The gate does not only stop an agent. It sizes it. 📐
Most trading agents size a position from a forecast and a confidence score. A number that sounds precise and is rarely tested. When the market changes, the score stays confident and the position stays large.
MONARK engine e question: how uncertain is this reading, measured, not guessed?
Every claim an agent submits comes back with a region: the range the gate stands behind at a coverage level it controls. The width of that region is the measure of uncertainty. Never a probability of being right.
That measure becomes the size. Here is the rule we are writing for our agents:
🟢 Tight region, commit: the agent may take its position, within its limits.
🟡 Wide region, defer: the agent reduces, or waits for a better reading.
🔴 No region it can stand behind, abstain: no new entry. If the data itself is missing or disputed, the agent holds its hedge and enters nothing.
Every commit draws on B_t, the token's depletable right to act. Uncertainty shrinks the position; repeated commits shrink the budget. Two brakes, both measured.
So the engine is not an off switch. It is a dial: the more uncertain the market, the smaller the agent. The calmer and better measured, the more room it gets, and never more than its budget allows. 🎚️
Our trading agents will run this in paper first, every decision signed and published, before a single real position.
Sized by what is measured. Never by a confidence score.
Most trading agents size a position from a forecast and a confidence score. A number that sounds precise and is rarely tested. When the market changes, the score stays confident and the position stays large.
MONARK engine e question: how uncertain is this reading, measured, not guessed?
Every claim an agent submits comes back with a region: the range the gate stands behind at a coverage level it controls. The width of that region is the measure of uncertainty. Never a probability of being right.
That measure becomes the size. Here is the rule we are writing for our agents:
🟢 Tight region, commit: the agent may take its position, within its limits.
🟡 Wide region, defer: the agent reduces, or waits for a better reading.
🔴 No region it can stand behind, abstain: no new entry. If the data itself is missing or disputed, the agent holds its hedge and enters nothing.
Every commit draws on B_t, the token's depletable right to act. Uncertainty shrinks the position; repeated commits shrink the budget. Two brakes, both measured.
So the engine is not an off switch. It is a dial: the more uncertain the market, the smaller the agent. The calmer and better measured, the more room it gets, and never more than its budget allows. 🎚️
Our trading agents will run this in paper first, every decision signed and published, before a single real position.
Sized by what is measured. Never by a confidence score.
Last week in Singapore, Agentic Finance put two questions on stage: how do we give agents the power to decide, and who stops them? 🤖
The answers were serious and they all came from the same place: outside the agent. Mandates, oversight, custody, compliance, law. A human watches ething goes wrong, a human pulls the plug. Usually after the damage.
We start from the other end. solana:FYZcYCHSp8FzNba1UtDZydKKGosmxVNpFBiVuia38AhT puts the limit inside the decision itself. 🔒
How it works today:
MONARK engine sits between an agent and the action it wants to take. The agent submits a claim; the gate answers commit, defer or abstain, with a region you can audit and the budget left. Never a probability of being right, never a confidence score.
The token carries B_t, a depletable right to act. Every commit draws on it. Defer and abstain cost nothing. When the budget runs out, the gate abstains: no commit, whatever the agent wants. The brake is in the protocol, not in a meeting.
What comes next:
Misses will drain B_t faster. An agent that keeps getting it wrong loses its authority to act, step by step, before the losses compound. Errors stop being a postmortem; they become the signal that takes the controls away. 📉
Then KRAIDLE KERNEL: least authority for agents. An agent holds only the rights it needs, for the task in front of it, and only as long as its record earns them. Authority becomes something measured and earned, not granted once and forgotten. ⚖️
Why it matters: the whole industry is asking who sets the limits. Our answer is that the limit should be computed, auditable and enforced at the moment of the decision, by design.
We are eager to work with the main players in agentic finance: wallets, brokers, exchanges, lending protocols and agent builders. In the coming weeks we will select a few teams to test our solutions with us. DMs are open. 🤝
Not a return. Not a deposit. A metered right to act.
CA: solana:FYZcYCHSp8FzNba1UtDZydKKGosmxVNpFBiVuia38AhT
2
4
21
Last week in Singapore, Agentic Finance put two questions on stage: how do we give agents the power to decide, and who stops them? 🤖
The answers were serious and they all came from the same place: outside the agent. Mandates, oversight, custody, compliance, law. A human watches ething goes wrong, a human pulls the plug. Usually after the damage.
We start from the other end. solana:FYZcYCHSp8FzNba1UtDZydKKGosmxVNpFBiVuia38AhT puts the limit inside the decision itself. 🔒
How it works today:
MONARK engine sits between an agent and the action it wants to take. The agent submits a claim; the gate answers commit, defer or abstain, with a region you can audit and the budget left. Never a probability of being right, never a confidence score.
The token carries B_t, a depletable right to act. Every commit draws on it. Defer and abstain cost nothing. When the budget runs out, the gate abstains: no commit, whatever the agent wants. The brake is in the protocol, not in a meeting.
What comes next:
Misses will drain B_t faster. An agent that keeps getting it wrong loses its authority to act, step by step, before the losses compound. Errors stop being a postmortem; they become the signal that takes the controls away. 📉
Then KRAIDLE KERNEL: least authority for agents. An agent holds only the rights it needs, for the task in front of it, and only as long as its record earns them. Authority becomes something measured and earned, not granted once and forgotten. ⚖️
Why it matters: the whole industry is asking who sets the limits. Our answer is that the limit should be computed, auditable and enforced at the moment of the decision, by design.
We are eager to work with the main players in agentic finance: wallets, brokers, exchanges, lending protocols and agent builders. In the coming weeks we will select a few teams to test our solutions with us. DMs are open. 🤝
Not a return. Not a deposit. A metered right to act.
CA: solana:FYZcYCHSp8FzNba1UtDZydKKGosmxVNpFBiVuia38AhT
The answers were serious and they all came from the same place: outside the agent. Mandates, oversight, custody, compliance, law. A human watches ething goes wrong, a human pulls the plug. Usually after the damage.
We start from the other end. solana:FYZcYCHSp8FzNba1UtDZydKKGosmxVNpFBiVuia38AhT puts the limit inside the decision itself. 🔒
How it works today:
MONARK engine sits between an agent and the action it wants to take. The agent submits a claim; the gate answers commit, defer or abstain, with a region you can audit and the budget left. Never a probability of being right, never a confidence score.
The token carries B_t, a depletable right to act. Every commit draws on it. Defer and abstain cost nothing. When the budget runs out, the gate abstains: no commit, whatever the agent wants. The brake is in the protocol, not in a meeting.
What comes next:
Misses will drain B_t faster. An agent that keeps getting it wrong loses its authority to act, step by step, before the losses compound. Errors stop being a postmortem; they become the signal that takes the controls away. 📉
Then KRAIDLE KERNEL: least authority for agents. An agent holds only the rights it needs, for the task in front of it, and only as long as its record earns them. Authority becomes something measured and earned, not granted once and forgotten. ⚖️
Why it matters: the whole industry is asking who sets the limits. Our answer is that the limit should be computed, auditable and enforced at the moment of the decision, by design.
We are eager to work with the main players in agentic finance: wallets, brokers, exchanges, lending protocols and agent builders. In the coming weeks we will select a few teams to test our solutions with us. DMs are open. 🤝
Not a return. Not a deposit. A metered right to act.
CA: solana:FYZcYCHSp8FzNba1UtDZydKKGosmxVNpFBiVuia38AhT
2
3
19
1/ 🧵 Least privilege × conformal inference.
An idea from 1975 says what an agent may touch. A theory built in 1998–2005 says what a prediction may claim.
An AI agent that holds tools needs both, and the two fit closely. A long thread, with the math and live calls 👇
2/ he Protection of Information in Computer Systems", 1975:
"Every program and every user of the system should operate using the least set of privileges necessary to complete the job."
Its stated purpose: limit the damage of an accident or error.
3/ The same paper states fail-safe defaults next to it:
"Base access decisions on permission rather than exclusion."
By default there is no access. Their argument: a mistake in a system that grants by permission fails by refusing. That is safe, and it gets noticed fast.
4/ An older source: Dennis & Van Horn, CACM 1966. A computation runs inside a "sphere of protection" given by a list of capabilities (a C-list).
Delegation can only narrow: a capability you pass on must be implied by one you hold. Authority never grows by being handed down.
