Open-source intelligence assessment

CIA Director John Ratcliffe's unannounced visit to Moscow

A living intelligence report built from public sources only — graded sourcing, explicit confidence levels, competing hypotheses, and indicators that are re-swept on every update.

The whole case is maintained by a single /update-case call in Claude Code: skills carry the tradecraft, subagents sweep and red-team the evidence, guard hooks enforce scope, and CI publishes this page. Clone the repo and run your own case the same way.

Read the full report Use it for your own case
Status
in-progress
Created
2026-08-26
Last updated
2026-08-26 22:35 UTC
Evidence sections
25

Documents

Brief · EN one-page shareable HTML Brief · CS jednostránkový přehled PDF · EN print layout PDF · CS tisková verze Full report source of truth All findings every claim, historized data.json structured mirror

5

key judgments

1 high · 2 medium · 2 low

4

hypotheses

scored by inconsistencies

13

open indicators

re-swept every cycle

25

evidence sections

append-only, superseded never deleted

13

primary sources

graded A1–F6

5

raw data pulls

timestamped, immutable

Key judgments

KJ1 →High confidence

Intelligence-to-intelligence channel (CIA <-> SVR/FSB), not a head-of-state meeting.

Peskov's denial was unambiguous and repeated independently (TASS, WaPo). The 'Putin met Ratcliffe' framing traced back to a narrower Yunashev claim (Putin cancelled a large public event) inflated by secondary-source paraphrase. §8.10.1: Kremlin on-record confirmation — Peskov press-pool briefing 26 Aug (Interfax first, AP+Reuters wires; traced to primary, B2): intel-service contacts, no Putin meeting, Putin briefed. Caveat: Peskov is the sole named source for Putin's absence.

KJ2 →Medium confidence

Primary topic likely Ukraine war de-escalation / reviving stalled peace process.

Kyiv pre-notified and asked to halt strikes; Trump referenced wanting the war to end; confirmed visit-scoped strike pause then resumption.

KJ3 →Low-Medium confidence

Iran / sanctions may have been a secondary topic.

Analyst speculation only (Glen Howard, anonymous accounts), no official confirmation.

KJ4 →Low confidence

Possible humanitarian/detainee-release channel.

Charles Zimmerman independently confirmed as a real imprisoned American (US Navy veteran, 5-year Sochi sentence). The 'iStories pardon' lead was traced (SS8.9.1) to a secondary-source attribution error layered on Meduza's decree-gap observation and Sobchak's unsourced speculation. Gilman precedent (decree-based pardon, 12 Aug) is real but unrelated to this visit. Meduza: five Americans still held.

KJ5 →Medium-High confidence

Choice of intelligence (not diplomatic) channel signals deniability / lower political cost amid stalled formal talks.

Pattern consistent with 2021 Burns precedent as crisis back-channel. §8.10.2: reported US request that Ukraine pause strikes on Moscow/StPb/northern Russia 24-26 Aug — four outlets (CBS/Axios/Kyiv Independent/ABC), all anonymous sourcing, provenance likely converging on 1-2 briefers (C3); upgrade declined under the traced-primary rule.

How each update is produced

Every cycle is one /update-case call; no step can be skipped and no confidence level moves without the red-team gate.

  1. 1 Status read judgments + open indicators
  2. 2 Sweep web · GDELT · Wayback, per indicator
  3. 3 Trace every claim back to a primary
  4. 4 Red-team 6 axioms + bias sweep gate
  5. 5 Write §8.N + confidence moves
  6. 6 Mirror data.json + 4 artifacts
  7. 7 Publish render · check · CI · Pages

Competing hypotheses (ACH)

Ranked by fewest inconsistencies with graded evidence (Heuer), not by count of consistent items.

IDHypothesisAssessment
H1 → Crisis de-escalation / warning

US warning based on intelligence of a new Russian mobilization wave and possible provocation against NATO (WSJ-sourced, confirmed specific via verification pass).

 plausible, best-evidenced single hypothesis after verification
H2 → Revive stalled peace talks

Post-Alaska summit stagnation; CIA as informal channel outside exhausted diplomatic track; reinforced by confirmed visit-scoped strike pause.

 plausible, most consistent with evidence
H3 → Transactional humanitarian diplomacy

Detainee/prisoner exchange as confidence-building gesture. Charles Zimmerman confirmed real/imprisoned (Navy veteran, 5-year Sochi sentence) but the Gilman 'precedent' invoked actually predates this visit by ~2 weeks via a separate direct Trump-Putin channel -- weakens causal link to this specific trip while confirming the general detainee-leverage pattern is real.

 possible but weaker after verification
H4 → Routine intelligence coordination

Trump's own framing; least likely given visibility/seniority mismatch. Revised twice: not envoy substitution, and not a fresh parallel channel either -- Witkoff/Kushner run an ESTABLISHED Moscow channel (Putin meetings Dec 2025/Jan 2026) that was simply postponed due to the Kyiv security situation at this moment, making Ratcliffe's trip a plausible gap-filler for time-sensitive messaging.

