.1 to accept an empty claimedAlignments array. That is legitimate for the four vc-grounding entries whose only 'claim' was a deployment property that has since moved to the hosting field, but it is a loosening of an error-severity rule and is recorded here so future waves do not lean on it to silence warnings. |
| v2.15.1 | 2026-08-18 | CORRECTION to the 2.15.0 entry's own wording: that entry claimed 'hops' is identical with and without the market layer. It is not, and cannot be — trace step 6 emits real supplied_by edges into vendorCategory and every trace edge is scored. Measured at this release: high-risk CV screening 413 hops with the layer, 378 without (35 vendor edges); support assistant 165 vs 136 (29 vendor edges). Band, score, chainMin and every non-vendor stage score are byte-identical in both variants, and the vendor stage always scores strictly above the chain minimum, so it can never become the weakest link that sets the band. An honest invariant replaces a false one. |
| v2.15.1 | 2026-08-18 | The 2.15.0 entry said 70 '(certification)' claims were downgraded; the true number is 63. Digits corrected in place — contentHash is the fingerprint of the graph file, not of the entry text, so no hash changed. |
| v2.15.0 | 2026-08-17 | Seven new integrity rules for marketExamples (entry shape, hosting enum, alignment wording, certification shape, duplicate product names, desc/marketExamples consistency, market-position labels — the last three errors/warnings per convention), with tests. Selection metrics added for the eight layers that had none. |
| v2.15.0 | 2026-08-17 | REFUSED and deliberately not imported: market-position / quadrant labels of named companies (an integrity error if one ever appears); per-vendor regulatory coverage assertions, coverage_depth and audit_ready fields, and vendor→article edges; Colorado SB 24-205 as a live regulation (repealed, never took effect — existing modelling unchanged). 'SR 26-2' stays flagged as pending verification and was filed as a curator verification proposal against Federal Reserve primary sources; a second unsourced compilation is circular corroboration, not confirmation. Compliance gate manifest and artifact pack stay vendor-free. |
| v2.13.2 | 2026-08-17 | GOLDEN SUITE — three audit stress tests became permanent cases, authored from law rather than from the graph, with article-level sources. g-confidential-summary (on-premise contract summarisation) PASSES: rc-minimal, and art-9 is correctly absent — confidentiality is located in GDPR Art. 32 / ISO 27001 as an information-security dimension and does not, per se, meet any Annex III category. g-gpai-no-exemption PASSES: a high-risk recruitment system built on an external, vendor-certified GPAI API still carries art-9 through art-15 — using a certified base model exempts nothing. The scope-drift cascade is a two-half pair: g-scope-drift-after PASSES with rc-high via Annex III 4(b), art-27 (FRIA) present and, with DE in markets, reg-betrvg-87 and gdpr-88 present. g-scope-drift-before FAILS and is recorded as known-failing with an owner and a date: the reasoner tiers the pre-drift FAQ bot as high risk on the employment keyword alone ("HR handbook") although it evaluates no person — the exact over-triggering the audit predicted, now a disclosed reasoner gap instead of an unknown one. The case asserts no negative expectation, so exclusion precision stays 1.0 and nothing wrong is published while the detector is narrowed. |
| v2.13.1 | 2026-08-17 | reg-pld — MATERIAL GAP CLOSED. The Revised Product Liability Directive carried a description and nothing else: no status, no lastVerified, no effective date, no citation, even though its transposition deadline is 9 December 2026. It now records status "in-force — transposition pending", the full date chain (entered into force 8 December 2024; transposition deadline 9 December 2026; applies to products placed on the market on or after that date), sourceKind primary and the EUR-Lex ELI citation. The statusNote states the evidence split explicitly: the in-force and deadline dates are primary (EUR-Lex), the transposition-progress picture (Hungary adopted 16 December 2025; roughly half of Member States with no significant public progress as of June 2026) is SECONDARY, from a Faegre Drinker survey. instrumentKind corrected from "regulation" to "directive" — the first use of that value in the graph, and the accurate one for a directive that binds only after national transposition. |
