Release Assurance

Inspiration

I've spent nine years working on banking data conversions. The failures that worry me most are not the ones that crash. They are the ones that report success while quietly changing what the data means. Release Assurance came from wanting to catch that damage before it reaches customers, compliance teams, or auditors.

Release Assurance is built for banking migration engineers, release managers, compliance teams, and internal auditors who need to prove not only that a change passed, but why it was allowed to ship.

We built Release Assurance around one principle: Codex proposes, humans approve, and auditors get receipts. We wanted to show that GPT-5.6 and Codex can have a responsible place in regulated workflows when their authority is bounded and every consequential action remains reviewable.

What it does

Release Assurance turns a banking migration specification into an executable assurance workflow:

Requirements from the implementation document become a schema-validated control manifest. Deterministic checks test the migrated records. Each failure maps back to the requirement it violates. The system presents a complete Codex-proposed patch diff for review. A human reviewer sees the complete diff, adds a decision note, and explicitly chooses Approve or Reject. Only approval permits verification. The approved change is verified in a disposable workspace. The system creates an evidence pack with provenance, traceability, the decision record, and the state-transition audit trail.

A green status is not enough. Release Assurance records what was required, what failed, what changed, the recorded approval actor and decision note, and what verified the correction.

The submitted demo

To give judges a repeatable, credential-free experience, the submitted demo shows the application in fixture mode. The workflow replays frozen, schema-validated GPT-5.6 and Codex outputs against canonical synthetic banking data. Running that application path requires zero API keys and makes zero live model calls while preserving the failure state, traceability matrix, patch review, human approval, rerun, and downloadable evidence pack.

Pavel developed the browser director with Codex. During video production, live OpenAI model calls generated the narration script and synthesized speech, while the browser director synchronized captions, cursor movement, and UI choreography.

The same application boundaries isolate optional live GPT-5.6 requirement extraction and read-only Codex patch generation. Deterministic checks and human approval remain authoritative in both modes. We chose fixture mode for the recording so reviewers can reproduce the product experience without credentials, paid calls, or nondeterministic output. We do not represent the replay as a live model run.

How GPT-5.6 and Codex were used

We used GPT-5.6 throughout Build Week as a planning, requirements-analysis, and review partner. It helped us inspect repository state, turn human product decisions into bounded implementation tasks, review patches and CI evidence, diagnose cross-platform failures, and design the structured requirement-extraction boundary. In optional live mode, that boundary translates implementation prose into a schema-validated control manifest with provenance. GPT-5.6 does not decide whether a migration passed. Deterministic code remains authoritative.

We used Codex across the repository to implement backend and frontend slices, generate and refine tests, diagnose Windows and browser-automation failures, review pull requests, and harden the final demo workflow. In optional live mode, Codex analyzes a caught failure and returns a narrowly scoped, reviewable patch diff. It cannot approve or silently ship its own work. Patch scope and applicability are validated before the proposal reaches the reviewer.

The human team kept control of the product, architecture, scope, and approval decisions.

How we built it

Release Assurance uses a Python FastAPI backend and a React and TypeScript frontend. An explicit state machine ensures that actions occur only from valid states. Stable identifiers connect requirements, tests, failures, patch proposals, approvals, reruns, and evidence.

Our frontend contribution focused on making the assurance workflow understandable, reviewable, and demonstrable.

We built the React and TypeScript experience, including the agent timeline, traceability and failure views, complete diff review, approval and replay flow, polling and step minimap, evidence-pack presentation, and final demo orchestration. Our most important UX decision was to make human approval the visible checkpoint of the story, guiding reviewers from requirement to failure to proposed change before revealing the final evidence.

The hardest frontend challenge was synchronizing unpredictable backend timing with generated narration, captions, cursor movement, scrolling, and UI state while keeping the demo under three minutes. We solved this with a browser-recording runtime developed with Codex. It follows actual UI state, prepares speech in parallel, and preserves the same visible approval gate used by the interactive application. We learned that trustworthy AI UX depends on making model boundaries, provenance, and human handoffs obvious.

We used Codex throughout as an implementation and review partner for React and TypeScript development, refactoring, synchronization debugging, testing, and cross-platform CI hardening.

Fixture and live boundaries are deliberately separated. Fixture mode uses frozen contracts and synthetic records for reproducibility. Model-facing outputs are schema validated, deterministic acceptance checks verify the records, and patch verification happens in a disposable workspace that protects the repository from modification.

The public repository includes setup instructions, sample fixture data, an MIT license, and cross-platform commands. The supported judge path is:

make setup
make test
make demo

The current CI suite runs 194 backend tests and 34 frontend tests across Windows, macOS, and Linux.

The team

We met during Build Week and combined Melinda's nine years of professional banking data-conversion experience with Pavel's 25+ years across UI/UX, frontend engineering, and software architecture. Pavel's background includes Mozilla, Telerik, SiteGround, Payhawk, LimeChain, co-founding SashiDo and CloudStrap, and fractional architecture work across multiple companies. Codex became our third teammate across implementation, review, testing, and cross-platform hardening.

Challenges

The hardest part was deciding where AI was useful without letting it become the authority. A confident model answer is not evidence, so model output remains constrained and reviewable while deterministic checks and human approval act as the release gates.

We also had to preserve traceability across the entire workflow. The final evidence pack must reconstruct the history without relying on a chat transcript, so every artifact and state transition needs stable provenance.

Cross-platform execution exposed practical differences in process management, patch application, browser automation, and command shims. Fixing those issues made the fixture path reproducible across Windows, macOS, and Linux.

What we learned

The strongest pattern for high-stakes AI is a hybrid one:

Models interpret and propose. Deterministic systems verify. Humans authorize consequential actions. The product preserves evidence for later scrutiny.

Release Assurance is our working proof of that pattern. GPT-5.6 extracts the explicit requirements. Codex proposes the fix. Deterministic checks verify it against the defined controls. Humans retain control.

What's next

Next, we would expand the control library beyond the canonical banking fixture, add enterprise identity and approval policies, sign exported evidence packs, and connect the workflow to existing CI/CD and governance systems.

Codex proposes. Humans approve. Auditors get receipts.

Pre-existing work disclosure

The base migration engine in reconcile/ is pre-existing work originally developed in MeLinResearch/Reconcile. It was imported under the MIT License from commit b280ed49388791f3cae7fa2fc88144c2c706bd9d and was not created during OpenAI Build Week.

The work created during the July 13 to July 21, 2026 submission period is Release Assurance around that engine: frozen contracts and canonical fixtures; the GPT-5.6 requirement-extraction boundary; deterministic control checks; the Codex patch-proposal boundary; the FastAPI workflow, state machine, store, and API; the React traceability, diff-review, approval, rerun, and evidence experience; disposable verification and evidence generation; and cross-platform test and demo tooling. The repository's dated commit history and Codex-linked pull requests document this Build Week work.