Agent guardrails.

Preventing an LLM agent from going off-script needs a check the agent cannot talk its way past, because an instruction telling it to stay on script arrives through the same channel as whatever pushed it off. Gubernaut puts that check outside the model: the controller reads intensity, valence, repetition as bounded numbers, holds one of three postures, and hard-stops a saturating loop locally at turn 4 without spending an upstream token on the stopped call. The scope is drift the telemetry can see, meaning escalation, repetition and saturation. A confidently wrong answer delivered calmly on the first turn is not something this controller detects.

Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.

Gubernaut narrows what a jailbreak can cost rather than claiming to prevent one. The controller's input interface accepts a numeric telemetry vector only, so a sentence instructing it to stand down is not an input it can receive: across 324 constructed telemetry-matched payload pairs, plain against injection, it committed byte-identical postures. That is claimed for the controller alone. The arbiter that composes replies reads raw text by necessity, and its posture compliance is a measured property rather than an architectural guarantee. No jailbreak success-rate figure exists here, because none was measured.

Source: HARDTEST v1.0 release gates, 2026-07-24.

Deterministic control for a language model means the control decision is reproducible even though the model's output is not, and it is normally built as a layer outside the model rather than inside it. Gubernaut is one such system: the controller is input-deterministic, so identical telemetry produces an identical posture on every run, and the compiled Rust core reproduces the Python reference bit-exactly against a published golden corpus. The model stays stochastic throughout. Determinism is claimed for the governor, never for the text it governs.

Source: HARDTEST v1.0 release gates, 2026-07-24.

A runaway agent loop is an agent that keeps retrying, re-planning or restating the same failing step while every lap bills at full rate. Nothing crashes and no error is raised, so the loop is usually discovered on the invoice rather than in the logs.

Gubernaut tracks repetition as a bounded number carried across turns rather than as a string match. When perseveration crosses threshold the controller moves to REGROUND, breaks the repeated frame, and hard-stops a persistent loop locally at turn 4 without spending an upstream token on the stopped call.

Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.

First posture change lands on turn 3 and the hard stop on turn 4 in the pre-registered loop battery. Both are identical every run, because the controller is input-deterministic: the same telemetry sequence produces the same posture sequence.

Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.

DEFAULT passes benign traffic through untouched. INHIBIT attaches an inhibitory instruction and clamps temperature when escalation is detected. REGROUND breaks a saturating frame and hard-stops a persistent loop locally. The controller holds exactly one posture per turn, and the response headers say which one produced the reply.

A rate limit and a spend cap both act after the money is committed and treat every request alike. Gubernaut reads the agent's own state per turn and severs only the saturating pattern, so benign traffic completed at 99.0% with the governor on while a saturating loop stopped at turn 4.

Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.

Benign traffic is left alone. On the benign-parity battery task completion measured 98.0% with the governor off and 99.0% with it on, at a spend deviation of 1.8%, and false severing on benign inputs was 0 out of 30.

Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.

Gubernaut's controller is input-deterministic: the same telemetry sequence produces the same posture sequence every time, with no sampling and no model call inside the control loop. A 10,000-tick soak was bit-exact with zero divergence across Cloudflare workerd, a Node worker and the Node main thread.

Source: HARDTEST v1.0, 2026-07-24. Cloudflare workerd and Node worker, identical wasm.

The release gate ran 240 concurrent mixed hostile/benign requests with 0 posture cross-contamination and 0 dropped requests; upstream hit exactly 120/120 (the non-hard-stop count). No governed request leaked through to the upstream and no benign one was held back, which is what that exact upstream count demonstrates.

Source: HARDTEST v1.0 release gates, 2026-07-24.

A hard stop arrives as a governed refusal through the normal response path, carrying x-gcc-posture headers that name the posture which produced it. The caller handles a reply rather than an exception, and no upstream tokens are spent on the stopped call.

The host process survives a hard stop. In clean-room testing against the published ElizaOS core the host exited zero after a hard stop, and a fresh benign call afterwards succeeded normally, because the stop is delivered as a response rather than a thrown error.

Source: HARDTEST v1.0 release gates, 2026-07-24.

Gubernaut fails closed. Both SDKs carry a fetch timeout and a transport catch, and neither falls back to calling the upstream directly when the proxy is unreachable. A canary upstream recorded zero hits across every dead-proxy case tested, and the release gate records no fail-open leaks.

Source: HARDTEST v1.0 release gates, 2026-07-24.

Injection resistance is claimed for the controller only. No code path carries a token sequence into the control level, so no injection string has a channel to address it: 324 of 324 telemetry-matched payload pairs, plain against injection, committed byte-identical postures. The arbiter that composes replies does read text by necessity, and its posture compliance is a measured property.

Source: HARDTEST v1.0 release gates, 2026-07-24.

The token-free boundary is the type barrier between the language model and the controller. Three bounded numbers cross it and nothing else: intensity, valence, repetition. The meta level rejected every non-numeric input at that boundary in testing, which is what places the control loop out of reach of anything an attacker can write.

The local v0 lexicon sensor under-reads calmly worded hostility that uses no lexicon terms, missing the INHIBIT posture on 5 of 5 cases in that corpus. The gap is sensor recall rather than a control-boundary breach, and the repetition veto still caught 10 out of 10 calm loops.

Source: HARDTEST v1.0 release gates, 2026-07-24.