5/ Hardy, "The Confused Deputy", 1988. A compiler held a license to write its stats file. A user named the billing file as the debug output, and the compiler overwrote it.
"The compiler serves two masters and carries some authority from each to perform its respective duties."
6/ Miller, "Robust Composition" (2006), the Principle of Least Authority:
Permission is what a program touches directly. Authority is every effect it can cause, via others too.
"we must provide the right amount of authority just-in-time, not excess authority just-in-case."
7/ Mainstream platforms now do this by default:
• AWS IAM: "By default, all requests are implicitly denied" (the root user aside)
• GitHub Actions: name one token permission and "all of those that are not specified are set to none"
• NIST SP 800-53 has a control for it: AC-6
8/ Then came LLM agents 🤖 OWASP Top 10 for LLM Apps 2025, LLM06 Excessive Agency:
"The root cause of Excessive Agency is typically one or more of: excessive functionality; excessive permissions; excessive autonomy."
Mitigation 7: authorize downstream, not in the LLM.
9/ Simon Willison named the "lethal trifecta" in June 2025: private data, untrusted content, and a way to communicate externally.
If an agent has all three, an attacker can make it send your data out.
Least privilege gives the fix: remove one leg.
10/ Research builds it in:
• CaMeL (Google, Google DeepMind, ETH Zurich) tags values with capabilities: 77% of AgentDojo tasks solved with provable security, 84% undefended (v2)
• Progent checks a least-privilege policy on each tool call: attack success 39.9% → 1.0% (v3)
11/ Both state limits. CaMeL: "No, prompt injection attacks are not fully solved." Progent "cannot be used to defend against attacks that operate within the least privilege".
Least privilege bounds what CAN be done. It says nothing about whether the action chosen is right.
12/ That second question is statistical: how often does the agent's claim miss? 📐
Conformal inference answers it without assuming the model is right. Vovk, Gammerman, Shafer and colleagues built it in 1998–2005; the fast split form is Papadopoulos et al., 2002.
13/ Split conformal in four steps:
• fit any model on one dataset
• score n held-out points, s_i = s(x_i, y_i), larger = worse fit
• k = ⌈(n+1)(1−α)⌉, q̂ = the k-th smallest score
• C(x) = {y : s(x, y) ≤ q̂}
The set holds every answer the data do not rule out.
14/ If the n calibration points and the test point are exchangeable:
P(Y ∈ C(X)) ≥ 1 − α
and, with no ties, ≤ 1 − α + 1/(n+1).
Why: the test score's rank among the n+1 scores is uniform. No correct model, no parametric family, no asymptotics.
15/ A small n limits what you can ask for. n = 10, α = 0.1: k = ⌈9.9⌉ = 10, so q̂ is the largest score.
n = 10, α = 0.05: k = ⌈10.45⌉ = 11 > n. The textbook answer is q̂ = +∞, a set holding every label.
The smallest α that n points allow is 1/(n+1).
16/ What it does NOT say:
• Coverage is marginal, averaged over calibration and test draws.
• Coverage given every x is impossible without assumptions on the distribution (Vovk 2012; Lei & Wasserman 2014).
• It is never the probability that THIS answer is right.
17/ The marginal number also varies between calibration sets. Given one set, coverage is Beta-distributed near 1 − α.
Angelopoulos & Bates: with n = 1000 and α = 0.1, it typically lands between .88 and .92.
The guarantee belongs to the procedure, not to one call.
18/ For groups: Mondrian conformal (Vovk, Lindsay, Nouretdinov, Gammerman, 2003) calibrates each declared category on its own points, so coverage holds per group.
The price: each group lives on its own n. Groups are fixed in advance; a thin group gets nothing useful.
19/ Two edge cases are signals:
• The full set is "certain to be correct" and tells you nothing (Shafer & Vovk 2008).
• The empty set rejects every candidate. It is a prediction known to be wrong, and a hint that the input looks unlike the calibration data.
20/ When exchangeability breaks:
• Barber, Candès, Ramdas, Tibshirani (Ann. Stat. 2023): coverage ≥ 1 − α minus a weighted total-variation gap you cannot observe.
• Gibbs & Candès (NeurIPS 2021) adapt α_t: a long-run error-rate bound, no claim per step.
21/ Beyond "is y in the set?":
• Conformal risk control (Angelopoulos et al., ICLR 2024): E[loss] ≤ α for any bounded monotone loss.
• Learn then Test (Angelopoulos et al., Ann. Appl. Stat. 2025): if no setting can be certified, it abstains.
22/ Now side by side 🔗
fail-safe default ↔ abstain unless the data justify acting
least set of privileges ↔ smallest set the data allow
grant per role ↔ coverage per declared group
"grant everything" ↔ the full set
revoke on change ↔ an exchangeability alarm
23/ The last row is real math: exchangeability martingales (Vovk, Nouretdinov, Gammerman, ICML 2003).
Bet against exchangeability at fair stakes, starting from 1. By Ville's inequality, P(wealth ever reaches C) ≤ 1/C.
A valid alarm that the ground under a grant has moved.
24/ Complements, not substitutes.
Least privilege bounds the damage of an action, and says nothing on how often it is wrong.
Conformal bounds how often a claim misses, and says nothing on the damage.
An agent gate needs both: a ceiling on harm, a rate of error.
25/ Papers already sit where they meet:
• KnowNo (Ren et al., CoRL 2023): conformal sets decide when a robot planner must ask a human.
• A July 2026 arXiv paper gives LLM tool calls a risk budget per argument role: untrusted content "should never set a recipient."
26/ That is least privilege per argument, with a guarantee on how often each check fails.
At MONARK, this is the design space we build in. Here is how the two halves meet in one gate 👇
27/ MONARK's gate decides, never acts. Docs: "The gate emits a decision; it never calls the tool it names. It holds no key, moves no fund".
An agent sends a claim, gets commit, defer or abstain, an auditable region and the budget left. Never a probability of being right.
28/ Least privilege applies to the decider itself 🔒
Exactly four tools are served: attest, gate, cascade, calibrate. Their code imports no file-system, network or process module, calls no fetch and reads no clock. A test scans every tool file and fails on any hit.
29/ The caller cannot widen its own guarantee. On a calibrated class, the server sets α and nMin. Live calls today:
α = 0.1 instead of 0.01 → 400 policy_alpha_mismatch
nMin = 10 instead of 100 → 400 policy_nmin_mismatch
Least privilege, applied to statistical parameters.
30/ Nor can it impersonate a calibrated population. Your own calibration sent on a calibrated key → 400 byo_overrides_committed. Look-alike keys (case, l/I/1, rn/m…) are refused too.
The server derives the stratum from ŷ; the caller never picks it.
31/ Authority per category, default deny. The liquidation class is split into strata of ŷ fixed in advance; only stratum 0 is calibrated (n = 170). Live:
ŷ in stratum 0 → commit, upper bound [0, ŷ + q̂]
ŷ in stratum 1 → abstain, under_calib, no region
32/ Honest about small n: at α = 0.01 and n = 170, k = ⌈171 × 0.99⌉ = 170 = n, so q̂ is the largest score seen, reported as is. One more nine (α = 0.001) would need n ≥ 999.
The served text says it: one recorded episode, no coverage claimed for any other event.
33/ Bring your own scores and watch the deny branch 🧪 Ten scores from 0.1 to 1.0, α = 0.1, so q̂ = 1. Live:
A 0.85, B 1.5 → C = {A} → commit
A 1.5, B 2.0 → C = ∅ → abstain
A 1.5, B 0.5, intent A → C = {B} → abstain
A 0.3, B 0.6, τ = 1 → C = {A, B} → defer
34/ Same scores at α = 0.05: k = 11 > n = 10. Where the textbook returns the whole space, the gate refuses: abstain, under_calib.
Budget 0.01 under a floor of 0.05 → abstain, budget_exhausted.
NaN, a zero-width region, an empty set: abstain. Nothing defaults to commit.
35/ The caller carries the budget; the gate does not hold it. The gate compares it with the caller's floor and hands it back unchanged.
Each request gets a fresh server: no account, no stored caller data. A decider with no state has nothing to escalate.
36/ Keys 🔑 In the data path, exactly one module may read a paid endpoint key, and the key may only travel to a closed list of exact hosts, over https.
Every other module names providers by label. A run opens and locks only the providers it names.
37/ Separation of privilege ("two keys") on the evidence side: our on-chain sensor reads value-bearing data from two distinct providers. If the bytes differ, the window fails closed.
