TEMPO

Why I built it

I started TEMPO while building Understand Video on my own. Codex made every implementation iteration faster, but speed did not answer a different question: “who decided this should be built, from what evidence, and within what exact scope?”

TEMPO grew out of that problem. It blocked my downstream build when its evidence, repository identity, or authorization did not match. Those blocks became direct evidence that the framework was doing its job.

This submission is TEMPO. Understand Video is the separate downstream product I used to dogfood the framework and produce the explanation video; its code is not copied into TEMPO.

Judge it in 60 seconds

From a clean clone, with Python 3.10+ and no account, API key, package install, or sample-data download: python bin/tempo demo

The run takes about two seconds and ends with JUDGE_DEMO_PASSED. Before that, it shows model advice creating no authority, insufficient evidence naming the next experiment, readiness remaining blocked without a warrant, one bounded start succeeding, out-of-scope work and protected-input drift failing closed, and a hash-chained ledger verifying while the human verdict stays blank.

Open the 60-second animated browser preview Preview the bilingual audit console Watch the 155-second demo video

The browser console is deliberately read-only and uses a clearly labeled synthetic fixture. It demonstrates the review experience; it cannot authorize work or pretend to be customer evidence. To interact with it, clone the repo, serve demo/ locally, and open audit-console.html.

What TEMPO does

TEMPO is a deterministic business-to-MVP control layer for founders, product leads, and innovation owners supervising coding agents.

A planning provider may propose an opportunity, business model, hypothesis, and cheapest experiment. TEMPO treats that output as untrusted advice. Evidence is checked for provenance, freshness, directness, measurements, and counterevidence. Hard blockers run before scores. Readiness returns either the next experiment or eligibility for a human decision. Eligibility never grants implementation authority. A separate, time-bounded human warrant binds the assessment, evidence, charter, repository identity, scope, action, budget, and deadline. Every implementation start is checked against that warrant. Drift, expiry, revocation, and out-of-scope work fail closed. A serialized hash-chained ledger, durable checkpoint, receipts, and verdict memo make the decision inspectable without filling the human-owned verdict.

The useful answer is sometimes “not yet.” TEMPO returns the failed condition and the cheapest next experiment instead of a vague denial.

How I built it

The released vertical slice is a dependency-light Python CLI with JSON Schema contracts, deterministic state transitions, local file/action guards, evidence checks, authorization and revocation, verification receipts, and a credential-free judge demo. GitHub Actions runs it on Windows, macOS, and Linux and in a digest-pinned, unprivileged, network-disabled container.

Two integrity bugs shaped the final design. A warrant now binds the exact Git origin, revision, commit, worktree, Git directory, and common directory, so a branch, origin, commit, or second-worktree change invalidates authority. Ledger append is failure-atomic: if checkpoint replacement fails, TEMPO rolls back only the exact fsynced event; if safe rollback cannot be proved, it remains blocked. The released repository-subject tests and ledger failure tests exercise both paths.

Final verification discovered 107 tests: 106 pass and one Windows symlink-permission case is skipped where the OS denies symlink creation. The latest public CI is green across every required host and the network-disabled judge container.

How I used Codex and GPT-5.6

I used Codex Desktop with GPT-5.6 throughout the build, not only for an initial scaffold. It helped me reconcile the supplied TEMPO specification with the pinned MIT-licensed VEMO mechanisms, find the circularity between readiness and authority, design the contracts, implement the policy kernel, write adversarial failure cases, dogfood the workflow against Understand Video, and audit the release from a judge's perspective.

I kept one boundary explicit: GPT-5.6 could propose, critique, and generate code, but it could never sign a warrant, create authority, manufacture a passing receipt, or fill the human verdict. submission/ai-usage.json maps those build-time contributions to inspectable files and tests. The released demo makes no OpenAI API call and needs no credentials.

Evidence, impact, and limits

TEMPO already changed one real workflow: my own Understand Video build. Three preserved recovery/replay workspaces recorded repeated readiness and input failures; one unsafe start-accounting failure revoked authority; after recovery and a new human authorization, TEMPO recorded one valid start while the public MVP was delivered.

That is process evidence from one founder and one downstream product, not independent customer validation. I do not claim measured savings, production signing, external notarization, or live OpenAI runtime use. A real pilot should measure avoided implementation starts, decision-cycle time, time to the next useful experiment, and budget or scope drift caught.

The broader opportunity is a shared decision trail for product, research, finance, engineering, agencies, and security reviewers before a coding agent spends more time or budget.

Links and version boundary

Competition repository: https://github.com/vemodalen-x/TEMPO Supporting downstream proof: https://github.com/vemodalen-x/understand-video Video: https://youtu.be/CbfAwNdwy5c CI: https://github.com/vemodalen-x/TEMPO/actions/runs/29678398194

The video is filmed against public commit 262816ec27e2a85a00c318b2489df51adf26cca2 and CI run 29678398194. Earlier graph and hardening baselines remain in the repository's provenance; GitHub main and green CI are authoritative for the final code.

Category: Work & Productivity

Built With

• codex
• docker
• github-actions
• gpt-5.6
• json-schema
• python
• typescript