reference
Intended Documentation
Capability Truth Matrix
An honest matrix of Intended platform capabilities — what is implemented in code today, what is partial, and what is Roadmap. Written for auditors and evaluators.
Capability Truth Matrix#
This matrix records the implementation status of Intended platform capabilities against the code, so an evaluator or auditor can separate what runs today from what is planned. It is the single source of truth: site capability labels render from these rows, a CI check (check-capability-truth) fails the build if a public surface labels something more generously than its row here, and the build roadmap in ROADMAP.md orders the Planned/Partial rows by risk. To promote a capability when it ships, change its status here — the label and the gate follow automatically. Status values:
- Implemented — present in code, operational, and (for anything a customer installs) published/usable. Renders as Available.
- Partial — a core mechanism exists and is tested, but a documented piece is missing or unpublished (the gap is named in What's missing). Renders as Beta / Partial.
- Planned (a.k.a. Roadmap) — designed or scaffolded but not active/built today. Renders as Planned.
- Private — built and tested but intentionally internal/unpublished (not a customer-facing product yet). Renders as Private preview.
Some rows below carry the extra columns What's missing, Proof path (the test/file/command that proves the status), and Public surfaces (where the capability is referenced and must be labelled to match). The original concise sections keep the 3-column form.
Mechanisms, not certifications
Intended provides tamper-evidence and authority mechanisms. It does not ship certified compliance-framework control mappings: the runtime audit chain encodes no SOC 2 / ISO 27001 / EU AI Act control IDs, and Intended is not itself a certification authority. Compliance entries below describe evidence and workflow tooling, never an attestation Intended issues on its own behalf.
Core Runtime#
| Capability | Status | Notes |
|---|---|---|
Intent gateway (POST /intent) | Implemented | Accepts IntentRequest; returns APPROVED (200) / ESCALATED (202) / DENIED (403); fail-closed 500 AUTHORITY_LOOP_FAILED |
| Policy engine | Implemented | Rule-based, most-severe-wins, default-DENY; modern evaluateAuthority returns ALLOW/DENY/REQUIRE_APPROVAL/ESCALATE |
| Risk scoring | Implemented | baseRiskScore + privileged(20) + production(20) + sensitive(15), capped at 100; modifiers tenant-overridable |
| Structural policy on raw args | Implemented | Policy conditions evaluate the raw structural arguments of an action, not just risk labels: resolveArgsPath() walks dot/bracket paths (args.body.path, args.items[0].name) and MATCHES (regex, compilePolicyRegex) / CONTAINS operators run against the resolved value; a bare args field recursively scans all string leaves (depth-bounded). packages/authority-engine/src/policy-engine.ts (resolveArgsPath, getFieldValue, evaluateCondition) |
| Always-on catastrophic floor + Danger Zone | Implemented | A priority-1 catastrophic floor rule (buildCatastrophicFloorRule, matches destructive-arg patterns — DROP, TRUNCATE, DELETE FROM, rm -rf, git push --force, --no-preserve-root) is prepended to every evaluation (custom or bootstrap) and ESCALATEs to a catastrophic-review queue. It can only be disabled by config (TenantAuthorityConfig.catastrophicFloorDisabled, sourced from persisted state, never request input) behind an audited Danger Zone — recording catastrophicFloorDisabledBy / …At / catastrophicFloorAgreementVersion (a counsel-gated liability agreement). packages/authority-engine/src/policy-engine.ts; migration 20260701000000_catastrophic_floor_config |
| Read/write signal | Implemented | The engine derives a read/write operation signal from the classified Open Intent code (resolveOperationType → getOperationType(oiCode)), fail-safe to write when unknown; policy conditions read it via field: "risk.operation_type", and the bootstrap allow-rule auto-approves only confirmed reads (non-production, non-sensitive, low-risk). Derived from the classification, never from caller input. packages/authority-engine/src/{policy-engine,index}.ts |
| Authority Decision Token | Implemented | Ed25519 JWT, mandatory kid, 300 s TTL (default and hard max), single-use nonce |
| Audit hash chain | Implemented | Per-tenant SHA-256 AuditEntry chain, previousHash linkage, Serializable append; verifyAuditChain recomputes content + linkage |
| Evidence export | Implemented | generateEvidenceBundle: SHA-256 integrity hash + symmetric HMAC signature keyed off the tenant secret — tamper-evident to the tenant but not publicly verifiable (unlike the asymmetric, JWKS-verifiable Receipt — do not conflate the two in copy) |
