A Polygraph engine

polygen — code that's checkable from the first line

Most AI-written code is verified after the fact, if it's verified at all. polygen flips the order: it drafts the state machine and its contract together, self-repairs against its own checks before you ever see a diff, and ships with a regression corpus synthesized from the model it just built.

The pipeline

What goes in, the stages it runs, what it leaves behind. Step through the stages to trace the run.

fig 6

polygen

code that is checkable from the first line

One paragraph of intent in; a model-checked SAM v2 module, its rules, and a replayed regression corpus out.

author

human review

Contract draft

Observable fields, action alphabet, data domains, terminal states. The contract is the design spec, so it stops for review before any code exists.

→

Author module

A SAM v2 strict-profile module. Gated on the v2 surface, a strict validate, and a DEAD-AT-INIT refusal — a module that validates clean but can do nothing is sent back with the diagnosis.

→

Propose invariants

Candidate rules over the contract’s state, drafted for the designer to own.

→

repair loop

Model check

Exhaustive from init. On a violation, repair the code and re-check, capped at --repair-max rounds.

→

Cross-check

Contract and code come from independent model calls, so their action/data vocabularies are compared leaf by leaf — a silent enum-spelling mismatch can collapse the explorable state space.

→

Corpus

Synthesize a trace corpus and replay it independently against the module.

consumes

feature intent (one paragraph) · --model · ANTHROPIC_API_KEY

produces

contract.json · next.cjs · invariants.mjs · traces/*.ndjson · polygen-report.md

The repair loop fixes code, never invariants — an invariant encodes intent by definition. A run that did not converge is reported as NOT converged, never presented as clean.

How it works

Three stages, one output: a new state machine that arrives already gated.

Draft the contract

States, transitions, guards, and the invariants that come with them are generated alongside the implementation, not bolted onto it afterward.

Self-repair to its checks

Every violation polygen's own gate finds during generation gets fixed before the code reaches you, not flagged for you to fix later.

Synthesize a regression corpus

A set of traces derived from the verified model, so the first commit already has a test suite that actually explores the state space.

Fits with: Hands off a pre-verified machine to polyrun to execute, or to polygraph if you want an independent second opinion on code that came from elsewhere.