ARKON Change Factory

Review the exact change before execution. Enforce deterministic policy and keep authority human. Prove every outcome with a replayable 12-check receipt.

Comment

What it does

ARKON Change Factory is a governed change-workflow proof of concept: it lets a model propose a narrow, typed code change, keeps every consequential decision outside the model, and makes each terminal outcome replayable. The judge picks a versioned synthetic scenario (a bundled Retry-After repo family) rather than supplying arbitrary code.

Every request runs one visible governed chain:

immutable intent -> cited evidence -> typed plan -> deterministic policy -> human decision -> isolated RED/GREEN execution -> sealed receipt -> 12-check replay

It models five terminal outcomes explicitly:

  • awaiting_approval - policy passed, a human must decide; zero code executed.
  • verified - approved bounded patch passed baseline RED and final GREEN checks; sealed receipt created.
  • rejected - a human denied the change; zero execution.
  • blocked - policy or intent contradiction stopped it before approval; zero execution.
  • verification_failed - execution ran in a disposable sandbox but post-patch verification failed; the patch is discarded and sealed as unverified.

Why it's different

The model is not a shell, a merge bot, a policy authority, or a proof engine. It can only return strict typed intermediate representation over supplied evidence and allowlisted transformations. Deterministic code validates evidence coverage, paths, preimages, operation budgets, policy, decision bindings, diff conformance, tests, terminal state, and receipt replay. The browser isn't trusted either: reviewer names and rationales are unauthenticated assertions, and the server owns actor classification, decision idempotency, execution leases, and terminal receipts.

How GPT-5.6 is used

One protected, evaluator-separated workflow made exactly one bounded OpenAI Responses API request. It requested gpt-5.6, used strict structured output, store:false, no tools, no retry loop, and a bounded timeout/output budget. Evaluator truth and hidden cases were never model-visible; the returned plan still had to pass strict validation and deterministic policy. Policy reached REQUIRE_HUMAN_APPROVAL, so automation stopped at the human boundary. The public product is fixture-only and secret-free: it shows an allowlisted historical evidence projection and makes no live model call.

How it was built

A standalone Next.js + TypeScript app with strict Zod contracts, canonical serialization, a deterministic policy engine, a causal fixture executor, content-addressed evidence, Firestore persistence, execution leases, atomic operation budgets, and a 12-domain replay verifier. Codex was the primary build partner across architecture, typed model contracts, adversarial evals, trust-boundary reviews, browser journeys, and CI/CD; its reviews materially hardened public-API parsing, server-owned decision provenance, ambiguous-response reconciliation, interrupted execution, and concurrency-safe budgets.

What I learned

"Human in the loop" is too vague to be a trust guarantee. The system has to bind a decision to the exact reviewed evidence, plan, scope, and policy result, and give rejection, interruption, and failed-verification receipts the same care as the happy path.

What's next

Authenticated multi-reviewer approval, operator-independent signed evidence, tenant isolation, conflict resolution, and a separately reviewed sandbox/connector boundary before any real repository could enter scope.

Built With

  • codex
  • docker
  • firebase-hosting
  • firestore
  • github-actions
  • google-cloud-run
  • gpt-5.6
  • next.js
  • openai-responses-api
  • playwright
  • react
  • typescript
  • vitest
  • workload-identity-federation
  • zod
Share this project:

Updates