| v2.13.1 | 2026-08-17 | meta.currency.staleAfterDays SET TO 90 — app/graph mismatch fixed. The graph recorded no threshold, so the app fell back to 120 days; with the oldest lastVerified at 13 days under a weekly sweep, no node could ever be stale and the "may be stale" badge was structurally incapable of firing. 90 days is reachable: a node that falls out of the sweep for a quarter now surfaces to users as possibly stale. The reason is recorded in meta.currency.staleAfterDaysNote so the next reader does not have to rediscover it. |
| v2.12.9 | 2026-08-17 | HONEST LIMIT (documented, not fixed) — the reasoner runs client-side, so knowledge-graph.json necessarily ships inside the app bundle and a determined actor can recover it from network traffic. This lockdown removes the convenient bulk copy; it is not DRM and is documented as such in README.md and in a comment at the import site in src/lib/kg/data.ts. True protection would require moving the reasoner server-side, trading away latency, offline use and the 'no server sees your description' property — recorded as an open architectural decision, deliberately not approximated with obfuscation. |
| v2.12.8 | 2026-08-16 | WALKERS — the five monitoring dimensions are reachable. executeWalker dispatched through a three-way ternary, so the scheduled 'tech' and 'vendor' runs fell through to graph reflection and would have recorded reflection findings under a foreign walker identity. Dispatch is now an exhaustive Record<Walker, fn>: a walker without an implementation is a type error. A test asserts each of the five names resolves to its own function. The security model is untouched — agents still only propose, curators still decide, budget caps and ISO-week idempotency unchanged. |
| v2.12.7 | 2026-08-16 | ACCESSIBILITY — a skip-to-content link before the navigation, a real label and announced validation error on the describe textarea, and the unstyled 404 and crash screens rebuilt with house tokens. 43 unused scaffold components and 33 orphaned dependencies removed. |
| v2.12.5 | 2026-08-16 | LEGAL CORRECTION — Art. 50 APPLIES FROM 2 AUGUST 2026, NOT 2 DECEMBER 2026. The graph and the landing "what changes next" strip modelled 2 Dec 2026 as the Art. 50 application date. That was wrong and it told readers a duty that already binds them starts next December. Art. 50 transparency — chatbot disclosure, deepfake labelling, synthetic-content and emotion-recognition disclosure — is in force now. |
| v2.12.5 | 2026-08-16 | NEW INTEGRITY RULE cite.amendedSourceCurrency (error): a node marked amendedBy must not have its only citation pointing at a source on the hand-maintained list of texts verified to be pre-amendment, and must carry a caveat. The stale-source list is explicit and dated, entry by checked entry — a hostname heuristic would either over-block honest mirrors or go quietly stale. 0 errors on the shipped graph. |
| v2.12.5 | 2026-08-16 | OMNIBUS MODELLING CONFIRMED CORRECT against the primary text, unchanged: Annex III standalone high-risk 2 Dec 2027, Annex I embedded 2 Aug 2028, sandboxes 2 Aug 2027, Art. 6(1a)–(1c) inserted with 6(3)/6(4) unamended, Annex VIII Section B points 7 and 9 deleted, Art. 99(6a) extending the reduced caps to small mid-cap enterprises per Commission Recommendation (EU) 2025/1099. Recorded as a nuance on the omnibus block: the Commission's November 2025 proposal tied the deferral to a conditional trigger keyed to the availability of harmonised standards; the adopted text replaced it with unconditional fixed calendar dates. |
| v2.12.5 | 2026-08-16 | MEASURED SUITES, RE-RUN AFTER THE CORRECTION. Golden suite: 39 cases, 29 expectations met, 10 unmet (all 10 accepted with owner, date and reason), 5 not independently verified. Exclusion precision 73.7% (19 negative assertions), inclusion recall 100.0% (31), flag recall 77.8% (9). Temporal category now 5 cases, all passing. Mutation harness: 9 of 56 injected graph faults detected — tier-shift 5/8, gate-invert 3/8, status-force-in-force 1/8, and 0/8 for applies-in-flip, triggers-delete, triggers-spurious and crosswalk-swap. Survivors are named on /correctness. Full suite 464/464 across 44 files. |