In CI, the workflow token is read-only; every action is pinned to a full commit SHA.
38/ Read `allow: true` correctly: it is a coverage verdict on YOUR prediction, not permission to run the tool. Your runtime enforces the act; for spend caps, use your platform's controls.
The door every transfer, swap or signature would pass first is named, not delivered.
39/ Reading rules 📚
• Coverage is marginal, under exchangeability, and void under drift unless re-checked.
• Abstain is an answer. An empty set is a signal.
• The caller cannot widen its own terms.
• Never a probability of being right.
monarkgate.tech/docs/gate
40/ Sources: Saltzer & Schroeder 1975 · Dennis & Van Horn 1966 · Hardy 1988 · Miller 2006 · OWASP LLM06:2025 · Willison 2025 · arXiv 2503.18813, 2504.11703, 2307.01928, 2607.24343 · Vovk et al. 2003, 2005 · Barber et al. 2023 · Angelopoulos & Bates
github.com/KraidleAI/Mona…
An idea from 1975 says what an agent may touch. A theory built in 1998–2005 says what a prediction may claim.
An AI agent that holds tools needs both, and the two fit closely. A long thread, with the math and live calls 👇
2/ he Protection of Information in Computer Systems", 1975:
"Every program and every user of the system should operate using the least set of privileges necessary to complete the job."
Its stated purpose: limit the damage of an accident or error.
3/ The same paper states fail-safe defaults next to it:
"Base access decisions on permission rather than exclusion."
By default there is no access. Their argument: a mistake in a system that grants by permission fails by refusing. That is safe, and it gets noticed fast.
4/ An older source: Dennis & Van Horn, CACM 1966. A computation runs inside a "sphere of protection" given by a list of capabilities (a C-list).
Delegation can only narrow: a capability you pass on must be implied by one you hold. Authority never grows by being handed down.
5/ Hardy, "The Confused Deputy", 1988. A compiler held a license to write its stats file. A user named the billing file as the debug output, and the compiler overwrote it.
"The compiler serves two masters and carries some authority from each to perform its respective duties."
6/ Miller, "Robust Composition" (2006), the Principle of Least Authority:
Permission is what a program touches directly. Authority is every effect it can cause, via others too.
"we must provide the right amount of authority just-in-time, not excess authority just-in-case."
7/ Mainstream platforms now do this by default:
• AWS IAM: "By default, all requests are implicitly denied" (the root user aside)
• GitHub Actions: name one token permission and "all of those that are not specified are set to none"
• NIST SP 800-53 has a control for it: AC-6
8/ Then came LLM agents 🤖 OWASP Top 10 for LLM Apps 2025, LLM06 Excessive Agency:
"The root cause of Excessive Agency is typically one or more of: excessive functionality; excessive permissions; excessive autonomy."
Mitigation 7: authorize downstream, not in the LLM.
9/ Simon Willison named the "lethal trifecta" in June 2025: private data, untrusted content, and a way to communicate externally.
If an agent has all three, an attacker can make it send your data out.
Least privilege gives the fix: remove one leg.
10/ Research builds it in:
• CaMeL (Google, Google DeepMind, ETH Zurich) tags values with capabilities: 77% of AgentDojo tasks solved with provable security, 84% undefended (v2)
• Progent checks a least-privilege policy on each tool call: attack success 39.9% → 1.0% (v3)
11/ Both state limits. CaMeL: "No, prompt injection attacks are not fully solved." Progent "cannot be used to defend against attacks that operate within the least privilege".
Least privilege bounds what CAN be done. It says nothing about whether the action chosen is right.
12/ That second question is statistical: how often does the agent's claim miss? 📐
Conformal inference answers it without assuming the model is right. Vovk, Gammerman, Shafer and colleagues built it in 1998–2005; the fast split form is Papadopoulos et al., 2002.
13/ Split conformal in four steps:
• fit any model on one dataset
• score n held-out points, s_i = s(x_i, y_i), larger = worse fit
• k = ⌈(n+1)(1−α)⌉, q̂ = the k-th smallest score
• C(x) = {y : s(x, y) ≤ q̂}
The set holds every answer the data do not rule out.
14/ If the n calibration points and the test point are exchangeable:
P(Y ∈ C(X)) ≥ 1 − α
and, with no ties, ≤ 1 − α + 1/(n+1).
Why: the test score's rank among the n+1 scores is uniform. No correct model, no parametric family, no asymptotics.
15/ A small n limits what you can ask for. n = 10, α = 0.1: k = ⌈9.9⌉ = 10, so q̂ is the largest score.
n = 10, α = 0.05: k = ⌈10.45⌉ = 11 > n. The textbook answer is q̂ = +∞, a set holding every label.
The smallest α that n points allow is 1/(n+1).
16/ What it does NOT say:
• Coverage is marginal, averaged over calibration and test draws.
• Coverage given every x is impossible without assumptions on the distribution (Vovk 2012; Lei & Wasserman 2014).
• It is never the probability that THIS answer is right.
17/ The marginal number also varies between calibration sets. Given one set, coverage is Beta-distributed near 1 − α.
Angelopoulos & Bates: with n = 1000 and α = 0.1, it typically lands between .88 and .92.
The guarantee belongs to the procedure, not to one call.
18/ For groups: Mondrian conformal (Vovk, Lindsay, Nouretdinov, Gammerman, 2003) calibrates each declared category on its own points, so coverage holds per group.
The price: each group lives on its own n. Groups are fixed in advance; a thin group gets nothing useful.
19/ Two edge cases are signals:
• The full set is "certain to be correct" and tells you nothing (Shafer & Vovk 2008).
• The empty set rejects every candidate. It is a prediction known to be wrong, and a hint that the input looks unlike the calibration data.
20/ When exchangeability breaks:
• Barber, Candès, Ramdas, Tibshirani (Ann. Stat. 2023): coverage ≥ 1 − α minus a weighted total-variation gap you cannot observe.
• Gibbs & Candès (NeurIPS 2021) adapt α_t: a long-run error-rate bound, no claim per step.
21/ Beyond "is y in the set?":
• Conformal risk control (Angelopoulos et al., ICLR 2024): E[loss] ≤ α for any bounded monotone loss.
• Learn then Test (Angelopoulos et al., Ann. Appl. Stat. 2025): if no setting can be certified, it abstains.
22/ Now side by side 🔗
fail-safe default ↔ abstain unless the data justify acting
least set of privileges ↔ smallest set the data allow
grant per role ↔ coverage per declared group
"grant everything" ↔ the full set
revoke on change ↔ an exchangeability alarm
23/ The last row is real math: exchangeability martingales (Vovk, Nouretdinov, Gammerman, ICML 2003).
Bet against exchangeability at fair stakes, starting from 1. By Ville's inequality, P(wealth ever reaches C) ≤ 1/C.
A valid alarm that the ground under a grant has moved.
24/ Complements, not substitutes.
Least privilege bounds the damage of an action, and says nothing on how often it is wrong.
Conformal bounds how often a claim misses, and says nothing on the damage.
An agent gate needs both: a ceiling on harm, a rate of error.
25/ Papers already sit where they meet:
• KnowNo (Ren et al., CoRL 2023): conformal sets decide when a robot planner must ask a human.
• A July 2026 arXiv paper gives LLM tool calls a risk budget per argument role: untrusted content "should never set a recipient."
26/ That is least privilege per argument, with a guarantee on how often each check fails.
At MONARK, this is the design space we build in. Here is how the two halves meet in one gate 👇
27/ MONARK's gate decides, never acts. Docs: "The gate emits a decision; it never calls the tool it names. It holds no key, moves no fund".
An agent sends a claim, gets commit, defer or abstain, an auditable region and the budget left. Never a probability of being right.
28/ Least privilege applies to the decider itself 🔒
Exactly four tools are served: attest, gate, cascade, calibrate. Their code imports no file-system, network or process module, calls no fetch and reads no clock. A test scans every tool file and fails on any hit.
29/ The caller cannot widen its own guarantee. On a calibrated class, the server sets α and nMin. Live calls today:
α = 0.1 instead of 0.01 → 400 policy_alpha_mismatch
nMin = 10 instead of 100 → 400 policy_nmin_mismatch
Least privilege, applied to statistical parameters.
30/ Nor can it impersonate a calibrated population. Your own calibration sent on a calibrated key → 400 byo_overrides_committed. Look-alike keys (case, l/I/1, rn/m…) are refused too.
