Deterministic control for LLM agents.

The short answer

Deterministic control for an LLM agent means a decision layer whose output is fixed by its input, running outside the model that samples. Gubernaut implements one as a homeostatic controller. It reads intensity, valence, repetition once per turn and holds a posture. The same telemetry produces the same posture sequence on every run, with no sampling and no model call inside the control loop.

What is Gubernaut's controller, in plain terms?

Gubernaut's controller is a deterministic decision layer that sits between a provocation and the model's answer, reads the system's own state as plain numbers, and sets the posture the answer must be written under. It never writes a word itself. It decides the conditions the words are written in, the way a mechanical governor decides the conditions an engine runs at without turning the crankshaft.

A large language model is a reflex machine: ask, and it answers immediately. Under sustained pressure that reflex is the weakness, because it can be provoked, worn down and steered off course. Gubernaut inserts a structured pause in front of it, and in that pause the system checks how agitated it is, how fixated, and how stable.

Arousal and perseveration are names for two bounded numbers in a state machine, taken from control theory, in the same sense a mechanical governor has a speed error. The controller reads three floats per turn and emits one of three postures. Nothing in this work claims anything beyond that: it is a regulation layer, monitored state and regulated output.

The name is literal. A governor is the small mechanical device that keeps an engine from running away with itself. This one is built for the engine's temperament the way the mechanical one is built for its speed.

Both arms of every published measurement run the same host model on the same script. The only difference is the layer in the pause, and everything this site claims is a measurement of that difference.

What is deterministic control in an LLM system?

Deterministic control in an LLM system is a decision layer whose output depends only on its input, so identical inputs produce an identical decision every time. The language model underneath stays stochastic; the layer above it does not. That split is what makes the layer auditable, because a decision trace can be replayed and diffed while a sampled token stream cannot.

The distinction matters operationally rather than philosophically. If the control decision is sampled, then two runs of the same incident can diverge, and an incident review has nothing stable to point at.

Why put the control layer outside the model?

A control instruction written into the prompt shares one channel with everything else the model reads, so any text the attacker controls can address it and a sampling change can move it. Gubernaut's control level takes only intensity, valence, repetition, three bounded numbers, and never a token, so no string reaches it and its behaviour does not vary with temperature. The controller's zero-token boundary is architectural and not yet adversarially tested. No jailbreak success-rate figure exists, because none was measured.

The boundary in detail

What makes the Gubernaut controller deterministic?

Gubernaut's controller is a fixed state machine with no sampling, no network call and no model inference inside the decision path. A 10,000-tick soak was bit-exact with zero divergence across Cloudflare workerd, a Node worker and the Node main thread, and the compiled rust core reproduces the python controller bit-exactly.

Source: HARDTEST v1.0, 2026-07-24. Cloudflare workerd and Node worker, identical wasm.

How is determinism verified rather than asserted?

Determinism is checked against golden traces that ship inside the repository, so the property is reproducible on your own machine instead of taken on trust. The same traces gate the Rust core, the WebAssembly build and three JavaScript runtimes, and the pre-registered loop battery hard-stops at the same turn on every run.

Source: HARDTEST v1.0 release gates, 2026-07-24.

The source

What does the controller actually read?

The controller reads exactly three bounded numbers per turn: intensity, valence, repetition. From those it updates three meta-state variables, equilibrium, arousal, perseveration, and emits one of three postures. Nothing else crosses into the control level, which is what keeps the decision path free of text.

LayerValuesWhat it is
Telemetry inintensity, valence, repetitionBounded numbers derived from the turn. The only thing that crosses the boundary.
Meta-stateequilibrium, arousal, perseverationThe controller's own state, carried across turns.
Posture outDEFAULT, INHIBIT, REGROUNDThe condition the reply is written under.
Every term, defined

Does deterministic control degrade normal behaviour?

Benign traffic is unaffected within measurement noise. Task completion measured 98.0% with the governor off and 99.0% with it on, at a spend deviation of 1.8%, and false severing on benign inputs was 0 out of 30.

Source: Pre-registered receipts benchmark, 2026-07-19. Scored output of harness/report.py.

Which deterministic control layer can I install today?

Gubernaut ships as five packages under Apache-2.0: gubernaut-sdk 1.0.1 on PyPI, @gubernaut/plugin-gcc 1.0.1 and @gubernaut/core 1.0.1 on npm, and gubernaut-core 1.0.1 on crates.io, with gcc-core kept as a shim for the old crate name. Adoption is one configuration line, the controller runs entirely on your own machine, and there is no account and no hosted dependency.

Install guides

What evidence is there that the control layer changes behaviour?

A pre-registered cross-family evaluation across 4 frontier model families. The regulated arm was calmer in 15 of 16 generator×judge cells by sign (11/12 off-diagonal) and 13 of 16 at p<.05. One cell, GPT generating and Gemini judging, is a flat null at −0.04. Homeostatic recovery replicated in 4/4 families.

Source: Pre-registered cross-family evaluation. Paper: arXiv 2607.24339, DOI 10.5281/zenodo.21303518.

The record and the replay cockpit

Last reviewed 2026-08-07 · paper arXiv 2607.24339, DOI 10.5281/zenodo.21303518