intentrouter.ai Free assessment

IntentRouter · the engine by StoneWave

The intent router that shows its work.

State a goal in plain words. IntentRouter decomposes it into specialist Sovereign Roles, mechanically verifies every claim against its cited evidence, and seals the run in a tamper-evident, hash-chained ledger — local-first, so your data never has to leave your hardware.

Run a free assessment → Read the reliability spec
LOCAL-FIRST GUARDIAN-VERIFIED HASH-CHAINED FAILS CLOSED OUTCOME-ONLY FEE

Terminal example: a run is parsed into an execution graph, dispatched to three roles, one output is rejected by the Guardian for a failed evidence check, the worker iterates, all outputs are approved, and the ledger is sealed and verified with the IntentRouter verifier.

Architecture

One pipeline. No path around the audit.

Every run takes the same road. There is deliberately no route from a worker's output to your screen that bypasses validation — the Guardian sits in-line, not on the side.

01
Intent
plain-English goal
02
Execution graph
core/intent_parser.py
03
Role dispatch
core/dispatcher.py
04
Guardian audit
core/guardian.py
05
Verified outcome
+ evidence index
reject ⟲ iterate — rejections return required fixes; workers retry up to max_iterations, then fail closed

Structural validation runs on every parse attempt; malformed graphs are fed back to the model for repair. If no model is reachable at all, routing degrades to a deterministic keyword router — the gateway never fails dark.

The machine

Module by module.

Six subsystems, each with one job and a paper trail. File paths are real — this page is generated from the same repository it describes.

Intent Parser THE BRAIN

Decomposes raw intent into a JSON execution graph — tasks, dependencies, roles — against the Sovereign Map. Parse errors are fed back for repair; no model, no problem: it degrades to deterministic routing.

core/intent_parser.py

Role Dispatcher THE ROUTER

Deterministically matches graph tasks to Sovereign Roles, assembles role prompts, and manages worker lifecycle — including sandboxed tool rounds. Unregistered roles fall back to the Analyst: logged, never silent.

core/dispatcher.py · roles/roles.yaml

Guardian THE VALIDATION LOOP

A two-stage audit of every worker output: first a mechanical, model-free evidence check, then semantic judgment against the published Puck Standard and the role's rubric. It rejects by default when it cannot rule.

core/guardian.py · standards/

State Store THE MEMORY

A local, versioned state machine: decisions, facts, and verdicts stay keyword-searchable across a run — how a decision made at step 1 is still in scope at step 10. All state lives on local disk.

memory/state_store.py

Proof Chain THE PROVABILITY LAYER

Every model call is appended to a SHA-256 hash-chained ledger; run records are sealed with a content hash linked to the ledger head. Each run exports a human-readable audit file.

core/proof.py

Correction Store ACTIVE LEARNING

Every Guardian rejection is persisted as a negative example and replayed to future workers as lessons — so standards enforcement compounds across runs instead of resetting.

memory/state_store.py

Reliability, documented

Not vibes. Mechanisms.

The failure mode of AI systems is confident fabrication. IntentRouter's answer is architectural: every guarantee below is enforced in code, exercised by an offline test suite, and inspectable in any sealed run.

REL-01

Evidence before inference

Stage one of the Guardian audit is mechanical and model-free: cited files must exist in the sandbox, quoted passages must appear verbatim in the cited file, memory keys must actually recall, API-call references must exist in the log. Hallucinated citations die here — before any model gets a vote.

ENFORCED BY core/guardian.pyVERIFY sei.py audit <run>
REL-02

Fails closed

A Guardian that cannot complete its audit rejects — it never approves by default. And there is no code path from a worker's output to the user that bypasses validation. Rejections are explicit: "This does not meet the Sovereign Standard", with the required fixes.

ENFORCED BY core/guardian.pySTANDARD standards/puck_standards.md
REL-03

Reject → iterate → learn

Rejected workers get the rejection reasons and iterate, up to a hard max_iterations bound. Every rejection is persisted to the Correction Store and shown to future workers in that role — standards compound across runs instead of resetting to zero.

ENFORCED BY core/dispatcher.py · memory/state_store.pyVERIFY sei.py corrections
REL-04

Tamper-evident by construction

Every model call appends to a SHA-256 hash-chained ledger; the run record is sealed with a content hash linked to the ledger head. Any post-hoc edit, insertion, or deletion breaks the chain and is detected. Every brief ends with an Evidence Index mapping each finding to its proof.

ENFORCED BY core/proof.pyVERIFY sei.py verify <run>
REL-05

Local-first, air-gappable

Default execution uses on-box models — prompts and client data need never leave client hardware. External model escalation is an explicit, logged choice, and a deterministic no-model mode exists. All state persists on local disk; even the audit dashboard is a single offline HTML file.

ENFORCED BY api/model_client.py · config.json
REL-06

Never fails dark

Structural validation runs on every parse attempt and parse errors are fed back for repair; if no model is reachable, the parser degrades to a deterministic keyword router. Unroutable tasks fall back to the Analyst role — logged, never silent.

ENFORCED BY core/intent_parser.py · core/dispatcher.py
REL-07

Sandboxed tools, human gate

All tool execution is path-sandboxed: agents cannot reach the host filesystem outside explicitly declared workspace roots. Irreversible or outward-facing actions sit behind a human approval gate — the system asks before it acts beyond analysis.

