Touchstone — claims verification for the agent era

Your AI makes claims.
Touchstone proves them.

Touchstone turns what an AI system says into executed, sealed evidence. A claim comes in; a real check runs in your environment; a deterministic gate renders the verdict and seals the dossier — so what reaches your customer, your regulator, or your board is a claim a machine already tried to break.

Request the dossier Read the diligence ledger

$ touchstone verify claims.batch.json
PLAN    4 claims · exec ×1 · grep ×1 · json ×1 · fetch ×1
EXECUTE npm test  (model never executes — plan only)

exec    ✓ SUPPORTED
grep    ✓ SUPPORTED
json    ✓ SUPPORTED (deep-equal)
fetch   ✗ UNVERIFIABLE — fail-closed

GATE    deterministic · non-LLM · fail-closed
DOSSIER sealed  sha256:9f41…c2ae  model:null

Anchored claims verify with zero model calls. Unverifiable never becomes true.

The engine

Five ways to execute a claim. One gate that never guesses.

01 · Run it

exec

The claim says a command behaves a certain way, so the command runs — for real, in your environment, under your keys. Exit code and output become the evidence. The model never touches the shell.

cmd · exit · output anchor

02 · Read it

read

The claim quotes a file, so the file is read and the quote must match character for character. Verbatim anchors run at least eight characters — long enough that coincidence doesn't pass.

file · verbatim anchor ≥8

03 · Search it

grep

The claim says the code contains — or no longer contains — a pattern, so a real search runs against the real tree. Presence is proven, not remembered.

pattern · path

04 · Call it

fetch

The claim cites an endpoint, so the endpoint is called and the response — status and body — is captured as evidence. If the network can't prove it, the verdict is UNVERIFIABLE, not a shrug.

url · status · body anchor

05 · Compare it

json

Structured output is compared by anchored deep-equality: the expected object must match the executed result exactly where anchored. A mismatch fails closed to UNVERIFIABLE — the gate never guesses.

expect · deep-equalNewest check kind.

06 · Decide

the gate

A pure, deterministic, non-LLM function renders every verdict: SUPPORTED, REFUTED, or UNVERIFIABLE. REFUTED is reserved for executed evidence that contradicts the claim. No temperature, no prompt, no drift.

pure function · model:nullZero model calls to verify an anchored claim.

How it works

The claim is cheap.
The dossier isn't.

1

Claim

The assertion is stated in the open claim-batch format: what's claimed, and what would prove it.

2

Plan

The model proposes a check — exec, read, grep, fetch, or json — and nothing else. It plans; it does not run anything.

3

Execute

The check runs for real, in your environment, under your keys. The model never executes.

4

Judge

Output is compared against the claim: verbatim anchors must match character-for-character; json checks run anchored deep-equality.

5

Gate

A pure, deterministic, non-LLM function renders the verdict: SUPPORTED, REFUTED, or UNVERIFIABLE. No temperature, no prompt, no drift.

6

Dossier

The verdict, the evidence, and the run are sealed with a sha256 hash. Change one byte and the seal shows it.

{
  "id": "claim-014",
  "check": "json",
  "cmd": "node scripts/legacy-total.js",
  "expect": { "total_cents": 4821900 }
}
verdict SUPPORTED — executed output matched, byte for byte

json semantics: anchored deep-equality against executed output. A mismatch fails closed to UNVERIFIABLE — the gate never guesses. REFUTED is reserved for executed evidence that contradicts the claim.

claim-batch@0 is a format, not a platform. Anything that writes JSON can emit it; anything that reads JSON can consume it. Specification available on request →

One question survives every regime. Show me it operated.

Regulators stopped asking whether you have a policy. They ask for evidence it ran.

claim was stated→check was executed→verdict was gated→seal is unaltered

Texas TRAIGA — in force Jan 2026. NIST AI RMF operation-evidence stands as an affirmative defense.
FTC accuracy-substantiation enforcement — Operation AI Comply. Claims about what an AI system does must be substantiated before they're made.
EU AI Act, Article 50 — transparency obligations from Aug 2026. High-risk obligations land later: Dec 2027 and Aug 2028.

Security apparatus

Designed so you don't have to trust us.

separation

The model plans and judges. It never executes. Execution happens in your environment, under your keys.

byo-key

Bring your own key. Your credentials never transit our infrastructure; a viral day costs you nothing and leaks nothing.

gate

The verdict gate is pure, deterministic, non-LLM code. No temperature, no prompt, no drift.

fail-closed

Anything unproven is UNVERIFIABLE. The system has no way to say "probably."

seal

Dossiers are sha256-sealed. Change one byte and the seal shows it.

no-imports

Touchstone vendors its dependencies — nothing is imported across the trust boundary between verifier and verified, and no transitive supply-chain surface comes with it.

words

We say verification and evidence — never audit, attestation, or opinion. Those are reserved professional terms (AICPA AT-C 205), and using them casually would be its own false claim.

Diligence, applied to ourselves

We ran the bear case first.

A six-stage market diligence with an adversarial QA gate — findings published to the ledger, kill criteria included.

55+vendors mapped — none sell evidence a control operated

5check kinds — code, text, network, structured data

0model calls to verify an anchored claim

8characters minimum for a verbatim anchor

Read the diligence ledger →

Beyond the gate

Touchstone is one instrument of six.

It ships alone and works alone. Around it sits the Isonomai federation — intent, rules, decisions, proof exchange, outcomes — independent instruments wired by the same open formats, each carrying an honest maturity label. Adopt the gate today; the rest is there when a claim needs more than a verdict.