The Trueness platform

Owner: Claude (written into Codex's product lane while Codex is idle; Codex to reconcile with the screen specification and the model plan). Status: first draft, 25 October 2026, enterprise scale. Companion documents: product and UX specification (screen-by-screen behaviour), models and integrations (model routing, MCP contract), operating system (the 18 procedures the platform automates), calibration method (what the calibration engine computes). Nothing described here has been built; this is the specification the pilot builds against.

1. What the platform is, in one paragraph

Start with what a team does with it on a Monday: paste a concept or drop an ad, an email, a page or a deck; twelve people who behave like the brand's audience react in their own voices with a score and a reason; a chair gives a verdict and a second reader challenges it; you interview any one of them; you ask the research behind them a question and get a cited answer; you send a one-page PDF to the room. That everyday usefulness is the product, and it is described in what it is like to use Trueness every week. Everything below exists to make that experience fast, trustworthy and defensible at enterprise scale.

Trueness is a governed research platform with five parts: an audience engine that builds and runs synthetic audiences on any frontier model from a brand's own evidence; a calibration engine that recruits and runs fresh human holdouts, seals them from the build, and measures every audience against them each quarter; a record registry that keeps a versioned, client-owned Calibration Record for every audience, market and use; three access surfaces (a web workspace, an API, and an MCP server) through which the brand, its agencies and its AI tools query calibrated audiences with the record's scope of use attached to every answer; and an operations layer that runs the back office as agent workflows with human approval gates. The product the client sees is the audience, the record and the surfaces. The product Trueness runs is the calibration engine and the operations layer.

Brand: CMO / CCO, insights lead; Executive quarterly readBrandCMO / CCO, insights leadExecutive quarterly read Agencies (sub-tenants): Strategists, planners; Test work before the client doesAgencies (sub-tenants)Strategists, plannersTest work before the client does Analysts and AI tools: API clients, agent workflows; Claude / ChatGPT via MCPAnalysts and AI toolsAPI clients, agent workflowsClaude / ChatGPT via MCP Trueness people: Research lead; External reviewer, custodianTrueness peopleResearch leadExternal reviewer, custodian

Web workspace: 14 customer views, 12 operator viewsWeb workspace14 customer views, 12 operator views API and webhooks: Same objects, tenant-scoped, signed eventsAPI and webhooksSame objects, tenant-scoped, signed events MCP server: Same permissions; scope of use on every answerMCP serverSame permissions; scope of use on every answer Authorisation layer: brand tenant, agency sub-tenants, reviewer access, client-controlled sharing, audit trail, spend envelopes

Audience engine: Evidence claims: observed, derived, generated; Synthetic people with cited grounding; Model-agnostic audience versions; Chair and challenger synthesisAudience engineEvidence claims: observed, derived, generatedSynthetic people with cited groundingModel-agnostic audience versionsChair and challenger synthesis Calibration engine: Quarterly human waves per market; Sealed holdouts, separate custody; Metrics with intervals; baselines; Monthly drift pulsesCalibration engineQuarterly human waves per marketSealed holdouts, separate custodyMetrics with intervals; baselinesMonthly drift pulses Record registry: Calibration Record per audience, market, use; Versioned, signed, client-owned; Permitted uses, expiry, triggers; PDF, JSON, CSV exportsRecord registryCalibration Record per audience, market, useVersioned, signed, client-ownedPermitted uses, expiry, triggersPDF, JSON, CSV exports

Operations layer: 18 procedures as agent workflows: enquiry, intake, protocol lock, fieldwork, build, blinded validation, release,; studies, monitoring, billing, renewal, model release, incident, monthly close.; Human approval gates only where money moves, a record is signed, or a rights question is open. Everything metered.Operations layer18 procedures as agent workflows: enquiry, intake, protocol lock, fieldwork, build, blinded validation, release,studies, monitoring, billing, renewal, model release, incident, monthly close.Human approval gates only where money moves, a record is signed, or a rights question is open. Everything metered.

External: panel suppliers and recruiters for the human waves (by API); model providers through a gateway, named model and version per audience; data processing agreements; regional hosting. Blue outline marks the human arm. Nothing shown here has been built; it is the specification the pilot builds against.

