A Polygraph engine

polynv — invariants elicited, not invented

The rules a system must never break usually live in one engineer's head. polynv gets them out — not by asking you to write formal logic, but by asking you to judge concrete scenarios it generates, then testing whether your answer actually holds under mutation.

The pipeline

What goes in, the stages it runs, what it leaves behind. Step through the stages to trace the run.

fig 5
polynv
find the rules everything else is measured against
Writing predicates from a blank page is a scarce skill. polynv converts it into judging concrete, pre-checked stories.
elicit
01
Harvest
Contract-vocabulary templates, state-property mining over snapshots and trace states, precedence mining over ordered event streams, frontier-model domain priors, LLM code reading.
→
02
Pre-check
Every candidate is run against the reachable graph before anyone is asked about it — so it arrives already labelled.
→
03
designer decides
Interview
Two answerable questions: “this holds everywhere — rule or coincidence?” and “this concrete sequence is possible today — acceptable?”, with the shortest path.
→
04
Ledger
Confirm / reject / modify (re-checked, consequence-diffed) / defer to a named person. Append-only in intent-ledger.json.
→
05
Grade
Mutate the machine across four operator families, discard behaviourally-equivalent mutants by graph comparison, grade the set by kill ratio. Survivors become the next questions.
consumes
contract.json · next.cjs · traces/ · fleet snapshots
produces
invariants.mjs · intent-ledger.json · adequacy grade
Generation never holds acceptance. A model may propose; only the designer confirms — and every disposition is attributed and append-only.

How it works

An interview the machine leads, grounded in the system's own state space.

1

Harvest candidate rules

Drawn from the state machine's own vocabulary — terminal states, typed fields, effect kinds — so every candidate is grounded in what the system actually does.

2

Grade them by mutation

Each candidate is checked against deliberately broken variants of the machine, so you're judging whether a rule catches real defects, not whether it sounds right.

3

You own every disposition

polynv proposes, you confirm, reject, or refine; the result is an append-only ledger of intent, not a black-box guess.

Fits with: Feeds directly into polygen (as the contract to build to) and polygraph (as the checklist an audit verifies against).