Sixty-One Microseconds

Sixty-one microseconds. That is what the governor adds to a decision when it runs inside the path, measured across thirty thousand of them.

The number matters because of the objection it answers.

Governance that acts in-flight has one standing objection. A governor that fires before the next inference sits in the decision path, and every decision waits for it. Read-after governance carries no such cost. It reads a record that already exists, on its own clock, after the output has formed. The question that decides whether in-flight governance is practical is not whether it should act. It is what acting costs.

The objection.

A control plane that reads the run after the output exists pays nothing at decision time. The output is already formed. The record is read later.

A governor that modulates authority and holds an envelope before the next inference cannot wait. It runs while the decision is being made. If it adds milliseconds, it changes the latency profile of the system it governs. At enough scale, milliseconds per decision is a tax the operator will not pay, and the governor gets moved out of the path and back to read-after.

The objection is practical, not theoretical. It is the reason most assurance ends up as forensics. The path could not afford the governor, so the governor was taken off the path.

What we measured.

We built the governor as a production runtime. C++17, roughly eighteen hundred lines, no external dependencies beyond the system thread library. We ran it across thirty thousand governed decisions and recorded the latency of each one.

Mean: sixty-one microseconds. Ninety-fifth percentile: eighty-three microseconds. The ceiling we designed to was one hundred twenty-three. The runtime came in at roughly half its own budget, with the tail still under the line.

What the number means.

Sixty-one microseconds is below the noise floor of the decision it governs. An agent decision that calls a tool, waits for the return, and conditions its next step on the result takes milliseconds at the fast end and seconds at the slow end. A governor that adds sixty-one microseconds to that is not a cost the operator can feel. It is a rounding error against the work the decision was already doing.

That is the measurement that retires the objection. In-flight governance was supposed to be the expensive option. Measured, it costs less than the first network round trip the decision makes.

The second measurement.

Latency was the first thing we measured. Parity was the second.

The governor exists in two independent implementations. A reference implementation in Python, written for development, and the production runtime in C++. Both produce the same per-decision record. Not a similar record. The same canonical JSON, byte for byte, and the same SHA-256 over it. Run one decision through both, and the two signatures match.

Why parity is the point.

A signed record is only as trustworthy as the thing that signed it. If the only software that can produce the record is the vendor's binary, then verifying the record means trusting the binary. The examiner who cannot reproduce the signature is taking the vendor's word that the record is what the run produced.

Byte-parity takes the binary out of the trust equation. When a second implementation, in a different language, on a different stack, produces the identical signature for the same decision, the signature is a property of the decision and not of the build that emitted it. A reviewer can reproduce it from the specification alone. The audit object becomes verifiable by a party who trusts neither implementation, which is the only kind of verifiability that survives a vendor change or a courtroom.

Where it runs.

The runtime governs in two production settings today. Vehicle dynamics, where it sits in the control path of a moving platform. Commercial real estate financial signals, where it governs the models that score a deal. Both are live. Both produce the signed record on every decision.

A third surface, cyber telemetry, is built and verified end to end against synthetic data shaped like a real detection feed. The thirty thousand decisions in the latency measurement come from that surface. It has not run against a live feed, and we do not describe it as if it had.

What we are building.

Wayfinder Systems Group builds the substrate that governs the run while it is still being made and signs the record of what it did. The latency measurement says the governor is cheap enough to live in the path. The parity measurement says the record it signs can be verified by someone who trusts neither the vendor nor the build. The first makes in-flight governance practical. The second makes its output evidence. Patents held in The Wayfinder Trust. We call her Velma.