| v2.12.4 | 2026-08-16 | MUTATION HARNESS: 9 of 56 injected graph faults were detected (8 per operator, 7 operators). Per operator: tier-shift 5/8, gate-invert 3/8, status-force-in-force 1/8, and zero for applies-in-flip, triggers-delete, triggers-spurious and crosswalk-swap. Surviving mutants are named individually on /correctness — a wrong jurisdiction mapping, a withdrawn instrument forced in force, and a deleted or invented trigger currently pass the suite unnoticed. |
| v2.12.4 | 2026-08-16 | TWO FALSE COMMENTS CORRECTED. The credits module claimed every ledger write goes through the definer functions; the payment webhook writes directly, and the comment now describes both sanctioned paths. The teams module described purchased credits as a future wave; that bucket is filled today. |
| v2.12.3 | 2026-08-15 | TESTIMONIAL FORM MATCHES THE DATABASE. The form accepted a longer quote and role than the table allows, so a member's submission failed with a raw constraint error. The limits are stated once and shared with the form, and the public display gate now really reads the consent record it documents. |
| v2.12.2 | 2026-08-15 | TESTS. Signature rejection (missing header, wrong secret, tampered body, stale timestamp), idempotent replay crediting exactly once, event-supplied amounts ignored, team-pool crediting, refund compensation and partial scaling, won-versus-lost disputes, the provenance split leaving earned standing untouched, and the unconfigured deployment refusing to start a checkout instead of half-charging. |
| v2.10.1 | 2026-08-15 | CRITICAL — REPEALED LAW NO LONGER SERVED AS APPLICABLE. The status vocabulary is defined on the term before the em dash, but isApplicableLaw() and isPendingLike() compared the FULL status string, so "repealed — reenacted by SB 26-189 (2026); never took effect" matched nothing and fell through to applicable. On the DEFAULT markets (EU+US) an HR, credit or claims analysis therefore listed the Colorado AI Act (SB 24-205) — which never took effect — as applicable law, carrying the duty-of-care, impact-assessment and risk-management-programme duties the same release documented as removed, and it was not even routed to the horizon. Fixed on all four fronts: both checks now compare statusTerm(); reg-colorado sets operatorBinding:false; a new integrity rule (jurisdiction.recordOnlyNotApplicable) asserts that no repealed or withdrawn instrument can be applicable and that every shipped status TERM is in the vocabulary; and reasoner regression tests run EU+US, not EU-only, asserting the act is absent from applicable law and present as a record on the horizon for uc-hr, uc-credit and uc-claims. The whole graph was swept for other statuses carrying a qualifier after the term. |
| v2.10.1 | 2026-08-15 | ART. 6(4) DUTIES ARE OBLIGATIONS. Taking the derogation flips the tier to limited, so collectObligations never saw them and they appeared in no obligation list, count or dossier section — they existed only as next steps. They are now surfaced as obligations, because they are owed precisely BECAUSE the derogation was taken. Earlier wording that implied otherwise is corrected here. |
| v2.10.1 | 2026-08-15 | RECORD CORRECTION. The reg-colorado statusNote said "Magistrate Judge Cyrus Y. Chung"; the verified record says "Judge Cyrus Y. Chung". The designation is dropped. |
| v2.10.0 | 2026-08-15 | CORRECTION OF OUR OWN RECOMMENDATION — the human-in-the-loop blueprint previously recommended a post-hoc explainability API (SHAP/LIME or CoT traces) for high-risk decision support including credit. For CONSEQUENTIAL SCORING of natural persons (credit, insurance pricing, tenant screening, employment scoring) that was the wrong default: local surrogate explanations are sampling-unstable, vary with the perturbation and background choice, and can be selected to look fair while the decision surface is unchanged — and an adverse-action reason that would not change the outcome if the person remediated it is not a defensible reason. Those cases now resolve to intrinsic interpretability (glass-box additive models with enforced monotonicity), with post-hoc methods kept as a supplementary diagnostic only. New integrity rule + test: a consequential-scoring use case must not resolve to a post-hoc-only explainability pattern. |
| v2.9.0 | 2026-08-12 | PENALTY MODEL — instruments now carry structured 'penalties' (tier label, maximum amount, maximum percentage of turnover, basis, who it applies to, article, citation URL) for the AI Act, GDPR, NIS2, CRA, DORA and Colorado. Conclusions and the dossier render statutory CEILINGS with the SME inversion of Art. 99(6) stated as written; the app never computes an expected fine. Integrity rule: a penalty without an article and a resolvable citation URL is an error. |
