Your agent stopped making progress. The bill did not.
Gubernaut sits in front of the call, reads three numbers per turn, and cuts the loop off. It is a local, OpenAI-compatible proxy, and it hard-stops a saturating loop at turn 4.
- 1DEFAULT
- 2DEFAULT
- 3REGROUND
- 4REGROUND
- 5REGROUND
- 6REGROUND
- 7REGROUND
- 8REGROUND
- 9REGROUND
- 10REGROUND
Source: Pre-registered verbatim-loop battery, gpt-5.6-sol, 3 runs, 2026-07-21. receipts/engineering/ablation/ in thegubernaut/gubernaut v1.0.0.
Free · Apache-2.0 · runs on your machine · no account, no telemetry
A governor, in the 1788 sense.
The controller reads the machine's own state and closes the valve. It never reads your text, which is why it cannot be talked out of stopping.
The controller, every turn
- 3 numbers in intensity, valence, repetition
- 0 tokens read
- 1 posture out
Gubernaut is two parts and only one of them is token-free. The controller decides, and sees nothing but those three numbers. The arbiter that writes the reply reads the text, because writing a reply requires reading one.
Injection resistance is claimed for the controller only, the token-free meta level. The arbiter reads raw text by necessity, and its posture compliance is a measured property rather than an architectural property.
01 · The receipts
The bill is the benchmark.
A failed tool call retried word for word. A demand reworded and sent again. Every lap sends the whole conversation back, and you pay for all of it, every time.
Measured across seven measured configurations across four model families, generator and judge, both arms.
What these numbers do not cover
0/30 false severs on the benign battery, and 10/10 calm loops caught by the repetition veto. The same batteries record 5/5 missed INHIBIT on calmly worded, non-lexicon hostility on that corpus, which the v0 lexicon sensor does not read as hostile. The controller acted correctly on the telemetry it was given, and on that corpus the telemetry was wrong. The repetition channel is unaffected, which is why loops are still caught when nothing hostile happens.
Sever precision: docs/LIMITS.md, thegubernaut/gubernaut, tag v1.0.0.
Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py. Both arms make the same number of attempts, so the spend delta is the whole measurement.
02 · The objection
Three things teams try first.
“We already have monitoring.”
Monitoring will usually see it. Several platforms flag the same tool called with identical arguments, and the trace is there afterwards. What an alert cannot do is act: it raises a notification, a person has to read it, and the loop keeps billing in the gap between those two things. Overnight, that gap is the whole night. Gubernaut sits in the request path instead, so the decision happens before the call is sent: first posture change at turn 3, hard stop at turn 4, and a hard-stopped turn never reaches the upstream. Keep the dashboard. It is the record. It is not the brake.
Working out which one you have: why is my agent stuck in a loop · why is my agent burning tokens
“Just add a calming system prompt.”
Tested, pre-registered, on the same saturating loops. The prompt did not contain the runaway, and it added tokens to every turn while failing to.
- Governed Flat from attempt 4. A hard-stopped turn calls no upstream, so it costs nothing.
- Ungoverned Climbs for the whole battery. Nothing inside the loop is aware that it is a loop.
- Calming prompt Ends above the ungoverned arm. The prompt did not contain the runaway, and it added tokens to every turn while failing to.
Source: Pre-registered ablation, 2026-07-21, gpt-5.6-sol, N=3. The static prompt was insufficient on 3/4 frontier families. On these RLHF-aligned frontier models the governed-vs-prompt-only warmth-recovery contrast was weak and mixed. No behavioral-tone headline is claimed.
“A turn cap already does this.”
A cap counts turns, and a count cannot separate a stuck agent from a working one. Set high enough not to kill a legitimate long task, it fires only once most of the money is spent. Gubernaut reads repetition and escalation as state, so the trigger is the pattern rather than the length: 10/10 calm loops caught by the repetition veto, 0/30 false severs on the benign battery. The same batteries record 5/5 missed INHIBIT on calmly worded, non-lexicon hostility on that corpus, which the v0 lexicon sensor does not read as hostile. A cap is a sound backstop for the invoice, and it is not control.
How the approaches compare03 · Install
Three commands, then it is in the path.
pip install gubernaut-sdkgubernaut-proxy --upstream https://api.openai.comclient = OpenAI(base_url="http://localhost:8000/v1")Step 2 is not optional. Nothing is listening on port 8000 until the proxy is running, so a client pointed at it first gets a connection refused. The same controller also ships as a library you call in your own process, with no proxy at all: Rust and WASM, Node and on-chain, both Apache-2.0 at 1.0.1. The full install, both spend tables and the postures
04 · The record
Measured, then published.
15/16 cells by sign · 13/16 at p<.05 · recovery 4/4 · 1 null
That null is one cell, GPT generating and Gemini judging, flat at -0.04. The three sub-threshold cells all sit on the same near-saturated GPT host.
The regulation evaluation: the 4x4 regulation evaluation, all four families serving as both generator and judge. Separate from the cost benchmark above, which measured spend across seven measured configurations across four model families and asked a different question.
Arousal and perseveration are names for two bounded numbers in a state machine, taken from control theory, in the same sense a mechanical governor has a speed error. The controller reads three floats per turn and emits one of three postures. Nothing in this work claims anything beyond that: it is a regulation layer, monitored state and regulated output.
Built by one engineer. The paper, the data, the judge panels and the source are all public, under an ORCID and a DOI. Who is behind this