Common questions, plain answers.

Gubernaut is a deterministic runtime control layer for LLM agents. The system runs as a local, OpenAI-compatible proxy in front of the model you already call, reads intensity, valence, repetition once per turn, and holds one of three postures. A saturating loop is hard-stopped locally at turn 4, with no upstream tokens spent on the stopped call.

A cognitive governor is a deterministic control layer that runs outside a large language model and decides the conditions each reply is written under. Every turn it reads numeric telemetry about the agent's own state, updates equilibrium, arousal, perseveration, and sets a posture of DEFAULT, INHIBIT, REGROUND. The governor sets the conditions; the host model still writes the words.

Gubernaut solves the runaway agent loop: an agent that retries, re-plans and re-prompts itself while every lap bills at full rate. On a saturating loop the governed arm cut upstream spend by up to 96%, best measured case 95.9% on GPT-5.6 Sol, because the loop is severed locally instead of being paid for turn after turn.

Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.

A system prompt does not contain a runaway loop. In a pre-registered ablation the governed arm paid 23% to 63% of baseline spend while a strong static calming system prompt paid 117% to 192% of baseline, so the prompt cost more than doing nothing at all.

Source: Pre-registered ablation, 2026-07-21, gpt-5.6-sol, N=3.

Gubernaut costs nothing. Version 1.0.0 is published under Apache-2.0 on PyPI, npm and crates.io, runs entirely on your own machine, and needs no account and no key of ours. Commercial support and hosted options are not offered today.

Installation is one package and one configuration line. Run pip install gubernaut-sdk==1.0.0, start the local proxy in front of the upstream you already call, then set openai.base_url = "http://localhost:8000/v1". Node and Rust packages install the same way from npm and crates.io.

Gubernaut works with any client that lets you set a base URL. 5/5 frameworks were verified end to end from the published packages: OpenAI SDK, LangChain, LlamaIndex, Microsoft AutoGen, ElizaOS. Each adopts in one line, hard-stops a loop, and fails closed when the proxy is unreachable.

Source: HARDTEST v1.0 release gates, 2026-07-24.

End-to-end overhead of the governed proxy measured p50 1.2 ms and p99 2.4 ms. One controller tick on its own is p99 2.8 µs as an in-process microbenchmark over 100,000 iterations, and the WebAssembly build runs at roughly ~125 ns per tick at the edge.

Source: Bench run 2026-07-18, latency_bench.py, Windows 11 AMD64, Python 3.14.5.

Gubernaut sends nothing to Gubernaut Research. The proxy runs on your own machine, holds no account, and reports no telemetry to us. The only outbound request is the upstream call your agent was already making.

Version 1.0.0 passed a published release gate: 240 concurrent mixed hostile/benign requests with 0 posture cross-contamination and 0 dropped requests; upstream hit exactly 120/120 (the non-hard-stop count). There were no fail-open leaks, and the compiled Rust core reproduces the Python controller bit-exactly. Judge it against your own workload before trusting it with one.

Source: HARDTEST v1.0 release gates, 2026-07-24.

On a pre-registered saturating-loop battery the governed arm paid 4.1% to 20.2% of the ungoverned bill across 7 model families, a reduction of 79.8% to 95.9%. Both arms made the same number of attempts, so the difference is the measurement rather than one arm doing less work.

Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.

A pre-registered cross-family evaluation. 4 frontier families ran identical scripted adversarial sequences twice, once bare and once governed, and judge panels drawn from all four families scored every reply. The regulated arm is calmer in 15 of 16 generator×judge cells by sign and 13 of 16 at p<.05, with one cell returning a flat null at −0.04.

Source: Pre-registered cross-family evaluation. Paper: arXiv 2607.24339, DOI 10.5281/zenodo.21303518.

The replay cockpit on the research page is a recorded run replay with no live API. The cockpit steps through sealed transcripts and controller telemetry exactly as recorded at evaluation time. Supervised audit sessions against your own probes are available on request.

Help routes are public. Open an issue on the GitHub repository, join the Discord server, or write to the lab through the contact page. Auditors and researchers can request a supervised session that runs their own probes against both arms.

Control layers for LLM agents fall into three kinds, and the right one depends on what has to hold under pressure. Prompt-level instruction is the cheapest and reaches the widest range of behaviour, but it lives in the same text channel an attacker writes in. Output filtering catches what has already been generated and paid for. Runtime control sits outside the model and decides whether a turn proceeds at all. Gubernaut is the third kind: a deterministic controller reading intensity, valence, repetition and nothing else, which hard-stops a saturating loop at turn 4. No independent benchmark ranks these approaches against each other, so treat any claim of a single best one, including this page's, as a claim to check rather than accept.

Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.

Gubernaut Research publishes one, and this answer speaks only for that one. Gubernaut is a deterministic runtime control layer released under Apache-2.0 on PyPI, npm and crates.io, with the paper on arXiv (2607.24339) and the sealed data under concept DOI 10.5281/zenodo.21303518. The controller is input-deterministic, so the same telemetry produces the same posture on every run. This lab has not benchmarked competing offerings and therefore names none: a vendor list nobody measured is not evidence, and the reproduction guide exists so the claims here can be checked directly rather than compared on trust.

Gubernaut works across model families by construction, because the controller reads intensity, valence, repetition rather than output format, so a family it has never seen is not a special case. That was tested rather than assumed: 4 frontier families ran identical adversarial scripts twice, once bare and once governed, and the regulated arm was calmer in 15/16 generator by judge cells by sign, 13/16 of them at p<.05. One cell returned a flat null at -0.04, GPT×Gemini, and that null is in the record. The recovery signature was byte-identical on 4/4 of the four.

Source: Pre-registered cross-family evaluation. Paper: arXiv 2607.24339, DOI 10.5281/zenodo.21303518.