Rust and WebAssembly.

Install from crates.io

cargo add gubernaut-core

call the controller

let mut ctl = Controller::default();
let posture = ctl.tick(intensity, valence, repetition);

The Rust core is the deciding state machine, not a proxy. There is no base_url to set and no HTTP client: you call tick() and act on the posture it returns.

Free and Apache-2.0, running entirely on your machine. View on crates.io · Read the source

How do I use it once it is installed?

Gubernaut Keel is a library inside your program: call the controller each turn with intensity, valence, repetition, and your own code acts on the posture it returns. There is no proxy in this lane, and nothing is intercepted for you.

use gubernaut_core::Controller;

// the controller holds meta-state across turns and decides a posture.
// no allocation in the hot path, no network, no tokens.
let mut ctl = Controller::default();

let posture = ctl.tick(intensity, valence, repetition);
match posture {
    Posture::Default  => forward(request),
    Posture::Inhibit  => forward(request.with_clamped_temperature()),
    Posture::Reground => local_fallback(),   // zero upstream tokens
}

Rust / WASM specifics

How fast is one decision?

One controller tick measured p99 2.8 microseconds in an in-process Python microbenchmark over 100,000 iterations on Windows 11 AMD64: not end-to-end, not the wasm core, no network. Compiled to wasm the same logic runs at ~125 ns per tick inside Cloudflare workerd, with 200 ns p99 measured on the identical binary in a Node worker. Cloudflare workerd is a real edge runtime; its Spectre-hardened clock precludes an internal per-tick distribution, so the workerd figure is external-throughput-derived and the distribution is the identical wasm's Node-worker number.

Does the Rust core agree with the Python reference?

Yes, and it is checked rather than assumed. The compiled Rust core reproduces the Python controller bit-exactly. The repository ships the golden traces, so parity is something you can reproduce locally rather than take on trust.

Is it safe to run at the edge?

A 10,000-tick soak in Cloudflare workerd was bit-exact against the reference with flat memory, and the same held in a Node worker and on the Node main thread. The crate carries a deny-unsafe-code attribute, scoped-allowed only for the export attribute on the FFI shim.

Why is the crate now called gubernaut-core?

The crate was renamed from gcc-core to gubernaut-core because the old name was unsearchable: typing "gcc" into any developer search returns the GNU Compiler Collection. crates.io cannot rename a crate, so gcc-core was given a forwarding address rather than being abandoned. It is still published, it still installs, and it re-exports gubernaut-core, so an existing build keeps working with no change. The compiled controller is byte-identical across the rename, which means every measured figure on this site describes the same binary it did before.

Can I run the same controller from JavaScript?

@gubernaut/core is the same controller compiled to WebAssembly and bound for JavaScript, installed with npm install @gubernaut/core. It runs in-process with no proxy hop and no dependencies, which is what makes it usable in a serverless function, an edge worker or a browser, where a local proxy process cannot run. It decides, it does not intercept. Acting on a REGROUND posture is the caller's job, which is the one thing the proxy does that this does not.

Where does the same decision run?

Gubernaut Keel makes the same decisions, bit for bit, at the edge and on your own servers: 10,000-tick soak bit-exact (0 divergence) with flat memory in workerd, a Node worker, and Node main.

In Cloudflare workerd, ~125 ns per tick; 200 ns p99 on the identical wasm in a Node worker. Cloudflare workerd is a real edge runtime; its Spectre-hardened clock precludes an internal per-tick distribution, so the workerd figure is external-throughput-derived and the distribution is the identical wasm's Node-worker number. The spend receipts were measured through the proxy and are Gubernaut Tiller's, not Gubernaut Keel's.

Other languages

The same controller ships for three runtimes. They share the deciding core, so a posture decision is identical whichever one you run.

• Gubernaut TillerPythonpip install gubernaut-sdk
• A Gubernaut Tiller clientNode / on-chainnpm install @gubernaut/plugin-gcc

Last reviewed 2026-08-07 · paper arXiv 2607.24339, DOI 10.5281/zenodo.21303518