2. The five parts

2.1 Audience engine

Input: the brand's approved segmentation, personas, research archive and any first-party survey data (rights-registered), plus syndicated profile data where the brand has none. Every fact is stored as an evidence claim with source, page, date, base and permission (three typed layers: observed, derived, generated).
Build: synthetic people are written from the evidence with cited grounding; the number of people, the household and market mix and the subgroup design are recorded as design choices, never presented as a sample. A chair-and-challenger synthesis runs on every study; a second provider is used for the challenger where possible.
Model-agnostic: an audience version is bound to a named model and version. Changing the model creates a new audience version that must be recalibrated before release. The engine runs on the client's chosen simulator where contractually required; Trueness then operates as the calibration layer only.
Output: audience versions with status (draft, current for named use, restricted, expired, revoked) and the list of uses the current record supports.

2.2 Calibration engine

Wave design: per programme, per market, per quarter. A wave is a sealed human study: recruitment to the audience definition through two panel suppliers, attention and fraud screens, interviews for themes, completes for distributions, incentives reconciled, exclusions pre-registered.
Custody: holdout outcomes and stimulus identifiers are hashed and held by a custodian role with access separated from everyone who builds or prompts. Developers cannot query outcomes through retrieval, exports or assistant tools.
Computation: versioned statistical code (not a model) computes distributional distance, rank-order agreement on stimuli, subgroup fidelity, dispersion ratio and theme overlap, each with confidence intervals, against simple baselines (an ungrounded model, a prior wave). Abstention and coverage are measured as first-class results.
Drift: monthly pulses (100–150 humans) screen for drift between quarterly waves; a drift trigger restricts affected uses and schedules recalibration.

2.3 Record registry

The Calibration Record is an immutable, versioned object: audience, market, model and version, evidence snapshot, wave dates, recruitment method, sample and effective sample sizes, stimulus provenance, development and holdout separation, metrics with intervals, subgroup findings, abstention frequency, failed and inconclusive endpoints, permitted uses, expiry, early triggers, reviewer signature, supersession links.
Ownership: the record belongs to the client. It exports as a signed PDF, JSON and CSV, and is readable by the client's auditors, agencies and regulators without Trueness in the room.
Scope of use travels with every answer: any result from any surface carries the record identifier and the permitted-use statement of the audience version that produced it.

2.4 Access surfaces

Web workspace: the fourteen customer views in the screen specification (engagement home, audience library and detail, evidence room, Calibration Record, new study, run progress, results, compare, explore reactions, human follow-up, reports, usage, team and integrations) and the twelve operator views (work queue, capacity, rights review, study designer, holdout custody, evaluation bench, release queue, model registry, refresh dashboard, cost, support, data lifecycle).
API: versioned, tenant-scoped; the same objects as the web (audiences, records, studies, runs, results, exports); webhooks for wave completion, record release, drift triggers and study results; rate limits and signed events.
MCP server: the same permissions and limits as the web, exposed as tools an analyst can use inside Claude, ChatGPT or an agent workflow: list audiences, read a record, estimate and create a bounded study with explicit confirmation of scope and spend, follow a job, retrieve a released result, draft a human follow-up request. Raw participant data, holdout answers, credentials and payments are never tools. Packaged Claude and ChatGPT connectors follow once the private MCP has been used by the anchor partner's agency.

2.5 Operations layer

Every one of the 18 procedures (enquiry, qualification, intake, evidence mapping, protocol lock, fieldwork, build, blinded validation, release, study request, synthesis and challenge, monitoring and refresh, support, billing, renewal, model release, incident, monthly close) runs as an agent workflow with deterministic state transitions and a human approval gate only where money moves, a record is signed, or a rights question is open.
Agents draft; services decide. Access, budgets, statistics, billing and state changes are deterministic application services; models prepare, extract, draft, simulate and triage.
Everything is metered: tokens, fieldwork spend, research hours, reviewer days, per tenant and per programme, so the finance model is fed by actuals from month one.