The server derives the stratum from ŷ; the caller never picks it.
31/ Authority per category, default deny. The liquidation class is split into strata of ŷ fixed in advance; only stratum 0 is calibrated (n = 170). Live:
ŷ in stratum 0 → commit, upper bound [0, ŷ + q̂]
ŷ in stratum 1 → abstain, under_calib, no region
32/ Honest about small n: at α = 0.01 and n = 170, k = ⌈171 × 0.99⌉ = 170 = n, so q̂ is the largest score seen, reported as is. One more nine (α = 0.001) would need n ≥ 999.
The served text says it: one recorded episode, no coverage claimed for any other event.
33/ Bring your own scores and watch the deny branch 🧪 Ten scores from 0.1 to 1.0, α = 0.1, so q̂ = 1. Live:
A 0.85, B 1.5 → C = {A} → commit
A 1.5, B 2.0 → C = ∅ → abstain
A 1.5, B 0.5, intent A → C = {B} → abstain
A 0.3, B 0.6, τ = 1 → C = {A, B} → defer
34/ Same scores at α = 0.05: k = 11 > n = 10. Where the textbook returns the whole space, the gate refuses: abstain, under_calib.
Budget 0.01 under a floor of 0.05 → abstain, budget_exhausted.
NaN, a zero-width region, an empty set: abstain. Nothing defaults to commit.
35/ The caller carries the budget; the gate does not hold it. The gate compares it with the caller's floor and hands it back unchanged.
Each request gets a fresh server: no account, no stored caller data. A decider with no state has nothing to escalate.
36/ Keys 🔑 In the data path, exactly one module may read a paid endpoint key, and the key may only travel to a closed list of exact hosts, over https.
Every other module names providers by label. A run opens and locks only the providers it names.
37/ Separation of privilege ("two keys") on the evidence side: our on-chain sensor reads value-bearing data from two distinct providers. If the bytes differ, the window fails closed.
In CI, the workflow token is read-only; every action is pinned to a full commit SHA.
38/ Read `allow: true` correctly: it is a coverage verdict on YOUR prediction, not permission to run the tool. Your runtime enforces the act; for spend caps, use your platform's controls.
The door every transfer, swap or signature would pass first is named, not delivered.
39/ Reading rules 📚
• Coverage is marginal, under exchangeability, and void under drift unless re-checked.
• Abstain is an answer. An empty set is a signal.
• The caller cannot widen its own terms.
• Never a probability of being right.
monarkgate.tech/docs/gate
40/ Sources: Saltzer & Schroeder 1975 · Dennis & Van Horn 1966 · Hardy 1988 · Miller 2006 · OWASP LLM06:2025 · Willison 2025 · arXiv 2503.18813, 2504.11703, 2307.01928, 2607.24343 · Vovk et al. 2003, 2005 · Barber et al. 2023 · Angelopoulos & Bates
github.com/KraidleAI/Mona…
3
6
23
Raphaëlle d'Ornano's Decoding Discontinuity is worth reading in full if you track where value goes as AI agents do the work.
Her latest essay: intelligence is splitting into two products, cheap decisions and premium deliberation. What decides which one you buy is the threshold.
r words: "Disruption bends the curve. Discontinuity stops it and starts a new one."
When intelligence becomes abundant, value moves to whoever coordinates it: the workflow, the context, and the record of what was decided.
The essay looks at a model that answers a declared question with one answer and a probability, and charges nothing for output. Code owns the workflow. Above a confidence threshold, the program proceeds. Below it, a larger model or a person takes over.
Her own caveat is the right one: speed and cost are shown, reliable confidence is not. The benchmark's reference answers came from frontier models, so agreeing with them is not independent evidence. Her test: a thousand or more held-out cases, labelled by people.
That test is the whole game. A model's probability is a claim about itself. A threshold you can sign off on has to be measured on your own data, on examples the model never saw.
Statistics has a tool built for this: conformal prediction. Score the model's errors on held-out labelled cases. Keep the error at the rank set by your target. Every answer within that margin goes in a set that holds the right one at least at the stated rate, whatever the model.
The set turns into an action.
One answer left: commit.
Several: defer. Too little is ruled out to act yet: wait for more evidence, or hand it on.
No time or budget left to defer: abstain, on the record.
Escalation stops being a hunch. It becomes a rule with a stated error rate.
The limits matter as much as the guarantee. The rate holds on average across cases, not for each case. It assumes new cases look like the calibration set. Drift breaks it, so calibration is measured again. A decision that states this is honest.
Her other point lands here too: frontier models now act more and explain less, so the written trace thins. When the model stops explaining, the guarantee has to live outside it: the question, the level, the calibration it came from, the action taken. That is the receipt.
Her hypothesis: value moves to whoever holds the thresholds and the record of decisions. We would add one condition. A threshold is only worth holding if its error rate is measured, stated and signed.
That is the logic of the gate we build at MONARK: commit, defer or abstain at a stated coverage. Never a probability of being right.
Her essay: decodingdiscontinuity.com/p/typesafe-jev…
How the gate works: monarkgate.tech/how
Her latest essay: intelligence is splitting into two products, cheap decisions and premium deliberation. What decides which one you buy is the threshold.
r words: "Disruption bends the curve. Discontinuity stops it and starts a new one."
When intelligence becomes abundant, value moves to whoever coordinates it: the workflow, the context, and the record of what was decided.
The essay looks at a model that answers a declared question with one answer and a probability, and charges nothing for output. Code owns the workflow. Above a confidence threshold, the program proceeds. Below it, a larger model or a person takes over.
Her own caveat is the right one: speed and cost are shown, reliable confidence is not. The benchmark's reference answers came from frontier models, so agreeing with them is not independent evidence. Her test: a thousand or more held-out cases, labelled by people.
That test is the whole game. A model's probability is a claim about itself. A threshold you can sign off on has to be measured on your own data, on examples the model never saw.
Statistics has a tool built for this: conformal prediction. Score the model's errors on held-out labelled cases. Keep the error at the rank set by your target. Every answer within that margin goes in a set that holds the right one at least at the stated rate, whatever the model.
The set turns into an action.
One answer left: commit.
Several: defer. Too little is ruled out to act yet: wait for more evidence, or hand it on.
No time or budget left to defer: abstain, on the record.
Escalation stops being a hunch. It becomes a rule with a stated error rate.
The limits matter as much as the guarantee. The rate holds on average across cases, not for each case. It assumes new cases look like the calibration set. Drift breaks it, so calibration is measured again. A decision that states this is honest.
Her other point lands here too: frontier models now act more and explain less, so the written trace thins. When the model stops explaining, the guarantee has to live outside it: the question, the level, the calibration it came from, the action taken. That is the receipt.
Her hypothesis: value moves to whoever holds the thresholds and the record of decisions. We would add one condition. A threshold is only worth holding if its error rate is measured, stated and signed.
That is the logic of the gate we build at MONARK: commit, defer or abstain at a stated coverage. Never a probability of being right.
Her essay: decodingdiscontinuity.com/p/typesafe-jev…
How the gate works: monarkgate.tech/how
3
4
21
🚨 Narabi logged its first stress day.
📅 On 2026-09-28 (UTC), 54.68M USDe were burned against an opening supply of 4.95B: ~1.10% of the stock redeemed in one day. The rule: a day is "stress" when burns reach 1% of opening supply.
⛓️ Every number recomputes from Ethereum.
📉 t: the day-over-day change in redemption velocity broke out of the committed static band four days running, Sep 28 → Oct 1. Four static misses in a row.
🎯 The adaptive quantile tracker: zero misses over the same days. On Oct 2, back inside the band.
🧭 Context, not cause: on Sep 26 Ethena said USDe-linked token incentives drop to zero from the end of September. Two days later came the largest burn day of Narabi's 16-day timeline. We publish the flow. We don't claim why it moved.
⚠️ What it doesn't mean:
- no alarm, no auto-switch: the served gate still reads its committed calibration
- the pre-registered drift test (calm-miss ≥ 0.40 over 90 calm pairs) isn't evaluable yet; a drift opens a review, never flips anything
- no coverage claim, no probability
🔍 Check it yourself: pull timeline.jsonl + state.json, recompute any window with eth_getLogs (Transfers to/from zero) and totalSupply, replay the tracker, verify the hash chain.
👉 monarkgate.tech/narabi
If anything differs, that's the finding, and it's yours to publish.
