The busiest day of the week. sgit.ai published four business plans as vaults (business plans↗), a set of proposed partnerships (version log, v0.6.4) and two briefs for riskmandate.ai (briefs index↗). riskmandate.ai built one of those briefs the same day (v1.34.2↗).
Lead: A brief written on one site, built on another the same day
sgit.ai released v0.6.7 at 20:55 on 24 September (git log): a build brief asking riskmandate.ai for an interview page (the brief↗). The reasoning is in one line: "Asking them to talk for twenty minutes usually does." (the brief↗). The reader pastes a prompt into ChatGPT, which interviews them in voice mode and writes up their feedback (the brief↗). The first page is for a founder strong in UK events, marketing and content (version log, v0.6.7).
riskmandate.ai registered it as D19 and built it in v1.34.2, dated the same day (v1.34.2↗). Its note links "The first interview page", unlisted and sent by link (v1.34.2↗). The copy button was tested in a browser against all 3,573 characters of the stored prompt (v1.34.2↗). The prompt is the brief's, "with two corrections" to what the site states, both recorded beside it (v1.34.2↗). The page reached the live site with v1.34.3, after failing CI checks had held back the releases before it (v1.34.3↗). v1.34.4 then added six questions on the Agent Behaviour Policy and made it a thirty-minute interview (v1.34.4↗), which is how the live page↗ reads now.
Part of the brief is not done. Its checklist asks for one end-to-end run in ChatGPT voice mode (the brief↗). riskmandate.ai's agent has no ChatGPT account, "so that run is the lead's." (v1.34.2↗). Sending summaries back through a write-only lane stays marked as later (v1.34.2↗).
The two sites' records disagree. riskmandate.ai's brief register↗ lists the brief with what was built and what was not. In the snapshot taken that night, sgit.ai's briefs index↗ still shows the ask as open, and the brief itself still reads "Status: open. Written 24 September 2026." (the brief↗). The longer story is here.
Also today
Four business plans, each a vault
sgit.ai published four business plans as vaults, each from a voice memo by the founder that day (Company X-Ray↗, Lesson Loop↗, Risk Acceptance Office↗, Connector Twin↗). Company X-Ray reads a company's own documents together and sells in four levels from £50 to £1,500 on RiskMandate.ai's pattern (vault page↗). Lesson Loop turns a coach's end-of-lesson voice memo into a note in the player's own vault (vault page↗). The Risk Acceptance Office replays one invented risk over six weeks (vault page↗), behind an article↗ whose pitch is "who has accepted this, and until when?". Connector Twin replays an invented agent session from a hash-chained journal (vault page↗). A new page gathers them: "We are looking for business partners to build them." (business plans↗).
Proposed partnerships with the clouds and the AI providers
sgit.ai added sixteen pages under /partnerships/: two hubs, and one page each for cloud platforms and AI providers (version log, v0.6.4). They are proposals, and each hub says "there has been no conversation yet" (clouds↗, AI providers↗). The clouds hub is plain about status: Docker works, the AWS templates are in beta, the founder's Azure and Google Cloud deployments are not written up, and S3-compatible stores are untested (clouds↗). The vault connector the provider pages describe does not exist yet (AI providers↗). Research corrected two first drafts, including that sgit.ai is served from GitHub Pages, not AWS (version log, v0.6.4). The same release asked riskmandate.ai for the risk side of every partnership (brief↗); that ask is still open on the briefs index↗.
Who holds the keys?
The day began with a call for collaboration on vault key management (git log, version log, v0.6.2). It opens: "We are looking for a key manager, not building one." (the call↗). It asks password managers, identity providers, platform credential managers and hardware key makers for browser-first key release on the user's approval, with names that are addresses and never keys (the call↗). The rule comes from experience: a word-based share token was removed on 12 August 2026 after a review found it could be recovered in about a tenth of a second on a GPU (the call↗). Later plans lean on it: Lesson Loop lists easy key handling as open and points here (Lesson Loop↗). The page says no organisation named on it has been contacted (the call↗).
