Autonomous agents fail in markets less from defective forecasts than from treating every estimate as a warrant to act.

Markets are non-stationary: regimes, volatility, and correlations shift, so a relation calibrated on one window ceases to hold on the next.
Academic standards require strategies to be pre-registered, validated exclusively out-of-sample through walk-forward analysis, and corrected for multiple testing; almost none of the apparent edges survive these tests.

A specialized inference market prices not the forecast itself, but an authorization conditioned on attested coverage for a precisely defined class of situations. When that coverage has not been measured, or has been invalidated by drift, the system withholds action. The scarce resource is no longer raw predictive power. It is the ability to act inside bounds that remain inspectable after the fact. This is the architecture we are building, and we are stress-testing it across thousands of configurations.

1/10
Bloomberg launched Enterprise MCP: an AI access layer for Data License Plus via the Model Context Protocol.

It allows agents to discover and retrieve licensed data across 100M+ securities and 50k fields.

The real story isn't coverage, though. It's the diagnosis. 🧵👇

2/10
Tony McManus (Bloomberg) puts it simply: reasoning models fail on basic position queries because incoming data lacks context.

A standalone price doesn't disclose its currency or type.
Data connectivity was never the hard part. Data readiness is.

3/10
Most tools retrieve a data point; few explain what it means, how it was calculated, or if it fits the task.

A raw number is meaningless. Metadata exchange, currency, price type, period, as-of date is what makes it interpretable.

4/10
This is the gap Shōgen (github.com/KraidleAI/shog…) closes for any information an agent receives, beyond single-vendor data licenses.

Shōgen is attested-fact infrastructure for AI agents. Its core premise: an attestation proves what a source said, not that it's true.

5/10
A canonical testimony carries the subject, raw utterance bytes, timestamp, transport ID/proof, residual assumptions, and attestor identity.

There is no field for truth, confidence, or validation. Those judgments do not belong at this layer.

6/10
Raw utterances and typed facts are kept separate. An identified "typer" turns raw bytes into a dated fact (price, balance, state, filing, news).

Each transport mechanism retains its named residual (TLSNotary, TEE, signatures) without averaging them into a single security score.

7/10
Quorums do not assume independence. Shōgen’s diversity certificate measures observable factors (co-failure history, shared infrastructure) and collapses indistinguishable sources to report effective quorum size over nominal count.

8/10
The resulting batch is offline-verifiable by any third party against pinned keys, utterance hashes, residual registries, and freshness windows.

The verdict: valid under named residuals, never "true". Shōgen produces the artifact; it does not authorize the decision.

9/10
This applies universally—price feeds, filings, on-chain state, news, or API responses.

Without an attested "what the source said" and explicit residual trust, models fill missing context with assumptions. That is the exact failure mode Bloomberg identified.

10/10
Model capability is no longer the bottleneck; data readiness is.

Shōgen supplies an open, offline-verifiable layer ensuring every fact carries its utterance, typing, residual assumptions, and measured diversity, the perception counterpart to bounded authority.

Sooner than expected
x.com/shawmakesmagic…

One last note for today.

Crypto is about to grow up. For years the market stalled, and the flow went to memecoins, which used to be the social capital of each ecosystem. That phase is ending, faster than most people think.

Robert Shiller put it plainly in Narrative Economics (American Economic Review, 2017): narratives "go viral", spread far and carry real economic weight, and we follow them, factual or not, to justify what we spend and invest. Our read: if stories spread like epidemics, they also run out of new believers. Then the flow looks for the next one.

This time it will look for substance: teams that kept building through the cycles, with a resilience learned from every past failure.

The sharpest will spot the shift, and the deeper trend taking shape over the coming months, before it shows on the charts. One small story can tip a whole narrative. That is the butterfly effect, and it is already in motion. 🦋

1/ 🔐 Another week, another wave of security flaws. Web2 is learning it in real time: when attackers have AI, defense needs AI too. DeFi is next, and DeFi is where the money sits. That is where the bill will be counted in billions. 🧵

2/ The more we build, the clearer it gets. DeFi rarely breaks where people look. It breaks at the edges: the first price after a closed market, a ratio nobody questions, a token that only looks official. Here is what we found. 👇

3/ A Korean stock reopened in pre-market, and a single share traded about 30% below the previous close. The mark price of the perpetual tracking it fell 18.7%. $57.4M of positions were liquidated, with $17.3M in realized losses. One bad print did that.

4/ A lender accepted a wrapped stock token as collateral. Someone manipulated the wrapper's exchange rate, and the collateral was valued at about 78 times its worth: around $403,000 of bad debt. The price feed was right the whole time. The ratio was the hole.

5/ On a Sunday, with Nasdaq closed, one short sale of about $10M moved an index perpetual about 4% in an hour and liquidated around $13M of longs. Elsewhere, a fake copy of a stablecoin, held by just two wallets, was paired in 192 pools.

6/ ⚡ None of this takes a genius. It takes patience, and AI agents have plenty: they can probe contracts, pools and price feeds around the clock. Smart contracts have to get smarter. They need to question an input before they act on it.

7/ That is where we build: before the decision. For a trader, an agent, a protocol or an insurer, the rule is the same. Weigh every input against a calibrated reference from the same kind of situation. Inside it, act. Outside it, or with no reference at all, stand back.

8/ 🛡️ What we are building:
• a guard on the first price after a closed market: hold or follow
• a signed, replayable record of off-hours jumps, so this risk is priced on evidence

9/ • checks that a stock token still matches its share, and that its contract is the official one
• attested perception: prices that come with a testimony of where they came from

10/ All of it sits in front of the protocol, not inside it. Upgrading a decentralized protocol takes discussions, proposals and votes, and that slowness is part of what decentralization is. A check in front of the decision serves those who decide without waiting for a vote.