| Interpretation layer (LIM) | Partial | NL→intent with ranked hypotheses (primary drives the decision). The text LIM classifies a small action set, not all 173 Open Intent categories — only the physical classifier emits OI-NNNN today (Roadmap for text) |
| Sequence conformance | Partial | Deterministic scoreSequenceConformance is wired; the Markov scorer is a prototype, not wired (Roadmap) |
Keys & Token Distribution#
| Capability | Status | Notes |
|---|---|---|
| Per-tenant signing keys | Implemented | Ed25519 (default; RSA-4096 / ES256 selectable), private key AES-256-GCM at rest, statuses ACTIVE/PREVIOUS/RETIRED, rotation via kid |
| Local token verification | Implemented | @intended/verify and the connector SDK verify the authority token with kid pinning, algorithm-agnostic across the mint set — EdDSA (Ed25519) default, RS256 / ES256 selectable — with the alg pinned to the supplied public key (so alg: none and algorithm-confusion are rejected) |
| Customer-managed keys (CMK / HSM signing) | Partial | The authority-token private key can live in the customer's KMS/HSM — Intended never holds it: every issuance calls the provider's Sign API and the customer's public key is published into the tenant JWKS by kid, so relying parties verify offline through the same algorithm-agnostic verifier. aws_kms is REAL (@aws-sdk/client-kms Sign / GetPublicKey; ES256 via ECC_NIST_P256 with DER→JOSE transcode, RS256 via RSA — KMS has no Ed25519, so the JWS alg is honest to the key type). gcp_kms and azure_kv are NotImplemented stubs behind the same interface (throw CmkNotImplementedError, never a faked signature) — that gap is why this is Partial. Config on TenantAuthorityConfig (cmkProvider, cmkKeyId, cmkAlgorithm, cmkKid, audited cmkEnabledBy/At). packages/authority-engine/src/{cmk-signer,jwks}.ts; migration 20260702000000_customer_managed_keys |
| JWKS HTTP route for tenant authority keys | Implemented | services/api/src/routes/jwks.ts serves /.well-known/jwks.json (physical-AI signer) and /.well-known/authority/:tenantId/jwks.json (per-tenant authority keys), public, max-age=300. Auth0 request-path verification (packages/auth/src/auth0-jwt.ts) verifies via jose.createRemoteJWKSet. Proof: GET /.well-known/jwks.json; vitest run packages/auth (auth0-jwt suite) |
Operator & Policy#
| Capability | Status | Notes |
|---|---|---|
| Policy authoring | Implemented | Author and validate via API and CLI |
| Policy simulation | Implemented | Compare, drift, and blast-radius analysis |
| Policy deployment | Implemented | intended deploy-policy (a.k.a. policy-pack-install); staged with approval |
| Escalations & approvals | Implemented | escalations-list / escalations-approve / escalations-reject |
| Incident investigation | Implemented | Audit query, token inspection, event ledger |
Enterprise Administration#
| Capability | Status | Notes |
|---|---|---|
| Tenant management | Implemented | Create, configure, suspend tenants |
| Role-based access | Implemented | Roles + API-key scopes drive per-route permissions |
| API token governance | Implemented | intended_live_ customer keys (legacy mrt_ still accepted); no separate test/sandbox key tier; SHA-256 hashed at rest; scope constraints |
| Audit export | Implemented | Timeline, narrative run export, per-intent evidence bundle |
| Emergency controls | Implemented | Enterprise-admin emergency-controls surface |
| Identity provider integration (SSO/SCIM) | Implemented | Runtime OIDC/SAML callback handling and SCIM lifecycle with tenant-bound enforcement |
Developer Integration#
| Capability | Status | Notes |
|---|---|---|
| REST API (intents, policies, audit) | Implemented | See the API reference |
| Decision token verification | Implemented | Local (@intended/verify) or via the verifier routes |
| SDKs (published) | Implemented | TypeScript @intended-inc/sdk (publish-ts-sdk.yml → npm) and Python intended (publish-python-sdk.yml → PyPI) are the published, CI-tested SDKs. A Go edge-verifier (intended-go) ships for physical-AI. Canonical entry points: createIntendedSdk({ baseUrl, tenantId, apiKey }) → .authorize() / .guard() (TS); IntendedSdk(api_key=, tenant_id=, api_url=) → .authorize() (Py) |
CLI (@intended/cli) | Partial | Real 1,210-line command surface (packages/cli, tested) — flat hyphenated commands (intent-submit, audit-query, verify, …); no intended policy … group. Not published: @intended/* is a phantom scope with no publish workflow, and it depends on unpublished workspace packages, so npm i -g @intended/cli does not work today |