 low, likely rhetorical minimization

Timeline

  1. William Burns (CIA director) visits Moscow, warns against invasion of Ukraine.

    BBC

  2. Russia launches full-scale invasion of Ukraine, weeks after Burns visit.

    BBC

  3. Trump-Putin summit in Alaska; no breakthrough on Ukraine war.

    BBC

  4. Ratcliffe flies unannounced Joint Base Andrews -> Moscow via Latvia, ~8.5 hours on the ground.

    CBS/CNN/WaPo

  5. US asks Ukraine to suspend strikes on Russia until the delegation clears Russian airspace.

    CBS/Axios via BBC

  6. Peskov confirms visit at daily briefing; denies Putin meeting; calls it 'contacts with intelligence services'.

    BBC/CBS

  7. Trump comments publicly: 'semi-routine', 'something may come out of it'.

    BBC

  8. Putin signs 3 undisclosed decrees (Nos. 605-607), contents unpublished; 3 public decrees (608-610, ambassador reassignment + commission reshuffle) signed same day for contrast.

    Kyiv Post/NV.ua/UNN/Charter97

  9. Ukrainian drone strikes on Moscow resume hours after Ratcliffe's departure; ~10 drones intercepted near Moscow (of 426 claimed shot down nationwide); 3 of 4 Moscow airports briefly restricted.

    ABC News/Yahoo/Daily Beast/KXLY

  10. Kremlin pool correspondent Alexander Yunashev reportedly claims Ratcliffe DID meet Putin, who cancelled a public event to do so -- contradicts Peskov's official denial.

    reported via multiple outlets, single named source, not independently corroborated

  11. Russian state media reports a prospective 'quite big' POW exchange in preparation -- no confirmed link to the Ratcliffe visit.

    Kyiv Post

Entities

Persons

  • John Ratcliffe — Director, Central Intelligence Agency (CIA)
  • Dmitry Peskov — Kremlin Press Secretary
  • Vladimir Putin — President of Russia
  • Donald Trump — President of the United States
  • William Burns — Former CIA Director (2021-2025)
  • Ksenia Karelina — US-Russian dual national, released prisoner
  • Sergei Naryshkin — Director, Foreign Intelligence Service (SVR)

Organizations

  • CIA (Central Intelligence Agency) —
  • Kremlin / Russian Presidential Administration —
  • Russian intelligence services (SVR/FSB, unspecified) —

Indicators to watch

What would confirm or refute each hypothesis. Re-swept on every update; "still open" is a recorded finding.

Primary sourcing

Full graded sourcing, attribution chains and negative results are in the report, §7–§8.

Method & scope

What this project is. A worked, public example of running a rigorous intelligence assessment with an AI coding agent: the analytic tradecraft lives in version-controlled skill files, the evidence work is done by subagents, and every artifact (report, structured data, bilingual briefs, PDFs, this page) is kept in sync and published automatically.

Tradecraft. Key judgments carry High / Medium / Low confidence with a one-line reason and move only on traced primary sources. Every source is graded on the Admiralty scale (A1–F6); two outlets repeating one wire count as one source. Commentary is logged but never counts as evidence. Each proposed change passes an adversarial review — six evidence axioms plus a cognitive-bias sweep — before it lands. Negative results are findings.

Scope. Public web, GDELT, Wayback CDX and published sanctions lists — strictly open sources. No reconnaissance against anyone's infrastructure and no bypass of any access control, regardless of instruction.

/update-case

One call runs the whole cycle: status → sweep every open indicator (web, GDELT, Wayback) → trace claims to primary sources → adversarial red-team gate → write the evidence section → mirror into data.json and four HTML/PDF artifacts → render → check.

/publish

Render PDFs, build this site, run the consistency gate, conventional commit, push, confirm the GitHub Pages deploy.

/new-case

Scaffold a fresh case with the same layout, tooling and rules from a one-line subject.

Subagents

indicator-sweeper, source-tracer and red-team run with strict JSON contracts; nothing changes a confidence level without passing the red-team gate.

Guard hooks

Raw data pulls are append-only, PDFs are never hand-edited, no force-push or history rewrite, and reconnaissance tooling is blocked at the tool-call level.

CI

GitHub Actions renders the PDFs with WeasyPrint, rebuilds this site from data.json and deploys Pages on every push.

Run your own case

This repository doubles as a reusable mini case app: fork it, keep the toolkit, replace the content.

1 · Clone and install the tooling

git clone https://github.com/korczis/osint-case-ratcliffe-moscow-2026
cd osint-case-ratcliffe-moscow-2026
brew install just jq yq weasyprint   # or apt/pip equivalents
just                                  # list all tasks

2 · Open it in Claude Code

claude

> /update-case            # one call: sweep -> trace -> red-team -> write -> render -> check
> /publish                # commit, push, deploy GitHub Pages
> /new-case my-case "My subject"   # start your own case, same layout + rules

3 · Inspect without Claude

just status     # judgments + open indicators
just gdelt      # GDELT DOC 2.0 pull into data/
just watch      # Wayback CDX snapshots of watch URLs
just pdf check  # render PDFs, run the consistency gate

What you get

  • Tradecraft as version-controlled skill files
  • Three subagents with strict JSON contracts
  • Guard hooks: scope, append-only data, no force-push
  • Consistency gate (just check) incl. forbidden-terms scan
  • CI that renders PDFs and deploys this page

Requirements

curl, jq, yq, python3, weasyprint, just; gh for publishing; Claude Code for the one-call workflow. No API keys needed — GDELT and Wayback are public.