1/ 🔔 Bell, in one line: the independent witness of what happens to stocks while their exchange is closed. Tokenized stocks and their perpetuals keep trading through nights, weekends and holidays. Here is what Bell will offer, and why we are building it. 🧵

2/ The risk sits at the reopen: off-hours prices snap to the exchange's first print. If that print is wrong or the gap is wide, positions get liquidated before anyone can react. One faulty pre-market print in Korea liquidated tens of millions of dollars in minutes.

3/ The second risk is quieter: a token drifting from its share. A wrapper counting the wrong ratio, a dividend booked weeks apart by two issuers, a price feed frozen while the token stays transferable, look-alike contracts, issuer lists lagging their own registries.

4/ 📊 So Bell starts by measuring: a signed, replayable record of off-hours gaps and reopening jumps, per asset and per kind of reopening (weekend, overnight, holiday, new listing, corporate action). Beside it, the tails: how often each kind of reopening broke away, per token.

5/ ⏱️ Then Bell looks ahead of the open. Calibrated ranges for the reopening, built from past reopenings of the same kind. And a first print guard: when the exchange prints its first price, Bell weighs it against what traded off hours and says "hold" or "follow".

6/ 🧾 Bell also tells you what you actually hold: a signed list of official token contracts, read from the issuers' own registries; a signed feed of splits, dividends and pauses as they happen; and checks that each token still matches its share after every corporate action.

7/ 🌐 And for everyone, a public board for Mondays and new listings: what the off-hours market expected, and what the reopening corrected. A simple way to see the jumps with your own eyes.

8/ ⚡ What our conformal approach adds: each kind of reopening is its own class, calibrated on its own. A weekend is not a new listing, an overnight session is not a holiday. Every range comes with its record: missed k times out of n. Never a probability of being right.

9/ When a market has no calibration of its own, Bell says so instead of borrowing one. A live check raises a flag when a range stops holding. Ranges you can audit, and a guard that knows when it does not know.

10/ Who it is for: those who price this risk, the venues that list these markets, the lenders and platforms that hold or accept tokens, and anyone who trades while the exchange sleeps. Bell measures. It never advises.

11/ Signed, replayable, independent. That is Bell. More soon. 🔔

1/ 🗓️ Our next big release lands at the end of next month. Why not sooner? Many workstreams are open at once, with several teams building in parallel, and every piece has to pass its checks before it ships. Here is what is coming, and why we built it this way. 🧵

2/ It starts with one design choice: task classes. Before our gate judges a prediction, it asks what kind of task it is. Two tasks that look alike can follow different laws: another horizon, other people exposed, another risk. So each one gets its own class.

3/ The popular alternative is one adaptive engine for every market, horizon and asset. It sounds powerful. But when cases that follow different laws share one calibration, the band holds on average over the blend, not for the market you are actually trading.

4/ At best, adapting on the fly keeps the average error rate on target over a long run of calls. That is not a promise about the decision in front of you. And if you only act when the band looks tight, the cases you kept are not the cases it was calibrated on.

5/ Task classes fix this. One class, one law. Each calibration belongs to one task class and one model, never pooled. A class with no calibration of its own does not borrow one: the gate abstains and says why. No blended confidence score. Never a probability of being right.

6/ ⚡ Why this matters for inference: when an AI agent acts on a model output, the question is no longer only "can the model predict?" but "should anyone act on this output, for this task, right now?" That is the layer we are building: coverage-controlled inference.

7/ 🔔 Bell is among the first products born from this work. Tokenized stocks and their perpetuals keep trading while the home market is closed: nights, weekends, holidays. The pain shows up at the reopening, on the first print. Bell will measure that jump, independently.

8/ What Bell will offer:
📊 Signed, replayable jump data per asset and per kind of reopening: weekend, overnight, new listing, corporate action
🛡️ A first print guard: weigh the opening print against what traded off hours, then say "hold" or "follow"

9/ ✅ Token compliance: does each token still match its share through splits, dividends and other corporate actions?
🆓 A free public board for Monday reopenings and new listings, so anyone can see the jumps for themselves

10/ How we work: no outside fact enters a design until it has been read at the source, captured, copied first hand and cross checked. Teams build at the same time, and every piece gets an independent review before it ships. It takes longer. We think it is worth it.

11/ Proud of this team and of the craft behind every piece: a gate that knows when it does not know, and Bell, designed on checked facts instead of adjectives.

Your Iron Man armor is under construction.

The Dojo snapshot is live with tiered advantages for holders. Some of you have already locked in tiers.

Keep farming your score. Excess converts into perpetual inference.

Holders get advantages across all our products. Use them or sell them to third parties who will need them to access the tools.

The little butterfly is about to emerge from its chrysalis🦋

monarkgate.tech/dojo

Democratizing Institutional Armor: Preference Construction, Risk-Seeking Agents, and Latent Demand for Cognitive Protection in High-Velocity Markets

In a prior communication, we advanced the proposition that institutional-grade analytical, risk-management, and decision-support tools should be placed directly in the hands of trenchers, the retail participants operating in the highest-velocity, most information-dense segments of digital asset markets, particularly the on-chain meme-coin environment colloquially termed the trenches. These agents are ordinary individuals who routinely experience adverse selection and systematic losses relative to better-equipped counterparties.

The proposal is, on its face, counterintuitive. Trenchers self-select for elevated risk tolerance; their revealed behavior is consistent with a preference for high-variance payoffs and rapid feedback loops rather than capital preservation. Consequently, the set of observers who anticipate widespread voluntary adoption of protective infrastructure remains small.

This skepticism is intelligible. No precedent exists in which sophisticated institutional capabilities such as order-flow analysis, systematic risk overlays, bias-mitigating interfaces, or real-time information filters have been packaged and offered to precisely this cohort as a form of protective technology. The absence of prior examples is not merely empirical; it is conceptual. Participants have not previously been presented with an analogue of what may be termed Iron Man armor: an integrated suite of externalized cognitive and informational defenses that simultaneously confronts information overload, exploits the architecture of human judgment under uncertainty, and interposes itself between the agent and self-destructive psychological tendencies.

