ARVIS: A Runtime Assurance Kernel for LLM-Based Systems with Deterministic Replay and Pre-Registered Empirical Validation

Systems built on large language models increasingly perform actions rather than merely produce text, yet the tooling around them concentrates on filtering what a model says and offers little for governing what the surrounding system does, and even less for proving afterwards why an action was allowed. We present ARVIS, an open-source runtime assurance kernel that a host application consults on every turn. ARVIS contributes three properties that are uncommon in this setting. First, a graded authorization architecture: every proposed act receives a verdict from a monotone lattice (allow, require human confirmation, block), computed by a stack of enforcement layers that may harden but never silently relax a verdict, failing closed wherever its own state is unknown, with all real-world effects brokered through a single mediated boundary. Second, evidence-grade auditability: each turn is exported as a canonical intermediate representation, committed to by a composed hash binding the tool registry, the effective configuration, the active policy tables, and redacted effect journals; any decision replays bit-identically from its exported record against an externally stored anchor. Third, control-theoretic runtime monitoring with measured rather than assumed constants: a composite Lyapunov function over the decision loop, an adaptive layer under an explicit dwell-time discipline, and an anytime-valid upper confidence bound on the risk rate. Validation follows a pre-registered protocol on two published synthetic corpora (1,440 and 1,632 turns): eleven of twelve registered criteria pass on the first corpus and twelve of twelve on the second, with the single failure reported as a failure; an ablation shows measured contraction on every closed-loop turn (probability of per-turn contraction 1.000 against 0.495 without state feedback). We state the limits plainly: corpora are synthetic, the mathematics has not yet had external review, and no claim is made about the content a model produces — only about the dynamics and the governance of the decision loop around it. Preprint describing ARVIS software version 0.1.0b7. Source code, validation artifacts and documentation: https://github.com/Julien-Lefauconnier/arvis — documentation site: https://julien-lefauconnier.github.io/arvis/ — package: https://pypi.org/project/arvis/