What we have shipped
Not a roadmap. A changelog, generated from the repository: every row
names the commit that shipped it, and the build fails if that commit is
not on main — the branch that serves this site.
No row here can be written by hand into existing, which is also why the
most recent date below is the real one rather than today's.
- 15 changes shipped
- 5 areas of the product
- 2026-07-19 most recent
By Philip Luca — Founder of GovExpress; prior domain experience at Bloomberg Government and GovWin IQ.
02 — HOW TO READ THIS
- Shipped
- Live on govexpress.ai. 15 rows, each carrying the commit that put it there, resolved against git at build time.
- Dated
- The date beside a row is the commit's own author date, not the day somebody wrote the row. The build compares the two and fails if they disagree.
- Nothing else
- There is no second column. We do not publish a pipeline, a plan, or a date for anything unreleased — see the note at the foot of this page.
Shipped
15On the branch that builds govexpress.ai. Each row names the commit, and the build fails if that commit is not there — so this page cannot describe something a visitor cannot reach. There is no second column: we do not publish what is coming.
Score & Methodology
-
/methodology — what the Federal Readiness Score reads, in public
Every category the score reads, what each one looks at, and — the part most scoring pages omit — what the number never claims. Published rather than gated, because a diagnostic nobody can argue with is a diagnostic nobody should trust.
-
Containment narrowed to scoring context, so it can stay switched on
The first version of the containment gate matched ordinary web code and had to be argued with on every deploy. A gate people route around is not a gate, so its patterns were narrowed to scoring context — which is what let it become blocking instead of advisory.
-
A build gate that keeps scoring internals off every public page
The score's internals are the product, and a marketing page that leaks one hands a vendor the answer key. A gate greps the built site for scoring identifiers, weights and thresholds and fails the build on a hit, so containment is a property of the pipeline rather than a habit.
Compliance
-
FedRAMP 20x Class A, written only from primary sources
Published two weeks before the Class A submission pipeline opened, with every date, eligibility rule and Key Security Indicator linked to where FedRAMP says it. It set the sourcing standard the compliance brief now inherits — a link to the record, or the claim does not run.
-
The federal-entry guide for software companies, and its cluster posts
A long-form guide to selling software to the federal government plus three supporting posts on the paths an ISV actually has to choose between. The first content on the site written for the reader who has not decided whether federal is worth entering at all.
Data
-
The first contractor profiles, built from public award records
Twenty contractor pages assembled from federal award data rather than from a company's own description of itself, each carrying the reporting-lag disclosure the figures require. The corpus this established is what the entity graph later scaled.
-
The USASpending layer — typed, slugged, and rolled up by parent UEI
Federal award data arrives as child records under dozens of registrations per company, so a naive read understates a contractor and a careless one double counts. This layer resolves to the parent unique entity identifier first and types everything downstream of it.
Platform
-
An editorial type system, on a benchmark scale
Space Grotesk for display, Instrument Serif for the emphasis word, and a measured scale the gates assert at render time rather than trust to a stylesheet. Federal buyers read the site on the same screens they read everything else on; it should not look like a template.
-
A gate suite that opens the page and measures it
Thirteen gates covering type scale, type face, focal discipline, photo licensing and horizontal overflow, run in a real browser at two viewports and with scripting disabled. Assertions about rendered pixels, not about source files that were supposed to produce them.
-
One token file, and a gate that fails on a colour typed anywhere else
Colour, spacing and radius moved into a single stylesheet, and a build gate now fails on a hardcoded hex anywhere outside it. That is what makes a light-theme regression a build failure instead of something a visitor reports three weeks later.
-
A contrast and accessibility pass, and honest data-source naming
Fixed-dark surfaces decoupled from the theme, small text brought to WCAG AA against what is actually painted behind it, and every data source renamed to the system it really comes from. Federal buyers run accessibility checks; so should we, first.
-
The site moved to a static S3 and CloudFront deploy
Every page is prerendered and served as a file. There is no application server in front of the marketing site, which removes an entire class of exposure from a surface that holds nothing worth attacking in the first place.
API & Integrations
-
Explicit AI-crawler allows, and a named author on the record
Answer engines are how a compliance question gets asked now, so the crawlers behind them are allowed by name rather than by omission — and the pages they read carry a named, credentialed author and a citation baseline instead of an anonymous byline.
-
Entity pages, and the handoff endpoint into the app
The route family behind every contractor profile, plus the handoff endpoint that carries a reader from a public page into the application without retyping who they were looking at. The seam between the marketing site and the product.
-
Structured-data builders and a generated robots.txt
Schema.org output moved into one set of builders instead of literals typed into each template, so a structured-data fix lands on every page that emits the shape rather than on the two someone remembered. robots.txt became a route, not a static file to forget.
04 — WHAT THIS PAGE DOES NOT DO
It does not tell you what is coming. Not as a hedge — as a rule, and not a temporary one. We publish no roadmap, no pipeline, and no dates for unreleased work. A plan published is a plan that has to be quietly revised, and revising it in public is how a page like this turns into the compliance guidance we spend our time correcting: confident, specific, and wrong a month later.
Ordering is by date, not by priority. Rows are grouped by area and sorted newest first. Nothing here says which piece of work mattered most, because that is a judgement and this page only carries facts.
It describes this site and the public data behind it. Work inside the application is not listed unless it changed something a visitor can see here. Scoring internals are never listed: a build gate fails if any of them reach a public page, and this page is a public page.
The categories the score reads, and what it never claims, are on the methodology page. The regulatory movement behind the Compliance rows is tracked in the compliance brief.