NEMA Boundary Runtime

Turn conversational signals into deterministic, executable AI safety policies—with inspectable traces, response controls, and post- generation verification.

Comment

Inspiration

LLM boundary behavior is often hidden inside a static prompt. When a conversation becomes urgent, dependent, or emotionally intense, developers can see the final response—but not a deterministic explanation of why control behavior changed.

We wanted a small policy layer that could be inspected, replayed, tested, and calibrated independently from the model. Instead of asking the model to explain its own behavior, NEMA makes the runtime itself produce the explanation.

What it does

NEMA—Neurostate Machine Language—separates conversational-state inference from policy execution.

A validated ControlState enters a deterministic runtime. Versioned policies evaluate that state, emit response-control directives, and produce a condition-level execution trace.

The interface displays:

  • inferred conversational signals
  • fired NEMA policies
  • generated control directives
  • baseline and controlled responses
  • a token-level difference view
  • post-generation directive verification
  • the exact policy execution path

Developers can temporarily modify a policy threshold and replay the same input. Overrides are schema-validated, size-bounded, and never persisted.

The deterministic NEMA runtime—not GPT-5.6—decides which policy fires.

How we built it

The project uses FastAPI and Pydantic for strict validation, a priority-ordered deterministic policy runtime, a responsive browser interface, replayable thresholds and traces, a limited post-generation verifier, a 40-case offline development contract, Pytest, Playwright, and Docker.

The public sandbox uses transparent deterministic fixtures, so judges can inspect and replay the system without an API credential.

A separate four-scenario, 12-call integration proof used GPT-5.6 Sol through OpenRouter. GPT-5.6 Structured Outputs inferred the validated control state, while matched baseline and controlled paths used the same pinned model. Only the controlled path received directives selected by NEMA.

The proof completed 12 successful calls using 3,505 tokens at a reported cost of $0.08235. It demonstrates integration, not benchmark performance or generalization.

How Codex contributed

Codex was the primary implementation partner during OpenAI Build Week. It helped translate the initial specification into the runtime, policy schema, execution trace, Policy Lab interface, deterministic and adversarial tests, browser harness, Docker packaging, hosted-sandbox controls, GPT-5.6 proof adapter, and limited post-generation verifier.

Human decisions defined the product boundary, scientific disclaimers, privacy defaults, evaluation claims, credential handling, and publication gates.

Challenges

The hardest design problem was preserving useful support without turning the system into a cold refusal layer. We also had to distinguish conformance testing from model-performance evidence, prevent unsafe policy overrides, avoid false positives, and separate observable verification from semantic guarantees.

Accomplishments

  • The same validated state and policy version always produce the same trace.
  • Invalid policy data and oversized bundles fail closed.
  • Temporary policy replay never mutates the server policy.
  • Desktop and mobile browser checks pass.
  • The 40-case contract is inspectable case by case.
  • The public sandbox requires no credential and stores no conversation text.
  • GPT-5.6 integration was demonstrated separately from the offline suite.

What we learned

Safety controls become easier to test when model inference, deterministic policy decisions, response generation, and post-generation verification are separate layers.

Explainability is more useful when it is generated by the runtime itself instead of asking the model to explain its own behavior.

What's next

  • blinded evaluation using unseen conversational cases
  • model-specific calibration profiles
  • human-review and abstention paths
  • semantic conflict arbitration between directives
  • signed, versioned organizational policy packs
  • broader boundary-control integrations and deployment tooling

Important limitations

ControlState is a behavioral control representation, not a medical or psychological diagnosis. The offline 40-case contract is not GPT-5.6 performance or evidence of generalization. This prototype does not guarantee prevention of dependency or harm.

Built With

Share this project:

Updates