📅 On 2026-09-28 (UTC), 54.68M USDe were burned against an opening supply of 4.95B: ~1.10% of the stock redeemed in one day. The rule: a day is "stress" when burns reach 1% of opening supply.
⛓️ Every number recomputes from Ethereum.
📉 t: the day-over-day change in redemption velocity broke out of the committed static band four days running, Sep 28 → Oct 1. Four static misses in a row.
🎯 The adaptive quantile tracker: zero misses over the same days. On Oct 2, back inside the band.
🧭 Context, not cause: on Sep 26 Ethena said USDe-linked token incentives drop to zero from the end of September. Two days later came the largest burn day of Narabi's 16-day timeline. We publish the flow. We don't claim why it moved.
⚠️ What it doesn't mean:
- no alarm, no auto-switch: the served gate still reads its committed calibration
- the pre-registered drift test (calm-miss ≥ 0.40 over 90 calm pairs) isn't evaluable yet; a drift opens a review, never flips anything
- no coverage claim, no probability
🔍 Check it yourself: pull timeline.jsonl + state.json, recompute any window with eth_getLogs (Transfers to/from zero) and totalSupply, replay the tracker, verify the hash chain.
👉 monarkgate.tech/narabi
If anything differs, that's the finding, and it's yours to publish.
1
4
27
1/ 🧵 In 2026, DeFi's biggest losses didn't come from buggy contracts.
They came from trusting data paths nobody had measured.
Infra & ops compromises: ~15% of incidents, ~76% of losses (Immunefi, H1 2026).
What @usemonark's sensor Shōgen changes 👇
theblock.co/news/ecosystem…
---
2/ 🌉drained.
The bridge was configured with ONE verifier. In Chainalysis' words: "No second DVN had to agree."
Attackers poisoned the RPC nodes that verifier read.
A network on paper. One source in practice.
chainalysis.com/blog/kelpdao-b…
---
3/ 📉 Oct 10, 2025: $19B liquidated, the largest event on record.
Binance priced USDe collateral off its own order book. USDe printed $0.65 there, and nowhere else.
One venue's price became everyone's margin call. ~$728M in compensation followed.
coincentral.com/exclusive-data…
---
4/ 🪙 Jul 2026, BLC stablecoin: >99% depeg.
The liquidation module took a single recorded price as authoritative. No cross-check, no range check.
Same lesson, smaller scale: when one input fails, everything downstream fails with it.
crypto-economy.com/oracle-attack-…
---
5/ 🔢 Here's the trap.
"5 sources agree" is a COUNT.
What protects you is how many of them fail INDEPENDENTLY. Five feeds reading the same exchange, cloud or verifier are one source wearing five hats 🎭
Almost nobody measures this. It's assumed.
---
6/ 🛰️ Shōgen is a sensor for @usemonark.
It doesn't claim a price is right. It does three things:
① binds every answer to the exact bytes a source returned
② measures how sources fail TOGETHER over time
③ publishes k_eff: effective sources, not nominal ones
---
7/ 📐 How "fail together" is measured:
🔸 co-failures: outages, staleness, outliers striking several sources at once, tested against an independence model
🔸 shared infra: same ASN, host, CDN, upstream
Measured axes are counted. Declared ones are shown, never counted.
---
8/ ☁️ Shared infra is visible BEFORE it fails:
AWS us-east-1, Oct 2025: Coinbase & Robinhood down together.
Cloudflare, Nov 18 2025: Coinbase, Kraken, Aave, Etherscan, DefiLlama hit the same day.
"Different providers", one dependency.
coindesk.com/business/2025/…
---
9/ 🤖 Why now: agents.
ERC-8004 brought on-chain identity & reputation to AI agents. The first empirical study found 59–91% of reviewers show coordinated Sybil behavior.
Reputation without measured independence is just a vote count.
arxiv.org/abs/2606.26028
---
10/ ⚡ An agent that liquidates, rebalances or pays on "3 sources agree" acts in milliseconds, and its actions are final on-chain.
Before acting, it needs one answer: is that 3 sources, or 1?
That number, k_eff, is what Shōgen hands to MONARK and to any agent.
---
11/ 🧭 The discipline behind it:
✅ measured vs declared, always stated apart
✅ analysis rules written & timestamped BEFORE the data is read
✅ no "verified", no "guaranteed": measurements, with their axes and their limits
---
12/ 🔭 Shōgen doesn't make data true.
It makes dependence visible, so MONARK, and any agent, can price it before it fails.
🌒 Many lights. How many roots?
They came from trusting data paths nobody had measured.
Infra & ops compromises: ~15% of incidents, ~76% of losses (Immunefi, H1 2026).
What @usemonark's sensor Shōgen changes 👇
theblock.co/news/ecosystem…
---
2/ 🌉drained.
The bridge was configured with ONE verifier. In Chainalysis' words: "No second DVN had to agree."
Attackers poisoned the RPC nodes that verifier read.
A network on paper. One source in practice.
chainalysis.com/blog/kelpdao-b…
---
3/ 📉 Oct 10, 2025: $19B liquidated, the largest event on record.
Binance priced USDe collateral off its own order book. USDe printed $0.65 there, and nowhere else.
One venue's price became everyone's margin call. ~$728M in compensation followed.
coincentral.com/exclusive-data…
---
4/ 🪙 Jul 2026, BLC stablecoin: >99% depeg.
The liquidation module took a single recorded price as authoritative. No cross-check, no range check.
Same lesson, smaller scale: when one input fails, everything downstream fails with it.
crypto-economy.com/oracle-attack-…
---
5/ 🔢 Here's the trap.
"5 sources agree" is a COUNT.
What protects you is how many of them fail INDEPENDENTLY. Five feeds reading the same exchange, cloud or verifier are one source wearing five hats 🎭
Almost nobody measures this. It's assumed.
---
6/ 🛰️ Shōgen is a sensor for @usemonark.
It doesn't claim a price is right. It does three things:
① binds every answer to the exact bytes a source returned
② measures how sources fail TOGETHER over time
③ publishes k_eff: effective sources, not nominal ones
---
7/ 📐 How "fail together" is measured:
🔸 co-failures: outages, staleness, outliers striking several sources at once, tested against an independence model
🔸 shared infra: same ASN, host, CDN, upstream
Measured axes are counted. Declared ones are shown, never counted.
---
8/ ☁️ Shared infra is visible BEFORE it fails:
AWS us-east-1, Oct 2025: Coinbase & Robinhood down together.
Cloudflare, Nov 18 2025: Coinbase, Kraken, Aave, Etherscan, DefiLlama hit the same day.
"Different providers", one dependency.
coindesk.com/business/2025/…
---
9/ 🤖 Why now: agents.
ERC-8004 brought on-chain identity & reputation to AI agents. The first empirical study found 59–91% of reviewers show coordinated Sybil behavior.
Reputation without measured independence is just a vote count.
arxiv.org/abs/2606.26028
---
10/ ⚡ An agent that liquidates, rebalances or pays on "3 sources agree" acts in milliseconds, and its actions are final on-chain.
Before acting, it needs one answer: is that 3 sources, or 1?
That number, k_eff, is what Shōgen hands to MONARK and to any agent.
---
11/ 🧭 The discipline behind it:
✅ measured vs declared, always stated apart
✅ analysis rules written & timestamped BEFORE the data is read
✅ no "verified", no "guaranteed": measurements, with their axes and their limits
---
12/ 🔭 Shōgen doesn't make data true.
It makes dependence visible, so MONARK, and any agent, can price it before it fails.
🌒 Many lights. How many roots?
2
4
25
1/ 🧵
Imagine a weather app that says "70% chance of rain"… and nobody ever checks if it rains 70% of the time.
That's most of AI in trading today: confident outputs, no receipts.
Here's how MONARK does it differently. No hype, just the mechanism. 👇
2/ 🚪
First, what MONARK to act: open a position, size a loan, move funds.
Before it acts, it asks MONARK. MONARK answers one of three things:
✅ COMMIT
⏸️ DEFER
🛑 ABSTAIN
And every answer comes with a statement you can check.
3/ 📏
The trick behind it is called conformal inference.
The idea is beautifully simple: don't trust what a model SAYS about itself. Measure how wrong it has actually been, on real past data, and turn that track record into a rule.
4/ 🧮 [image A]
Step 1: give the strategy a "score" for every past moment.
Right direction? Score 0. Wrong? Score 1.
