Every setting, in plain language

Kill switch

The kill switch is a single flag in the Governor that every surface reads — this panel, Telegram's /stop, and the app's menu all move the same switch. While it is on, the control plane starts no model calls and settles any running job as failed-loudly, with a receipt, rather than letting it trail off.

It deletes nothing and changes nothing else: jobs, receipts, the vault, your caps and your settings all stay exactly as they were. Resume with the button here (or /resume) when you want GUS back.

Governor mode

Enforcing is the normal mode: when the Agent-Shield gate blocks something, it stays blocked, and when an action is risky enough to need your approval, the job parks until you answer.

Permissive (SELinux-style) keeps every check — scanning, classification, spend caps, receipts — but records blocks and parks instead of enforcing them, and keeps a report of what it let through. Two floors never relax in either mode: vault reads stay denied, and the spend caps and the kill switch are unchanged. Approval delegation (below) only has any effect while the Governor is permissive.

Approval delegation

With the Governor in Permissive mode, you can let some parked actions be decided by an agent instead of you: GUS itself, deciding with one metered model call in the control plane, or a named delegate resolving a park on a job it did not submit. Every delegated approval is hash-bound to the exact action, single-use, rate-limited, and receipted with who approved it and the reason they gave.

Some classes are floors and are never delegable, in any mode, under any setting: vault reads, deletes, installs, sends and posts, git push, sudo/kill-class shell, and keychain access. Flipping the Governor back to Enforcing takes the whole delegation back at once.

GUS approves delegates' jobs

Delegates (like the Nova bridge) can hand GUS work but could never get a parked action past you. With this on — and the Governor permissive — a park on a delegate's job is offered to GUS first: the configured model sees the exact action and answers approve or deny, with a reason that lands on the receipt.

The decision call is metered against the same spend caps as any other model call, and anything that goes wrong with it — no provider, an error, a reply that doesn't parse — is a denial, never a shrug. Parks that fall outside the scope setting below are never offered to GUS at all.

GUS approves its own jobs

Normally the agent asking for an action is never the one who approves it — that separation is the point of the approval system. This setting is the deliberate, narrow exception: in Permissive mode only, GUS may also resolve parks on jobs it submitted itself, under the same scope and rate limits as any other agent approval.

It is off by default, every such approval is receipted as GUS approving its own action (nothing is disguised as an operator decision), and the floors still hold: GUS can never approve its own deletes, installs, sends, git pushes, vault reads, sudo-class shell, or keychain access.

Delegates may approve

With this on — and the Governor permissive — a delegate who is handed an approval (in the group chat or the panel) may resolve a park on someone else's job: yours, GUS's, or another delegate's. The resolution is checked again at the moment it lands, so a press alone grants nothing.

The one rule that never bends: a delegate can never approve its own submitted job, even with this on. Self-approval is reserved to GUS itself, and only via the separate setting above.

Delegation scope

Scope decides which parked action classes an agent approver may even be offered. Bounded keeps it to the everyday driving actions: clicking, typing and other Mac input injection; writes to files outside the approved work folders; and shell commands that aren't on the allowlist.

Everything except the floors widens that to any class that can park — with the floors still carved out, always: vault reads, deletes, installs, sends and posts, git push, sudo/kill-class shell, and keychain access are never delegable under either scope.

Max agent approvals per hour

Delegated approvals are counted over a rolling hour, across GUS and every delegate together. Once the count reaches this number, new parks are no longer routed to agent approvers; they wait for you like any Enforcing-mode park.

Set it to 0 to switch agent approvals off without unticking the boxes above. Your own approvals are never counted and never limited.

Provider

The provider is the model service behind GUS's thinking — Gemini, Anthropic, OpenAI, a model on your own machine via Ollama, or the StarTek starter gateway where configured. The offline stub is a test double, not a real model.

Your API key goes straight into the encrypted vault on this machine when you save; it is never shown again, never logged, and never sent anywhere except the provider's own endpoint at call time. One honest catch: on Google's free Gemini tier, Google may use what you send to improve its models — a paid key removes that.

Model

Each provider names its models its own way, and GUS passes the name through unchanged. The Governor meters every call against your spend caps using its per-model price table, so the model choice is also a cost choice: a bigger model spends the same caps faster.

Changing the model takes effect on the next job — no restart, and jobs already running keep the model they started with.

Spend cap — per task

Every model call a job makes is reserved against this ceiling before it runs. A job that would spend past it is cut off and ends as failed-loudly with a receipt showing where the money went — it cannot borrow from tomorrow's budget or argue its way past.

Only you can change caps, here or via the setup step. Agent approvers under the delegation policy can approve actions, never spending: the caps bind them exactly as they bind the agent.

Spend cap — per day

The daily ceiling is the Governor's running total of settled spend for the day, across every job and every conversation — including jobs submitted by delegates and the metered calls GUS makes when it decides a delegated approval.

Reaching it doesn't break anything mid-flight: running jobs settle what they've reserved, and new paid work is refused until the day rolls over. Only you can change it.

Spend cap — per month

The monthly ceiling catches what the smaller caps can't: a modest daily spend, left running, is real money by month's end. The Governor totals settled spend for the month and refuses new paid work once the ceiling is reached.

Like every cap, it is enforced outside the model, applies to delegate-submitted work and approval decisions alike, and can only be changed by you.