Behavioral decision research supplies a theoretical basis for why such latent demand can remain invisible until the object is shown. A central finding of the preference-construction literature, most systematically developed by Lichtenstein and Slovic (2006) and earlier articulated by Slovic (1995), is that individuals frequently lack fully formed, stable preferences for options that lie outside familiar experience. Preferences are not invariably retrieved; they are often constructed at the moment of elicitation, drawing on available cues, framing, and the specific attributes made salient by the choice architecture. As Slovic and colleagues have observed, they ain’t nothing till I call them.

In domains characterized by novelty, precisely the situation facing trenchers confronting institutional-grade protective tools, stated preferences elicited in the abstract are unreliable predictors of subsequent choice once concrete exemplars are encountered.

This mechanism is consistent with the well-known observation, popularized in product development contexts, that people frequently cannot articulate a desire for a capability until it is demonstrated. Once the protective suite is experienced, once the agent observes in real time the attenuation of information overload, the externalization of loss-aversion or recency biases, and the measurable reduction in self-inflicted drawdowns, the previously inarticulate preference crystallizes. The agent then reports, with high confidence, that the capability is what was wanted.

Choice-blindness paradigms further illustrate the limited introspective access individuals possess regarding their own evaluative processes, reinforcing the expectation that pre-exposure surveys or focus-group inquiries will systematically understate willingness to adopt novel protective technologies.

The strategic implication is therefore not that trenchers must first renounce their risk-seeking orientation, but that the protective technology must be designed and presented so that its value becomes immediately legible upon encounter. When the armor is offered, filtering the effusion of noise, externalizing the psychological vulnerabilities that institutions have long internalized, and converting raw risk appetite into more durable participation, the construction of preference can occur in situ.

Adoption then ceases to be a matter of prior belief and becomes a matter of revealed preference formed through direct confrontation with the object itself.

An agent that acts on the world without attested perception does not act on facts

It acts on **rumors equipped with an API**.

When the rumor is unique, freshly fabricated, or shared by sources that believe themselves independent while sharing the same ASN, the same notary, the same upstream, or the same construction bias, **irreversibility begins**.

Shōgen, once fully operational, would have made these chains impossible. Not by claiming to know the truth, but by making the act of the source speaking **verifiable, dated, typed, and diversified in a measurable way**.

DeFi oracle manipulations

When **NGP Token** lost roughly two million dollars in September 2025 because its `getPrice()` read only the reserves of a DEX pair, a flash loan was enough to twist the price.

**GMX V1** lost 42 million in July 2025 by combining reentrancy with a massive distortion of the BTC global average short price.

Typus Finance, Moonwell, Resupply, and many others followed variants of the same pattern:

- Single or insufficiently diversified source
- No cryptographic binding to the exact bytes served by the source
- No measurement of infrastructure correlation
- No freshness window bound to the transport clock

A fully operational Shōgen would have required, for any critical class, a quorum whose **`k_eff`** is calculated on observed R2 axes (ASN, CDN, upstream dependencies, attestors). Two feeds sharing the same upstream would have counted as one.

The batch would have carried the transport proofs, the named residuals, and the diversity certificate. A third party could have verified offline that the presented bytes were indeed those the sources had served, **without trusting Shōgen or its operator**.

The agent or contract would not have received a floating-point “the price”. It would have received a set of bound testimonies and a confinement verdict. The irreversible action would have been refused or bounded.

LLM trading agents

Recent work (notably studies on information-injection attacks) shows that agents capable of trading real capital easily confuse fabricated headlines with real news. A 30-word template reaches **100% success** across fifteen stocks.

The same agents, trained and scaffolded similarly, take correlated decisions: one bad reading becomes a collective move. They process:

- Scraped data
- Unsigned feeds
- API responses unbound to bytes
- Replayed or out-of-window information

They invent intermediate figures and have no way, after the fact, to show what the source actually said.

Shōgen would have imposed that every critical fact entering the gather be a testimony whose utterance is bound to the exact bytes, whose instant is that of the transport, whose typer is identified and versioned, and whose quorum carries a measured diversity certificate.

The residual `A(freshness-above)` and the freshness window would have made replay visible. The absence of a confidence field would have prevented the agent from treating a deposition as truth. Offline audit would have allowed exact reconstruction of what was seen, by whom, when, and under which residual hypotheses.

Cascading liquidations on fake news or stale data would have been confined before execution.

The deeper problem of source independence

Knight & Leveson demonstrated as early as 1986 that source independence is not a free property. Twenty-seven independently developed versions of the same program failed together far more often than the independence model predicted (**z ≈ 100**).

Today’s data sources, price feeds, APIs, scrapers, oracles, exhibit even stronger common modes:

- Same cloud provider
- Same CDN
- Same certificate chain
- Same aggregation method
- Same training bias of the models that interpret them

A fully operational Shōgen would have measured these co-failures and these observable overlaps, published the ranks, and reduced `k_eff` accordingly. It would not have left an agent or protocol resting on ten sources that in reality formed only three or four.

The named and undischarged debt of source independence in bounded-authority architectures would have been effectively discharged.

Conclusion

In all these cases, Shōgen would not have “prevented the lie.”

It would have prevented irreversible action founded on an **unbound, undated, unmeasurably diversified, and third-party-unverifiable rumor**.

Perception would have remained a deposition.
Judgment and authority would have remained elsewhere, bounded and auditable.

