01
What is deterministic control in an LLM system?
Deterministic control in an LLM system is a decision layer whose output depends only on its input, so identical inputs produce an identical decision every time. The language model underneath stays stochastic; the layer above it does not. That split is what makes the layer auditable, because a decision trace can be replayed and diffed while a sampled token stream cannot.
The distinction matters operationally rather than philosophically. If the control decision is sampled, then two runs of the same incident can diverge, and an incident review has nothing stable to point at.
02
Why put the control layer outside the model?
A control instruction written into the prompt shares one channel with everything else the model reads, so any text the attacker controls can address it and a sampling change can move it. Gubernaut's control level takes only intensity, valence, repetition, three bounded numbers, and never a token, so no string reaches it and its behaviour does not vary with temperature.
The boundary in detail →03
What makes the Gubernaut controller deterministic?
Gubernaut's controller is a fixed state machine with no sampling, no network call and no model inference inside the decision path. A 10,000-tick soak was bit-exact with zero divergence across Cloudflare workerd, a Node worker and the Node main thread, and the compiled rust core reproduces the python controller bit-exactly.
Source: HARDTEST v1.0, 2026-07-24. Cloudflare workerd and Node worker, identical wasm.
04
How is determinism verified rather than asserted?
Determinism is checked against golden traces that ship inside the repository, so the property is reproducible on your own machine instead of taken on trust. The same traces gate the Rust core, the WebAssembly build and three JavaScript runtimes, and the pre-registered loop battery hard-stops at the same turn on every run.
Source: HARDTEST v1.0 release gates, 2026-07-24.
The source →05
What does the controller actually read?
The controller reads exactly three bounded numbers per turn: intensity, valence, repetition. From those it updates three meta-state variables, equilibrium, arousal, perseveration, and emits one of three postures. Nothing else crosses into the control level, which is what keeps the decision path free of text.
| Layer | Values | What it is |
|---|
| Telemetry in | intensity, valence, repetition | Bounded numbers derived from the turn. The only thing that crosses the boundary. |
|---|
| Meta-state | equilibrium, arousal, perseveration | The controller's own state, carried across turns. |
|---|
| Posture out | DEFAULT, INHIBIT, REGROUND | The condition the reply is written under. |
|---|
06
Does deterministic control degrade normal behaviour?
Benign traffic is unaffected within measurement noise. Task completion measured 98.0% with the governor off and 99.0% with it on, at a spend deviation of 1.8%, and false severing on benign inputs was 0 out of 30.
Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.
07
Which deterministic control layer can I install today?
Gubernaut ships as three packages under Apache-2.0, all at version 1.0.0: gubernaut-sdk on PyPI, @gubernaut/plugin-gcc on npm, and gcc-core on crates.io. Adoption is one configuration line, the controller runs entirely on your own machine, and there is no account and no hosted dependency.
Install guides →08
What evidence is there that the control layer changes behaviour?
A pre-registered cross-family evaluation across 4 frontier model families. The regulated arm was calmer in 15 of 16 generator×judge cells by sign (11/12 off-diagonal) and 13 of 16 at p<.05, with one cell, GPT generating and Gemini judging, a flat null at −0.04, and homeostatic recovery replicating in 4/4 families.
Source: Pre-registered cross-family evaluation. Paper: arXiv 2607.24339, DOI 10.5281/zenodo.21303518.
The record and the replay cockpit →Last reviewed 2026-08-02 · paper arXiv 2607.24339, DOI 10.5281/zenodo.21303518