A Polygraph engine · the audit

polygraph — audit code that already exists, against reality

Most stateful code in production was never modeled at all. polygraph doesn't ask you to write a spec first — it generates independent specifications from the code itself, replays real traces against them, and model-checks whichever specification survives contact with reality.

How it works

You don't need a spec to start. polygraph builds and tests candidates for you.

1

Generate independent specs

Multiple candidate models of what the code does, derived from the code, not from what the comments or the original author claimed.

2

Replay real traces

Actual execution history is run against every candidate spec; the ones that don't match reality are discarded.

3

Model-check the survivor

The specification that matches reality is then checked exhaustively, surfacing the reachable states nobody exercised in production yet.

Fits with: The plugin to run first on a codebase you didn't write, before deciding whether polynv, polygen, or polyvers apply.