Site: halve the work page, add the sentences prose lint to CI

The work page drops from 1,434 words to about 900 with the same four
services and every status kept. scripts/lint-prose.mjs runs the
sentences trope ruleset over every content page; medium and high
severities fail, there is no baseline, and the page count starts at
zero blocking. The deploy workflow runs it before the Hugo build. The
open status pill is muted rather than red: an open issue is tracked
work, not a failure.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EFsqVDRNABeAMP8zhQawtz

Author: lex00

.github/workflows/hugo.yml

@@ -32,6 +32,13 @@ jobs:
         uses: actions/checkout@v6
         with:
           fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+          cache: npm
+      - run: npm ci
+      - name: Prose lint (sentences ruleset)
+        run: npm run lint:prose
       - name: Setup Pages
         id: pages
         uses: actions/configure-pages@v6

.gitignore

@@ -1,3 +1,4 @@
 public/
 resources/_gen/
 .hugo_build.lock
+node_modules/

assets/css/site.css

@@ -72,7 +72,7 @@ hr{border:0;border-top:1px solid var(--rule);margin:2rem 0;}
 .status-measured{color:var(--good);border-color:var(--good);}
 .status-documented{color:var(--warn);border-color:var(--warn);}
 .status-proposed{color:var(--faint);}
-.status-open{color:var(--bad);border-color:var(--bad);}
+.status-open{color:var(--muted);border-color:var(--rule-strong);}
 
 /* footer */
 .pagefooter{max-width:var(--wide);margin:2rem auto 0;padding:1.4rem 1.5rem 2.5rem;border-top:1px solid var(--rule);color:var(--muted);font-size:0.9rem;}

content/about.md

@@ -3,13 +3,13 @@ title: "About"
 summary: "Intentius is a one-person infrastructure consultancy. The tools came out of the work."
 ---
 
-Intentius does infrastructure work for teams that inherited more than they built: shared production accounts, state files nobody wants to touch, pipelines maintained by hand on whichever forge the company used last, and now agents that need production access without production keys.
+Intentius does infrastructure work for teams that inherited more than they built: shared production accounts, state files nobody wants to touch, and now agents that need production access without production keys.
 
 The tools exist because the work kept hitting the same wall. Every infrastructure tool outside Kubernetes keeps a private ledger of what it owns, and the ledger is where the permission boundary, the secrets and the lock end up. An entire industry sells workarounds for that ledger from a layer above it. We wanted the record where IAM could read it.
 
 [choudoufu](https://intentius.io/choudoufu/) is the smallest possible change to OpenTofu that does this for AWS: two tags per resource, and the state file becomes a cache. [chant](https://intentius.io/chant/) goes the other way, out of Terraform and into the platform's own spec, across many platforms, with the same property. Both are open source, both are documented to the point of naming their own gaps, and neither has a pricing page.
 
-The person behind it has run infrastructure for a long time and writes about it at [lex00.github.io](https://lex00.github.io/). The [Accessible Ops](https://accessibleops.net/) spec, which this site rates every tool against, was seeded in part by that writing.
+The person behind it has run infrastructure for a long time and writes about it on [a personal blog](https://lex00.github.io/). The [Accessible Ops](https://accessibleops.net/) spec, which this site rates every tool against, was seeded in part by that writing.
 
 ## How we work
 

content/accessible-ops.md

@@ -4,7 +4,7 @@ summary: "Fourteen properties an infrastructure toolchain either has or does not
 wide: true
 ---
 
-[Accessible Ops](https://accessibleops.net/) is a spec, not a product. Its fourteen properties describe what it takes for a newcomer, human or agent, to operate infrastructure safely: the source predicts the platform spec, the same check runs at the keystroke, every change arrives as a diff in one place, credentials are scoped and revocable, the live system is the truth, and so on.
+[Accessible Ops](https://accessibleops.net/) is a spec, not a product. Its fourteen properties describe what it takes for a newcomer, human or agent, to operate infrastructure safely. The source predicts the platform spec. Every change arrives as a diff in one place where someone can say no. The live system is the truth.
 