Price moved? Score = how far, measured in "expected volatility" units.
Do this hundreds of times and you get a pile of honest scores.
5/ ✂️
Step 2: sort the scores and cut.
The classic recipe cuts at position 91 out of 100. On average, that works.
But "on average" hides something: for the specific calibration you're serving, it can fail almost half the time (45% in our example).
6/ 🔒
So we cut stricter: position 96.
An exact binomial count says this cut fails on at most 5% of calibrations, and we publish the exact error bound next to it.
A little more width buys a statement that holds for THIS calibration.
7/ 🎯
Step 3: the cut becomes a region.
For direction: "up only", "down only", or "both" (= not sure).
For price moves: a band, like "the drop over the next hour stays inside X".
If the region is a single side, the agent can COMMIT. If not, MONARK stays quiet.
8/ 🥋 [image B]
Where do the strategies come from? Our KATA.
A kata is a frozen strategy: trend, momentum, mean reversion, order flow, volatility.
• it reads only closed candles
• change one setting = a new kata, counted publicly
No secret tuning.
9/ 🔐
The data: 2 years of real spot candles for BTC, ETH, BNB, SOL. 70,080 per asset, zero missing.
And we haven't looked at it yet. 👀
Everything is written down and fingerprinted BEFORE we open the data. Like a scientist registering the experiment before running it.
10/ 🧩
Each (strategy × asset × horizon × side × conviction) is its own "cell": 280 cells, each calibrated once.
Every cell gets served. Either it earns a region, or it serves calibrated silence.
No cell gets deleted because the result looked bad.
11/ 🛡️
Why should DeFi care?
Two of our questions look at the PATH, not the close: "how far can price drop inside the next hour?"
Because liquidations happen on the wick, not at the close. That band is what an agent needs to size a safety buffer.
12/ 🧾 [image C]
Every MONARK answer carries its receipt: which cell, which rank, how many past misses, the error bound, and a fingerprint of the calibration.
Anyone can recompute it. That's the point: you don't have to trust us.
13/ ⚠️
And we say plainly what this is NOT:
✕ not a probability of being right
✕ not a promise about every single trade
✕ it holds per time window, not over a position's lifetime
✕ it assumes the past resembles the future, and we test that assumption
14/ 🤫
Our honest expectation, written before seeing the data:
Most direction cells will stay silent. Markets are hard.
A gate that says "I can't vouch for this" isn't failing. It's doing its job. And we'll publish the silences in the same format as the wins.
15/ ⛩️
Data → kata → calibration → a checkable answer → silence when it's deserved.
That's conformal inference, end to end.
The DOJO trains. MONARK gates. The kata are coming. 🥋
Imagine a weather app that says "70% chance of rain"… and nobody ever checks if it rains 70% of the time.
That's most of AI in trading today: confident outputs, no receipts.
Here's how MONARK does it differently. No hype, just the mechanism. 👇
2/ 🚪
First, what MONARK to act: open a position, size a loan, move funds.
Before it acts, it asks MONARK. MONARK answers one of three things:
✅ COMMIT
⏸️ DEFER
🛑 ABSTAIN
And every answer comes with a statement you can check.
3/ 📏
The trick behind it is called conformal inference.
The idea is beautifully simple: don't trust what a model SAYS about itself. Measure how wrong it has actually been, on real past data, and turn that track record into a rule.
4/ 🧮 [image A]
Step 1: give the strategy a "score" for every past moment.
Right direction? Score 0. Wrong? Score 1.
Price moved? Score = how far, measured in "expected volatility" units.
Do this hundreds of times and you get a pile of honest scores.
5/ ✂️
Step 2: sort the scores and cut.
The classic recipe cuts at position 91 out of 100. On average, that works.
But "on average" hides something: for the specific calibration you're serving, it can fail almost half the time (45% in our example).
6/ 🔒
So we cut stricter: position 96.
An exact binomial count says this cut fails on at most 5% of calibrations, and we publish the exact error bound next to it.
A little more width buys a statement that holds for THIS calibration.
7/ 🎯
Step 3: the cut becomes a region.
For direction: "up only", "down only", or "both" (= not sure).
For price moves: a band, like "the drop over the next hour stays inside X".
If the region is a single side, the agent can COMMIT. If not, MONARK stays quiet.
8/ 🥋 [image B]
Where do the strategies come from? Our KATA.
A kata is a frozen strategy: trend, momentum, mean reversion, order flow, volatility.
• it reads only closed candles
• change one setting = a new kata, counted publicly
No secret tuning.
9/ 🔐
The data: 2 years of real spot candles for BTC, ETH, BNB, SOL. 70,080 per asset, zero missing.
And we haven't looked at it yet. 👀
Everything is written down and fingerprinted BEFORE we open the data. Like a scientist registering the experiment before running it.
10/ 🧩
Each (strategy × asset × horizon × side × conviction) is its own "cell": 280 cells, each calibrated once.
Every cell gets served. Either it earns a region, or it serves calibrated silence.
No cell gets deleted because the result looked bad.
11/ 🛡️
Why should DeFi care?
Two of our questions look at the PATH, not the close: "how far can price drop inside the next hour?"
Because liquidations happen on the wick, not at the close. That band is what an agent needs to size a safety buffer.
12/ 🧾 [image C]
Every MONARK answer carries its receipt: which cell, which rank, how many past misses, the error bound, and a fingerprint of the calibration.
Anyone can recompute it. That's the point: you don't have to trust us.
13/ ⚠️
And we say plainly what this is NOT:
✕ not a probability of being right
✕ not a promise about every single trade
✕ it holds per time window, not over a position's lifetime
✕ it assumes the past resembles the future, and we test that assumption
14/ 🤫
Our honest expectation, written before seeing the data:
Most direction cells will stay silent. Markets are hard.
A gate that says "I can't vouch for this" isn't failing. It's doing its job. And we'll publish the silences in the same format as the wins.
15/ ⛩️
Data → kata → calibration → a checkable answer → silence when it's deserved.
That's conformal inference, end to end.
The DOJO trains. MONARK gates. The kata are coming. 🥋
1
2
23
The story said: 4.77M of the token added to provide more liquidity 📣
The chain says: 30,968 tokens in ONE tick, zero WETH, range set above spot. A sell order wearing an LP costume 👀 Three days later it is already two thirds filled 📉
Same object, two readings. Shōgen reads the t attests the fact from independent reads (one tick, one asset, above spot, the event log as source of truth) and keeps the residual honest. The tick and the zero WETH are facts, "he wants out" is a reading 🔍
This is where Kaihi comes in to work with Shōgen. For every other LP in that pool, a 30,968 token wall at one tick is toxic flow announced in advance. Kaihi takes the attested fact and moves exposed ranges before the wall is crossed. Kaihi is upcoming, Shōgen is built 🧭
The chain says: 30,968 tokens in ONE tick, zero WETH, range set above spot. A sell order wearing an LP costume 👀 Three days later it is already two thirds filled 📉
Same object, two readings. Shōgen reads the t attests the fact from independent reads (one tick, one asset, above spot, the event log as source of truth) and keeps the residual honest. The tick and the zero WETH are facts, "he wants out" is a reading 🔍
This is where Kaihi comes in to work with Shōgen. For every other LP in that pool, a 30,968 token wall at one tick is toxic flow announced in advance. Kaihi takes the attested fact and moves exposed ranges before the wall is crossed. Kaihi is upcoming, Shōgen is built 🧭
Stani deployed 30,968.25 AAVE of Aave liquidity in a single tick.
This is a 1-tickSpacing range order, or a 0DTE covered call. It signals "I want to exit that position", not "I want to provide healthy liquidity".
2
4
27
solana:FYZcYCHSp8FzNba1UtDZydKKGosmxVNpFBiVuia38AhT : institutional grade tools for the people the market was built to beat 🏛️
I. The casino, measured 🎰
Call the trenches what they are. On the largest token launchpad of the fastest chain, more than seven million tokens were five trades between January 2024 and March 2025. Fewer than one hundred thousand of them kept more than a thousand dollars of liquidity. A market surveillance firm that studied the whole population put it in one number: 98.6 percent of those tokens collapsed into worthless pump and dump patterns shortly after launch. The reason is not bad luck. It is the pricing curve itself, which raises the price with each purchase and pays the creator first, so that whoever joins later buys inflated and sells into the creator's exit.