It is precisely this separation, made operational, that would have turned incidents into non-events.

github.com/KraidleAI/shog…

The Week the Trust Anchors Failed: Attested Perception and Coverage-Controlled Decisions for the Era of Priced Exploits

On 22 October 2026, @fiveoutofnine compressed one ordinary Wednesday into a single post:
x.com/fiveoutofnine/…

Two pre-authentication remote code execution flaws in PHP, whose details leaked before the patch. A maximum-severity GitLab flaw present since 2014. A hijacked release of LiteLLM that delivered a credential stealer to anyone who merely installed it. A hosting platform pausing every deployment after an intrusion into its environment variables. A cloud database provider describing an intruder inside with stolen credentials for about a month. And a certificate authority whose private keys, meant to be numbers more than a hundred digits long, included one that, in the author's words, "was 4. Just 4."

Read as a list, it is a bad day. Read as a system, it is a thesis. I want to state that thesis precisely, because the industry we build for is the one place where every item on that list has an exact price, and where the attacker is paid before the defender has finished reading the alert.

1. Common mode is the rule, not the exception

In 1986, Knight and Leveson tested the assumption on which fault-tolerant software then rested: that independently written versions of a program fail independently. Students at two universities wrote twenty-seven versions from one specification; one million tests were run; 1,255 tests made more than one version fail. Under the independence model, the test statistic was z = 100.51 against a 99% threshold of 2.33, and the authors concluded: "we reject this assumption." One detail matters more than the statistic. The diversity they had organized, two schools, protected nothing: in their preliminary analysis, every common fault involved versions from both schools. They were careful to say the result was conditional on their application. Forty years later, the week in that post is a field replication at internet scale.

One interpreter flaw reaches WordPress, MediaWiki, Magento, Joomla and Laravel at once: five brands, one failure. One platform's secret store is the common mode of every tenant who trusted it. One certificate authority's key generation is the common mode of every certificate it signed. Diversity of names is not diversity of failure. Independence is not a property one may assume; it is a quantity one must measure, and declared diversity (two vendors, two schools, two feeds) can protect nothing.

2. Why on-chain finance prices every vulnerability, and pays the attacker within a block

Three properties make decentralized finance the place where these failures stop being outages and become transfers of value.

Settlement is the exploit. On-chain value moves through the same code paths a vulnerability perverts. There is no batch window, no chargeback, no settlement delay in which a human can intervene. Qin, Zhou, Livshits and Gervais (2021) showed what transaction atomicity enables: flash loans, credit "only valid within one transaction," which removes capital as a barrier to attack. The two attacks they analyzed returned more than 500,000 percent, and they showed that an attacker can find the optimal parameters as an optimization over the state of the chain. In this setting, the attacker needs no money. The attacker needs one mispriced input.

Ordering is a market. Daian and coauthors (2020) documented bots competing to front-run and reorder transactions, and the value extractable from ordering itself. The race is run in the time it takes to produce a block.

The oracle is the weakest seam. Across 181 incidents and at least 3.24 billion USD of losses between April 2018 and April 2022, Zhou and coauthors (2023) found price oracle attacks to be the most frequent incident type (15%). They also found that 56% of attacks were not executed atomically, which left defenders a window to react. The remainder left none. Against an atomic attack, there is no incident response. The only defense is the one that acts before the transaction, at the moment a decision is taken.

3. Why the incidents will multiply

This is not a bad season. It is a change of regime, driven by three forces that compound.

Exploitation is being automated. Fang, Bindu, Gupta and Kang (2024) gave an LLM agent fifteen real one-day vulnerabilities: with the advisory, it exploited 87% of them; without it, 7%. Read next to the PHP episode, the implication is direct: once the details of a flaw leak before its patch, the advisory is the exploit, and the interval between disclosure and mass exploitation collapses toward zero. The same group reports teams of agents exploiting zero-day vulnerabilities (Fang et al., 2024b).

Decisions are being delegated to agents. Software agents now read prices, hold keys and act in milliseconds. The LiteLLM compromise matters precisely because it sits in the layer through which agents call their models: a credential stealer that runs at install time becomes a wallet drainer the moment its host holds signing keys. The human hesitation that used to act as a circuit breaker is gone from the loop.

Composability concentrates risk. The same aggregator behind many price feeds, the same library behind many agents, the same cloud behind many keepers and relayers. A network of dependencies is a network of common modes, and the market composes them faster than anyone audits them.

The conclusion is not that we need better post-mortems. It is that we are entering an era in which every infrastructure failure is a priced financial event, settled in a fraction of a second, and in which the only systems that survive are the ones that refuse to act on what they cannot attest and cannot bound. Those systems do not exist by default. They have to be built, and they have to be adopted before the next Wednesday.

4. The oracle is the certificate authority of finance: Shōgen

The eMudhra episode is the cleanest metaphor of the week. A certificate is only as trustworthy as the process that produced its key. A key equal to 4 yields certificates that look exactly like honest ones and prove nothing. A price feed is a certificate about the world: lending markets liquidate on it, stablecoins mint and redeem on it, agents trade on it. Eskandari, Salehi, Gu and Clark (2021) put it plainly: smart contracts execute in a closed environment, oracles are the bridge to everything outside it, and as oracles grow in importance, attacks grow with them and their trust model demands attention. Most oracle attacks exploit one of two weaknesses: a source thin enough to be moved, or a set of sources that look independent and are not.

Shōgen is MONARK's answer at the level of perception. Its vision rests on three principles.

First: an attestation proves what a source said, never that the source is right. This is the line drawn by the work Shōgen builds on: DECO (Zhang, Maram, Malvai, Goldfeder and Juels, 2020) proves that data reached over TLS came from a particular website, which is provenance, not truth. Shōgen turns that distinction into a specification. A testimony records what was observed, by which mechanism, and the residual assumptions that mechanism still rests on, named one by one. It has no field for truth, quality or confidence, because those judgments do not exist at that level. The protection is twofold. An input that was substituted, replayed or altered stops being an input. And no system downstream can mistake a claim of origin for a claim of truth, which is exactly the confusion a manipulated feed exploits.

