How it works · the long version

A work system that treats its own AI as untrusted.

The homepage is the thesis; this is the mechanism. GUS wraps a language model in a deterministic shell — a response engine that runs in fixed phases, eight architectural components, and self-improvement loops that learn from correction. Here's what each part does and why it exists.

The response engine Jump to FAQ

First principle

A work system, not a chatbot.

The distinction is not tone — it is architecture. A chatbot optimizes for a helpful reply. GUS optimizes for a defensible action, and refuses to treat the model's cooperation as a security control.

GUS · work system

Every action passes through code that runs whether or not the model cooperates.
State persists to on-device memory and an append-only audit trail.
Dangerous capability is locked behind explicit, time-boxed elevation.
Answers advance a task, gather information, or record a decision.
Safety lives in the shell around the model, where it can be verified.

Chatbot

Safety is a request in the prompt — honored only when the model complies.
Context evaporates at the end of the session.
Whatever the model can call, it can call, whenever it decides to.
Answers optimize for sounding helpful.
Safety lives inside the model, where it cannot be audited.

Orchestration · the response engine

Seven phases, every time.

GUS routes each task through a named, versioned behavioral engine. The phases are fixed so behavior is predictable — the model fills in the reasoning, but never gets to skip a step.

Orient

load state

Pull identity, active context, and relevant past corrections from local memory before reasoning about anything.

Assess

classify

Judge the task's classification level and blast radius. Higher tiers raise the bar for what runs without confirmation.

Plan

decompose

Break the work into concrete, reviewable actions — the smallest steps that flush out unknowns early.

Execute

gated

Each proposed action is intercepted by a hook, judged against deny-lists and the active profile, then run or blocked.

Validate

verify

Confirm the change did what it was supposed to — drive the real behavior, not just trust that a command returned zero.

Persist

remember

Write durable facts, decisions, and their rationale to memory so the next session resumes with full context.

Learn

self-tune

Ingest corrections from the session and fold them back into the guardrails, so the same mistake is harder to repeat.

Architecture · Praxis

Eight components, in depth.

Grouped as four disciplines — foundation, knowledge, action, reflection. Each is where a principle becomes enforceable practice.

Foundation · Identity

Who the assistant is

Mission, goals, beliefs, and mental models loaded at session start — so behavior is anchored to a role, not improvised per prompt.

Foundation · Rules

The guardrails

Modular, path-aware rules plus lifecycle hooks and permanent deny-lists. The deterministic law the model operates under.

Knowledge · Context

Compiled knowledge base

A self-maintaining wiki of investigations and entities, cross-linked and classification-governed — institutional memory that survives the session.

Knowledge · Data

Local temporal graph

Thousands of facts and corrections in an on-device, full-text-searchable knowledge graph. Queried first on recall; no vendor cloud holds it.

Action · Orchestration

The Algorithm

The versioned seven-phase engine above — the behavioral spine that governs how a response is formed and constrained.

Action · Network

Agents & MCP mesh

Scoped sub-agents and single-binary Rust integrations speaking JSON-RPC over stdio — capability without an open network surface.

Reflection · Learning

Self-improvement

Correction ingestion, assertion-based skill tuning, and memory consolidation — the loops that make the system better over time.

Reflection · Audit

Compliance trail

Hook-generated JSONL logs and a decision record with dissent logging — an evidence trail you can replay.

Surface · integrations

A mesh with no open ports.

GUS reaches your security stack through standalone Rust services — one binary each, speaking JSON-RPC over stdio. No HTTP listener, no exposed port, immune to DNS-rebinding, and credentials resolve from a vault at runtime rather than a config file on disk.

stdio-only

No listening socket

Integrations talk over standard input/output, not a network port. There is no endpoint to scan, rebind, or reach from off-host.

vault-brokered

Secrets never on disk

Credentials are resolved from a secrets manager just-in-time and passed without landing in argv, process listings, or a committed config.

dry-run-gated

Writes are opt-in

Vendor tools that mutate state default to read-only and require an explicit confirm — a preview of the exact request comes first.

reviewed

Vetted before wiring

Every third-party integration is security-reviewed before deployment. Known-bad connectors stay permanently rejected.

Reflection · learning loops

It gets sharper from being corrected.

Correction is not lost at the end of a session. GUS runs explicit loops that fold what it learned back into its own guardrails and memory.

/reflectLearn from corrections

Analyzes a session's corrections and updates skill files, prompts, and agent definitions.

/skill-evalAssertion-tuned skills

Runs binary assertions against a skill's output and tunes it until it passes — an overnight research loop.

/dreamConsolidate memory

Prunes stale entries and merges duplicates, keeping the knowledge graph dense and accurate.

/adversarial-reviewSecond-model check

A separate model's perspective catches blind spots and drift before anything ships.

Deployment

Personal daily-driver, or team edition.

The same framework, with the secret-storage and accountability seams swapped for the environment. Personal-versus-enterprise is a pluggable backend, not a fork.

Personal

One user, one machine

Secrets and the break-glass code word live in a personal password manager.
Break-glass elevation alerts the owner directly.
On-device memory and audit; nothing leaves the laptop by default.
Self-service recovery — rotate your own code word, no admin flow.

Enterprise

Per-user, across a team

Secrets brokered from an enterprise privileged-access vault, per user.
Per-user break-glass with an audit trail keyed to the actor.
Central control of shared policy while each install stays least-privilege.
Shipped as a hardened template — the guardrails travel with it.

Questions

The things people ask first.

Does my data go to a vendor cloud?

Your investigation history, corrections, and audit trail live on-device in a local knowledge graph and JSONL logs — no vendor cloud holds them. The language model itself runs through whichever AI provider you configure, so the reasoning text transits that provider; the durable record of what you did stays local.

Which AI model does it use?

GUS is a framework layered on a coding-agent harness and defaults to the latest, most capable models available to it. The point is that the guardrails are model-independent: hooks, profiles, deny-lists, and the audit trail enforce the same way regardless of which model is behind the wheel.

Is GUS a product I can install, or a framework?

A framework. The AI harness is the engine; GUS is the doctrine, guardrails, memory, and integrations layered on top of it. It ships as a hardened template you stand up for your own environment.

How does the OT/ICS safety actually work?

Through command-level gates, not protocol parsing. GUS can read and validate an industrial proxy or firewall config, but commands that restart or reconfigure a live OT service are hard-blocked at the argv layer and handed to a human with a maintenance window. It does not sit inline on Modbus/S7/DNP3 traffic — it refuses the dangerous operation, deterministically.

What happens when it needs a dangerous capability?

It stays locked behind break-glass — an explicit, time-boxed elevation that requires a code word entered out-of-band, carries a TTL, and alerts the owner. Least privilege is the resting state; elevation is the exception, and every switch is logged.

Can it act on my systems on its own?

Only through the gate. The assistant never touches your systems directly — its intent is intercepted, judged against the deny-lists and active profile, and either run, blocked, or routed to break-glass. Outbound and irreversible actions require confirmation, and the reason for every decision is recorded.

Get started

Bring your stack; keep your guardrails.

GUS is in limited access for security teams working across IT and OT.

Request access → Back to overview

heygusai.io · deterministic by design