polyx reads the record your agents and teams already produce, finds the rules that record supports, has a person approve each one, and serves them back to the agent the moment before it acts. Where no approved rule applies, it says so instead of guessing.
Every AI transformation starts by writing rules down. polyx measures how far practice and policy have drifted apart, and names each rule on either side.
Fig. 1 — polyx diff: the conformance report. Every finding links to the interactions behind it, and contradictions inside the mined set are listed separately.
Rules your best people and agents keep that no document states. This is the part a written policy cannot give an agent, and the part a transformation most often loses.
Split into violated (it came up and was skipped) and never exercised (it never came up). The two are never merged, because only the first is a problem.
Each confirmed rule carries its support as a count, such as held 13 of 14, and the case that broke it.
Five steps, one loop. No step asks a language model for a rule.
Fig. 2 — The polyx loop. The miner and the advisor are deterministic. The only judgement is a person’s, at step 4.
Same corpus, alphabet and thresholds give the same rule set. Every run writes a manifest, and every printed figure expands to its source records.
Each rule shows its support, the cases that satisfy it and the cases that contradict it, in the reviewer’s own vocabulary.
Nothing is served until someone marks it real. Verdicts survive re-mining; a rejected rule returns only if its evidence changes materially.
A missing fact is unknown, never false. The advisor says whether no rule applies or a rule applies but lacks a fact, and names the fact.
Claude Code already records every session in ~/.claude/projects and already exposes a hook before each tool call. polyx uses both.
~/.claude/projects, read in placeWhat the model saw in one of our own sessions, from a rule mined on that project’s history and approved by a person. It can commit and push, or push anyway if the user asks. A habit nobody had written down is now a number, shown at the moment it matters.
| Framework | Where polyx plugs in |
|---|---|
| Claude Code | PreToolUse hook, shipped |
| Claude Agent SDK | hooks.PreToolUse, same script, in-process |
| LangGraph | wrap the tool node, or interrupt_before |
| OpenAI Agents SDK | a tool guardrail |
| Vercel AI SDK | tool middleware |
Same verdicts everywhere. The work that differs per framework is typing its trajectory; for Claude Code that alphabet ships.
The hook fails open: if the advisor is unreachable, the tool runs and the hook says so once. POLYX_HOOK_STRICT=1 makes it fail closed.
We run polyx on our own work: 198 Claude Code sessions across 46 projects. It proposed about four thousand candidates, and most were coincidences. These twelve were approved, each only in the projects whose own history keeps it. Each figure is how often the rule held across those projects.
| Before the agent… | Rule | Projects | Held |
|---|---|---|---|
| pushes | commits first, in the same episode | 9 | 529 of 552 |
| pushes | has asked you something earlier in the session | 5 | 321 of 354 |
| pushes | has looked at the repository state | 3 | 152 of 156 |
| pushes | pushes at most once per episode | 4 | 294 of 316 |
| deletes files | has asked you something earlier in the session | 9 | 191 of 225 |
| deletes files | has looked at the repository state | 7 | 257 of 297 |
| discards changes | looks at the repository state, in the same episode | 3 | 33 of 35 |
| stages changes | has run the tests | 8 | 694 of 758 |
| commits | stages first, in the same episode | 17 | 1,269 of 1,302 |
| edits a file | has read or written that same file | 25 | 3,582 of 4,158 |
| edits a file | reads a file first, in the same episode | 3 | 188 of 198 |
| edits a .js file | reads a file first, in the same episode | 3 | 26 of 26 |
Twelve rules become 96 project-level rules in service. Each was already how the work was done; now it is counted, and checked before the action. A rule that held 86% of the time is a practice, not a law, which is why a person decides which ones are served.
Much of what decides the next action is said, not recorded. Jev, TypeSafe’s System One model, answers a declared yes/no question about a text with a calibrated probability in about 200 ms. polyx uses it only to add facts. Jev never decides a verdict.
obs.states_double_charge = trueFig. 3 — An observation port. Silence in the text is not evidence that something did not happen, so a predicate can assert a fact but cannot deny one.
In the shipped walkthrough, ten complaints are identical in every typed field. With Jev, polyx recovers the rule that separates them: when the customer states a double charge, escalate, at 5 of 5.
Observed facts are added first and only add keys. Switching Jev on can turn an abstention into an answer or surface a hidden warning. It cannot withdraw a warning or create an abstention. A property test checks this.
A Jev answer can vary slightly between calls, so answers are recorded in one pass and digest-pinned. Mining reads the recording, and anyone with the file reproduces every figure without a key.
The real cost of a predicate is about sixty labelled examples, which is one person’s afternoon. At TypeSafe’s published pricing, annotating a hundred thousand events costs about two dollars. A predicate is not a security control: one that reads a poisoned text reports what the poison says.
polyx needs three things from a domain: actions typed against a reviewed alphabet, each declared none, reversible, compensable or irreversible; a way to split the record into episodes; and an outcome per episode. Rules are mined only around actions that cost something to undo.
Evaluated on ABCD and τ²-bench retail: conversations where the consequential actions are already buttons in a CRM.
Runs unchanged on BPIC 2017: 31,509 loan applications through a bank’s own process, with no dialogue and no conversational agent.
Claude Code transcripts: pushes, deletes, deploys and edits, each typed with its consequence, and the steps that should come first.
If a system records who did what, in what order, and how it ended, it has a corpus. The adapter is the only per-source work.
Reads your agents’ logs and reports which of the rules they were given they kept. No mining, no model call, no network. One command on Claude Code.
Get started → polyxBUSL-1.1 · in-house production use grantedFinds the rules nobody wrote down, puts them in front of a reviewer, serves the approved ones to the agent and reports policy against practice.
Get started → polyx-benchApache-2.0 · open dataPublic benchmark rulebooks broken into single clauses, so a precision figure can be checked by anyone. ABCD: 499 clauses, of which 155 are expressible.
Get started →polyx is source-available under the Business Source License 1.1 and converts to Apache-2.0 four years after each version is published. Production use within your own organisation is granted. The Jev adapter is MIT.