 We use it as the bar for every engagement. When we recommend a tool, or build one, this is why.
 

content/compare/chant-cdk-and-pulumi.md

@@ -34,6 +34,6 @@ Reach and years. CDK covers every CloudFormation resource and Pulumi covers ever
 
 ## Where we are waiting
 
-- Until chant 0.63 the approval gate recorded who approved and when but not which plan. Approve, edit the root, re-run, and the edited change applied. Since 0.63 a resolution names the plan digest and the re-run is refused by name. That was our own biggest hole, and it is closed rather than never having existed. {{< status kind="shipped" date="2026-09-09" href="https://github.com/INTENTIUS/chant/pull/2338" >}}
+- Until chant 0.63 the approval gate recorded who approved and when but not which plan. Approve, then edit the root and re-run, and the edited change applied. Since 0.63 a resolution names the plan digest and the re-run is refused by name. That was our own biggest hole, and it is closed rather than never having existed. {{< status kind="shipped" date="2026-09-09" href="https://github.com/INTENTIUS/chant/pull/2338" >}}
 - An agent driving chant over MCP or ACP can still answer a gate it raised itself. Until that closes, no claim about approval integrity across both products. {{< status kind="open" href="https://github.com/INTENTIUS/chant/issues/2384" >}}
 - The largest synthetic benchmark is 200 resources. There is no measured scale figure for chant comparable to choudoufu's 745, and none is claimed. {{< status kind="open" href="https://github.com/INTENTIUS/chant/issues/2317" >}}

content/compare/choudoufu-and-terraform-state.md

@@ -25,13 +25,13 @@ Everything else is stock OpenTofu, and the [gauntlet](https://intentius.io/choud
 
 ## The claims, and how to check them
 
-Each of these is a smoke scenario in the repository, two to six minutes on Docker plus a local AWS emulator. Each also runs inverted: under `BREAK=1` it manufactures the exact corruption the claim guards against and passes only by catching it. [The full list is twenty.](https://intentius.io/choudoufu/docs/claims/)
+Each of these is a smoke scenario in the repository, two to six minutes on Docker plus a local AWS emulator. Each also runs inverted, where under `BREAK=1` it manufactures the exact corruption the claim guards against and passes only by catching it. [The full list is twenty.](https://intentius.io/choudoufu/docs/claims/)
 
 - Owned resources cannot fall out of plans unnoticed. {{< status kind="measured" href="https://intentius.io/choudoufu/docs/claims/#claim-1-owned-resources-cannot-fall-out-of-plans-unnoticed" >}}
 - Contention settles at the platform API, never in a lock. {{< status kind="measured" href="https://intentius.io/choudoufu/docs/claims/#claim-2-contention-settles-at-the-platform-api-never-in-a-lock" >}}
 - Staleness costs reads, never results. A fresh, an ancient and a missing cache plan byte-identically. {{< status kind="measured" href="https://intentius.io/choudoufu/docs/claims/#claim-3-staleness-costs-reads-never-results" >}}
 - Recovery is a re-run, never surgery. {{< status kind="measured" href="https://intentius.io/choudoufu/docs/claims/#claim-5-recovery-is-a-re-run-never-surgery" >}}
-- The roundtrip: one command in, one file out. Stock stands an estate up, `live-import` adopts it, the cache hands a stock state file back. {{< status kind="measured" href="https://intentius.io/choudoufu/docs/claims/#claim-6-the-roundtrip---one-command-in-one-file-out" >}}
+- The roundtrip is one command in and one file out. Stock stands an estate up, `live-import` adopts it, the cache hands a stock state file back. {{< status kind="measured" href="https://intentius.io/choudoufu/docs/claims/#claim-6-the-roundtrip---one-command-in-one-file-out" >}}
 - Carve by retag. A 79-resource terralith is split into team estates with tag writes and no state surgery. {{< status kind="measured" href="https://intentius.io/choudoufu/docs/claims/#claim-12-carve-by-retag" >}}
 - The tag is the boundary. Two roles fenced to two halves of one estate by an IAM condition; refused by AWS, not by the tool, and the same refusal lands on a plain CLI call. Reproduced on a real account with CloudTrail evidence. {{< status kind="measured" href="https://intentius.io/choudoufu/docs/claims/#claim-13-the-tag-is-the-boundary" >}}
 - A plan costs its estate, not its account. Measured with 3,705 foreign resources in the account: the read pass did not move by one call. {{< status kind="measured" href="https://intentius.io/choudoufu/docs/claims/#claim-20-scale---the-estate-boundary-holds-when-the-account-is-a-terralith" >}}