| v2.9.0 | 2026-08-12 | COLORADO — the record is corrected rather than quietly updated: SB 24-205 never took effect, implementation was stayed in April 2026, and it was repealed and reenacted by SB 26-189 in May 2026 (new node 'reg-co-admt', enacted-not-yet-applicable, so it routes to the horizon section rather than posing as applicable law). |
| v2.8.2 | 2026-08-12 | FIX (user-visible): the landing capability strip read the release count as if it were an array and rendered 'every one of the 0 releases is hash-chained', on the very page that claims every figure is counted from the projection. The count is a number and is now read as one; a test fails when a capability card renders a zero for a projection value that is non-zero. |
| v2.8.2 | 2026-08-12 | CORRECTION (log accuracy): the 2.8.1 entry described the dossier integrity suite as covering 'six use cases and eight target markets'. Measured: six use cases and five distinct markets (EU, US, UK, SG, JP) across ten market selections. The sentence now says what the suite actually runs. |
| v2.8.1 | 2026-08-12 | CORRECTION (model): the derivation factor was not band-effective. Weighted at 0.15, a hop resting on an asserted crosswalk mapping or a practice-derived link still scored 0.92 on strong endpoints and rendered as robust, which contradicts the model's own claim that an interpretive step is disputable by construction. Hops with an interpretive basis are now capped at 0.77, one point below the robust floor of 0.78, so they can never present as robust; the cap is reported as 'capped: interpretive basis' next to the unchanged five-factor breakdown, and weakest-link aggregation carries it into every chain that runs through such a hop. |
| v2.8.0 | 2026-08-12 | TRACK RECORD: new public /track-record page — the logged-corrections ledger read from this changelog, the dispute statistics of the public review pipeline (aggregate counts only, readable without an account), and the calibration table that will report whether provisional claims really are corrected more often than robust ones. Where the data does not exist yet, the page says 'not enough data yet' instead of showing a number. |
| v2.7.1 | 2026-08-11 | DATA / documentation: the 'art-26' → 'ev-fria' edge is retained with an explicit recorded reason (deployer duties whose implementation the assessment documents) rather than being silently duplicated next to the new 'art-27' basis; the 2.7.0 changelog sentence about it was wrong twice and now describes what the graph actually contains. |
| v2.6.1 | 2026-08-11 | FACTUAL FIX: the EU Declaration of Conformity artifact cited Art. 19; the declaration of conformity is Art. 47. Corrected to match the Art. 47/48 nodes already in the graph. |
| v2.6.0 | 2026-08-11 | INTEGRITY: five new rules — evidence.orphan (no artifact without an obligation pointing at it), evidence.derivation (must be text or practice), evidence.artifactClass (must be one of the six classes), evidence.textArticle (a text-derived artifact must link the article whose text names it) and evidence.notLaw (nothing may classify, trigger or impose through an artifact). jurisdiction.nodeCode was widened from jurisdiction and article nodes to evidence nodes. The suite is now 49 rules, 0 errors. |
| v2.5.1 | 2026-08-11 | CORRECTIONS to the 2.5.0 note: the single-points-of-contact count is 8 of 27 as of March 2026 — the date the data node and the EPRS source carry, not June 2026 — and the integrity paragraph said five new rules where six rule IDs shipped. |
| v2.5.0 | 2026-08-11 | ENFORCEMENT INFRASTRUCTURE: 8 of 27 Member States had notified a single point of contact as of March 2026, against a 2 August 2025 deadline; the number of AI Act notified bodies has no authoritative public count and is recorded as unknown rather than estimated. Application dates are stated as fixed by the Digital Omnibus, Regulation (EU) 2026/1744 (in force 27 July 2026): Annex III standalone high-risk 2 Dec 2027, Annex I embedded 2 Aug 2028, Art. 50 transparency for generated content 2 Dec 2026, sandboxes 2 Aug 2027. GPAI obligations have applied since 2 Aug 2025, with the Code of Practice published 10 July 2025. |
