Trust nothing, check everything
Verify a publisher
A standard nobody can verify is a press release with a schema. Everything an intent/1 consumer needs is public, and none of it involves trusting us.
One command
npx intentmesh verify <domain>Fetches the well-known path under the specification's own consumer rules and answers with one
of four findings: published, invalid (with every problem named —
including a non-public item served at the public URL, the one failure this format must never
allow), absent, or unreachable — which is exit code 2, not 1, because a
network failure between you and a publisher is a finding about the network.
Fetching, safely
The consumer rules are normative in the specification: https only; a
timeout and a response size cap; redirects followed only within the same registrable domain — an
apex redirecting to www is the same publisher, a redirect to another host is somebody borrowing a
record. And an unreachable publisher is not one that published nothing:
absent and unreachable are different findings, and collapsing them makes
a claim about somebody else's organisation on the strength of your own network failure.
Three layers of checking
Well-formed — the JSON Schema
schema/intent-1.json validates structure in any language, any toolchain.
Permitted — validateFragment
The cross-field rules (derived expiry, promotion, authority) are not expressible in JSON
Schema. validateFragment in the library is the reference; the rules are numbered in
the spec so a competing implementation can cite them.
Fetched — the reference consumer
fetchFragment in the library implements the Discovery rules as code — the timeout,
the size cap, the same-publisher redirect boundary (stricter than the spec's registrable-domain
rule, deliberately: failing closed needs no public-suffix list, and this package ships no
dependencies). A competing consumer can be checked against it.
Pre-install — the vendored checker
vendor-intentmesh.mjs runs with bare node in a repository with no node_modules — the same file that emits can check.
What verification cannot tell you
That an intention is sincere. The format makes claims attributable (who asserted, who promoted, when it decays) and consistent (one authority per id, revisions never edits) — sincerity is what reputations are for, and pretending a format supplies it would be the overclaim this page exists to refuse.