content/compare/control-planes.md

@@ -4,9 +4,9 @@ summary: "A category of products puts an approval loop around Terraform and call
 weight: 30
 ---
 
-The pitch is consistent across the category. Every change is planned, visible and approved. Nothing runs off-plan. The plan is the agent's work list, applied one effect at a time. Import brings existing infrastructure in as a reviewed diff. It scales to thousands of resources. It is native to whatever transport agents use this year.
+The pitch is consistent across the category. Every change is planned, visible and approved. Nothing runs off-plan. The plan is the agent's work list, applied one effect at a time. Import brings existing infrastructure in as a reviewed diff. It scales to thousands of resources and speaks whatever transport agents use this year.
 
-Strip the framing and the mechanism is a loop: plan, pick one effect, apply it, replan, repeat, with a person or a policy between rounds. The safety property is a small blast radius achieved by sequencing. It depends on the approval step catching the bad effect before it runs, and it depends on every actor going through the loop. Anything holding IAM credentials goes around it.
+Strip the framing and the mechanism is a loop. Plan and apply one effect from that plan, then replan and go round again with a person or a policy between rounds. The safety property is a small reach for any one mistake, achieved by sequencing. It depends on the approval step catching the bad effect before it runs, and it depends on every actor going through the loop. Anything holding IAM credentials goes around it.
 
 We answer the same claims from a different layer. Ownership is a tag on the resource, so your IAM is the boundary, and it holds whether or not the actor went through any tool.
 

content/contact.md

@@ -9,12 +9,12 @@ summary: "There is no form and nothing to sign up for. Write to us, and say what
 
 The conversation goes faster with three things:
 
-- A diagram, or a list, of what exists today. Accounts, estates, state files, pipelines, and who owns which.
+- A diagram, or a list, of what exists today. Which accounts and estates there are, where state lives, and who owns each.
 - The one operation you would like to stop doing by hand.
 - Who has to approve it when it runs.
 
 That is usually enough to say in one reply whether we can help, and what it would look like if we did.
 
 ## What we are not
 
-Not a vendor. There is no product to license, no seat, no tenancy, and no lever for anyone to pull later. If the right answer for you is a tool we did not build, we will say so.
+Not a vendor. There is no product to license and no seat to buy, so nobody has a lever to pull later. If the right answer for you is a tool we did not build, we will say so.

content/tools.md

@@ -5,19 +5,19 @@ summary: "Everything Intentius builds is open source. Two of these are the reaso
 
 ## choudoufu
 
-OpenTofu plus identity hooks. Each AWS resource carries its identity as two tags, `tofu-estate` and `tofu-address`, written as part of the create call and read back live on the next plan. The state file is a cache you are allowed to lose, and the IAM you already run decides who may read or change what. Handover is granting a role, a split is a tag rewrite, adoption is a tag you write. Twenty claims, each a smoke scenario with its failure demonstrated. Experimental, AWS only, MPL-2.0 like upstream.
+OpenTofu plus identity hooks. Each AWS resource carries its identity as two tags, written as part of the create call and read back live on the next plan. The tags are `tofu-estate` and `tofu-address`. The state file is a cache you are allowed to lose, and the IAM you already run decides who may read or change what. Handover is granting a role, a split is a tag rewrite, adoption is a tag you write. Twenty claims, each a smoke scenario with its failure demonstrated. Experimental, AWS only, MPL-2.0 like upstream.
 
