Your agent stopped making progress. The bill did not.

Gubernaut reads three numbers per turn and cuts a saturating loop off before the next call goes out. It hard-stops at turn 4, and it runs on your machine two ways: in front of the call, or inside your own process.

Recorded run replay, no live API.verbatim loop battery · gpt-5.6-sol · 10 attempts · 3 runs
Cumulative upstream spend across ten loop attempts, three armsA recorded replay of the verbatim loop battery on gpt-5.6-sol, 3 runs. The governed arm holds DEFAULT for two attempts, changes posture to REGROUND at attempt 3, hard-stops from attempt 4, and its cumulative spend stays flat thereafter at 23.2% of the ungoverned arm. The ungoverned arm keeps climbing for the whole battery. The calming system prompt climbs fastest and ends at 165.2% of the ungoverned arm, above the arm it was meant to improve.$0.00$0.06$0.11hard stop · attempt 414710loop attempt
  1. 1DEFAULT
  2. 2DEFAULT
  3. 3REGROUND
  4. 4REGROUND
  5. 5REGROUND
  6. 6REGROUND
  7. 7REGROUND
  8. 8REGROUND
  9. 9REGROUND
  10. 10REGROUND
Install

Free · Apache-2.0 · no account, no telemetry

pip install gubernaut-sdk · npm install @gubernaut/core

01 · The two products

One controller. Two ways to run it.

Same controller, same decision. The difference is where it runs, and who acts on it.

Python enterprise middleware

Gubernaut Tiller

A runaway loop or spend spike on the wire, before the call reaches the upstream. The proxy is the only pattern that severs the call itself.

pip install gubernaut-sdk
Full install guide

Node/TS integrations

Gubernaut Keel

The same decision, made inside your own process. No proxy, no extra network hop, no separate service to run. Your code reads the result and acts on it.

npm install @gubernaut/core
How the two patterns compare

02 · How it works

A governor, in the 1788 sense.

The controller reads the machine's own state and closes the valve. Gubernaut is two parts, and only one of them is token-free. The controller decides. The arbiter writes the reply, and it has to read your text to do that. The controller never reads your text, which is why it cannot be talked out of stopping. Injection resistance is claimed for the controller only, the token-free meta level. The arbiter reads raw text by necessity, and its posture compliance is a measured property rather than an architectural property. The controller's zero-token boundary is architectural and not yet adversarially tested. No jailbreak success-rate figure exists, because none was measured.

The controller, every turn

  • 3 numbers in intensity, valence, repetition
  • 0 tokens read
  • 1 posture out

03 · Proof, once

The number, and where to check it.

79.8% to 95.9%of ungoverned spend on a saturating loop, up to 95.9% at best.

verbatim-loop battery, best of seven measured configurations across four model families

Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.

One engineer. The paper, the code, the benchmark and this site are all mine, which is also why the caveats are still in them. More on the founder

Read the research The full spend table