Chat

The Chat view is the panel acting as one more channel, like Telegram: what you type is screened for secrets, scanned by the Agent-Shield gate before it can reach the agent, classified, metered against your caps, and settled with a receipt. Nothing about coming from this page relaxes any of that — a message the gate would block on Telegram is blocked here, with the same receipt.

The conversation is kept in durable state on this machine, so a reload loses nothing, and Telegram keeps working in parallel — same jobs, two windows. When a chat job parks for approval, the card appears right in the conversation and resolves through the same hash-bound, single-use approval engine as every other surface.

Watch

The Watch view asks the Mac bridge for a fresh observation — the same observation path GUS itself uses — at most about once a second, and only while you are looking. Nothing is captured in the background, frames are never written to disk or sent anywhere, and pausing the view stops the requests entirely.

The frame needs the Screen Recording permission macOS grants to GUS.app. Without it the frame area says so plainly and the view still shows the timeline: every action, park, approval and gate decision from the durable event and gate logs, each line traceable to its receipt where one exists.

Voice — Call GUS

The Call button opens a live call: the microphone is on only while the call is open, your speech streams to the voice channel in the control plane, and a pause ends your turn. Speech is built in by default (v0.9.6): the app transcribes on this Mac and speaks with its own voices, so a call needs no speech server at all. In Settings → Voice you can instead point either half at an OpenAI-compatible endpoint you run (faster-whisper / Kokoro); at call start the endpoint is probed, and if it doesn't answer, the call uses built-in voice for that call and says so on the call strip — your setting is never rewritten. The call opens with a spoken greeting in that same voice (v0.9.7), so you hear GUS before you say a word; and if Dictation, Siri, or the speech-recognition permission is off, the app tells you before the call starts, with buttons that open the exact Settings panes — macOS owns those switches, so the app takes you to them rather than pretending it flipped them. However the words arrive, from that moment the transcript is an ordinary channel message and everything that applies to typed text applies to it, including a Shield block with its receipt. The reply is spoken sentence by sentence, so it starts talking before the whole reply exists — and if you talk over it, the speech cuts off and listens (that's barge-in; it stops the talking, never a running job). If endpoint speech fails mid-reply, the reply still reaches you as text, with the failure stated plainly. A call ends when you hang up, after three minutes of silence, or at sixty minutes — and every turn's stage timings (heard, thought, spoke) are kept in the call record, so 'is local fast enough?' is a measurement, not an opinion. Two v0.9.8 additions: a Mute button sits next to End Call while a call is open — muting stops the microphone feed instantly (nothing is transcribed, posted, or allowed to interrupt a reply; any half-finished sentence is discarded), the strip reads Muted, and unmuting resumes listening where it left off. And spoken replies take a faster lane: a voice chat job is steered to answer within a couple of model calls with a shorter, spoken-length reply budget, its stage timings (scan, model calls, queue) are recorded per turn, and if an answer is still being thought through after a couple of seconds GUS says 'Just a second.' rather than leaving silence — a request that genuinely needs tools leaves the fast lane and takes the time it takes.

Approvals by voice are deliberately narrow. When a job parks, you hear the exact summary from the approval record read back. Only an exact "confirm" or "yes, do it" runs it, only an exact "no" denies it, and anything else — including a plain "yes" — runs nothing and leaves the park waiting. "Stop" or "GUS stop" trips the same kill switch as typing /stop and ends the call. Voice never approves silently, and a spoken prompt injection is scanned and blocked like any other.

v0.9.9 makes voice testable before a call, and tidies the call itself. There is ONE Call button now — in the chat composer; the duplicate that used to sit in the window's top bar is gone (Invite remains there, still a placeholder). The Mute button is big and labeled, in the call strip while a call is open, and turns red while you are muted. In Settings → Voice, each endpoint (transcription and speech) has a Test Connection button: it probes the values in the form right now — nothing has to be saved first — and reports whether the endpoint answered, how long it took, and whether your model is in the endpoint's model list, so the old save → call → fail → re-edit loop is gone. Test mic and speaker runs a short check in the same pane: watch your microphone level while you talk, hear a test sentence through the speech engine you have selected, and — when transcription is built-in — say a short phrase and see what the recognizer heard, with a speed verdict for this Mac: 'real time on this Mac', 'borderline', or 'too slow on this Mac', the last with a nudge to try an endpoint instead. Recognition speed is measured from the end of your phrase to the finished transcript, against how long the phrase itself took — an older Mac gets steered to an endpoint in Settings, before a call, instead of finding out mid-call.

The Shield scan for voice has its own switch in Settings → Voice, ON by default. On: spoken requests get Agent-Shield's fast scan before they become jobs — deterministic patterns only, a second or two (since v0.9.10; the full semantic review was the biggest single chunk of the 0.9.8 call's measured wait, so it now guards typed messages, which aren't mid-conversation). The verdict, the signed receipt, and every block are the scan's own either way, and each turn's record says which scan it got. Off: spoken turns become jobs WITHOUT the injection scan — faster, and meant for testing and troubleshooting. Be clear-eyed about off: nothing checks your spoken words for prompt injection before they reach the agent. Typed messages on every other channel are still scanned either way, the secret-guard still screens voice, and the Governor's caps, approvals, and vault rules for actions are untouched. Every skipped turn is recorded as scan-skipped-by-operator in the call record (voice-turns.jsonl), so the record never pretends a scan happened.