Connector SDK (@intended/connector-sdk) | Private | Real, tested BaseAdapter toolkit that validates the token fail-closed (Ed25519 + kid + tenant/adapter/target + decision + expiry + single-use nonce) before executing. Marked private: true — an in-tree toolkit, not a published product. The public "build-your-own-connector" API shown in older marketing was invented; this is the real surface |
Physical AI#
| Capability | Status | Notes |
|---|---|---|
| Physical runtime API | Implemented | /v1/physical/* — classify, authority-tokens, snapshots, audit, approvals, revocations, actors, policy |
| Actor registration gate | Implemented | Unregistered actor → 403 actor_not_registered |
| Physical decision mapping | Implemented | ALLOW → 200 token (aud: intended-edge-verifier); ESCALATE → 200 ticket; DENY → 422 policy_denied; audit-gap → 423 |
| Edge verifier SDKs | Partial | Go intended-go and Python/ROS2 intended-ros2 exist; the Rust edge verifier (crates/intended-verifier) now exists in the repo with Rust↔TS conformance tests. Live fleet integration is still pending (reference/conformance-tested, not deployed on a real fleet) |
| Physical edge verifier (offline) | Partial | The edge verifier verifies the RS256-signed edge-authority token fully offline / zero-network: it caches the tenant JWKS (in-memory + optional disk) and never blocks the hot path on a network refresh; the trusted algorithm is pinned to the cached JWK, not the token header (closes downgrade). It also enforces an offline signed geofence — re-checking the requested pose against the signed region using an equirectangular WGS84 approximation (map-frame uses Euclidean), fail-closed on coordinate mismatch or incomplete pose. Both Rust (crates/intended-verifier) and TS surfaces exist, conformance-tested. Missing: a live robot fleet — none of the physical-AI go-live gates are met yet, so this is research/reference-grade, not deployed. KEEP RS256 for the edge token — the physical-AI signer genuinely uses RS256; this is distinct from the Ed25519-default runtime authority token. |
Security & Compliance#
| Capability | Status | Notes |
|---|---|---|
| Fail-closed defaults | Implemented | Default-DENY; /intent failure → 500 AUTHORITY_LOOP_FAILED |
| Enforcement lineage | Implemented | Tamper-evident per-tenant hash chain with content + linkage verification |
| Cryptographic token signing | Implemented | algorithm-agnostic, Ed25519 by default (RSA-4096 / ES256 selectable), per-tenant keys, rotation via kid |
| Tenant data & key isolation | Implemented | Per-tenant keys and data; cross-tenant access rejected (403 TENANT_MISMATCH) at the request boundary AND enforced at the database with Postgres row-level security, deny-by-default in production (the request tier connects as a least-privilege intended_app role via RDS IAM; a query with no bound tenant context returns nothing / writes fail closed; cross-tenant access is denied by policy) |
| Tamper detection | Implemented | verifyAuditChain reports the first broken index |
| SOC 2 evidence & program tooling | Partial | An evidence-capture and SOC 2 program-management surface exists (evidence packs, control evidence records, auditor-request and attestation-handoff workflows). It is tooling for an audit program, not a certification — the external auditor-issued attestation is an external dependency, and no control IDs are encoded in the runtime audit chain |
| Compliance evidence export (SOC 2 / HIPAA / NIST / EU AI Act) | Partial | exportCompliance maps real per-tenant runtime evidence (hash-chained audit trail + integrity check, authority-decision distribution, RLS/tenant-isolation posture, policy-pack inventory, decision signing) to framework control profiles. Each control is honestly scored satisfied / partial / manual / not-covered — the engine never emits a blanket "compliant" and never asserts a certification. Only controls Intended's data can substantiate are mapped; the profiles are deliberately partial, not exhaustive. packages/audit/src/compliance/*, services/api/src/routes/compliance-export.ts (admin-gated, tenant-scoped, audited) |
| Certified compliance control mappings (SOC 2 / ISO 27001 / EU AI Act) | Roadmap | The platform provides mechanisms, not certified mappings. Do not represent these as built-in or attested. (Distinct from the evidence-export row above: that produces evidence toward controls, not a certified/attested mapping.) |
Connectors (enterprise systems)#
A connector is "Implemented" only when a real adapter exists in code and is wired to the execution path. Named systems with no adapter are Planned — they may appear in blueprints or industry pages, but no code maps to them yet.