Now look at the people, not the tokens. A market data provider published two years of monthly realized results for every active wallet on that launchpad, April 2024 to April 2026. From April 2024 through late 2025 the majority of active wallets ended almost every month in the red. The floor came in June 2025: 30 percent of wallets in profit, 70 percent in loss, in one of the busiest months the platform ever had. When the numbers turned in 2026, the study's own hypothesis was not that traders got smarter. It was that most of the losing crowd left. And even in the best month on record, the typical winning wallet made between one and five hundred dollars. The study says in plain words that it counts realized results only, so a wallet holding a token that went to zero is not counted as a loss, and that bot activity was not filtered out. The losses are understated. The winners include machines.
One more fact, this time from the regulator. In February 2025 the staff of the securities regulator of the United States explained that these coins are akin to collectibles, typically with limited or no use, and that neither purchasers nor holders are protected by the federal securities laws. Read it twice. The only protection a person has in the trenches is the tool in their hand.
We are not writing this to mock anyone who has been there. Most of us have. We are writing it because the house is not a metaphor. It is a curve, a set of bots, a stream of launches, and an information gap between the people who read the machine and the people who read the feed. You do not beat a casino by playing harder. You beat it by understanding its machines, and by refusing to sit at a table you cannot read.
II. A word on price, once 📈
We do not comment on price. We make one exception today, because the question is being asked in good faith.
The MONARK token is nineteen days old. Variations of the size we have seen are ordinary at that age, and they are ordinary on projects capitalized in the millions that we would call triple A. They do something useful: they widen the base of holders. The first thing that attracts anyone to a financial asset is its price, up or down. Bitcoin is the reference case. Fewer than ten million addresses held any bitcoin in 2017; more than fifty million did by 2024; the count sits near fifty seven million today. Addresses are not people, and one person can hold hundreds of them, but the direction across cycles is not in doubt: each cycle leaves more hands holding the asset than the one before.
There is a second pattern that every builder knows and few buyers like to hear. Development phases are flat or down. Distribution phases are not. A product that ships turns a holder into a user, and a user who checks what we publish tells someone else. That is the only snowball we are interested in. We will not manufacture a hype cycle on top of products that add nothing, because that is exactly the machine described above, and we would rather be the people who read it than the people who run it.
V. The lever 🤖
Why agents at all? Because the largest technological lever humans have ever built is now cheap, and it is being pointed at ordinary people rather than held by them.
The central bank of central banks wrote in its 2024 annual report that the adoption of large language models is proceeding at such breathtaking speed that it easily outpaces previous waves of technology adoption, and that these systems are highly refined prediction machines. The global financial stability body named the vulnerabilities in the same breath: dependence on a few service providers, correlated behaviour across markets, cyber risk, model risk and data quality, and a new potential for fraud and disinformation in financial markets.
Read those two documents side by side and you have MONARK's map. Provider concentration is why Shōgen measures source independence instead of trusting one feed. Model risk is why Hikae refuses to decide outside its calibrated coverage. Disinformation is why Bell publishes a signed record that a stranger can replay. Prediction machines are why we never serve a probability of being right.
The institutions already have this. They have surveillance desks that read the launch stream, calibrated risk models, signed audit trails, and agents that act within a written mandate. The person in the trenches has a feed and a button. MONARK exists to close that gap, and the only way to close it is to put the biggest lever there is, an agent that reads the machine, between the person and the button, and to make that agent accountable to a bound rather than to a feeling.
I. The casino, measured 🎰
Call the trenches what they are. On the largest token launchpad of the fastest chain, more than seven million tokens were five trades between January 2024 and March 2025. Fewer than one hundred thousand of them kept more than a thousand dollars of liquidity. A market surveillance firm that studied the whole population put it in one number: 98.6 percent of those tokens collapsed into worthless pump and dump patterns shortly after launch. The reason is not bad luck. It is the pricing curve itself, which raises the price with each purchase and pays the creator first, so that whoever joins later buys inflated and sells into the creator's exit.
Now look at the people, not the tokens. A market data provider published two years of monthly realized results for every active wallet on that launchpad, April 2024 to April 2026. From April 2024 through late 2025 the majority of active wallets ended almost every month in the red. The floor came in June 2025: 30 percent of wallets in profit, 70 percent in loss, in one of the busiest months the platform ever had. When the numbers turned in 2026, the study's own hypothesis was not that traders got smarter. It was that most of the losing crowd left. And even in the best month on record, the typical winning wallet made between one and five hundred dollars. The study says in plain words that it counts realized results only, so a wallet holding a token that went to zero is not counted as a loss, and that bot activity was not filtered out. The losses are understated. The winners include machines.
One more fact, this time from the regulator. In February 2025 the staff of the securities regulator of the United States explained that these coins are akin to collectibles, typically with limited or no use, and that neither purchasers nor holders are protected by the federal securities laws. Read it twice. The only protection a person has in the trenches is the tool in their hand.
We are not writing this to mock anyone who has been there. Most of us have. We are writing it because the house is not a metaphor. It is a curve, a set of bots, a stream of launches, and an information gap between the people who read the machine and the people who read the feed. You do not beat a casino by playing harder. You beat it by understanding its machines, and by refusing to sit at a table you cannot read.
II. A word on price, once 📈
We do not comment on price. We make one exception today, because the question is being asked in good faith.
The MONARK token is nineteen days old. Variations of the size we have seen are ordinary at that age, and they are ordinary on projects capitalized in the millions that we would call triple A. They do something useful: they widen the base of holders. The first thing that attracts anyone to a financial asset is its price, up or down. Bitcoin is the reference case. Fewer than ten million addresses held any bitcoin in 2017; more than fifty million did by 2024; the count sits near fifty seven million today. Addresses are not people, and one person can hold hundreds of them, but the direction across cycles is not in doubt: each cycle leaves more hands holding the asset than the one before.
There is a second pattern that every builder knows and few buyers like to hear. Development phases are flat or down. Distribution phases are not. A product that ships turns a holder into a user, and a user who checks what we publish tells someone else. That is the only snowball we are interested in. We will not manufacture a hype cycle on top of products that add nothing, because that is exactly the machine described above, and we would rather be the people who read it than the people who run it.
V. The lever 🤖
Why agents at all? Because the largest technological lever humans have ever built is now cheap, and it is being pointed at ordinary people rather than held by them.
The central bank of central banks wrote in its 2024 annual report that the adoption of large language models is proceeding at such breathtaking speed that it easily outpaces previous waves of technology adoption, and that these systems are highly refined prediction machines. The global financial stability body named the vulnerabilities in the same breath: dependence on a few service providers, correlated behaviour across markets, cyber risk, model risk and data quality, and a new potential for fraud and disinformation in financial markets.
Read those two documents side by side and you have MONARK's map. Provider concentration is why Shōgen measures source independence instead of trusting one feed. Model risk is why Hikae refuses to decide outside its calibrated coverage. Disinformation is why Bell publishes a signed record that a stranger can replay. Prediction machines are why we never serve a probability of being right.
The institutions already have this. They have surveillance desks that read the launch stream, calibrated risk models, signed audit trails, and agents that act within a written mandate. The person in the trenches has a feed and a button. MONARK exists to close that gap, and the only way to close it is to put the biggest lever there is, an agent that reads the machine, between the person and the button, and to make that agent accountable to a bound rather than to a feeling.
4
6
33
why SHŌGEN? 🔎
Every agent that moves money does one thing before it acts: it reads. A price, a balance, a quote, a block. Then it spends, hedges, votes or unwinds risk on what it read.
The payment side of agentic finance is being armored fast: credentials, spending limits, body armors is the reading side. An agent is only as good as its inputs, and today those inputs arrive naked: no proof of who said them, no proof of when, and no measure of whether the "many sources" behind them are actually one.
🧨 The oracle problem is a sources problem.
In January 2023 the US commodities regulator brought its first "oracle manipulation" case: a trader pushed a token's price on the three exchanges that fed a lending protocol's price feed, the reported price jumped more than thirteen times in thirty minutes, and over $110 million was withdrawn against that fake value. Three inputs, one hand. The feed had sources. It had no independence.
📏 Decentralization is a claim until it is measured.
Nodes, providers, feeds: "decentralized" is used as an adjective, rarely as a number. Public node explorers show what one axis looks like once measured: more than half of the Ethereum consensus nodes counted today run on hosting providers, not residential connections. That is not a scandal. It is a measurement, and measurements are what a quorum should be built on.
🧾 The founding line.