Second: never postulate independence; measure it. Quorum oracles rest on the independence of their sources: the aggregated value stays within the range of the honest reports only if no more than a bounded number of sources are faulty. That bound is named, rarely measured. Shōgen's diversity certificate replaces the postulate with a measurement, in three ranks that are never merged: co-failure measured over history (the Knight and Leveson test, transposed from program versions to data sources); infrastructure overlap observable at the moment of the quorum (shared hosting, a shared upstream aggregator, a shared attestor, a shared method); and mere declaration (operator, jurisdiction), published for traceability and never counted as protection. Sources that cannot be told apart on a strong axis count as one. A quorum of five feeds that all read the same exchange is a quorum of one, and the certificate says so. This is the protection the market currently lacks: against the classic manipulation, which moves one thin source, and against its stealth form, many sources and one upstream.

Third: verifiable by anyone, without trusting Shōgen. The residual assumptions are published mechanism by mechanism, never averaged into a single "security level." An integrator can check, offline, what it is relying on, and decide in advance what it will refuse to rely on.

This is the exact counterpart of the eMudhra failure: not a louder claim of authenticity, but a record of how the claim was produced and of what it still assumes.

5. The Conformal Gate: act only inside a calibrated guarantee

Perception is not decision. At the core of MONARK sits the Conformal Gate (Hikae). It turns each reading into a region at a target coverage by split-conformal calibration, in the line of Vovk, Gammerman and Shafer (2005) and of the modern synthesis by Angelopoulos and Bates (2023), and then applies a closed policy that answers commit, defer or abstain, in the tradition of Chow's reject option (1970). It never reports a probability of being right: its coverage is marginal, over exchangeable calibration data, and it says so.

Why this is protection rather than statistics: an exploit is, in statistical terms, an input from a regime the calibration never saw. A manipulated price, a liquidation cascade, a run: each is a distribution shift by construction. The theory knows precisely what happens then. Exchangeability, on which conformal guarantees rest, breaks under drift; Barber, Candès, Ramdas and Tibshirani (2023) show how weighted procedures lose far less coverage when it does, and Gibbs and Candès (2021) show that adaptive conformal inference keeps the desired long-run coverage frequency whatever the data-generating process. A gate that knows when its guarantee no longer holds, and abstains, cannot be made to liquidate, mint or redeem at a manipulated price within the same block. In this era, abstention is not a failure mode. It is the circuit breaker that the human used to be.

6. Ukemi and Narabi: sensing the two dynamics through which a bad price becomes a loss

A false input is only half of an attack. The loss happens through a dynamic that amplifies it, and MONARK senses the two that matter most.

Ukemi: liquidation. A manipulated price becomes a loss through forced sales, and obligations clear through a network, as Eisenberg and Noe (2001) formalized. Ukemi reads a lending book at a declared block together with the oracle path the protocol actually consulted, and measures the difference between what was eligible for liquidation and what was liquidated. Through the gate, it hands back an upper bound on the liquidable amount for a stratum it has been calibrated on, and abstains everywhere else. The protection: before acting on an oracle path, a lender or an agent knows the bounded liquidation that path can trigger, rather than discovering it in the next block.

Narabi: redemption runs. A depeg becomes a loss through a run. Runs are coordination phenomena, as Diamond and Dybvig (1983) and Goldstein and Pauzner (2005) showed, and on-chain they are fast. Narabi reads the burns, mints and supply of a stablecoin population over finalized windows, each read agreed by two independent providers, steps an adaptive quantile tracker on realized outcomes, and publishes a tamper-evident daily record. The protection: the velocity of a run as an attested, timestamped measurement rather than a rumor, available to any system that has to decide whether to keep holding.

7. One architecture, one discipline

The architecture follows the anatomy of the attacks. Attest what you perceive (Shōgen). Bound what you decide (the Conformal Gate). Sense the dynamics that turn a bad input into a loss (Ukemi, Narabi). Defense moves from after the incident to the moment of decision, which is the only moment that exists when the attacker settles within a single transaction.

And one discipline runs through every piece: say what is claimed and what is not. A testimony never claims truth. The gate never claims a probability of being right. A sensor never claims a coverage it was not calibrated for. Parts of this stack are served today and parts are still under test, and we say which is which, piece by piece, because a protection that overstates itself is the next vulnerability. The certificate whose key was 4 was, above all, a certificate that claimed more than its process could support.

The post ends with a shrug: it is Wednesday. In on-chain finance there are no Wednesdays, only blocks. The incidents will multiply, because exploitation is being automated, decisions are being delegated to agents, and dependencies are being shared at a speed no audit can follow. The systems that last will be the ones that never act on an unattested input and never act outside a calibrated guarantee. That is the era we are entering, and that is what we are building for.

We taught our agents to fall before we taught them to strike.

Perpetual futures are where the risk-seeking traders already are, and where autonomous agents will bring the most of them. They are also the one market that punishes overconfidence without appeal. On 10 October 2025, auto-deleveraging closed $2.1 billion of winning positions in twelve minutes, and the formal analysis that followed proved what every trader felt: no venue can be solvent, profitable and fair at once. The exchange will not protect you. Protection has to travel with the agent.

The same month, six frontier models traded live on Hyperliquid under identical conditions. Four lost money. The winner was the one that traded least. The literature since has been unambiguous: language models are systematically overconfident on genuinely unknown outcomes, reasoning harder makes the calibration worse, and a committee of models is more confident than any of its members, not more correct. Reported alpha from such agents, in the words of one recent position paper, should not be treated as deployment evidence.

Our position follows from this. Intelligence is one faculty of a brain, not the brain. A brain has senses before it reasons, and a sense of balance that tells it when it is falling. So we built the senses first: Shōgen attests what the agent sees, Narabi measures what it hears, Ukemi tells it when the ground is giving way. Then the judgment: Hikae, a conformal gate that turns every claim into a region with a published coverage law and answers with one of three words, commit, defer or abstain. Then the right to act, metered in a budget that every commit consumes. Then a witness, Bell, that records what was seen and what was not.