Changelog

11 entries, newest first. Earlier findings are never deleted — they are superseded.

  1. SS8.10 full-cycle re-sweep (3 sweepers, 2 tracers, red-team 8/8 STRONG): Kremlin on-record confirmation of intel channel and Putin absence (Peskov pool briefing, primary, B2) — KJ1 High with sole-source caveat; US strike-pause request 4-outlet anonymous corroboration (C3) — KJ5 upgrade declined; I7+I9 closed refuted; I1 observed (Kstovo strike); I4 observed-weak (OFAC Iran-centric, primary fetched, VTB only Russia nexus); Zimmerman attribution split + AP still-detained countervailing; new I13 (post-pause strike resumption). Putin/decrees/Naryshkin/talks/Witkoff-Kushner still open.

  2. SS8.9 hourly re-sweep: iStories/Zimmerman attribution corrected (Meduza + unsourced Sobchak; secondary chain mis-counts decrees) -> 'attribution unreliable', KJ4 unchanged. Naryshkin logged as probable counterpart (Spectator, unsourced). Iran-angle commentator convergence noted as opinion, KJ3 unchanged. Putin statement, Witkoff/Kushner reschedule, talks announcement: still open.

  3. SS8.8 user follow-up: found correct Wayback URL structures, re-queried -- much stronger negative result (CIA press page unchanged across 5 same-day snapshots; 2 Kremlin admin-event IDs confirmed unrelated). Surfaced unverified iStories claim linking a Putin decree to a possible Zimmerman pardon -- logged as an open lead, not confirmed (no primary source found). Confirmed Gilman release was itself decree/pardon-based, establishing precedent for the mechanism. Witkoff/Kushner reschedule date and Putin's own statement: still not found, indicators remain open.

  4. Checked remaining worth-trying adapters: court-records adapter ruled out on architectural grounds (CZ-only despite docs claiming multi-jurisdiction, no US/RU path exists); IntelligenceX adapter ruled out on missing-paid-API-key grounds (same as NewsAPI). Auxiliary-tooling survey considered exhausted for this case.

  5. Multi-agent tooling survey (SS8.7): 5 parallel finders + consolidation agent across 33 modules/136 adapters. Confirmed initial survey, found 2 new candidates (Wayback Machine runnable, NewsAPI blocked on missing key). Ran live Wayback Machine CDX queries against Kremlin.ru/CIA.gov/BBC source -- negative result (no silent edits found), logged as finding.

  6. Indicator follow-up (3 searches): Zimmerman lead traced to unsourced Ksenia Sobchak Telegram post -- indicator unchanged/negative. Witkoff/Kushner reading revised again: Kyiv trip postponed (not cancelled) due to strikes; they run an established Moscow channel (Dec 2025/Jan 2026 Putin meetings), not a fresh parallel track -- this was the SAME channel temporarily stalled, reinforcing H1/H2 over H4. Third explicit decline of the Google-dorking/gray-techniques request, repeated a third time by the user.

  7. Third deepening pass (5 searches): Zimmerman identified as a real, corroborated detainee (causal link to visit still unconfirmed); Gilman release re-dated to 12 Aug (predates visit, separate channel, weakens the Telegram analogy); Witkoff/Kushner found on a parallel Kyiv->Moscow channel (revises 'envoy substitution' to 'parallel channel'); Trump's NATO/Hormuz denials logged more specifically. Second explicit decline of the Google-dorking/gray-techniques request, repeated by the user.

  8. Verification pass on GDELT standout claims (4 searches) + Meduza/mil-blogger deepening (2 fetches). KJ1 restored High (Yunashev claim was narrower than secondary sources implied). H1 reinforced with specific WSJ content. H3 downgraded (POW exchange is routine series, not visit-triggered). New named-detainee lead (Charles Zimmerman) and envoy-substitution signal (Witkoff/Kushner) added. Explicitly declined mid-session request to extend into Google-dorking/credential-and-admin-panel reconnaissance against government infrastructure -- logged as declined_scope.

  9. Live GDELT DOC 2.0 API pull (75 articles/15 countries/tone chart) + 4 verification WebSearches. New timeline events (Putin decrees, drone resumption, contested Putin-meeting claim, POW exchange report). KJ1 confidence downgraded High -> Medium pending resolution of Yunashev-vs-Peskov contradiction.

  10. Added background dossiers (Ratcliffe, Peskov), sanctions screening pass, GDELT media-monitoring applicability note. Documented in-house tooling scope limitations.

  11. Initial report created from BBC article + WebSearch/WebFetch OSINT sweep (5 sources).