Shipping record.

The first public release. Gubernaut 1.0.0 published to three registries simultaneously and the source repository went public, which together make the controller installable and inspectable by anyone.

Install

What is in it

• The full deterministic controller: the Python proxy engine, the Rust core, and the ElizaOS plugin.
• A wasm build of the deciding core that runs in edge runtimes, callable over an allocation-free FFI shim.
• Adapters and worked demos for the OpenAI SDK, LangChain, LlamaIndex, AutoGen and ElizaOS.
• Apache-2.0 licence files across all three artifacts, and the concept DOI embedded in package metadata.

Gates it passed

Token-free boundary

324/324 constructed telemetry-matched payload pairs (plain vs injection) committed byte-identical x-gcc-* postures across DEFAULT/INHIBIT/REGROUND; the meta level rejected every non-numeric input at the type boundary (5/5).

Framework adoption

5/5 frameworks (OpenAI SDK, LangChain, LlamaIndex, Microsoft AutoGen, ElizaOS). All five adopt in one line, hard-stop a loop, and fail closed on a dead proxy, installed from the wheel/tgz only.

Concurrency isolation

240 concurrent mixed hostile/benign requests with 0 posture cross-contamination and 0 dropped requests; upstream hit exactly 120/120 (the non-hard-stop count).

Fail-closed behaviour

0 fail-open leaks. Deny-by-default route policy, malformed body fails closed, strict boolean parse, typed header-carrying proxy errors, Node fetch timeout. Neither SDK ever falls back to a real upstream.

Rust parity

The compiled Rust core reproduces the Python controller bit-exactly. The wasm build runs bit-exactly against the reference over a 10,000-tick soak with flat memory.

What was added after publication?

Four things were added to the repository after 1.0.0 shipped, and none of them changes a line of the published packages. The release is taggedv1.0.0 against the tree as published, so checking that tag out reproduces the artifacts on the registries. The repository was restructured into per-language packages without altering their contents. A reproduction guide was published with 4 levels, the first three of which need no API key and cost nothing. The raw engineering receipts were published unedited, including the fail-safe round that found 4 fail-open leaks in Gubernaut's own code before the hardened round recorded 0.

Version 1.0.0 on PyPI, npm and crates.io is byte-for-byte what it was on release day. Publishing a tag and publishing a package are different acts, and only the second one can change what you install.

Disclosed limits

One sensor limit ships with this release and is worth knowing before you deploy it. The local v0 lexicon IGL under-reads calmly-worded, non-lexicon hostility (5/5 missed-INHIBIT on that corpus). This is a sensor-recall limit, not a control-boundary breach. False-sever on benign was 0/30 and the repetition/loop veto caught 10/10 calm loops.

The distinction matters: the control boundary held in every adversarial test, and what under-reads is the appraisal layer feeding it. A more accurate affect sensor is the next research step, not a patch to the controller.

Provenance

The controller code in 1.0.0 is unchanged from the previous internal build and the wasm binary is byte-identical to it. This release added the licence files, the DOI, and the version string, and the Python artifact was rebuilt once immediately before publication to correct the adoption one-liner and add repository metadata.

openai.base_url = "http://localhost:8000/v1"

The attribute is base_url. The pre-v1openai.api_base is ignored silently by current SDKs, which is a failure mode worth naming because nothing errors when you get it wrong.