Gubernaut Keel

What it decides

Same input, same decision, every run, so it can be tested and signed off.

Identical across runs because the controller is input-deterministic. The compiled Rust core reproduces the Python controller bit-exactly. 10,000-tick soak bit-exact (0 divergence) with flat memory in workerd, a Node worker, and Node main. Determinism is a property of the controller, the layer that decides; the model it watches stays stochastic.

Where it runs

It makes the same decisions, bit for bit, at the edge and on self-hosted servers.

In Cloudflare workerd, ~125 ns per tick; 200 ns p99 on the identical wasm in a Node worker. Cloudflare workerd is a real edge runtime; its Spectre-hardened clock precludes an internal per-tick distribution, so the workerd figure is external-throughput-derived and the distribution is the identical wasm's Node-worker number.

What it leaves to the program

Tiller is a local proxy that stops the call itself. Keel is the same decision as a library, inside the program.

The spend receipts were measured through the proxy, so they are Tiller's evidence, not Keel's. The native Rust per-tick figure is not published.

Install it

In JavaScript:

npm install @gubernaut/core

In Rust:

cargo add gubernaut-core

The controller as a Rust library, and the source of the wasm build.