01 · Run it
exec
The claim says a command behaves a certain way, so the command runs for real, in your environment, under your keys. The exit code and the output become the evidence.
Touchstone, claims verification for the agent era
Your AI makes claims.
Your AI makes claims.
Touchstone proves them.
Every claim your AI makes comes back as a sealed dossier. A claim like "the tests pass" is tried for real, in your environment, and the verdict is sealed with a hash anyone can re-check, so what reaches your customer, your regulator or your board is a claim a machine already tried to break.
Anchored claims verify with zero model calls. Unverifiable never becomes true.
Fail-closed. UNVERIFIABLE is a verdict in its own right.
Zero model calls for anchored claims.
sha256-sealed dossiers. Tamper shows.
The model plans and judges. It never executes.
An open format. Anything that writes JSON can emit claims.
The engine
Five checks. One gate that never guesses.
02 · Read it
read
The claim quotes a file, so the file is read and the quote has to match character for character. A verbatim anchor runs at least eight characters, long enough that coincidence doesn't pass.
03 · Search it
grep
The claim says the code contains a pattern, or no longer does, so a real search runs against the real tree as it stands today. Nothing is taken from the model's memory.
04 · Call it
fetch
The claim cites an endpoint, so the endpoint is called and the response, status and body, is captured as evidence. If the network can't prove it, the verdict is UNVERIFIABLE.
05 · Compare it
json
Structured output is compared by anchored deep-equality: the expected object has to match the executed result wherever it is anchored. A mismatch fails closed to UNVERIFIABLE.
06 · Decide
the gate
A pure, deterministic function with no model in it renders every verdict: SUPPORTED, REFUTED or UNVERIFIABLE. REFUTED is reserved for executed evidence that contradicts the claim. No temperature, no prompt, no drift.
How it works
The claim is cheap.
The claim is cheap.
The dossier isn't.
1
Claim
The assertion is stated in the open claim-batch format: what's claimed, and what would prove it.
2
Plan
The model proposes one check, exec, read, grep, fetch or json, and nothing else. It plans; it runs nothing.
3
Execute
The check runs for real, in your environment, under your keys. The model never executes.
4
Judge
Output is compared against the claim: verbatim anchors must match character-for-character; json checks run anchored deep-equality.
5
Gate
A pure, deterministic function with no model in it renders the verdict: SUPPORTED, REFUTED or UNVERIFIABLE. No temperature, no prompt, no drift.
6
Dossier
The verdict, the evidence, and the run are sealed with a sha256 hash. Change one byte and the seal shows it.
{
"id": "claim-014",
"check": "json",
"cmd": "node scripts/legacy-total.js",
"expect": { "total_cents": 4821900 }
}
verdict SUPPORTED — executed output matched, byte for byte
"id": "claim-014",
"check": "json",
"cmd": "node scripts/legacy-total.js",
"expect": { "total_cents": 4821900 }
}
verdict SUPPORTED — executed output matched, byte for byte
json semantics: anchored deep-equality against executed output. A mismatch fails closed to UNVERIFIABLE, and the gate never guesses. REFUTED is reserved for executed evidence that contradicts the claim.
claim-batch@0 is an open format. Anything that writes JSON can emit it; anything that reads JSON can consume it. Ask for the Specification →
One question survives every regime. Show me it operated.
Regulators stopped asking whether you have a policy. They ask for evidence it ran.
claim was stated→check was executed→verdict was gated→seal is unaltered
- Texas TRAIGA, in force Jan 2026. Evidence that NIST AI RMF controls operated is an affirmative defense.
- FTC accuracy-substantiation enforcement, Operation AI Comply. Claims about what an AI system does have to be substantiated before they're made.
- EU AI Act, Article 50, transparency obligations from Aug 2026. High-risk obligations land later: Dec 2027 and Aug 2028.
Security apparatus
Designed so you don't have to trust us.
separation
The model plans and judges. It never executes. Execution happens in your environment, under your keys.
byo-key
Bring your own key. Your credentials never transit our infrastructure; a viral day costs you nothing and leaks nothing.
gate
The verdict gate is pure, deterministic, non-LLM code. No temperature, no prompt, no drift.
fail-closed
Anything unproven is UNVERIFIABLE. The system has no way to say "probably."
seal
Dossiers are sha256-sealed. Change one byte and the seal shows it.
no-imports
Touchstone vendors its dependencies. Nothing is imported across the trust boundary between verifier and verified, and no transitive supply-chain surface comes with it.
words
We say verification and evidence, never audit, attestation or opinion. Those three are reserved professional terms under AICPA AT-C 205, and using them casually would be its own false claim.
Diligence, applied to ourselves
We ran the bear case first.
A six-stage market diligence with an adversarial QA gate, findings published to the ledger, kill criteria included.
55+vendors mapped, none selling evidence a control operated
5check kinds: code, text, network, structured data
0model calls to verify an anchored claim
8characters minimum for a verbatim anchor
Beyond the gate
Touchstone is one instrument of six.
It ships alone and works alone. Around it sit five more Isonomai instruments, for intent, rules, decisions, proof exchange and outcomes, wired by the same open formats and each labelled at its real maturity. Adopt the gate today; the rest is there when a claim needs more than a verdict.
Live
Pandect rules API
679 codified rules served in production, each carrying its citation and verification status.
Dry-run
RuleCore verticals
Seven verticals on one deterministic spine, running full pipelines on draft rule packs.
Instrumenting now
Proving ground
A public, falsifiable ledger of our own claims: the stack pointed at itself.
For engineers
Built to be examined.
Touchstone is inspectable end to end: a deterministic gate, a published pipeline, and dossiers you can re-check offline with zero model calls.
Verified beats asserted.
Ask for the dossier and it comes back within two business days, covering every property, what's live, what's dry-run and what's still in validation, with the receipts to check us.
sealed · sha256 · fail-closed · model:null