Site: cut every page to roughly half, lint clean

Content drops from 5,190 words to about 2,580 across the same eleven
pages. Structure, links and status pills kept. Zero blocking prose
findings.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EFsqVDRNABeAMP8zhQawtz

Author: lex00

content/_index.md

@@ -4,28 +4,28 @@ lede: "The creators of choudoufu and chant"
 sub: "Our tools are free. Need help?"
 problems:
   - title: "A Terraform estate nobody wants to inherit"
-    body: "One state file, many teams, and a migration project every time the org chart moves. We move ownership onto the resources as tags, so handover is an IAM grant and a split is a tag rewrite."
-    link: "Estate migration and carving"
+    body: "We move ownership onto the resources as tags. Handover becomes an IAM grant."
+    link: "Estate migration"
     href: "/work/#estate-migration-and-carving"
   - title: "Agents that need production access"
-    body: "You want an agent to run drift checks, nightly applies and migrations, and you do not want to hand it a cloud key. We set it up so the program makes the call and never holds the credential."
+    body: "The program makes the call and never holds the credential."
     link: "Agents against real infrastructure"
     href: "/work/#agents-against-real-infrastructure"
-  - title: "A pipeline per forge, hand-maintained"
-    body: "GitHub today, GitLab or Forgejo tomorrow, and a YAML file that drifts on each. We generate the pipeline from one typed project, with the approval gate as a fact in git."
-    link: "Generated CI with gates"
+  - title: "A pipeline per forge, by hand"
+    body: "One typed project generates all three, with the approval gate as a commit."
+    link: "Generated CI"
     href: "/work/#generated-ci-with-gates"
 ---
 
 <div class="tool">
   <div class="name">choudoufu</div>
-  <p>OpenTofu plus identity hooks. Each AWS resource carries its identity as two tags, written on the create call and read back on every plan. The state file becomes a cache you are allowed to lose, and your IAM decides who may change what. Twenty claims, each with a smoke scenario you can run. <a href="https://intentius.io/choudoufu/">Docs</a> · <a href="/compare/choudoufu-and-terraform-state/">How it compares</a></p>
+  <p>OpenTofu plus identity hooks. Ownership is two tags on the resource, and the state file is a cache you may lose. <a href="https://intentius.io/choudoufu/">Docs</a> · <a href="/compare/choudoufu-and-terraform-state/">Compare</a></p>
 </div>
 <div class="tool">
   <div class="name">chant</div>
-  <p>A type system for operations. Infrastructure is declared in a statically evaluable subset of TypeScript and folded to the platform's own spec before anything runs. Seventeen lexicons, one project, generated pipelines, durable gates. <a href="https://intentius.io/chant/">Docs</a> · <a href="/compare/chant-cdk-and-pulumi/">How it compares</a></p>
+  <p>A type system for operations. Typed source folded to the platform's own spec before anything runs. <a href="https://intentius.io/chant/">Docs</a> · <a href="/compare/chant-cdk-and-pulumi/">Compare</a></p>
 </div>
 <div class="tool">
   <div class="name">the standard</div>
-  <p>Both tools are rated, alongside the alternatives, against the fourteen properties of <a href="https://accessibleops.net/">Accessible Ops</a>. That scorecard is the bar we consult against. <a href="/accessible-ops/">Read down a column</a></p>
+  <p>Both are rated against the fourteen properties of <a href="https://accessibleops.net/">Accessible Ops</a>. <a href="/accessible-ops/">The scorecard</a></p>
 </div>

content/about.md

@@ -3,18 +3,16 @@ title: "About"
 summary: "Intentius is an infrastructure consultancy. The tools came out of the work."
 ---
 
-Intentius does infrastructure work for teams that inherited more than they built: shared production accounts, state files nobody wants to touch, and now agents that need production access without production keys.
+Every infrastructure tool outside Kubernetes keeps a private ledger of what it owns, and the ledger is where the permission boundary, the secrets and the lock end up. We wanted the record where IAM could read it.
 
-The tools exist because the work kept hitting the same wall. Every infrastructure tool outside Kubernetes keeps a private ledger of what it owns, and the ledger is where the permission boundary, the secrets and the lock end up. An entire industry sells workarounds for that ledger from a layer above it. We wanted the record where IAM could read it.
+[choudoufu](https://intentius.io/choudoufu/) is the smallest change to OpenTofu that does this for AWS. [chant](https://intentius.io/chant/) goes the other way, out of Terraform and into the platform's own spec, with the same property. Both are open source and neither has a pricing page.
 
