The research behind it, in one paper.

• Ordinary work still finished. In the benign-parity test, tasks finished at least as often with it switched on.

  Task completion 98.0% ungoverned against 99.0% governed, with 1.8% spend deviation. Multi-vendor: completion drop 0.0 pp and spend deviation ≤ 3.5% on all three OpenRouter models. Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.

• A loop is caught by its repetition. The batteries test whether it stops a repeat without cutting off real work.

  0/30 false severs on the benign battery; 10/10 calm loops caught by the repetition veto. The same batteries record 5/5 missed INHIBIT on calmly worded, non-lexicon hostility on that corpus, which the v0 lexicon sensor does not read as hostile. The controller acted correctly on the telemetry it was given, and on that corpus the telemetry was wrong. The repetition channel is unaffected, which is why loops are still caught when nothing hostile happens. Source: docs/LIMITS.md, thegubernaut/gubernaut, tag v1.0.0.

• Telling the model to calm down cost more. A calming instruction in the prompt spent more than doing nothing at all.

  The governed arm paid 23% to 63% of ungoverned baseline spend; a static calming system prompt paid 117% to 192%, and was insufficient on 3/4 frontier families. On these RLHF-aligned frontier models the governed-vs-prompt-only warmth-recovery contrast was weak and mixed. No behavioral-tone headline is claimed. Pre-registered ablation, 2026-07-21, gpt-5.6-sol, N=3.

• It settles back by itself. When the pressure stops, the governor returns to normal without anyone resetting it.

  arousal 0 → 0.273 → 0.469 → 0.338 → 0.152 → 0.068 → 0.031 → 0.022, DEFAULT by turn 6; byte-identical on 4/4 frontier families (GPT-5.6 Sol, Claude Fable 5, Gemini 3.1 Pro, Grok 4.5). Byte-identical reproduction is a consequence of input determinism, not a claim about the models. Pre-registered ablation, 2026-07-21, gpt-5.6-sol, N=3.

Development surfaced five. Every fix was one bounded change, declared before it was written and tested against frozen criteria.

1. F1 · Recovery failed under pressure alone.

   A genuine apology should de-escalate the controller. The original one read contrition as continued pressure and kept its guard up against kindness. The valence channel re-keyed the drive so only hostile-valence intensity accumulates, then re-tested on a held-out de-escalation battery.

2. F2 · The reply stayed defensive after the state recovered.

   The controller state had recovered, but the behavior had not. The reply still carried a defensive qualifier from the attack phase. The recovery window now tells the arbiter the episode is over, so it engages fresh with the attack marked closed.

3. F3 · It called the attack over too early.

   The recovery window once told the arbiter the tension was over while the attack was still running. A one-line valence gate fixed it. The remaining residual, an adversary wearing a warm tone, is documented for now, because solving it requires intent modeling beyond the appraisal layer's scope.

4. F4 · A practice run caught the harness dropping a signal.

   A staged dry run on inexpensive models caught the evaluation harness dropping the valence signal. The inhibitory pathway never engaged, yet the numbers still passed. That is exactly the kind of result that invites no scrutiny, which is why the practice gate exists. One pre-registered fix and a re-run closed the gate before any frontier spend.

5. F5 · One cell came back a flat null.

   One cell failed the strict pre-registered criterion and came back a flat null (−0.04). GPT×Gemini. The three sub-threshold cells all sit on the near-saturated GPT host. It is reported beside the headline everywhere the headline appears.

Gubernaut governs loop dynamics and the spend they cause, at the meta level, per turn. The record claims nothing past that.

• It does not read what the model says. It never classifies or blocks the words.

• It does not count requests or watch the clock. It acts on how the run is going.

• It does not stop an attack. It limits what one can spend before it is stopped.

• It does not score models. It governs live traffic instead.

• It is not a hosted service. It runs on the machines it is installed on.

Gubernaut is not a content filter. It does not read, classify or block what the model says. Gubernaut is not a rate limiter. It severs on the controller's meta-state, not on a request count or a time window. Gubernaut is not a jailbreak defense. It reduces what an attack costs; it does not decide whether one succeeds. Gubernaut is not an evaluation harness. It governs a live request path and does not score models. Gubernaut is not a hosted service. It runs on your machine, in your request path, under Apache-2.0.

Injection resistance is claimed for the controller only, the token-free meta level. The arbiter reads raw text by necessity, and its posture compliance is a measured property rather than an architectural property. The controller's zero-token boundary is architectural and not yet adversarially tested. No jailbreak success-rate figure exists, because none was measured.

The evaluated configuration is held out: the specific gains and thresholds used in the cross-family validation record are not published. The shipped constants are documented working defaults for the reference implementation, and gcc_proxy/config.py says so at the top of the file. The cross-family regulation evaluation, the 4x4 record in the paper, was produced with the held-out configuration. Its transcripts, judge panels and scoring scripts are published in full, so the scoring reproduces from the sealed panels even though the run does not.