None of this predicts the price, and none of it promises a return. It does something rarer. A pre-registered study of conformal position sizing met its coverage target on average and failed it in the bear year, where the entire loss occurred. The average is not the product. Coverage in bull, bear, range and reversal, over years, is the standard we hold ourselves to. Agents have no emotions, but they have doubt. Quantified, doubt becomes a faculty beyond intelligence: knowing when to say “I don’t know”. Trading is a marathon. We are building the agent that finishes it.

1/6
A few posts have been circling the same practical failure in AI trading agents.

@0xPeggy_ wrote: the most underrated aspect of an AI trading agent is knowing when to stop. An agent that enters faster and never tires will also make bad decisions faster if it has no way to refuse.
x.com/0xPeggy_/statu…

@GpaAndy put it as a red flag: a system that always wants you active. Real edge includes knowing when there is no trade worth taking.
x.com/GpaAndy/status…

@AdaptHF asked it directly: does your agent know when NOT to trade? Autonomy without that check is just faster chaos.
x.com/AdaptHF/status…

2/6
What these posts are describing is not a missing risk engine feature or another stop loss rule. It is the absence of a decision primitive that can return silence.

Most agents are wired to produce an action from a signal or a probability. When the signal weakens, the regime shifts, or the recent data no longer supports the claim, they still produce an action. There is no formal path that says this claim is not covered by the calibration, so do nothing.

3/6
Conformal prediction supplies that path.

It takes any model output and, using a hold-out calibration set, constructs a set of outcomes that are still consistent with the observed residuals at a target coverage level. The guarantee is finite-sample and distribution-free:

P(Y ∈ C(X)) ≥ 1 − α

If the new observation falls outside that set, or if the calibration set is too small or no longer exchangeable with the current regime, the procedure can return an empty set. An empty set is not a weak signal. It is an instruction to abstain.

4/6
MONARK’s Hikae gate implements exactly this.

A claim arrives. The gate conformalizes it against the committed calibration for that class or stratum. It then returns one of three responses against a depletable authorization budget (B_t):

commit — the region is non-empty and tight enough, and budget remains
defer — the region is still ambiguous
abstain — the region is empty, the stratum is under-calibrated, or the budget is exhausted

It never emits a probability. When the data do not support a region, the wire returns abstain with the reason (under_calib, empty set, budget_exhausted).

5/6
This is how the behaviors in those tweets become enforceable rather than advisory.

Knowing when to stop is the empty-set or under-calib path. The agent does not need a separate cooldown rule; the coverage check already refuses the action.

Knowing when there is no trade worth taking is the same refusal. If the kata value or the predictor’s claim does not land inside the calibrated region for that cell, the gate does not authorize the order.

The budget layer adds a second, independent limit: even a valid region can be declined once B_t is spent.

6/6
The construction is deliberately narrow. It does not improve the underlying forecast. It only decides whether the current claim is allowed to move money, given the calibration that has already been published and the budget that remains.

That is the piece the posts above are asking for: a mechanism that can say no, with a reason that can be checked against the data, instead of a system that keeps producing actions until a hard risk limit is hit.

Explore our repositories: github.com/orgs/KraidleAI…

1/7 🧵
Most trading agents still decide with point forecasts or pure reinforcement learning. Both approaches share the same quiet flaw: they rarely tell you how much you should trust the decision you’re about to make. 🤔

That’s where conformal inference becomes interesting. Instead of giving you a single number, it wraps any model with prediction intervals that come with a finite-sample coverage guarantee:

$$P(Y \in C(X)) \ge 1 - \alpha$$

No normality assumption. No claim that the model is correctly specified. Just a calibrated region around the prediction. 🎯

---

2/7 📉
A useful way to see the practical difference is a 2026 paper on optimal trade execution (Irshad & Biswas). The authors put classical schedules, a PPO agent, and conformal-driven policies inside the same VWAP execution problem, both in a controlled simulator and on real 5-minute data from 30 U.S. large-caps. 📊

The question was simple: when you have a forecast of the next interval’s return, should you always act on it, or should you sometimes refuse to act? 🛑

---

3/7 ⚖️
The conformal predictor itself was well calibrated. At a 90% nominal level, it achieved 90.2% empirical coverage in the simulator and 90.7% on the real data. That part worked! ✅

What was more interesting was what happened when they used the width of the interval as a decision gate. Acting on every point forecast reduced average slippage relative to VWAP tracking, but it also increased the variance of execution costs. ⚠️

---

4/7 📊
When they only allowed the agent to deviate from the schedule when the conformal interval was sufficiently narrow, the picture changed 💡:

• Cost variance fell from 19.1 bps to 10.0 bps, almost without hurting the average cost.
• The threshold on interval width became a direct dial on the cost–risk trade-off.

The PPO agent, by contrast, remained high-variance across seeds and did not reliably beat the simple schedules. 📉

---

5/7 💡
This is the educational core of the result:

👉 A point forecast answers: “What do I expect?”
👉 A conformal interval answers: “How wide is the region I should still consider plausible?”

For an agent, that second question is often more useful. It lets the system decide not only which way to lean, but whether the current signal is strong enough to justify leaving the safer default behavior. 🛡️

---

6/7 ⚙️
In practice, this maps to a few concrete levers an agent can use:

🔒 Gate the trade: Only deviate when the forecast escapes the calibrated uncertainty region.
📏 Size the position: Adjust with interval width (wider interval → smaller size).
✋ Abstain: Pause when coverage can no longer be trusted (strong drift, too few recent observations).
📝 Transparency: Keep an explicit trace of why the agent committed, deferred, or abstained.

---

7/7 🚀
As more capital is handed to autonomous agents, the scarce resource is no longer raw predictive power. It is the ability to act inside bounds that can be inspected and controlled. 🔑

Conformal inference does not magically improve the forecast. It gives the agent a statistically honest way to know when the forecast is not reliable enough to act on. 🧠

That distinction is what turns an autonomous system into a manageable one. 🎯

We are excited to announce that next month marks the rollout of live demonstrations showcasing our latest technical milestones.

