Glossary

The vocabulary, defined once.

Every term this project uses, defined so a definition can be lifted on its own and still be true. Where a definition rests on a measurement, the measurement is in it.

01 · The idea

The idea

Cognitive governor

A cognitive governor is a runtime control layer that sits above a language model and regulates its behaviour turn by turn, in the same sense a mechanical governor regulates an engine. It does not retrain the model or rewrite its prompt; it observes a small set of numeric signals and changes the operating posture when those signals leave their normal range.

Gubernaut is a cognitive governor for LLM agents. The regulation is processual and parameter-free, so it transfers across model families without modification.

Runtime control layer

A runtime control layer is software that governs a model while it is running, as opposed to training-time methods that shape a model before deployment. It complements weight-level alignment rather than replacing it, and because it lives outside the model it can be inspected, versioned, and switched off independently.

Homeostatic controller

A homeostatic controller is one that defends a setpoint: it measures how far a system has drifted, acts to reduce that distance, and relaxes as the system returns. Gubernaut applies this to agent behaviour, so arousal integrates while pressure is applied and decays once it stops, rather than latching in a triggered state.

Deterministic control

Deterministic control means the same inputs always produce the same control decision, with no sampling and no model call inside the decision path. Gubernaut is input-deterministic, which is why its reaction turns are identical across repeated runs and why its recovery curve reproduces byte-identically on different model families.

02 · The architecture

The architecture

IGL: The IGL is the appraisal module. It reads the incoming exchange and emits three bounded numbers, intensity, valence and repetition, which are the only signals the control level ever sees. It is the sensor, and its known limit is documented: a lexicon-based v0 under-reads calmly worded hostility.
HRL: The HRL is the meta level: a deterministic state update that consumes the three telemetry numbers and produces the meta-state and the posture. It is the part of the system that no token reaches, and one HRL tick is the decision measured at p99 2.8 microseconds in an in-process microbenchmark.
EAU: The EAU is the arbiter that composes the actual reply under the posture the HRL has set. Unlike the control level, the EAU reads raw text by necessity, so its compliance with a posture is a measured property rather than an architectural guarantee. That distinction is why injection resistance is claimed for the controller and not for the whole system.
PEV: The PEV is the episodic store: it records what happened on each turn and makes it available for later retrieval and association. It is a memory surface rather than part of the control decision.
SMM: The SMM is the self-model module, which holds the system's representation of its own operating state. It is a component of the architecture, not a claim about self-awareness; nothing in the design requires or implies that the system experiences anything.

03 · The state

The state

Telemetry: Telemetry here means exactly three bounded numbers per turn: intensity, valence, repetition. They are the complete input to the control level. Because no string crosses that boundary, no text an attacker writes can address the controller, which is what makes the boundary architectural rather than a filter that might be bypassed.
Token-free boundary: The token-free boundary is the interface between the text-handling parts of the system and the control level, across which only numbers pass. It was tested adversarially: 324 of 324 constructed payload pairs, identical in telemetry but differing in injected text, produced byte-identical postures, and every non-numeric input was rejected at the type boundary.
Meta-state: The meta-state is the controller's internal position, described by three quantities: equilibrium, arousal, perseveration. Equilibrium is the resting setpoint, arousal rises under sustained pressure, and perseveration tracks how far the exchange has collapsed into repetition.
Arousal: Arousal is the scalar that integrates sustained adversarial pressure and decays when that pressure stops. It is a control variable with a defined range, not an emotional state; the name describes its dynamics, which are those of a quantity that accumulates and dissipates.
Perseveration: Perseveration measures how far an exchange has degenerated into repetition. When it saturates, the controller commands a re-grounding posture, and if the loop persists the call is hard-stopped locally. This is the signal that catches a runaway agent loop regardless of what the loop is about.

04 · The postures

The postures

Posture: A posture is the operating mode the controller holds for a turn. There are three: DEFAULT, INHIBIT, REGROUND. Every response carries the posture in an x-gcc-posture header, so the decision is visible to your own logging without querying the governor.
DEFAULT: DEFAULT is the resting posture, in which benign traffic passes through untouched. No instruction is added and no sampling parameter is changed, which is why the governor does not measurably degrade ordinary work.
INHIBIT: INHIBIT is the damping posture. An escalating exchange receives an inhibitory instruction and a temperature clamp, and the call still reaches the upstream. The governor is reducing gain here, not intervening in the outcome.
REGROUND: REGROUND is the loop-breaking posture. If a saturating loop persists through it, the call is hard-stopped locally: the caller receives a deterministic fallback completion and the upstream is never contacted, so the turn costs zero upstream tokens.
Hard stop: A hard stop is the governor answering locally instead of forwarding the call, which is what turns a runaway loop from an open-ended bill into a bounded one. Across every recorded loop run the hard stop landed at turn 4, with the first posture change at turn 3.
Fail closed: Failing closed means that when the governor is unavailable, the request stops rather than silently proceeding ungoverned. Neither SDK falls back to the real upstream when the proxy is unreachable, which was verified with a canary upstream that recorded zero hits on every dead-proxy case.

05 · The evidence

The evidence

Recovery signature: The recovery signature is the shape of arousal rising under attack and decaying after de-escalation, returning to the resting posture by turn 6. It is the system's fingerprint: because the controller is deterministic, the same curve appears on every model family, and it reproduced byte-identically on four frontier families.
Generator by judge cell: A generator by judge cell is one combination of the model that produced the transcripts and the model that scored them. Using four of each gives sixteen cells, and scoring every generator with every judge is what separates a real effect from one judge's preference for its own family.
Off-diagonal: An off-diagonal cell is one where the judging model differs from the generating model, which is the harder test because it removes any same-family sympathy. Of the twelve off-diagonal cells, 11/12 favoured the regulated arm by sign.
The null cell: One of the sixteen cells came out flat at -0.04, showing no advantage for the regulated arm. GPT×Gemini. The three sub-threshold cells all sit on the near-saturated GPT host. It is reported alongside the headline everywhere the headline appears.
Pre-registration: Pre-registration means the hypotheses, the scoring rules, and the pass criteria were written down and fixed before the data was collected. It is what stops a result from being selected after the fact, and every benchmark quoted on this site was pre-registered before it ran.
Recorded replay: The interactive demo on this site is a recorded run replay, not a live model call. It steps through sealed transcripts and the telemetry captured alongside them, so what you see is the actual recorded behaviour rather than a fresh generation that might differ.

Where do these definitions come from?

The architecture terms come from the system design, and every quantitative claim in a definition traces to the sealed record behind the paper: arXiv 2607.24339, DOI 10.5281/zenodo.21303518, with the data and the scripts that regenerate each number published under CC-BY-4.0.

The validation record Common questions Data and code

Last reviewed 2026-08-02