 [Docs](https://intentius.io/choudoufu/) · [Source](https://github.com/INTENTIUS/choudoufu) · [The claims](https://intentius.io/choudoufu/docs/claims/) · [How it compares](/compare/choudoufu-and-terraform-state/)
 
 ## chant
 
-A type system for operations. Infrastructure is declared in a statically evaluable subset of TypeScript and folded to the platform's own spec with no module execution. Seventeen lexicons: AWS, Azure, GCP, Kubernetes, Helm, Docker, GitHub, GitLab, Forgejo, Fly, Fountain, Terraform and more. One project generates the pipeline for each forge, and gates are durable facts in git. `chant serve mcp` and `chant acp` let an agent drive it over stdio. Apache 2.0.
+A type system for operations. Infrastructure is declared in a statically evaluable subset of TypeScript and folded to the platform's own spec with no module execution. Seventeen lexicons cover the three big clouds and Kubernetes. Others reach the three forges. Fly, Fountain and Terraform have lexicons too. One project generates the pipeline for each forge, and gates are durable facts in git. `chant serve mcp` and `chant acp` let an agent drive it over stdio. It is licensed Apache 2.0.
 
 [Docs](https://intentius.io/chant/) · [Source](https://github.com/INTENTIUS/chant) · [The TypeScript subset, as a spec](https://github.com/INTENTIUS/typescript-as-data) · [How it compares](/compare/chant-cdk-and-pulumi/)
 
 ### The Fountain lexicon
 
-chant can declare a [Fountain](https://github.com/BinaryBourbon/fountain) estate the way it declares cloud infrastructure: agents, environments, vaults, teammates, schedules and webhook receivers, in TypeScript, applied through one call and diffed against what is live. Thirteen lint rules run before anything is sent, and they exist because of how agents fail: an environment that never said what network it wanted, a cloud key sitting in plain environment variables, an MCP server handed a literal token, a vault key silently shadowing an environment key. An agent, a teammate and a schedule are declared resources with per-tool permission verdicts, allowed vaults, allowed environments and a sandbox mode. Most products let you talk to an agent. This lets you declare one and diff it against what is actually running.
+chant can declare a [Fountain](https://github.com/BinaryBourbon/fountain) estate the way it declares cloud infrastructure, in TypeScript, applied through one call and diffed against what is live. The kinds it models are agents and their environments, vaults and teammates, and schedules and webhook receivers. Thirteen lint rules run before anything is sent, and they exist because of how agents fail: an environment that never said what network it wanted, a cloud key sitting in plain environment variables, an MCP server handed a literal token, a vault key silently shadowing an environment key. An agent is a declared resource with per-tool permission verdicts and a sandbox mode, and so are a teammate and a schedule. Most products let you talk to an agent. This lets you declare one and diff it against what is actually running.
 
 The six Fountain kinds chant models are modeled completely. The remaining API surface is excluded with recorded reasons.
 
@@ -39,4 +39,4 @@ Stateful local emulators so the tools above can be tested without an account. [m
 
 ## Also
 
-[pinhole](https://github.com/INTENTIUS/pinhole) draws chant's resolved graph as diagrams. [blacklight](https://blacklight.intentius.io) is a hosted chant audit: paste a public repo URL, get the misconfigurations in its CI, manifests and templates as ready-made diffs. [spicypath](https://spicypath.intentius.workers.dev) inspects any profile in the browser.
+[pinhole](https://github.com/INTENTIUS/pinhole) draws chant's resolved graph as diagrams. [blacklight](https://blacklight.intentius.io) is a hosted chant audit: paste a public repo URL and get its misconfigurations back as ready-made diffs. [spicypath](https://spicypath.intentius.workers.dev) inspects any profile in the browser.