| v2.4.2 | 2026-08-11 | SCOPE CORRECTION: the 2.4.1 gating was too tight and hid foreign AI law entirely — no new instrument carried a triggers edge and no node carried the always-applicable marker, so a China, Japan or Vietnam target market returned no instrument at all. The horizontal, AI-specific binding instruments now carry that marker: the KR AI Framework Act, the JP AI Promotion Act, the VN AI Law and the Chinese generative-AI Interim Measures, synthetic-content Labeling Measures and amended Cybersecurity Law. Conditional instruments earn scope honestly through 9 new triggers edges instead: the Deep Synthesis Provisions from synthetic-media and generative use cases, the Algorithmic Recommendation Provisions from recommender use cases, and the UK Online Safety Act from user-facing chatbot and generative use cases. Data laws stay gated on an ADM provision plus personal data or an automated decision. |
| v2.4.1 | 2026-08-11 | CORRECTIONS to the jurisdiction wave: sub-national instruments (Colorado AI Act, NYC LL 144, NY RAISE) are in scope again when their country is a selected market — the previous ternary always returned false; instruments now enter a conclusion only via a triggers edge, a relevant ADM provision (personal data plus an automated decision), or an explicit always-applicable marker, so eIDAS 2, EEOC Title VII and data laws without ADM provisions no longer attach to every use case; unverified instruments (e.g. the UK Crime and Policing Bill) are excluded from applicable law and shown in the horizon/unverified section instead; Taiwan's registry tier now reads "binding AI law passed — not yet in force"; pending policy instruments (South Africa's national AI policy) appear on the horizon and declare operatorBinding:false. |
| v2.4.1 | 2026-08-11 | INTEGRITY: seven new jurisdiction rules — registered jurisdiction codes, lifecycle status vocabulary, operatorBinding:false on every non-applicable status, unverified never applicable, uptake evidence for cross-jurisdiction bridges, horizon context, jurisdiction-node codes — plus reasoner tests pinning market filtering, horizon exclusion and an EU+US regression against pre-2.4 output. Changelog order restored to strictly newest-first; the landing page derives its correction release by date and semver instead of array position, and per-jurisdiction instrument counts from the explicit jurisdiction field instead of an id regex. |
| v2.3.2 | 2026-08-10 | CORRECTION (found by the audit against our own graph) — reg-colorado still asserted SB 24-205 as 'effective 30 June 2026'. Implementation was stayed by a federal court in April 2026 and a narrower repeal-and-replace (SB 26-189) passed in May 2026. Status set to 'amended — original text superseded by SB 26-189 (2026), implementation stayed', desc rewritten so it no longer asserts the old effective date, statusNote records the facts and flags that the successor's final text is pending full verification, lastVerified 2026-08-09. |
| v2.3.2 | 2026-08-10 | MEASURED DIFF — nodes 299 → 299 (unchanged), edges 1062 → 1062 (unchanged). This is a text, status and instrumentation release: three node corrections, one new integrity rule, one new published dataset (study gaps), zero graph topology changes. |
| v2.3.1 | 2026-08-09 | CORRECTION — reg-cloudact carried no `full` field, so the citation resolver could not render its statutory reference. Added full = '18 U.S.C. §2523 / §2713 (CLOUD Act)'. reg-cloudact was also grouped into 'sector, market & employment law' by the layer catch-all; it now sits in the cyber & resilience layer, which is where a sovereignty counter-force belongs in our own layer model. |
| v2.3.1 | 2026-08-09 | SCORING FIX — vendor confidence and the build/buy/assemble verdict counted named examples by parsing the desc text only, so the four categories that carry examples exclusively in marketExamples (sovereign infrastructure, grounding/retrieval/memory, observability & MRM, agentic applications) were scored as 'no named examples' and 15 components supplied by them were mislabelled 'market unmapped'. Named-example counting now reads marketExamples first and falls back to the desc parser; regression test added. |
| v2.3 | 2026-08-09 | MEASURED DIFF — nodes 296 → 299 (+3), edges 1030 → 1062 (+32), detectors 29 → 29 (unchanged), source layers 9 → 10. New nodes: vendor categories (3) vc-grounding (Grounding, Retrieval & Agent Memory), vc-observability (Agent Observability & Model Risk Management), vc-apps (Agentic Applications & Copilots). New edges: 20 supplied_by (components/patterns → the three new layers) and 12 relates_to (vendor layers → articles, regulations and one control objective). Structured market examples: 93 named products across 11 vendor categories — sovereign infrastructure 15, models & data engines 11, grounding/retrieval/memory 16, orchestration 9, runtime security 7, observability & MRM 10, agentic applications 8, privacy engines 5, agentic execution governance 4, GRC 5, secure data infrastructure 3. Integrity suite: 0 errors, orphan rule green. |
