GPT-5.6 investigates. Codex repairs. Neither decides PASS.
PromiseProof turns one "off means off" promise into cross-system evidence. GPT-5.6 proposes and ranks candidate explanations, then requests one allowlisted replay; PromiseProof runs it. Codex proposes a constrained two-file repair, a human approves the exact patch, and an unchanged Playwright journey and deterministic evaluator, never a model, decide PASS.
Monitoring can tell you a promise broke. PromiseProof carries the failure through bounded diagnosis, constrained repair, and independent verification.
diff --git a/src/judge/main.ts b/src/judge/main.ts index 4621c69..8545f12 100644 --- a/src/judge/main.ts +++ b/src/judge/main.ts @@ -516,7 +516,7 @@ function renderInvestigate(data: JudgeData): HTMLElement { element( "p", "replay-caption", - "A registered replay is one allowlisted factual experiment the model can request; deterministic code runs it and records the facts. This recorded replay confirms the leading explanation — it does not decide the verdict.", + "A registered replay is one allowlisted factual experiment the model can request; deterministic code runs it and records the facts. This recorded replay confirms the leading explanation, but it does not decide the verdict.", ), ); fork.append(down); @@ -658,7 +658,7 @@ function renderReplay(data: JudgeData): HTMLElement { section.append(toolbar); // The reveal is a fresh CSS animation on mount, so re-rendering these nodes - // replays it on demand — the crossing is the one moment judges should see move. + // replays it on demand. The crossing is the one moment judges should see move. // `data-replaying` marks the explicit "Play the crossing" click: under // prefers-reduced-motion the crossing stays still on stage entry (honoring the // preference) and only animates when the user actually asks for it. @@ -1252,7 +1252,7 @@ function start(): void { return; } stageHost.replaceChildren(definition.render(data)); - // Marks that the DOM now holds THIS stage — the signal transitions settle on. + // Marks that the DOM now holds THIS stage. The signal transitions settle on. root.dataset.rendered = stage; if (focus) { stageHost.focus(); @@ -1294,7 +1294,7 @@ function start(): void { return; } - // Ease the outgoing content out, swap, then ease the incoming content in — + // Ease the outgoing content out, swap, then ease the incoming content in, // a real crossfade instead of a hard cut. stageHost.classList.remove("is-entering"); stageHost.classList.add("is-leaving"); diff --git a/src/verify-ui/main.ts b/src/verify-ui/main.ts index f55dbe7..7894c19 100644 --- a/src/verify-ui/main.ts +++ b/src/verify-ui/main.ts @@ -125,7 +125,7 @@ function offFacts(ev: WorkEvidence): Fact[] { const captured = ev.activity.capturedActivities.length; const receipts = ev.activity.recommendationServiceReceipts.length; return [ - { k: "Scenario", v: "OFF — personalization off" }, + { k: "Scenario", v: "OFF, personalization off" }, { k: "Subject", v: ev.subjectId }, { k: "Preference (ui / stored / backend)", @@ -142,7 +142,7 @@ function offFacts(ev: WorkEvidence): Fact[] { } function onFacts(ev: WorkEvidence): Fact[] { return [ - { k: "Scenario", v: "ON — personalization on" }, + { k: "Scenario", v: "ON, personalization on" }, { k: "Subject", v: ev.subjectId }, { k: "Preference (ui / stored / backend)", @@ -224,7 +224,7 @@ function renderViolations(list: HTMLElement, violations: readonly ViolationLike[ list.replaceChildren(); if (violations.length === 0) { list.className = "vf-violations empty"; - list.append(tag("li", undefined, "Promise verified — no violations.")); + list.append(tag("li", undefined, "Promise verified, no violations.")); return; } list.className = "vf-violations"; @@ -232,7 +232,7 @@ function renderViolations(list: HTMLElement, violations: readonly ViolationLike[ const item = tag("li"); item.append( tag("code", undefined, violation.code), - document.createTextNode(` (${violation.clause}) — ${violation.message}`), + document.createTextNode(` (${violation.clause}): ${violation.message}`), ); list.append(item); } @@ -259,13 +259,13 @@ function noteFor(outcome: string, repro: string, tampered: boolean): string { return "This evidence does not pass strict validation, so the deterministic evaluator does not run on it."; } if (outcome === "PASS" && repro === "BOUND_AND_REPRODUCED") { - return "PASS. The deterministic evaluator verified the promise over the recorded evidence, and the sealed report reproduces exactly from it. No model graded this — an unchanged evaluator did."; + return "PASS. The deterministic evaluator verified the promise over the recorded evidence, and the sealed report reproduces exactly from it. No model graded this. An unchanged evaluator did."; } if (outcome === "BROKEN_PROMISE" && repro !== "BOUND_AND_REPRODUCED") { - return "Broken promise. Identifiable activity is present in the OFF evidence, so the same evaluator now fails no_identifiable_activity and raises PP_IDENTIFIABLE_EVENT_LEAK. The report sealed a moment ago no longer reproduces from this evidence — a PASS cannot be silently carried onto changed evidence."; + return "Broken promise. Identifiable activity is present in the OFF evidence, so the same evaluator now fails no_identifiable_activity and raises PP_IDENTIFIABLE_EVENT_LEAK. The report sealed a moment ago no longer reproduces from this evidence. A PASS cannot be silently carried onto changed evidence."; } if (outcome === "BROKEN_PROMISE" && repro === "BOUND_AND_REPRODUCED") { - return "Broken promise, sealed honestly. A new report was sealed for the current evidence and it reproduces — as BROKEN_PROMISE. Sealing binds whatever is true; it cannot manufacture a PASS."; + return "Broken promise, sealed honestly. A new report was sealed for the current evidence and it reproduces, as BROKEN_PROMISE. Sealing binds whatever is true; it cannot manufacture a PASS."; } if (tampered) { return "The evidence changed. Re-evaluate it, and verify the sealed report against it."; @@ -324,8 +324,8 @@ const APP_HTML = `