| Connector | Status | What's missing | Proof path | Public surfaces |
|---|---|---|---|---|
| GitHub (Actions, PRs) | Implemented | — (tied to the platform; no live external customers yet) | packages/execution-engine/src/adapters/github-actions.ts, github-pr.ts; packages/connectors/github/github-adapter.ts | app/platform/connectors, app/integrations |
| ServiceNow (incident, change) | Partial | Real Table-API adapter (incident create/update/read, change create), gate-routed through evaluateAuthority (a write ESCALATEs under the starter policy — never auto-executed), token-verified via the @intended/connector-sdk BaseAdapter, HTTPS/base-URL hardened. Builds green; unit + request-construction contract tests pass. Missing: validation against a live ServiceNow tenant; partner/customer proof pending | packages/execution-engine/src/adapters/servicenow.ts; packages/execution-engine/test/servicenow-adapter{,-contract,-classification}.test.ts | app/platform/connectors, app/integrations |
| Stripe (refund, invoice) | Partial | Real Stripe REST adapter (stripe.refund.create, stripe.invoice.create), gate-routed through evaluateAuthority (a financial write ESCALATEs under the starter policy — never auto-executed), token-verified via the @intended/connector-sdk BaseAdapter, base URL pinned to api.stripe.com (SSRF-hardened), native Idempotency-Key. Builds green; unit + contract + gate tests pass against mocks. Missing: live-mode proof against a real Stripe test key (owner-provided sk_test_… needed); customer proof pending. (Note: earlier the proof path pointed at a 1-line stub — now a real adapter.) | packages/execution-engine/src/adapters/stripe.ts; packages/execution-engine/test/stripe-adapter{,-contract,-gate}.test.ts | app/platform/connectors, app/integrations |
| Jira | Partial | Adapter exists; live validation pending | packages/execution-engine/src/adapters/jira.ts | — |
| MCP gateway (tool calls across MCP servers) | Partial | Real + CI-proven; re-scoped to @intended-inc/mcp-gateway and publish-ready (packed tarball installs clean and createIntendedGateway() works — local clean-install gate green; publish workflow .github/workflows/publish-mcp-gateway.yml). Still Partial until it's actually on the registry — blocked on merge-to-main + npm trusted-publisher config for the new name (see Gateways below) | packages/mcp-gateway | app/platform/connectors, app/mcp-gateway, app/integrations |
Enterprise-system adapters (real code, Beta until live proof)#
Each row below is a real BaseAdapter-gated adapter in packages/execution-engine/src/adapters/{name}.ts. Every one: verifies the Authority Decision Token (Ed25519 + kid + tenant/adapter/target binding + expiry + single-use nonce) before it executes any side-effecting call; sources a per-tenant, AES-256-GCM-encrypted credential from the connector-secret store; is host-pinned / SSRF-hardened (HTTPS-only, embedded-credential-free, metadata/link-local hosts blocked, requests built from pinned constants never caller input); and ships a real testConnection plus hermetic (mocked-HTTP) unit + contract tests that pass in CI with no live tenant. Under the starter policy every write ESCALATEs — nothing auto-executes. The only thing missing for each is live proof against a real, owner-provided credential — so each is Partial (renders as Beta), never GA. Rows are ordered as pagerduty, datadog, slack, okta, entra (Azure AD), vault, salesforce, gcp, workday, sap, aws.
