CLAIM→EVIDENCE→VERIFY→PUBLISH
Every claim traces to evidence.
Anything the evidence doesn’t support doesn’t get published — including on this page.
A verified control, gone by the afternoon
In July 2026, while pinning evidence for a security claim that had been live-tested that same morning, the control turned out to be absent — an unrelated merge had rewritten the file and dropped the authorisation attribute, the caller-scoping helper and the rate limits.
Nothing failed, because no test asserted any of it. A trust page generated from documentation — or from the assessor’s verified-that-morning note — would have published a false security claim about a live vulnerability.
Intransic is the process that caught it: sort the claims a repository makes, record what supports each one, and refuse to publish anything the support does not carry.
41 [HttpGet("records/{id}")]42- [Authorize(Policy = "CallerScoped")]43- [EnableRateLimiting("PerCaller")] + // (nothing — and nothing failed)44 public async Task<IActionResult> GetRecord(string id)
A security property not asserted by a test will eventually be removed by someone who does not know it matters.
Four gates between a claim and the public
One pipeline, run inside the repository. A claim moves right only when the gate holds; when evidence weakens, the claim moves back — on its own, before anyone reads it.
# one claim per capability, none implied
- id: SEC-004
claim: >-
Record reads are caller-scoped; a
foreign caller's id returns 404.
status: verified # earned below, not assertedA worked example — the July control, traced through all four gates in the skill’s real file formats.
The status is derived, not declared
Every published sentence traces left — to the tests that ran, the code that exists, the behaviour that was observed. The turnstile runs one way: evidence on the left, the claim it can carry on the right. Remove a piece of evidence and the status falls with it; nobody edits the word “verified”.
Get_returns_404_for_foreign_caller
[Authorize(Policy: "CallerScoped")]
The turnstile — “what stands to its right follows from what stands to its left.” One claim shown in full, in the ledger’s real format; a wall carries as many as the repository makes.
Held to its own standard
These are the claims this site makes, with the status the evidence supports. The grey row is the point: unbuilt things are stated as unbuilt.
| Claim | What it says | Status | Last checked |
|---|---|---|---|
| SITE-001 | The Intransic skill is released and installable in Claude Code.tag v0.2.2 · intransic-ai/intransic-skill — The repository is private pending testing, so this link does not resolve for an external reader. Re-checked 19 September 2026: tags v0.2.1 and v0.2.2 both exist on the remote, and the plugin and marketplace manifests at v0.2.2 both declare 0.2.2. That repository defines a release as a git tag; v0.2.1 also has a GitHub Release object and v0.2.2 does not. Installation itself was not re-exercised in that check. v0.2.0 was cited here until 12 August 2026 and was never tagged on any remote — the repository itself was local-only until that date. | verified | 2026-09-19 |
| SITE-002 | The process has been run end-to-end against one production codebase.first-run Foundation and evidence ledger, July 2026 — run artefacts live in the assessed repository and are private to it | verified | 2026-08-09 |
| SITE-003 | A hosted verification platform and public trust walls do not yet exist.live production API reports an empty ledger and publication disabled; no trust wall host exists — Checked 19 September 2026: the production API's /health reports dataSource "empty" and publicationWritesEnabled false, its ledger verification reports 0 entries, and trust.intransic.com has no DNS record. A production signing key exists in a Key Vault and has not signed anything. | planned | — |
A passing validation run establishes one thing: nothing is claimed that the evidence does not support. It does not establish that a system is secure, correct, private or compliant — and a trust process that overstates its own assurance has failed at the only thing it does.
Run it where the claims live
The process ships as a Claude Code plugin. It inspects before it writes and presents its plan before generating anything. Everything it writes is confined to foundation/, intransic/, trust/ and AGENTS.md — its operating rules prohibit touching production code, and every run ends with a report of exactly which files were created.
Then, in any repository: “run the Intransic foundation process here.” Out comes a canonical description of what the system actually is, an evidence ledger, and a public trust package that cannot say more than the ledger supports.
> /plugin marketplace add intransic-ai/intransic-skill > /plugin install intransic@intransic
No launch list, no product tour. When there is something more to run, we’ll say so.
hello@intransic.com