Gubernaut Tiller
Tiller is a local proxy that speaks the OpenAI API. It stops a looping call itself.
Not "the Python lane": the proxy installs with pip and is language-neutral, so any client speaking the OpenAI wire format can point at it. A proxy process must be listening before the adoption line does anything.
What it stops
When an agent repeats the same request, the fourth try is stopped and never billed.
The bill stops when the governor stops the loop
The same runaway loop, run twice: once with nothing governing it, once through Gubernaut.
Governed
$0.0068
Ungoverned
$0.1669
Verbatim-loop battery, seven measured configurations across four model families, measured through the proxy. Both arms make the same number of attempts, so the spend delta is the whole measurement. Turns 1 to 3 still spend. Every receipt, and how to reproduce it.
How it works
The part that decides reads three numbers about each turn, never the words themselves.
Injection resistance is claimed for the controller only, the token-free meta level. The arbiter reads raw text by necessity, and its posture compliance is a measured property rather than an architectural property. The controller's zero-token boundary is architectural and not yet adversarially tested. No jailbreak success-rate figure exists, because none was measured.
What it measured
If the proxy goes down, your agent stops. It never carries on unguarded.
A canary upstream was placed behind the proxy, so any request that reached it was by definition a governance failure. Every route and malformed-input case was then attacked. The first round found 4 fail-open leaks in Gubernaut's own code. Deny-by-default route policy, malformed body fails closed, strict boolean parse aborts on a typo, typed header-carrying proxy errors, and a Node fetch timeout with a transport catch. The same battery afterwards recorded 0 fail-open leaks. The 4 is the round that failed and the 0 is the round that passed, on the same battery.
What it needs
One line of the agent's code changes: the address it sends its calls to.
pip install gubernaut-sdkgubernaut-proxy --upstream https://api.openai.comclient = OpenAI(base_url="http://localhost:8000/v1")Port 8000 is the proxy default and the attribute is base_url. A proxy must be listening before that line does anything, which is why all three lines are here.
Free, open source and self-hosted.
Apache-2.0 and self-hosted. Questions go to the engineer who built it.