| Connector | Status | What's missing | Proof path | Public surfaces |
|---|---|---|---|---|
| PagerDuty | Partial | Real adapter (pagerduty.incident.trigger / pagerduty.incident.resolve), two pinned hosts (api.pagerduty.com REST via Authorization: Token token=<apiToken>, events.pagerduty.com Events v2 via routingKey), token-gated, per-tenant encrypted credential, real testConnection (GET /users?limit=1). Hermetic tests green. Missing: live proof (owner-provided PagerDuty apiToken + routingKey). | packages/execution-engine/src/adapters/pagerduty.ts; packages/execution-engine/test/pagerduty-adapter*.test.ts | app/platform/connectors, app/integrations |
| Datadog | Partial | Real adapter (datadog.event.create / datadog.monitor.mute), region-aware host pin (site selector → api.datadoghq.com / .eu / .ddog-gov.com, a stored baseUrl honored only if it resolves to a known Datadog host), DD-API-KEY + DD-APPLICATION-KEY headers, token-gated, per-tenant encrypted credential, real testConnection (GET /api/v1/validate). Hermetic tests green. Missing: live proof (owner apiKey + applicationKey). | packages/execution-engine/src/adapters/datadog.ts; packages/execution-engine/test/datadog-adapter*.test.ts | app/platform/connectors, app/integrations |
| Slack | Partial | Real adapter (slack.message.post / slack.channel.lookup), host pinned to slack.com (SSRF-hardened; a stored baseUrl must resolve to the Slack host or fails closed), bot token Authorization: Bearer xoxb-…, token-gated, per-tenant encrypted credential, real testConnection (auth.test). Hermetic tests green. Missing: live proof (owner bot token). Supersedes the earlier stale packages/connectors/slack/slack-adapter.ts reference — the real adapter is in execution-engine. | packages/execution-engine/src/adapters/slack.ts; packages/execution-engine/test/slack-adapter*.test.ts | app/platform/connectors, app/integrations |
| Okta | Partial | Real adapter (okta.user.suspend / okta.user.unsuspend), host validated to an Okta org domain (*.okta.com / *.oktapreview.com / *.okta-emea.com), API token Authorization: SSWS <apiToken>, token-gated, per-tenant encrypted credential, real testConnection (GET /api/v1/users?limit=1). Hermetic tests green. Missing: live proof (owner Okta baseUrl + apiToken). | packages/execution-engine/src/adapters/okta.ts; packages/execution-engine/test/okta-adapter*.test.ts | app/platform/connectors, app/integrations |
| Entra (Azure AD) | Partial | Real adapter (entra.user.disable / entra.user.enable) over Microsoft Graph, host pinned to graph.microsoft.com (+ national-cloud Graph hosts), Authorization: Bearer <accessToken>, token-gated, per-tenant encrypted credential, real testConnection (GET /v1.0/organization). Hermetic tests green. Missing: live proof (owner Graph accessToken). "Azure AD" = Microsoft Entra ID; same adapter. | packages/execution-engine/src/adapters/entra.ts; packages/execution-engine/test/entra-adapter*.test.ts | app/platform/connectors, app/integrations |
| HashiCorp Vault | Partial | Real adapter (vault.secret.read / vault.secret.rotate) over the KV v2 API, self-hosted so no vendor host-pin — SSRF hardening instead requires HTTPS, forbids embedded credentials, and blocks metadata/link-local hosts, X-Vault-Token auth, mount (default secret) + optional namespace, token-gated, per-tenant encrypted credential, real testConnection (GET /v1/sys/health). Hermetic tests green. Missing: live proof (owner Vault baseUrl + vaultToken). | packages/execution-engine/src/adapters/vault.ts; packages/execution-engine/test/vault-adapter*.test.ts | app/platform/connectors, app/integrations |
| Salesforce | Partial | Real adapter (salesforce.case.create / salesforce.case.update), OAuth 2.0 refresh-token grant (both the token-endpoint host and the resolved instance host must be a *.salesforce.com host or it fails closed), token-gated, per-tenant encrypted credential (instanceUrl, clientId, clientSecret, refreshToken), real testConnection (GET /services/data/). Hermetic tests green. Missing: live proof (owner connected-app creds + refresh token). | packages/execution-engine/src/adapters/salesforce.ts; packages/execution-engine/test/salesforce-adapter*.test.ts | app/platform/connectors, app/integrations |
| Google Cloud (GCP) | Partial | Real adapter (gcp.binding.add / gcp.instance.stop), service-account JWT-bearer OAuth (grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer at the pinned Google token host, then Bearer to pinned Google API hosts — cloudresourcemanager.googleapis.com, Compute), token-gated, per-tenant encrypted credential (client_email, private_key, project_id), real testConnection. Hermetic tests green. Missing: live proof (owner service-account key). | packages/execution-engine/src/adapters/gcp.ts; packages/execution-engine/test/gcp-adapter*.test.ts | app/platform/connectors, app/integrations |
