Your documents in git. Git nowhere in sight.

The people who do know git keep it. They clone, branch, push, and their commits arrive in the same review as everyone else's. Both kinds of contributor are editing one corpus, and neither has to pretend to be the other. That combination is the whole product: git-canonical, and people without git treated as first-class contributors.

Verso reads the repository's files and classifies every one of them, and every Markdown page is put through the indexer's own parser before anything is written. A page that cannot be read is not imported half-way and repaired later; it is skipped, and the reason it was skipped is on the receipt. Images come across with the pages that use them. There are caps — 2 MB a page, 10 MB an image, 2000 files, and a ceiling on decompressed bytes — because an import reads a stranger's data.

The receipt is the audit row, read back. It is not a summary rendered next to the record — it is the record, displayed. The receipt and the log cannot disagree, because there is only one of them.

A rendering on this page, not a photograph. The shape and the reason wording are the product's. The reasons are a closed set — a dot-file, not a document, over the 2 MB page limit, over the 10 MB image limit, past the 2000-file import limit, or unreadable MDX. Nothing is silently dropped.

Sync, and publishing back

Sync is a button you press, on the site's GitHub screen — not a webhook, not a schedule. It compares the repository's head against the last commit Verso saw and brings over what was added, edited and deleted. If the history was rewritten or the branch diverged, it stops and says so rather than guessing. There is no push-triggered sync today, and this page will not imply one.

Publishing in Verso pushes back through the Git Data API as an ordinary commit — blob, tree, commit, ref — with the proposal's title as the message and a line naming the proposal number. The push is fast-forward only. If the remote moved while you were working, Verso refuses, records why on the connection, and never blocks the publish that already happened inside Verso. It never forces. The commit lands under the Verso app's installation identity, which is what GitHub attributes an App's writes to; commits made inside Verso by a person carry that person as author and co-author.

An imported site starts members-only. A private repository stays private until opening it is a deliberate act, and the screens say so before and after — the failure mode where a company's internal handbook becomes a public website by default is a failure this product is not willing to have.

The reviewer is asking what will this do, and the two answers come apart most sharply where the stakes are highest. The hardest class is a pointer whose target moved while its own words did not: the link now goes somewhere else, and a character-level comparison of the sentence carrying it is blank, because nothing in it changed. A redline has no way to represent a relationship between two documents. The Change Ledger puts that case at the top of the list, in words.

A rendering on this page, not a photograph. Six fixed groups, always in this order. Page settings renders even when empty — that is where a change to who may read a document would appear, so its absence has to be asserted rather than inferred from a heading that isn't there.

The approve bar says what it is about to record

Reviewers approve in bulk. Everyone knows this, and most systems pretend otherwise, which produces item-by-item clicking that looks diligent and is not. So both buttons are real, and the count is stored — with the version of the classifier that produced the grouping, so that a year later the system said this was wording only is still a falsifiable statement rather than a memory.

A rendering on this page, not a photograph. Removing the shortcut only creates workarounds; what changes behaviour is being honest about the number, and keeping it.

Two properties that matter more than they read

• An approval is scoped to specific changes and to the content hash of the blocks they touch — never to the proposal as a whole. If the live document moves under a review, approvals of untouched blocks survive and approvals of touched blocks are invalidated individually, blocking, naming what moved and when.
• The base is stated in words, always. A line says what the comparison is against and whether it has moved since the review started. When it has, that line becomes the loudest thing on the screen.

Two smaller honesties live in the same bar. You can ask a colleague to review — from a picker of the people who could actually review this proposal, resolved by role and by surface, with you excluded from your own list. And if you approve your own work, the bar says so before you do it, and the record says so afterwards.

A support engineer three weeks into the job, a customer reading your API guide, a field officer answering a consultation. They open the page and edit it. No account, no licence, no git remote.

The suggestion lands in triage first, and triage is a different act from review with a different word, a different button and a different route. Accepting at triage means this is a good-faith human. Approving at review means this change is correct. Confusing those two would be an authorisation bug wearing a user-interface costume, so they never share anything.

The person who suggested gets a link that shows what happened to it — accepted, declined, or published.

Drop a file into the editor, paste it, or use /image from your computer. It is committed, content-addressed, into the same git repository as the pages that use it, on the branch you were editing. Clone the repo and the images came with you.

Alt text is asked for at insert time, because asking later means asking never.

Visibility is structural for a picture exactly as it is for a page: serving reads the bytes from the caller's own scope, so an image uploaded on an internal surface is a 404 to the public — not because a filter said no, but because the public tree has no such file. The test asserts that from the git objects themselves.

Two deliberate refusals. Formats are decided by decoding the bytes, never by the MIME type the uploader claimed. And SVG is not accepted: it is a script container wearing an image extension.

