• 

• 

• 

• 

• 

• 

• 

• 

• 

  Case Lab / Drift: boundary, conflict, contrast, and mutation cases expose 16 seeded application counterexamples.

• 

  Policy Studio: source clauses, strict PolicyIR, ambiguity decisions, and traceability stay connected.

• 

  Codex repair proof: 2 files changed, 7/7 regressions, 41/41 policy cases, zero drift, independent APPROVE.

• 

  Architecture: deterministic PolicyIR-to-Rego/OPA pipeline, app differential, bounded Codex repair, and evidence-bound proof.

PolicyTwin

Business policies live in prose while customer decisions live in code. A single strict inequality or misplaced exception can silently change who receives a refund. PolicyTwin connects each policy sentence to an explicit decision, executable rule, edge case, application behavior, code location, and reviewable proof.

The seeded Build Week workflow starts with a synthetic SaaS refund policy. Policy Studio keeps source-clause traceability and a strict PolicyIR. Decision Queue records three material ambiguity choices instead of hiding them in a prompt. Deterministic code compiles the accepted model to Rego, and checksum-pinned OPA 1.18.2 evaluates 41 golden, boundary, conflict, and generated cases. Integration / Drift compares the same accepted expectations with a deliberately buggy TypeScript fixture and exposes 16 counterexamples caused by three defects: excluding exactly day 14, excluding exactly 20% usage, and allowing an approved promotion to bypass final-sale precedence.

The bounded local challenge run then asked GPT-5.6 Sol through Codex SDK/CLI 0.144.6 to repair a fresh fixture copy. Codex returned complete replacements for the two fixed files without seeing the evaluation-only expected implementation. PolicyTwin derived the filesystem diff, ran the fixed typecheck and seven regression tests, replayed all 41 accepted policy cases, and required a distinct read-only Codex review. The captured result is 41/41, zero drift, and APPROVE with no blocking finding; prompt, schema, thread, tree, command, result, and diff hashes are checked into artifacts/challenge-evidence/.

The Proof view keeps claims attached to machine-readable evidence and leaves unavailable capabilities marked as not run. The local challenge profile is deliberately separate from the production verify:live contract: it may use a logged-in Codex SDK run on a disposable fixture, but it never claims cgroup-v2 isolation, direct Responses API evidence, deployment security, or production attestation.

Judges can reproduce the deterministic seeded workflow with pnpm demo:run, inspect all six views with pnpm dev, run the full offline gate with pnpm verify, and validate the captured GPT-5.6/Codex proof with pnpm challenge:check.

Built With

• codex
• gpt-5.6
• next.js
• opa
• openai
• rego
• sqlite
• typescript
• vitest