| Workday | Partial | Real adapter (workday.worker.hire / workday.timeoff.approve), OAuth 2.0 refresh-token grant at the tenant token endpoint (/ccx/oauth2/{tenant}/token), then Bearer to the tenant REST API (/ccx/api/v1/{tenant}/…); both hosts pinned to *.workday.com / *.myworkday.com, token-gated, per-tenant encrypted credential (host, tenant, clientId, clientSecret, refreshToken), real testConnection. Hermetic tests green. Missing: live proof (owner API-client creds). | packages/execution-engine/src/adapters/workday.ts; packages/execution-engine/test/workday-adapter*.test.ts | app/platform/connectors, app/integrations |
| SAP (S/4HANA Cloud) | Partial | Real adapter (sap.purchaseorder.create / sap.invoice.post), OAuth 2.0 client-credentials grant (tokenUrl → Bearer to the pinned baseUrl), token-gated, per-tenant encrypted credential (baseUrl, tokenUrl, clientId, clientSecret), real testConnection. Hermetic tests green. Missing: live proof (owner S/4HANA OAuth client). | packages/execution-engine/src/adapters/sap.ts; packages/execution-engine/test/sap-adapter*.test.ts | app/platform/connectors, app/integrations |
| AWS | Partial | Real adapter (aws.policy.attach / aws.instance.stop) with a hand-rolled SigV4 signer (no AWS SDK on the hot path), region-scoped IAM/EC2 endpoints, token-gated, per-tenant encrypted credential (accessKeyId, secretAccessKey, optional sessionToken, region), real testConnection. Hermetic tests green. Missing: live proof (owner IAM keys). | packages/execution-engine/src/adapters/aws.ts; packages/execution-engine/test/aws-adapter*.test.ts | app/platform/connectors, app/integrations |
| Oracle, NetSuite, Epic, CrowdStrike, Splunk, Snyk, ZAP, Veracode | Planned | No adapter code exists for these. Named in blueprints / industry pages only; blocked on partner agreements per specs/core/post-120day/blueprints/03-connector-expansion.md | absence: no file under packages/execution-engine/src/adapters/* for these names | any industry/enterprise page that lists them must label Planned |
Gateways & framework integrations#
| Capability | Status | What's missing | Proof path | Public surfaces |
|---|---|---|---|---|
| LLM gateway (policy-enforcing proxy) | Implemented | Deployed hosted endpoint at gateway.intended.so behind the prod ALB (module.llm_gateway), HA (2 Fargate tasks), image pinned to an immutable digest. It authenticates the Intended key, governs the call, and forwards to the upstream provider — OpenAI live-proven (x-intended-gateway-request-id + real upstream forward observed; no-key → 401, fail-closed). Bedrock/Vertex interceptors are reference-grade, not live-proven. Monitored: target-group health + 5xx alarms and a govern+forward synthetic canary, both → PagerDuty | live: curl https://gateway.intended.so/healthz (200) + keyed POST /v1/openai/chat/completions returns x-intended-gateway-request-id; infrastructure/terraform/production/llm-gateway.tf; vitest run packages/llm-gateway | app/gateway, app/integrations |
| LLM opt-out / deterministic-only mode | Implemented | — | X-Intended-Disable-LLM at services/api/src/routes/lim.ts; services/api/test/lim-llm-optout.e2e.test.ts | app/gateway |
| Multi-provider gateway (OpenAI / Anthropic / Bedrock / Vertex / NIM) | Partial | Five provider adapters exist in packages/llm-gateway/src/providers/{openai,anthropic,bedrock-anthropic,vertex-gemini,nvidia-nim}.ts, each parsing the provider's real streaming wire format into a canonical event and routing tool calls through the same authority resolver. They are real handlers, not stubs. But only OpenAI is live-proven end-to-end (real upstream forward observed at gateway.intended.so); Anthropic / Bedrock / Vertex / NIM are reference-grade, not yet live-proven. Copy must present multi-provider as "OpenAI live; others in beta", never "all providers GA". packages/llm-gateway/src/providers/registry.ts | app/gateway, app/integrations | |
| MCP gateway | Partial | Real createIntendedGateway, fail-closed, CI-proven against a live engine. Re-scoped off the phantom scope to @intended-inc/mcp-gateway; publish workflow added (OIDC trusted publishing, mirrors the SDK) with a clean-install gate; packed tarball verified to install + run locally. Still unpublished on the registry (npm view @intended-inc/mcp-gateway → 404) — the OIDC publish needs (1) the workflow merged to main and (2) a trusted-publisher config for the new name on npm. Flip to Available only after npm i @intended-inc/mcp-gateway works from the public registry | packages/mcp-gateway; .github/workflows/mcp-gateway.yml (live-proof); .github/workflows/publish-mcp-gateway.yml (publish) | app/mcp-gateway, app/integrations |