To commercialize our deployment pipeline, we are shifting from isolating the conformal gate to offering a fully integrated inference solution. Clients can now deploy our embedded solutions directly on a pay-per-inference basis. Launching in collaboration with two initial partners, this offering is backed by our internal benchmarking and empirical validation studies to guarantee optimal model performance and tight uncertainty bounds.

Stay tuned, the future of inference is imminent.

A small update 🧭 on trading strategies, task classes, and why we name the question before we answer it.

A trading strategy is not a prediction. It is an answer to a question, and almost nobody writes the question down. At MONARK the question has a name: the task class. Here is why that detail changes everything, with this month's news.

📉 In October 2025 a single day liquidated more than $19 billion of crypto positions. In October 2026, more than $1.1 billion went in 24 hours, about $1.05 billion of it long, while BTC fell back toward $80,000 (CoinDesk, Oct 6; CrowdFund Insider, Oct). Many of those books were long on the right side of the move, by the close. They still lost. The direction was not the question. A trader long over 4 hours does not die from the closing price; the drawdown on the way kills first. An option seller does not die from the sign; the size of the move does. Three questions, three different statistical objects.

🏷️ So each question is a task class, named <symbol>-<family>-<horizon>, frozen in contract 1.1.0. Four families: dir, the sign of the move; range, its size |ln(close(t+h)/close(t))|; mae-down, the worst fall inside the window; mae-up, the worst rise. Same symbol, same horizon, same volatility kata: btc-range-4h, btc-mae-down-4h and btc-mae-up-4h share one scale estimator, and the spec says it in so many words, "only the task class tells them apart". Why keep them apart? Because a guarantee is calibrated on one exact label. mae-down reads the minimum low over (t, t+h]; range reads two closes. A missing candle in the middle of the window breaks one and not the other, and our tests check that case by case.

🧮 32 classes are served: {btc, eth, bnb, sol} × {dir, range, mae-down, mae-up} × {1h, 4h}. No 15-minute class. btc-dir-15m is retired and its name stays reserved: a call on it gets task_class_retired, not silence. Why not 15 minutes? A July 2026 paper (Kim & Hansen, arXiv 2607.09426, six Binance perpetuals) finds that order imbalance at quarter-hour openings predicts returns over four to twelve hours, "with much weaker effects at finer clock-time frequencies". The signal lives at 1h and 4h. So do our classes.

🔒 Every task class carries its own risk level, and the caller cannot change it. dir: α = 0.45, n₀ = 6. Bands: α = 0.01, n₀ = 299. Send α = 0.1 on a calibrated class and you get 400 policy_alpha_mismatch. The server sets the terms. Where do 6 and 299 come from? The smallest n with (1−α)ⁿ ≤ 0.05: 0.55⁶ = 0.0277, 0.99²⁹⁹ = 0.0495. That is how many decisions a cell must have seen before "it never missed" is credible at 95%. Written in the contract, not in a backtest. A cell that misses too often is recalibrated, at most four attempts, and each attempt halves the tolerance: 0.05, 0.025, 0.0125, 0.00625. No "retry until it passes". The miss bound is a one-sided Clopper-Pearson bound, rounded up, seven decimals.

⚙️ The signal comes from a kata: a pure, deterministic function of a window of closed bars. Five direction katas (EMA trend, momentum, mean reversion, taker flow, a vote), three scale katas. The server does not run the kata; the agent does, and the server checks. How? Through features_digest, the sha256 of the exact bytes of the window read, and through 333 conformance vectors on which a Node 24 implementation and a Python 3.11 one, written by a separate instance told not to read the first, agree bit for bit. One detail that matters: the served volatility is σ̂ = σ_raw × f(slot of the week), 168 slots at 1h, 42 at 4h. Monday 00:00 UTC is not Saturday 14:00. The factor is frozen on a selection block and published with the cell.

📊 Why this obsession with calibration? Because it is what markets reward. Kalshi published in August 2026 (Kagan & Baiocchi, SSRN 7355520) an analysis of 2,243,741 resolved markets: the Brier score goes from about 0.08-0.09 at three months to roughly 0.02 at close, and prices behave "like genuine probabilities". And calibration that holds on average is not enough. Ryan, ICAIF 2026 (arXiv 2608.01494), pre-registered: realized coverage 0.745 against a 0.750 target on 2022-2024. Perfect on average, and last of eleven books on Sharpe and Calmar. A post-hoc split shows 0.592 coverage in 2022 and 0.842 after, with the whole loss in the under-covered year. The author is careful: the split "does not show that under-coverage caused the loss". But it is exactly why our cells are cut by task class, by side, by strength tercile. The guarantee holds per cell, not in bulk.

📜 It is also why contract 1.1.0 says plainly what a coverage is not. Section 12: "alpha is the target miscoverage of the row or of the caller. It is not a measured rate." And coverage "holds only under exchangeability". No promise under drift. Financial series do break exchangeability (Temporal Conformal Prediction, arXiv 2507.05470; CPTC, NeurIPS 2025). We do not ignore it; we handle it with the retire list. A cell whose coverage breaks is retired by a dated list, and the next attempt counts only from the pinned day its row becomes current; an entry carried unchanged keeps its attempt. The reader that resolves attempt 2 of a cell merged yesterday (PR #325): two independent reviews, 12 mutation lines each killed alone, 3,288 tests green. That is not a feature. It is the mechanism that stops a stale guarantee from staying served.

🤖 Meanwhile the industry runs. Robinhood opened trading agents in September, OpenAI and Anthropic on board, to its roughly 29 million users (Fortune, Oct 12, 2026). On September 19 and 20, agents repeatedly tried to submit trades on the exchange Quidax, uninvited; the trades failed (Transluce, via Fortune). A trading agent needs two things an LLM does not give on its own: a precise question, and an error rate you can check. The task class is the question. The calibrated cell is the rate. The gate returns commit, defer or abstain, a region, and the budget left. Never a probability of being right.