| v2.3 | 2026-08-09 | TWO SOURCE CORRECTIONS — the compilation's 'Mistral → Art. 10 & 13 open-source exemption' claim was NOT ingested as an article claim: the open-source exemption analysis is contested, so the entry reads 'positions its open-weight offering for EU sovereignty and auditability requirements'. Foundation-model documentation duties attributed by the source to Art. 50 were re-aligned to our own article structure (Art. 50 = transparency, technical documentation = Art. 11) or left without an article number. |
| v2.2 | 2026-08-09 | MEASURED DIFF — nodes 279 → 296 (+17), edges 957 → 1030 (+73), detectors 29 → 29 (unchanged). New nodes by type: components (7) comp-interface-transparency, comp-agent-registry, comp-nhi-broker, comp-tool-boundary, comp-tokenisation-engine, comp-sovereign-boundary, comp-agent-memory-record-store; threats (3) thr-a2a-impersonation, thr-jurisdictional-access, thr-standing-credentials; control objective (1) ctl-nhi-governance; regulation (1) reg-cloudact; standards (2) std-bsi-c3a, std-secnumcloud; vendor categories (3) vc-sovereign, vc-privacy, vc-agentgov. Integrity suite: 0 errors, orphan rule green. |
| v2.1.2 | 2026-08-07 | NEW FIELD `citeUrl` (any node, optional): a manual override for the citation resolver in src/lib/kg/cite.ts, which otherwise derives an authoritative public URL by pattern (AI Act article pages, EUR-Lex CELEX for regulations/directives, eCFR for CFR cites, Cornell LII for U.S.C., ISO catalogue search for ISO/IEC numbers). Convention: `citeUrl` always wins; when neither an override nor a pattern resolves, the UI renders no link at all, because a guessed source URL is worse than an absent one. No node currently sets `citeUrl` — the field exists so a corrected or non-patterned source can be pinned without a code change. |
| v2.1.1 | 2026-08-07 | WHY A CORRECTION RELEASE: meta.currency states that a node without a lastVerified date is a claim, not a fact. The corollary is that a correction without a changelog entry is indistinguishable from a claim that was never wrong. This release logs the errors found in a review of the shipped 2.1 graph, so the diff is auditable rather than silent. |
| v2.1.1 | 2026-08-07 | PENALTIES — 'reg-aiact': the third sanction tier read €7.5m / 1.5%. AI Act Art. 99(5) is €7,500,000 or 1% of total worldwide annual turnover, whichever is higher, for supplying incorrect, incomplete or misleading information to notified bodies or national competent authorities. Corrected to 1% and the article citation added. The €35m / 7% (prohibited practices) and €15m / 3% (Art. 9–15 high-risk obligations) tiers were already correct. |
| v2.1.1 | 2026-08-07 | UNDATED QUANTITATIVE CLAIMS — 'pat-dual-gate' carried four named guardrail products with specific latency figures and no verification date, the only quantitative vendor claim in the graph without one. It now has lastVerified 2026-08-07, the date of this correction pass, plus a statusNote framing the numbers as indicative order-of-magnitude figures from that period, dependent on model size, hardware and policy count, to be re-measured per stack. 'uc-scribe' summary no longer presents a named vendor and a named customer as fact; it describes the ambient-scribe pattern instead, consistent with how vendorCategory nodes handle named vendors. |
| v2.1.1 | 2026-08-07 | CHANGELOG INTEGRITY — the 2.1 entry itself was found to be reconstructed from a written description rather than from the data, and overstated almost every count (79 nodes and 482 edges claimed against 22 nodes and 255 edges actual; new threats, evidence artefacts and control objectives claimed where none were added). It has been rewritten from a programmatic diff of the v2.0 and v2.1 graphs and now names only ids that exist. The first rewrite still reported 251 edges (695 -> 946): it diffed an intermediate commit and counted only edges incident to a new node. Re-measured at the 2.1 merge point (950 edges), the delta is 255, and 6 of the new edges connect two pre-existing nodes, so the claim that every new edge touches a new node was also wrong; both are corrected in the 2.1 entry. The 1.6 entry has now been re-derived the same way: all nine of its numeric claims hold against a v1.5 -> v1.6 diff (8 use cases, 14 components, 7 patterns, 6 evidence artefacts, 8 regulations, 3 standards, 9 threats, 4 ISO 42001 control objectives — ctl-aims-riskassess, ctl-aims-dataquality, ctl-aims-traceability, ctl-aims-perfmon with their four 'includes' edges from std-iso42001 — and 6 new detectors, 15 -> 21). |