ENFORCED BY api/tools.py
REL-08

Even this page is in the audit scope

The public surface — including the page you are reading — is generated from the live system (the offer file plus the real role registry), SHA-256-hashed into a signed trust manifest, and checked for drift. Advertised capability cannot silently diverge from actual capability.

ENFORCED BY core/discovery.pyVERIFY sei.py discover --check
[CI ✓] An offline test suite with scripted models exercises the full pipeline on every push — graph validation (cycles, duplicate ids, unknown roles), parser repair and deterministic fallback, sandbox-escape attempts, both Guardian rejection stages, the full reject-iterate-approve loop, blocked-dependency propagation, and ledger tamper detection.

Zero trust required

Don't take this page's word for it.

# 1 · what the operator published (signed manifest)
curl -s https://intentrouter.ai/.well-known/sovereign-trust.json \
  | jq -r '.artifacts["index.html"]'

# 2 · what you are actually reading right now
curl -s https://intentrouter.ai/index.html | shasum -a 256

# same hash ⇒ this page is exactly what was
# generated and signed. different ⇒ don't trust it.
# inside an engagement, every run verifies the same way
python3 sei.py verify <run_id>   # ledger chain + seal
python3 sei.py audit  <run_id>   # human-readable proof chain

The trust manifest carries a SHA-256 digest of every published artifact — this page included — plus a capabilities digest derived from the live role registry, and it is Ed25519-signed. Stripping the signature is itself detectable, because the signing claim is inside the checksummed body.

A key served from the same host it vouches for is continuity, not a root of trust — so pin the key fingerprint out-of-band (DNS TXT _intentrouter-key.<domain>) and verify against it.

This is the posture throughout: we promise only what we can prove, and we hand you the tools to check.

The Sovereign Map

9 specialist roles. One standard.

Each role is a tuned domain expert with a matching Guardian rubric that defines what gets rejected — the rubric is the job description. This grid is generated from the live registry, so it cannot overstate what the system routes.

Sovereign_Compliance

Jurisdictional mapping, regulatory auditing, contract and sanctions review, risk mitigation.

legalcomplianceregulationregulatoryauditsanction

Sovereign_Crisis

Crisis command: incident triage, containment sequencing, stakeholder communication, business continuity, post-incident hardening.

crisisincidentbreachoutagerecallemergency

Sovereign_Deals

Deal architecture: M&A and investment analysis, valuation framing, term-sheet structuring, due-diligence orchestration, negotiation strategy.

acquisitionmergerm&adealterm sheetvaluation

Sovereign_Supply_Chain

Logistics network analysis, route and carrier alternatives, inventory positioning, disruption response.

logisticsshipmentshippingroutefreightport

Sovereign_Tax

Global tax architecture: entity structuring, transfer pricing, treaty analysis, withholding optimization, nexus and domicile strategy.

taxvatgsttransfer pricingtreatywithholding

Sovereign_Treasury

Liquidity monitoring, cash flow and financial exposure analysis, yield optimization, demand-leakage detection and recovery.

cashliquiditypaymentinvoiceleakagetreasury

Sovereign_Intelligence

Market and competitive intelligence: competitor mapping, pricing landscapes, positioning analysis, trend and threat detection.

competitorcompetitivemarketintelligencepricinglandscape

Sovereign_Talent

Workforce planning, talent acquisition strategy, human-AI hybrid role mapping, compensation benchmarking.

talenthiringhireworkforceteamheadcount

Sovereign_Analyst

General research, synthesis, and analysis for intents no specialist role covers. The routing fallback.

Adding a role is configuration plus two markdown files — a domain prompt and a rubric. No code.

Pricing

Aligned by construction.

20% of verified value

No recovery, no fee. 20% of independently verified recovered or created value.

The same Guardian and ledger that earn trust also adjudicate the fee: only value that survived the validation loop and is recorded in the tamper-evident ledger is billable. Estimated, projected, or unvalidated amounts never are. Disputes are settled by cited evidence, not assertion.

Start with a free assessment →

Verified net value = an outcome the Guardian validation loop approved and the provability ledger recorded, supported by cited evidence, net of amounts you would have realized anyway.

The load-bearing fine print
  • Decision support, not licensed legal or financial advice.
  • A human approves before anything irreversible or outward-facing happens.
  • Engagement data access is read-only and scoped by you; local-first deployment means it can stay on your hardware.
  • SOC 2: on the roadmap — stated as such, not implied otherwise.

B2A · machine-readable surface

Built to be evaluated by other people's agents.

Agents discover, evaluate, and transact with IntentRouter over MCP with no human in the loop — describe · get_offer · plan_intent · verify_run · list_runs. Everything below is generated from the same source of truth as this page and hashed into the trust manifest.

/llms.txtConcise agent-readable summary — /llms-full.txt for the long form
/offer.jsonMachine-readable offer — a buyer agent computes its own ROI
/.well-known/agent.jsonA2A agent card
/.well-known/mcp/server-card.jsonMCP server card
/.well-known/sovereign-trust.jsonSigned trust manifest — SHA-256 of every artifact on this site
/.well-known/security.txtCoordinated disclosure (RFC 9116)