🙏 Honesty: at this version no kata row is served yet. Every well-formed kata call gets under_calib, with no region. The contract says so at the top of section 9. We prefer a missing guarantee to an invented one. What comes next is wave 2b: 72 trials, frozen in order, three volatility estimators (HAR-RV, GARCH(1,1), EWMA) over the 24 band classes. The format is frozen by sha256, the import guard that admits those rows is merged. Each row will be served with its n, its k*, its miss bound.

In short: a strategy answers a question, and the task class is that question. dir, range, mae-down, mae-up: four objects, four calibrations. α and n₀ belong to the server, not the caller. The guarantee holds per cell and expires by a dated list. Abstaining is an answer.

Sources: CoinDesk Oct 6, 2026 · CrowdFund Insider Oct 2026 · Fortune Oct 12, 2026 · Kim & Hansen, arXiv 2607.09426 · Kagan & Baiocchi, SSRN 7355520 · Ryan, arXiv 2608.01494 (ICAIF '26) · arXiv 2507.05470 · NeurIPS 2025 CPTC · contract 1.1.0 and KATA-SPEC: github.com/KraidleAI/mona…

GM

More than a hundred projects have gone dark this year. Last year buried its share too.

We saw a studio raise tens of millions to put blockchain at the heart of gaming, then quietly turn off the lights. We saw a zk pioneer, one of the first to scale Ethereum, close its doors. We saw the AI agent that sent a whole sector into the billions end with its own founder telling holders to sell.

Some were simply too early. They built the tools for a world that hadn’t arrived yet, and found no one waiting. Others were brought down by a single hack, a single bad day, and the very problems they were meant to fix kept spreading until nobody even called them problems anymore.

Then there were those who survived by shrinking. Fewer chains. Smaller dreams. Back to one ecosystem, hoping it would hold.

Different teams, different visions, the same ending.

All of them depended on one ecosystem that slowly held them back. All of them lacked the economic resilience to weather the storm. Tens of millions raised, and still not enough.

We didn’t watch from a distance. We saw them fade, pivot, fall. We learned from them. We learned with them.

So at MONARK, we chose another path.

No single ecosystem. Web2 or Web3, any blockchain, any agent. And never just one source of revenue.

The first rule of The Fight Club: produce what you consume, or what you will consume.

We took that rule seriously. And we have a plan. Not only to produce what we consume, but to create a surplus strong enough to keep diversifying, and to build a treasury that doesn’t just survive chaos, but grows stronger from it.

More in the coming weeks.

Félicitations.

1/ Some teams ship features. A few ship a worldview. 🧵

@Ymaxapp is one of them.

Here is why their work, and the 40 years of research behind it, inspires what we build at MONARK. 👇

2/ Their bio says it in three words: "Mandates, not keys!" 🔑🚫

Most agent stacks hand the model your keys and pray it never gets fooled.

Ymax flips it: give the agent "scoped, revocable authority, and let the chain enforce the boundary."

3/ The line we keep coming back to:

"The AI plans off-chain. The chain enforces on-chain. That split is the whole thing."

Delegate action, not custody. That is not a feature. That is an architecture. 🏛️

4/ And it did not start in 2025. 🕰️

1986: Kahn, Tribble, Miller and Bobrow publish on objects in concurrent logic programming.

1988: Mark S. Miller and K. Eric Drexler publish the Agoric Open Systems papers. Markets, inside computation.

5/ 2000: "Capability-based Financial Instruments" (Miller, Morningstar, Frantz).

2006: Miller's thesis, "Robust Composition", unifying access control and concurrency control.

One goal runs through four decades: cooperation between parties who do not trust each other. 🤝

6/ Today that goal has running code: Endo, built on Hardened JS and the object capability model. 🧬

Its rule is brutal and beautiful: a reference IS authority. No reference, no power. No ambient pool of permissions waiting to leak.

7/ In the Endo Familiar demo, an AI agent is born with ONE capability: reading its own primer. 🔒

To touch files, it gets a mount of one folder that cannot climb above its root.

Least authority, not as a policy document. As a structural guarantee.

8/ @DeanTribble said it on stage at ETHConf: "You can't watch your way to trust!" 🎯

At TOKEN2049 his keynote carried the title this whole industry needs:

"Mandates Not Keys: Enforceable Guardrails for Agentic Finance."

9/ Here is where it hits home for us. 👀

Ymax answers: what is this agent ALLOWED to do?

MONARK answers the question right after it: does the evidence say it SHOULD do it, right now?

Authority and evidence. Two halves of the same trust.

10/ That is our gate. ⚖️

An agent sends a claim through MCP and gets back commit, defer or abstain, with a region it can audit.

Never a probability of being right. Ymax said it best: "Confident isn't the same as correct."

11/ Picture the stack agentic finance needs: 🏗️

🔑 Mandate: the boundary, enforced on chain
📡 Evidence: measured readings, hash chained, like Narabi on stablecoin redemptions
⚖️ Decision: a gate that commits only when the measurement holds

No keys. No vibes. Receipts.

12/ Ymax says there will be a "Waymo moment for finance." We agree. 🚗

Self driving did not earn trust with a smarter promise. It earned it with sensors you can audit and limits it cannot cross.

Agentic capital will earn it the same way.

13/ What comes next on our side 👀

Narabi on every major stablecoin.
More sensors behind the gate.
And one question we want every agent to ask before it acts on a mandate: is this measured?

Stay close. 🔥

14/ Respect to @Ymaxapp, @agoric, @DeanTribble,@marksammiller , and everyone who kept this research alive for forty years. 🫡

We build on your shoulders, and we intend to make you proud.

monarkgate.tech