| v2.1.1 | 2026-08-07 | CURRENCY HYGIENE — meta.currency.monitoredFeeds still listed the AILD procedure file as monitored, contradicting 'reg-aild.statusNote'; the entry now names the Omnibus and EHDS files and records that the AILD file is closed and watched only for a successor. 'art-4' and 'reg-colorado' carried a status with no lastVerified, against meta.currency.nodeFields; the status is dropped rather than backed by an invented date, and both descs still state the in-force date. meta.version and meta.date are bumped to 2.1.1 / 2026-08-07 so the graph identifies itself as the corrected build. |
| v2.1 | 2026-08-06 | WHY 2.1: 2.0 answered 'what do I build or buy it with?'. 2.1 answers 'what is actually being sold, under which regime, on which stack?'. Measured against the shipped v2.0 graph: 22 new nodes (257 -> 279) and 255 new edges (695 -> 950; 257 distinct new from/to/type triples, two of which deduplicate entries the v2.0 file carried twice). No nodes or edges were removed. 249 of the new edges attach to at least one of the 22 new nodes; 6 connect two pre-existing nodes and are corrections to the existing layer rather than part of the new one: reg-raise -> comp-vendor-dd / comp-registry / comp-incident (requires) and -> comp-risk-register (relates_to), plus supplied_by edges from comp-model-router and comp-watermark to vc-models. Counts and named ids in this entry were re-derived from a programmatic diff of the two graphs after the original entry was found to overstate them; an earlier correction put the edge delta at 251 (695 -> 946) by measuring an intermediate commit and counting only edges incident to a new node. See the 2.1.1 entry. |
| v1.5 | 2026-08-04 | THEME 3 — Currency & drift (answers 'a node that was accurate at launch can quietly become wrong'): meta.currency added — status vocabularies for legal acts (in-force/amended/proposed/repealed) and standards (draft/enquiry/formal-vote/published/ojeu-cited), per-node 'status' + 'lastVerified' fields, monitored feeds (OJEU, EP Legislative Observatory, JTC 21 dashboard, AI Office guidance), quarterly deepsearch review + community-dispute-triggered re-verification, and change-propagation rule (status change flags all dependent edges for review). Live proof shipped in this very release: prEN 18286 became EN 18286:2026 (published July 2026, first AI Act harmonised-standard candidate to reach publication; OJEU citation still pending) — the node was silently stale and is updated here. |
Dispute statistics
Loading the review pipeline numbers…
Calibration
The promise behind the three confidence bands is testable: if the bands mean anything, a claim we published as Provisional should be corrected more often than one we published as Robust. Measuring that requires corrections recorded against the band a claim carried when it was published — tracking started 2026-08-27, so there is not enough data for a statement yet. The table structure is shown so you can see exactly what we will have to report.
| Published band | Claims published | Later corrected | Correction rate |
|---|---|---|---|
| Robust | tracking started 2026-08-27 | — | not enough data yet |
| Check-worthy | tracking started 2026-08-27 | — | not enough data yet |
| Provisional | tracking started 2026-08-27 | — | not enough data yet |
Until this table carries real rows, the only external anchor we have is the machine-conducted pilot source audit over 5 cases: Web research 34% · Free checkers 17% · RAINavigator 62% instrument coverage. Machine-conducted pilot source audit, Aug 2026 — method, limitations and our own 12 found weaknesses: read the pilot study →
Hash chain
From release v2.8.0 forward, every release records the SHA-256 hash of the graph file it shipped and the hash of the release before it, computed by the build script. Older releases carry no hash: adding one retroactively would be manufacturing evidence, so we do not. See the chain on the changelog →