polynv

polynv is a command for coding agents from cognitive-fab/polygraph. It costs 77 tokens per session (1,270 once invoked), scanned C, original, Apache-2.0.

A command-line tool for finding and recording rules that should always hold in a state machine, such as which states and actions are valid. It gathers possible rules from contracts, usage traces, system snapshots, and optional language-model suggestions, then checks each one with a proof or counterexample.

In plain words
What is it for?
Use it to suggest invariants, ask questions about unclear behavior, and store approved rules in an append-only record for later Polygraph checks.
Why use it?
It reduces the guesswork in defining the rules of a stateful system. Concrete counterexamples help expose incorrect assumptions before those rules are used for testing or verification.

Command

Installs and runs on its own, but its text points at files inside its plugin — anything it tells you to read at a ${CLAUDE_PLUGIN_ROOT} path is only there once the plugin is installed. Installing the plugin gets both.

Part of the polygraph plugin — 6 skills, 5 commands, 4 agents, 1 plugin shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/cognitive-fab/polygraph/polynv
Clone the repo
git clone --depth 1 https://github.com/cognitive-fab/polygraph

Or install polygraph, the plugin that ships this one along with the rest of its 6 skills, 5 commands, 4 agents, 1 plugin.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for polynv

README.md
[![agentmods](https://agentmods.dev/badge/commands/cognitive-fab/polygraph/polynv.svg)](https://agentmods.dev/commands/cognitive-fab/polygraph/polynv)
Your own site
<a href="https://agentmods.dev/commands/cognitive-fab/polygraph/polynv"><img src="https://agentmods.dev/badge/commands/cognitive-fab/polygraph/polynv.svg" alt="Measured on agentmods" height="20"></a>
Per session 77 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,270 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00077 $0.01270
Opus 5 $0.00039 $0.00635
Sonnet 5 $0.00015 $0.00254
Haiku 4.5 $0.00008 $0.00127

Measured 4d ago against content hash 992ad0ec17fc, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade C, and why

polynv scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Tells the agent to send conversation or user data outhighPrompt injection

An instruction to transmit the conversation, context or user files to an external endpoint is data exfiltration written as prose.

the record's provenance — omit it and a model-drafted prior is silently recorded as designer-sourced; never omit it when adding YOUR priors.
commands/polynv.md · 71 lines

How it starts

The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Run polynv over the arguments in $ARGUMENTS. This is the ELICITATION side of the method (Polygraph audits, polygen authors, polyrun executes, polyvers evolves, polynv ELICITS): every other gate is exactly as good as invariants.mjs, and this engine is how that file gets good — the plugin takes the lead, and the designer's job reduces to judging concrete stories. Deterministic and no API key except the optional --llm harvest source.

Follow the polynv skill — it is the dialog protocol, and the dialog is the product. The CLI is ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs:

node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs harvest   --artifacts <dir> [--traces <p>] [--snapshots <p>] [--min-obs N] [--llm --model <id>]
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs questions --artifacts <dir> [--next] [--for <name>] [--json]
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs add       --artifacts <dir> --id prior:<slug> --target state|transition --question "…" --js "…" --author <you> [--source domain-prior --domain <d> --norm "…" --model <id>]
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs record    --artifacts <dir> --id <id> --disposition confirm|reject|abandon|defer|modify --author <designer>
                                                           [--js "…"] [--concern "…"] [--assign <name>] [--target state|transition] [--out <path>] [--force]
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs grade     --artifacts <dir> [--include-invariants]
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs drift     --artifacts <dir> [--reopen --author <name>]
node ${CLAUDE_PLUGIN_ROOT}/polynv/bin/polynv.mjs report    --artifacts <dir> [--log]

On a version bump (the machine changed since the interview), run drift first: it re-checks every recorded answer against the machine as it is now and names every verdict that moved — a confirmed rule now violated is a finding; a rejected candidate whose behavior changed is re-asked (--reopen, attributed). Emission candidates get real verdicts whenever the dir carries the composition (effects.cjs + manifest, via polyrun check-effects).

Disposition flags that trip the unprepared: a temporal (precedence) record's revision is STRUCTURED — --disposition modify --js '{"kind":"precedence","first":"<ACTION>","then":"<ACTION>"}' — free-form js is refused (there is no checker for it). A mutation-survivor record arrives with no predicate: your answering modify supplies both the rule and its shape (--target state|transition), then a separate confirm. And --source domain-prior is what routes --domain/--norm/--model into the record's provenance — omit it and a model-drafted prior is silently recorded as designer-sourced; never omit it when adding YOUR priors.

Workflow (the skill has the full protocol — these are the fixed points):

  1. Harvest first, passing every substrate the user has (traces, a polyrun journal export, fleet snapshots) — then contribute your own domain priors via add before the first question: identify the domain from the contract and enumerate its canonical invariants; the designer of a payment system gets asked about authorization-before-capture whether or not any harvester surfaced it.
  2. Interview one question at a time (questions --next), concrete-story-first. You propose and frame; only the designer dispositions — never answer an intent question on their behalf; offer defer --assign when they are unsure. Every record carries --author <designer>.
  3. Grade before closing (--include-invariants when a hand-written invariants.mjs exists). Survivor questions rank first on the next pass.
  4. End with the verdict: CONVERGED (all records terminal AND graded) or PARTIAL with what remains, per assignee. Commit intent-ledger.json (the system of record) and the generated invariants.mjs; INTENT-LOG.md is the rendered view for the PR.

Always state the disclosure the skill carries: pre-checks are consistency checks over the declared finite domains; harvested candidates are behavior, not intent; the grade bounds unconstrained behavior (behavior-REMOVING mutations largely evade it) and never certifies that the questions asked were sufficient.

Read the full file on GitHub · 71 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 71 lines · 0 tokens per session scan C 992ad0ec17fc

Subscribe to this mod's changes

polynv is a command published in the GitHub repository cognitive-fab/polygraph (11 stars, last pushed 8d ago), licensed Apache-2.0. It adds 77 tokens to every session and 1,270 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 1 finding (tells the agent to send conversation or user data out). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.