In the editor, / → Form. The block drops into the page wearing the page's own theme — labels in the reading face, controls in the interface face, inside the measure, no card chrome. It is part of the document, not an embed. A reader fills it in and the block is replaced by a small receipt where it stood: no modal, no redirect, no confetti.

Answers go to destinations — email, Slack, or a webhook — through one event bus. The admin console lists forms and their submissions above, destinations and their deliveries below, with each delivery attempt and its error shown verbatim rather than summarised. Delivery is at-least-once, retried, and dead-lettered when it keeps failing; the product says that rather than implying exactly-once.

The form's definition is read from the page's own source, never from the browser that submitted it, and a submission carrying a field the page never declared is rejected rather than quietly stored.

Form definitions live in the repository. Submissions never do. The form is part of the document and travels with it; the answers people gave you are operational data and stay in the application's own store.

Theming is a small set of seeds — brand hue, tone, radius, density, type pairing — and the resolver derives the whole ramp from them. What gets stored is theme/tokens.json and theme/theme.css, committed into your site's git repository with an author and a message. A rebrand is a change like any other change: reviewable, revertable, and undo our rebrand is a git revert rather than a support ticket.

Every derived pair is checked against WCAG 2.2 AA at save time and the ratios are emitted as literal values. To be exact about what that does and does not do: it reports, it does not block. You can publish a theme that fails, and when you do, the failures are named on the screen and written to the audit log. The alternative — refusing a company its own brand colour — is a fight the product would lose, and losing it silently would be worse.

One thing the theme editor deliberately cannot reach: the signal and diff colours. Approved-green, needs-a-close-look-red, the insertion and deletion marks — those mean the same thing on every Verso site, because a review screen where the customer chose what red means is a review screen you cannot read.

And there is no Powered by mark anywhere, on any plan, because there are no plans.

One corpus, several audiences: the public docs, a customer-only surface behind login, and the internal wiki and runbooks. Each surface reads its own branch, so a page above a reader's surface is not in the tree they are reading. A public search for a term that appears only on an internal page returns zero results — not no results you are allowed to see; zero, because those words were never indexed for that surface.

Absence, not refusal. No lock icons, no greyed rows, no request access. A reader on the public surface experiences a site with no internal pages, not a site with hidden ones. Where a refusal is unavoidable — you followed somebody's link — it is short, and it never confirms what exists.

One limit stated plainly, because it is the one a security review asks about: full-text and vector search run locally, on the deployment's own machine, with no network call. The generated answer does not — it needs a hosted model, and it is off unless a key is configured. With no key, search still works completely and the answer degrades to one honest sentence instead of an invented one. There is no local generation model, and pretending otherwise is exactly the claim that ends a review.

Clone the repository and you have the documents as plain Markdown, in real directories, with real history and real authorship — plus the images, plus the theme, plus the form definitions. Open it in any editor. Grep it. Diff it. Hand it to somebody in 2050 who has never heard of this product.

Two honest notes about the record, because a page that only tells you the good parts is not telling you anything. Publishing squashes: a proposal becomes one commit carrying intent, with the contributor recorded as a co-author — attribution survives, the intermediate commit-by-commit sequence does not survive as commits. And git is the documents, not the audit log: what was opened, what was approved without being opened, and under which classifier version, lives in the application's own database. Both stores are needed and neither is a copy of the other.

On price: GitBook publishes $65–249 per site per month plus $12 per user; Mintlify publishes a free tier, then $450–540 per month with metered AI credits. Verso has no pricing page and nothing to buy — there is no billing in the product at all. When there is, it will be on this page with a number on it.

• Billing, plans and pricing. There is no payment path, no plan model and no pricing page. Nothing in the product charges anybody.
• Single sign-on and provisioning. No OIDC, no SAML, no SCIM. Sign-in is Google or email and password. The authentication interface is deliberately narrow so a driver can be added without touching any route or permission check — which is a reason to believe it is tractable, not a reason to believe it exists.
• More than one language. English. No translation workflow, no per-locale routing, no diglot rendering.
• An OpenAPI reference. Verso does not render API reference documentation from a specification. If that is the job you are hiring for, this is not the tool yet.
• Published versions. No v1 / v2 version switcher, no pinned release of a documentation set, no scheduled or embargoed publication. Publishing is manual and immediate.

This list is dated, and it is expected to be wrong in the direction of items leaving it — which is the only direction that is any good. PDF export left it on 4 August: every site now prints as one document, at its own address, through the browser's own dialog. The same day added watching a page, a read-as-page preview in the editor and every review, a conflict-resolution screen, audiences you can add and close after a site exists, org-wide reading for internal surfaces, pages that belong to no site at all, and ⌘K search across everything you can read.