The AI Governance Tracker

There exists a finite window—roughly now to 2030—before AI embedding in critical infrastructure reaches a point where binding democratic governance becomes structurally unenforceable. Not by decision. By distributed normalization.

The AI Governance Window Tracker monitors that window in real time. Current status: Narrowing, approaching Critical.

Putting the Tracker to Work

• Set your contributor tier in the permission panel before submitting signals — your tier determines which domains you can write to
• Set each domain's status using the status chips:
  Opening, Holding, Narrowing, Critical, or Closed
• Submit signals to any domain you have write access to: signal text, source, and confidence level—saves locally without a server
• Run a synthesis to get a cross-domain verdict from the Claude API: window status, dual-clock positions, net assessment
• Export the result as markdown to archive or publish as a dated assessment entry
• Signal data is stored locally in your browser (IndexedDB) and persists across sessions until you clear your browser storage. Each new session will load your last signals—review and update them before running synthesis. Use incognito mode for a fully clean session.

About This Instrument: A note on the trackers origin

The AI Governance Window Tracker began as a SKILL.md—a structured methodology encoded for an AI agent—on March 19, 2026. It runs on a codebase with a longer lineage: source code originally built by Adam Wiggins and Orion Henry in 2004, before Heroku existed, solving problems of remote data persistence that the surrounding infrastructure hadn't yet abstracted away. The full origin story: the project that necessitated the Tracker, the codebase behind it, and the 20-year thread that connects them, is in From Skill to Instrument.

A note on infrastructure transparency—April 20, 2026

On April 19, 2026—the same day this tracker and its origin article launched publicly—Vercel disclosed a security incident involving unauthorized access to internal systems and credential compromise for a limited subset of customers. The incident originated with a compromised OAuth token from a third-party agentic AI tool used by a Vercel employee, which cascaded into access to environment variables not marked as sensitive.

This tracker is deployed on Vercel. Upon learning of the incident this morning, I rotated the app's Anthropic API key, marked it sensitive, and redeployed. User data was not at risk—the tracker's local-first architecture means all assessment state lives in your browser, not on Vercel's infrastructure.

The timing is worth naming directly: the incident is a concrete example of the agentic OAuth risk that this tracker monitors as a Domain 3 signal—AI agents granted broad third-party permissions producing downstream access failures that no single actor fully controlled or anticipated.

The governance problem the tracker exists to document showed up in the tracker's own deployment stack on launch day. That's not irony. That's the environment we're in.

Changelog

v2.0 | April 21, 2026 (evening)

• Duplicated Submit All Signals button below the five domain cards—no more scrolling back to the top to submit
• Fixed button disabled state parity—both Submit All Signals instances now correctly gray out when no signal fields are populated
• Added system prompt to synthesis API call enforcing compact, schema-constrained JSON output—optimized for production serverless environment
• Enforced exact status vocabulary in synthesis prompt (Opening, Holding, Narrowing, Critical, Closed)—domain status chips now populate correctly after synthesis runs
• Migrated API proxy to serverless function (/api/synthesize.js) — production no longer depends on local node server.js
• Fixed synthesis card layout on mobile—three-column clock grid now stacks to single column on small screens
• Fixed Download / Run Synthesis button overflow on narrow viewports—buttons now wrap cleanly to a new row

v2.0 | April 21, 2026 (morning)

• Fixed default domain status: all five domains now load as Unassessed rather than Holding—status is derived exclusively from synthesis, not stored as durable state
• Synthesis now writes per-domain status back to domain cards after running
• Added storage behavior note to user instructions: signal data persists in browser IndexedDB across sessions; incognito mode for clean sessions

v2.0 | April 19, 2026
Transition from Claude skill to live web application. The tracker rebuilt as a Vite + React + TypeScript + Tailwind app with Y.js / IndexedDB persistence, a five-domain signal board, multi-tier permission model derived from mod_infinity.c, AI synthesis via Anthropic API, and live deployment at governance-tracker-eight.vercel.app, embedded at systemsofthought.com/governance/. First application of the Systems of Thought design system—Libre Baskerville / Inter typography pairing, #081225 accent color—established in this project's April 17 Ghost build session.

v1.5 | April 5, 2026
First full quarterly assessment. Complete output structure delivered: domain assessments, summary table, dual-clock positions, net assessment, implications, and executive summary. Window estimate tightened from 2025–2032 to 2025–2030. ~35+ signal categories active.

v1.2–v1.4 | March 23 – April 5, 2026
Iterative refinements. Signal architecture expanded, cultural signal synthesis layer added, cadence architecture replaced. Domain 3 and Domain 5 signal categories introduced. Frontier developer timeline confirmations added as a tracked signal class.

v1.1 | March 23, 2026
First directional check. A quick five-domain signal pass—no dual-clock positions, no domain summary table, no formal synthesis structure. Window status implied as Narrowing but not formally stated.

v1.0 | March 19, 2026
Initial build. The tracker was developed as a private Claude skill in a single session. The .skill file was packaged and delivered, ending with a first prompt run to establish an initial baseline assessment.