| AI-framework adapters (LangChain, CrewAI, AutoGen, Semantic Kernel) | Partial | Real adapters in packages/adapters/src/*; LangChain/Vercel/MCP are CI-proven; publish/coverage uneven across the four | packages/adapters/src/{langchain,crewai,autogen,semantic-kernel} | app/integrations |
| OpenClaw / openshell adapter | Implemented | — published as @intended-inc/openshell-adapter | packages/openshell-adapter/src; npm @intended-inc/openshell-adapter | app/integrations |
| Terraform provider | Preview (publish-ready, unpublished) | Real provider, not a stub (2026-07-02). Built on the Terraform Plugin Framework: provider intended + resource intended_policy_pack (CRUD via real POST /policy-packs/install + GET /policy-packs/installed) + data source intended_policy_packs (GET /policy-packs). Compiles to a plugin binary; terraform validate/apply work via dev_overrides (proven in CI). NOT published to the Terraform Registry — no intended-so/terraform-provider-intended public repo, no GPG signing key, no signed release; source = "intended-so/intended" will not resolve from the registry yet (owner action; see the package README "Publishing"). Additional resources (threshold/connector/domain_pack) still roadmap. | go test ./... + go build . in packages/terraform-provider-intended; .github/workflows/terraform-provider.yml | the Terraform tutorial blog (still gated — flip only after registry publish) |
| Kubernetes / Helm (admission controller + charts) | Partial | Real admission code (packages/k8s-admission) + two Helm charts; CI proves helm lint + kind apply + Calico egress-deny. But images and charts are unpublished (no charts.intended.so, no chart-registry push); pods can't become ready without published images | vitest run packages/k8s-admission; .github/workflows/chart-validation.yml | the K8s tutorial blog (gated to "coming soon") |
GitHub Action (authority-check) | Partial (publish-ready, unpublished) | Real action.yml + source. Fixed 2026-07-02: dist/index.js is now a committed, self-contained bundle (tsup inlines @actions/core — a node20 action runs it with no node_modules); a vitest smoke test + a bundle self-containment check + a dist-drift guard run in CI (.github/workflows/github-action-build.yml). Still owner-gated to publish: a uses: action can't be consumed from the private intended-so/intended monorepo — it needs a public intended-so/authority-check repo + @v1 tag + Marketplace listing (a founder decision; see the package README "Publishing"). Copy-paste uses: traps remain neutralized: the fully-fictional CI/CD blog is draft; packages/github-action/README.md documents the real surface with a publish-ready-not-published banner; the DevOps snippet is illustrative. Flip to Implemented when a public repo + @vX exist and a real workflow consumes it | packages/github-action/action.yml; git ls-files packages/github-action/dist; git tag (no v1) | README / any "add to CI" docs |
Deployment & enterprise tiers#
| Tier | Status | What's missing | Proof path | Public surfaces |
|---|---|---|---|---|
| Managed cloud (multi-tenant) | Implemented | — generally available, self-serve | prod ECS + console | app/pricing, app/enterprise |
| Single-tenant / BYOC | Partial | Helm chart + Docker stack are chart-complete; not yet stood up & proven in a customer environment (no deployed SKU) | infrastructure/helm/intended-stack; docker-compose.yml | app/pricing, app/enterprise |
| Air-gapped on-premise | Partial | Air-gap overlay + default-deny-egress NetworkPolicy + offline bootstrap are CI-proven (egress-blocked, 3 tests) but not customer-deployed; gated/on-request, not GA | infrastructure/helm/intended-stack/values-airgapped.yaml; docs/self-host-gateway/air-gapped.md; CI egress proof | app/pricing (label "on request"), data-residency/air-gap blog (already qualified) |
| Hybrid (cloud control-plane + on-prem data-plane) | Planned | Architecture doc only; no implementation/IaC/tests | docs/integration-architecture.md (design only) | any page naming hybrid must label Planned |
Compliance & attestations#
| Capability | Status | What's missing | Proof path | Public surfaces |
|---|---|---|---|---|
| SOC 2 Type I | Partial (in progress) | Control matrix drafted + technical controls live, but auditor not engaged and policies unsigned; RFP drafted not sent | docs/compliance/control-matrix.md; docs/compliance/engagement-package/soc2-type1-rfp.md | app/legal/security, app/compliance, app/enterprise — all must read "in progress", never "certified" |
| SOC 2 Type II | Planned | Observation-period clock not started; realistic readiness ≈ Q1–Q2 2027 | docs/archive/SECURITY-TODO.md | same — never present as held |