-[choudoufu](https://intentius.io/choudoufu/) is the smallest possible change to OpenTofu that does this for AWS: two tags per resource, and the state file becomes a cache. [chant](https://intentius.io/chant/) goes the other way, out of Terraform and into the platform's own spec, across many platforms, with the same property. Both are open source, both are documented to the point of naming their own gaps, and neither has a pricing page.
-
-The thinking behind the tools is written up at length on [our blog](https://lex00.github.io/). The [Accessible Ops](https://accessibleops.net/) spec, which this site rates every tool against, was seeded in part by that writing.
+The thinking is written up on [our blog](https://lex00.github.io/). The [Accessible Ops](https://accessibleops.net/) spec, which this site rates every tool against, was seeded in part by that writing.
 
 ## How we work
 
-Measured, not argued. A claim about our own tools links to the test that proves it or the issue that says it is not done. When a check fails once and passes on a re-run, that is a finding, not a flake.
+Measured, not argued. A claim about our tools links to the test that proves it or the issue that says it is not done.
 
-Upstream, in small pieces. Changes to other people's projects go in as reviewable stacks with tests, on the maintainer's conventions.
+Upstream, in small pieces. Changes to other people's projects go in as reviewable stacks with tests.
 
-Nothing to buy. Everything we build is open source and stays yours. If you want help using it, or help with an estate that has nothing to do with our tools, [ask](/contact/).
+Nothing to buy. If you want help, [ask](/contact/).

content/accessible-ops.md

@@ -1,13 +1,9 @@
 ---
 title: "Accessible Ops"
-summary: "Fourteen properties an infrastructure toolchain either has or does not. This is the standard we consult against, and the scorecard is how the tools we use, ours included, measure up."
+summary: "Fourteen properties a toolchain has or does not. The bar we consult against."
 wide: true
 ---
 
-[Accessible Ops](https://accessibleops.net/) is a spec, not a product. Its fourteen properties describe what it takes for a newcomer, human or agent, to operate infrastructure safely. The source predicts the platform spec. Every change arrives as a diff in one place where someone can say no. The live system is the truth.
-
-We use it as the bar for every engagement. When we recommend a tool, or build one, this is why.
-
-Each row below is one property. Open a row for the reasoning behind each mark, or follow the arrow to the property's full text. Two columns are hidden for now while their notes are rechecked.
+[Accessible Ops](https://accessibleops.net/) is a spec, not a product. Open a row for the reasoning behind each mark, or follow the arrow to the property. Two columns are hidden while their notes are rechecked.
 
 {{< scorecard >}}

content/compare/_index.md

@@ -1,8 +1,8 @@
 ---
 title: "Compare"
-summary: "Opinionated matchups, one page each. Every claim about our own tools links to the test, the smoke scenario, or the issue that says it is not done yet."
+summary: "One page per matchup. Every claim about our tools links to the proof or the issue."
 ---
 
-We are not neutral. We built two of the tools on these pages because the alternatives kept the record of what you own somewhere your IAM cannot see. Read the marks as arguments, follow the links, and decide for yourself.
+We are not neutral. Read the marks as arguments and follow the links.
 
-Every claim on these pages carries a status: measured means a test or smoke scenario proves it and you can run it; shipped means it exists with a date; documented means the docs describe it and nothing measures it yet; open means an issue is filed and the site is waiting on it.
+Measured means a test you can run. Shipped means it exists, with a date. Documented means nothing measures it yet. Open means an issue is filed.

content/compare/chant-cdk-and-pulumi.md

@@ -1,39 +1,30 @@
 ---
 title: "chant, CDK and Pulumi"
-summary: "All three let you write infrastructure in TypeScript. Only one of them refuses to run it."
+summary: "All three take TypeScript. Only one refuses to run it."
 weight: 20
 ---
 
-CDK and Pulumi are programs. You write TypeScript, the tool executes it, and what comes out depends on what ran: a context lookup, an environment variable, a call into the SDK. CDK synthesizes a CloudFormation template you can read afterwards. Pulumi keeps its own state and shows you a preview.
-
-[chant](https://intentius.io/chant/) is source. It accepts the subset of TypeScript whose value is fully determined by literals, constants and references, and folds that source to the platform's own spec, CloudFormation or a Kubernetes manifest or a Fly machine config, with no module execution. A call-as-value is not refused by a lint rule; it is unrepresentable. The [specification](https://github.com/INTENTIUS/typescript-as-data) and a conformance suite are public.
-
-That one difference decides most of the rows below.
-
-## Row by row
+CDK and Pulumi execute your program, and the output depends on what ran. [chant](https://intentius.io/chant/) accepts only the subset of TypeScript whose value is fixed by literals and references, and folds it to the platform's own spec with no execution. The [subset is a spec](https://github.com/INTENTIUS/typescript-as-data) with a conformance suite.
 