Two sites ask the same question: can it be undone?
On the same day, both sites wrote about what Google lets you take back. sgit.ai's article quotes the Gmail API on its delete: "This operation cannot be undone." (sgit.ai article↗). riskmandate.ai's article, "A deleted meeting comes back. An edited one does not.", argues that editing a calendar event, not deleting it, is the permission to worry about (v1.32.3↗). Both corrected themselves on Google Vault: sgit.ai's plan found Vault has covered Calendar since November 2023 (Connector Twin↗), and riskmandate.ai found that Workspace editions with Vault keep earlier versions for an admin to export, not to restore (v1.32.3↗). In the snapshot, neither article links to the other (sgit.ai article↗, riskmandate.ai article↗).
riskmandate.ai draws the chain to the board
riskmandate.ai published an article arguing that the map of who owns what in AI runs sideways, and accountability runs upwards (v1.34.4↗). Over the next releases it drew the article: a blast radius that can be played (v1.34.5↗), then every live risk lighting its path to the board (v1.34.6↗), then residual risks: "A control does not make a risk zero; it leaves a green one." (v1.34.8↗). sgit.ai's risk acceptance article makes the same point in its own words: every path ends at the board (sgit.ai article↗). Both say the engine is missing: authority as data and the clocks are proposed, not built (v1.34.4↗), and no engine yet records acceptances or fires at expiry (sgit.ai article↗).
Everything else, by site
sgit.ai
- Every risk is already accepted↗: a foundation article on risk acceptance; a vault per material risk is labelled a proposal.
- Before you give an agent a connector, give the connector a twin↗: the case for a journal and replay of every connector call.
- Business plans to build on sgit↗: the new home for the plans.
- For RiskMandate.ai: the risk side of the partnerships↗: an open brief, which also notes that Level 1 is priced at £10 on riskmandate.ai's pricing page and £5 elsewhere.
- Proposed partnership pages, one line each:
- AWS↗: a reviewed reference architecture and a marketplace listing, from templates in beta.
- Microsoft Azure↗: deployed in the founder's tests, undocumented; a Blob Storage backend is the main work.
- Google Cloud↗: finish the Cloud Run path; storage routes not yet tested.
- IBM Cloud↗: vaults beside IBM Sovereign Core for regulated data.
- The European clouds↗: one tested deployment on each of five providers.
- DigitalOcean↗: a one-click vault server.
- Rackspace Technology↗: managed vaults across clouds.
- Netlify↗: encrypted sites on a static host.
- OpenAI↗: a vault connector for the plugins directory.
- Anthropic↗: a vault connector for the connectors directory, and vault skills.
- Mistral AI↗: a fully European stack.
- Google Gemini↗: a CLI extension and a route to the agent gallery.
- OpenRouter↗: the bounded-key pattern vault apps already use.
- ElevenLabs↗: per-key spend limits or short-lived speech tokens.
riskmandate.ai
- v1.32.0↗: How it works rebuilt as six steps, each with its status; a diagram naming things that do not exist removed.
- v1.32.1↗: the word "rung" replaced across the site, with a test that keeps it out.
- v1.32.2↗: UK support, in the open, a register of 79 programmes and events; nothing applied for.
- v1.33.0↗: business cases, by the risk a product changes, starting with its own.
- v1.34.0↗: an OWASP graph and eighteen open-source business cases.
- v1.34.1↗: a brief and pack for a behaviour-policy vault about each organisation the lead talks to; no real person's vault made yet.
- v1.34.3↗: four releases that CI had held back reach the live site.
- v1.34.7↗: the version chip shows on laptops, phones and tablets.
SGit-AI__CLI
- The interview-page brief, the canonical copy, status open.
- The partnership-risk brief, the canonical copy, status open.