3. Who uses it and what they see

Persona	Surface	What they do	What they must never be able to do
Chief marketing or customer officer	Quarterly executive read (web and PDF)	See, per audience and market, what the synthetic audience can be relied on for this quarter, what changed, and what needs real people	Nothing is hidden from them; they see failed and inconclusive endpoints
Brand and insights lead	Web workspace	Commission studies, read results and records, request human follow-ups, manage agency access	Tune an audience against sealed outcomes
Agency strategist or planner (sub-tenant)	Web workspace, MCP in their own assistant	Test creative, messaging and media ideas against the calibrated audiences before the client sees them	See other agencies' studies; export participant data; alter audience versions
Analyst or data scientist	API, MCP	Automate recurring checks, pull results into decks and dashboards, run bounded studies from an agent workflow	Exceed entitlement or scope without confirmation
Trueness research lead	Operator views	Design waves, lock protocols, review exclusions, interpret results, draft the record	Access sealed outcomes before analysis is frozen
External reviewer and holdout custodian	Operator views, separated	Hold the sealed set; check computation and claims; sign the record	Be the same person as the research lead
Trueness operator (agent-run, human-supervised)	Operations layer	Run intake, procurement, billing, monitoring, incidents	Approve spend or sign records

4. Data, tenancy and security

Tenancy: brand tenant with agency sub-tenants and reviewer access; client-controlled sharing of audiences and records; cross-organisation audit trail; removal revokes new access and retains released records under contract.
Data classes: source assets (rights-registered, hashed, retained to a date), evidence claims, audience versions, protocols and human studies, model configurations, records, studies and runs (with run manifests: model identifiers, prompt hashes, seeds where supported, token usage, spend), decisions and outcomes, ledger events.
Participant data: minimised and anonymised before modelling; panel data processed under data processing agreements; regional hosting (US and EU) for the human data; deletion scopes and provider deletion requests on offboarding.
Security baseline for enterprise procurement: SSO, role-based access, tenant isolation tests, immutable record versions, encrypted evidence stores, audit logs, SOC 2 Type I within the first year and Type II by year two, security questionnaire pack maintained as a living document.
Spend controls: per-run maximum, per-tenant monthly envelope, metered failures and retries; cheaper models promoted only after measured quality.

5. Proposed stack (to be confirmed by Codex)

Application: a Node and TypeScript web application on a managed platform with a Postgres database, object storage for evidence and exports, durable workflows for waves and long-running jobs, and a queue for fieldwork and model jobs.
Models: through a gateway that lets the engine bind an audience version to a named model and version from any provider, with usage metered per tenant; statistical computation in versioned Python with tests, never in a model.
Fieldwork: panel suppliers integrated by API for quotas, completes and quality flags; qualitative recruitment and moderation through contracted partners; incentives reconciled automatically.
Surfaces: web workspace; REST API with webhooks; MCP server as a first-class service sharing the same authorisation layer.
Operations: agent workflows (the 18 procedures) with approval gates; metering and ledger events feeding the finance model.

6. Build plan

Phase	Months	What exists at the end	Gate
0. Thin workspace	0–2	Evidence room, audience engine on one model, protocol lock, holdout custody, first wave run through supplier APIs, record generator producing a signed PDF and JSON, operator work queue	Anchor partner's first wave delivered
1. Programme surfaces	2–4	Full customer workspace, agency sub-tenants, read-only MCP for the anchor's agency, drift pulses, executive read, metering	Anchor's agency uses MCP in anger; second wave
2. Scale	4–8	API and webhooks, study creation through MCP with confirmation, multi-market waves, model registry with recalibration workflow, SOC 2 Type I, agency licence tooling	Two Enterprise Audits delivered on the platform
3. Channel and portfolio	8–14	Group tenancy, shared audiences across brands, licensee operator views, packaged Claude and ChatGPT connectors	First licensee programme

Build cost assumption for the model: a fractional engineering team (two engineers and a part-time security lead) through phase 2, around $0.6–0.9m in the first year including platform and model costs, before the research bench. Codex to confirm in the finance rerun.

7. What the platform is not

Not a self-serve persona tool: there is no sign-up, no free tier, and no audience without a record. Not a panel: fieldwork is bought from suppliers under contract. Not a simulation vendor: the engine runs any model and will run a client's chosen simulator as the thing being calibrated. Not a chatbot: exploratory conversation with a synthetic person exists (explore reactions) and is labelled generated; it never creates a validated score.