| Healthcare policy pack | Implemented | — 7 real deny/escalate rules, tested | packages/policy-packs/src/healthcare-hipaa/index.ts; vitest run packages/policy-packs | app/enterprise/compliance |
| HIPAA-compliant infrastructure | Planned | Intended does not operate HIPAA-compliant infra today (the BAA template says so explicitly) | docs/legal/templates/business-associate-agreement.md header | legal sign-off required — case studies / compliance pages must not assert "HIPAA-compliant" |
| BAA (Business Associate Agreement) | Partial | Template exists but is "NOT EFFECTIVE until separately executed AND Intended confirms HIPAA readiness in writing" — not an executable offering today | docs/legal/templates/business-associate-agreement.md | app/enterprise/compliance ("BAA executable" → legal sign-off) |
Operations & verifiability#
| Capability | Status | What's missing | Proof path | Public surfaces |
|---|---|---|---|---|
| Monitoring & alerting (paging) | Implemented | — Live in prod: 8 SLO alarms, auth/login canaries (API + browser), 3 dashboards, PagerDuty wired and proven 2026-06-30 | infrastructure/terraform/production/alarms.tf, canary.tf, observability.tf; docs/runbooks/synthetic-canaries.md | status pages, enterprise page |
| Publicly-verifiable receipts | Implemented | A sealed, offline / publicly-verifiable authority-decision receipt: the embedded authority token is asymmetrically signed (Ed25519/EdDSA by default; RSA-4096/ES256 selectable) and verifies against the public tenant JWKS plus a hash-linked audit chain — it checks out from its own bytes, so the receipt stands without us (this manifesto claim is true and must not be softened). Boundary: this public verifiability is the receipt only — it is not the generateEvidenceBundle() export, which is a SYMMETRIC HMAC (tenant-verifiable, not publicly verifiable). Never present the export bundle as publicly verifiable. Scope: served on /intent/:id/receipt; the /v1/agent-intent path returns 409 (known gap) | services/api/src/lib/receipt-builder.ts; services/api/test/receipt.e2e.test.ts | receipt copy must scope to the /intent path AND must never imply the HMAC export bundle is publicly verifiable |
| Self-governance ("we govern ourselves with our own engine") | Partial | A governed internal-action module submits INTENDED's own privileged actions (production deploy gate, ops-agent triggers) through the same evaluateAuthority /intent pipeline customers hit, under a real self-tenant Organization row (no RLS bypass), and honors the decision (ALLOW/ESCALATE/DENY) with a real hash-chained audit record. The live .github/workflows/deploy-production.yml does call the gate before terraform apply (in-VPC one-off ECS task) and records a real hash-chained decision per deploy; the deploy intent classifies to a genuine OI code (OI-305) and an owner-triggered, CI-attested deploy resolves a real ALLOW under one narrow self-tenant rule (issue #132) — wrong actor / wrong repository / missing, forged or malformed provenance / non-main ref / unclassified intents still DENY/ESCALATE. The CI provenance is cryptographically verified GitHub Actions OIDC: the workflow mints an aud-scoped (intended-deploy-gate) token, and the gate verifies its RS256 signature against GitHub's JWKS (kid-pinned, TTL-cached) plus exact issuer/audience and exp/iat before ANY claim feeds the decision — raw GITHUB_* env is recorded as non-authoritative audit context only and can no longer attest a deploy. Still rolling out: the gate runs in dry-run (INTENDED_DEPLOY_GATE_MODE=dryrun) — a HALT is logged as a warning and does not yet block the pipeline (the enforce flip is a held owner sign-off). Copy must still say "rolling out", not "in place". | services/api/src/lib/internal-governance.ts; services/api/src/lib/github-oidc.ts + services/api/src/lib/__tests__/github-oidc.test.ts (OIDC signature/issuer/audience/expiry + JWKS cache proof); services/api/src/lib/deploy-gate.ts + services/api/test/deploy-gate.test.ts; packages/authority-engine/src/__tests__/self-governance-policy.test.ts (narrow-ALLOW + deny-variant proof); services/api/test/internal-governance.e2e.test.ts (ALLOW/ESCALATE/DENY + audit proof); gate step in .github/workflows/deploy-production.yml | any "we govern ourselves" copy must say "rolling out" not "in place" until enforce mode is on |
Reading this matrix#
- Implemented entries are safe to depend on today.
- Partial entries: depend on the named core mechanism, not on the documented-but-unwired refinement.
- Roadmap entries are not yet live — design around the Implemented surface.
Next Steps#
- Go-Live Runbook — production rollout checklist
- Operational Readiness — pre-launch validation
- Enforcement Lineage — the audit mechanisms behind these guarantees