 | Property | chant | CDK | Pulumi |
 |---|---|---|---|
-| The source predicts the platform spec | Folds to native spec, no run | Synthesizes a template, but a lookup can shift it when it runs | Runs the program; no static spec, only an engine preview |
-| The same check at the keystroke | Type and fold diagnostics, human and agent alike | TypeScript types check; infra correctness needs synth and a plan | TypeScript types check; infra correctness needs a preview |
-| Every change is one diff in one place | One typed change set against live | `cdk deploy` | `pulumi up` |
-| Secrets by name, least privilege | By reference, never held, keyless signing | Refs and IAM, but the program can read secrets at runtime | ESC gives references, but core stores secrets in state |
-| Bounded blast radius | Owned-only by marker, a per-environment removal cap, a blast-radius graph | Stack and IAM boundaries; refs can widen reach | Stack and IAM boundaries; refs can widen reach |
-| Reversible before risky | Reversible runs ungated; destructive gated with saga rollback | CloudFormation auto-rollback; no gate on an irreversible change | No rollback; re-apply a prior state |
-| Escalate the judgment | A durable approval gate that survives a crash | Approval in the CI pipeline | Approval via a paid add-on |
-| The live system is the truth | No state store | No tool-side copy; CloudFormation's own record | Keeps its own authoritative state |
-| Adopt in place | Imports a template or a live estate; the spec stays native | `cdk import`, then rewrite as code | `pulumi import`, then rewrite as code |
-| Manage only what you declare | Deletes gated on an ownership marker | Absence in the template deletes | Absence in the program deletes |
-| Verify the artifact | SBOM, provenance and a signature at synthesis, verified at the deploy gate | CI add-ons | CI add-ons |
+| Source predicts the spec | Folds, no run | Synthesizes, but a lookup can shift it | Engine preview only |
+| Check at the keystroke | Type and fold diagnostics | Types; correctness needs synth and plan | Types; correctness needs a preview |
+| Secrets by name | By reference, never held | Program can read them at runtime | Core stores them in state |
+| Blast radius | Owned-only by marker, removal cap | Stack and IAM; refs widen reach | Stack and IAM; refs widen reach |
+| Reversible before risky | Destructive gated, saga rollback | Auto-rollback, no gate | No rollback |
+| Escalate the judgment | Durable gate | In the CI pipeline | Paid add-on |
+| Live system is the truth | No state store | CloudFormation's record | Its own state |
+| Adopt in place | Spec stays native | `cdk import`, then rewrite | `pulumi import`, then rewrite |
+| Manage only what you declare | Deletes gated on a marker | Absence deletes | Absence deletes |
+| Verify the artifact | SBOM, provenance, signature | CI add-ons | CI add-ons |
 
-The [full scorecard](/accessible-ops/) has the reasoning behind each mark and the two rows this table leaves out.
+The [scorecard](/accessible-ops/) has the reasoning behind each mark.
 
-## What CDK and Pulumi have that chant does not
+## What they have that chant does not
 
-Reach and years. CDK covers every CloudFormation resource and Pulumi covers every provider Terraform does. chant covers seventeen platforms through its lexicons, and a resource a lexicon does not model is not something you can declare yet. The [lexicon list](https://intentius.io/chant/) is the honest boundary, and a compatibility page in the shape of the one above is filed and not yet written. {{< status kind="open" href="https://github.com/INTENTIUS/chant/issues/2318" >}}
+Reach and years. A resource a lexicon does not model cannot be declared yet. A compatibility page is filed and not written. {{< status kind="open" href="https://github.com/INTENTIUS/chant/issues/2318" >}}
 
-## Where we are waiting
+## Fixed, and still open
 
-- Until chant 0.63 the approval gate recorded who approved and when but not which plan. Approve, then edit the root and re-run, and the edited change applied. Since 0.63 a resolution names the plan digest and the re-run is refused by name. That was our own biggest hole, and it is closed rather than never having existed. {{< status kind="shipped" date="2026-09-09" href="https://github.com/INTENTIUS/chant/pull/2338" >}}
-- An agent driving chant over MCP or ACP can still answer a gate it raised itself. Until that closes, no claim about approval integrity across both products. {{< status kind="open" href="https://github.com/INTENTIUS/chant/issues/2384" >}}
-- The largest synthetic benchmark is 200 resources. There is no measured scale figure for chant comparable to choudoufu's 745, and none is claimed. {{< status kind="open" href="https://github.com/INTENTIUS/chant/issues/2317" >}}
+Until 0.63 an approval did not name the plan it approved. It does now. {{< status kind="shipped" date="2026-09-09" href="https://github.com/INTENTIUS/chant/pull/2338" >}} An agent on MCP can still answer its own gate. {{< status kind="open" href="https://github.com/INTENTIUS/chant/issues/2384" >}} No scale figure beyond a 200-entity bench. {{< status kind="open" href="https://github.com/INTENTIUS/chant/issues/2317" >}}