Most stateful code in production was never modeled at all. polygraph doesn't ask you to write a spec first — it generates independent specifications from the code itself, replays real traces against them, and model-checks whichever specification survives contact with reality.
The stateful code already exists, nobody ever modeled it, and increasingly an agent wrote it. You want to know what it can reach before it reaches it in production.
Either a pass over every reachable state, or the shortest sequence of actions that breaks your rules — a reproduction you can paste into a test.
What goes in, the stages it runs, what it leaves behind. Step through the stages to trace the run.
You don't need a spec to start. polygraph builds and tests candidates for you.
Multiple candidate models of what the code does, derived from the code, not from what the comments or the original author claimed.
Actual execution history is run against every candidate spec; the ones that don't match reality are discarded.
The specification that matches reality is then checked exhaustively, surfacing the reachable states nobody exercised in production yet.