Shōgen means testimony. An attestation proves what a source said, never that the source told the truth. Every serious transport primitive already draws this line: TLS notarization proves that bytes came from a given site, and its own authors say it does not solve the oracle problem; content provenance standards refuse to make value judgments. Shōgen adopts the line as a specification. A testimony is a deposition, not a verdict.
🧱 What Shōgen adds above the transport. Four objects, in order:
1. Testimony: the raw answer of a source, captured by an attested transport, with content, source, instant and the residual trust of the transport named.
2. Fact: a testimony typed by an identified adapter into class, value, unit, method and freshness window. Typing is tested, not mathematically established, and the fact carries the identity of the typer.
3. Quorum verdict: k facts of one class, an estimator whose containment can be stated, and a certificate of diversity.
4. Verifiable batch: testimonies, facts, verdict and certificate, checkable offline by a third party against pinned keys, without trusting Shōgen.
🔬 The certificate of diversity is the part that did not exist.
Since 1986 we have known that independent teams writing independent versions still fail together far more often than chance allows: 27 versions, a million tests, 1,255 coincident failures, the independence hypothesis rejected at 99%. Organized diversity, two universities, protected nothing. Every quorum design since then has assumed the independence it did not measure. Shōgen replaces the assumption with a certificate that publishes what was measured (infrastructure, upstream dependencies), what was only declared (jurisdiction, operator) and the effective quorum that results. Three sources on one upstream count as one.
🌐 Beyond finance.
The same layer serves any agent that reads the world: an RPC answer, a registry entry, a public page, a sensor. Wherever an agent must act on what a machine told it, the questions are the same: who said it, when, through what, and how many truly distinct witnesses agree.
🧭 What is built and served today, said plainly.
The attest tool: one committed witness, its bytes, its hash and its named residual hypotheses. The full Shōgen sensor, which produces continuous testimonies across sources, is under test and is not served yet. We publish the limits with the piece.
⚙ One piece of the MONARK engine.
Shōgen is attested perception. Next to it, bounded authority: no irreversible action without a permit bound to the bytes it acted on. Perception that can be checked, authority that can be bounded, and a fleet of pieces around them, each with its records published. That is the engine. This is one gear.
Every agent that moves money does one thing before it acts: it reads. A price, a balance, a quote, a block. Then it spends, hedges, votes or unwinds risk on what it read.
The payment side of agentic finance is being armored fast: credentials, spending limits, body armors is the reading side. An agent is only as good as its inputs, and today those inputs arrive naked: no proof of who said them, no proof of when, and no measure of whether the "many sources" behind them are actually one.
🧨 The oracle problem is a sources problem.
In January 2023 the US commodities regulator brought its first "oracle manipulation" case: a trader pushed a token's price on the three exchanges that fed a lending protocol's price feed, the reported price jumped more than thirteen times in thirty minutes, and over $110 million was withdrawn against that fake value. Three inputs, one hand. The feed had sources. It had no independence.
📏 Decentralization is a claim until it is measured.
Nodes, providers, feeds: "decentralized" is used as an adjective, rarely as a number. Public node explorers show what one axis looks like once measured: more than half of the Ethereum consensus nodes counted today run on hosting providers, not residential connections. That is not a scandal. It is a measurement, and measurements are what a quorum should be built on.
🧾 The founding line.
Shōgen means testimony. An attestation proves what a source said, never that the source told the truth. Every serious transport primitive already draws this line: TLS notarization proves that bytes came from a given site, and its own authors say it does not solve the oracle problem; content provenance standards refuse to make value judgments. Shōgen adopts the line as a specification. A testimony is a deposition, not a verdict.
🧱 What Shōgen adds above the transport. Four objects, in order:
1. Testimony: the raw answer of a source, captured by an attested transport, with content, source, instant and the residual trust of the transport named.
2. Fact: a testimony typed by an identified adapter into class, value, unit, method and freshness window. Typing is tested, not mathematically established, and the fact carries the identity of the typer.
3. Quorum verdict: k facts of one class, an estimator whose containment can be stated, and a certificate of diversity.
4. Verifiable batch: testimonies, facts, verdict and certificate, checkable offline by a third party against pinned keys, without trusting Shōgen.
🔬 The certificate of diversity is the part that did not exist.
Since 1986 we have known that independent teams writing independent versions still fail together far more often than chance allows: 27 versions, a million tests, 1,255 coincident failures, the independence hypothesis rejected at 99%. Organized diversity, two universities, protected nothing. Every quorum design since then has assumed the independence it did not measure. Shōgen replaces the assumption with a certificate that publishes what was measured (infrastructure, upstream dependencies), what was only declared (jurisdiction, operator) and the effective quorum that results. Three sources on one upstream count as one.
🌐 Beyond finance.
The same layer serves any agent that reads the world: an RPC answer, a registry entry, a public page, a sensor. Wherever an agent must act on what a machine told it, the questions are the same: who said it, when, through what, and how many truly distinct witnesses agree.
🧭 What is built and served today, said plainly.
The attest tool: one committed witness, its bytes, its hash and its named residual hypotheses. The full Shōgen sensor, which produces continuous testimonies across sources, is under test and is not served yet. We publish the limits with the piece.
⚙ One piece of the MONARK engine.
Shōgen is attested perception. Next to it, bounded authority: no irreversible action without a permit bound to the bytes it acted on. Perception that can be checked, authority that can be bounded, and a fleet of pieces around them, each with its records published. That is the engine. This is one gear.
1
4
27
MONARK Chronicles — Ep. 1: Engine First
Everyone asks what the car looks like.
There is no car yet. There is an engine.
Designed in 3D. Calibrated to the micron. Measured point by point. Frozen, stressed, tested and still running.
Only then does it go in the body.
Engine first. Body later.
Everyone asks what the car looks like.
There is no car yet. There is an engine.
Designed in 3D. Calibrated to the micron. Measured point by point. Frozen, stressed, tested and still running.
Only then does it go in the body.
Engine first. Body later.
Higgsfield + holder tokenomics + memetic incentives?
Wen solana:6GGY8GViCR5v4xR4Lxb4nfiAJsEoJua5Gj6YecxbJ4BQ x solana:EN2nnxrg8uUi6x2sJkzNPd2eT6rB9rdSoQNNaENA4RZA collab?
13
9
43
1/ 🥋 The MONARK Dōjō is a flywheel. Not the buzzword kind. The kind you can check.
Here is how it turns, and what the research says about each turn. 🧵👇
2/ 🪙 Turn one: hold.
Keep MONARK in your own wallet. Nothing to stake, nothing to lock, nothing to sign up for.
The Dōjō nts: tokens × days, parcel by parcel.
3/ ⏳ Turn two: let time count.
Whatever you hold, the clock is 60 days. A bigger bag does not shorten it.
Sell a parcel, and that parcel's count restarts. No snapshot game. No last-minute buy.
4/ 📚 Why 60 days and not a ladder?
We looked. The literature does not show that a gradual schedule keeps holders better than a hard floor.
What it does show: when a known unlock date arrives, people leave together (IPO lock-ups, Ofek & Richardson).
5/ 🔒 So one rule follows: nothing is "earned once".
Your agent and its budget follow what you hold today. Not what you held on day 60.
There is no unlock date to run for, because there is no unlock.
6/ 🤖 Turn three: get an agent.
Egg, the first cap, opens an agent at your address. Yours.
Points beyond your cap are not wasted: they become inference, paid by MONARK, to train that agent in the Dōjō.
7/ ⚖️ How is the inference shared?
Proportionally to units, from an envelope published before each period. Capped per address. Unused share expires, and the expiry is published.
It is the only rule you cannot game by merging or splitting addresses (Calleja & Llerena). No first come, first served.
8/ 📈 Turn four: the agent trains.
Spot crypto first, then perps. You voted for that order.
It trains in the open, on a public, signed record. No leaderboard of agent performance: the research says a ranking changes how people behave, not how well agents do (Barton et al.).
9/ 🔍 Every line is checkable.
Your count, your share, your agent's budget: each address gets its own line with a proof, the same way proofs of liabilities work (DAPOL). Nothing is declared. Everything is read from the chain.
10/ 🔁 Why it turns.
Holders let time count → the formula opens agents → surplus points train them → their work lands on a public record → the record gives a reason to hold.
11/ 🧠 "Flywheel" is a management word. The mechanisms behind it have names: network effects, adoption complementarity, critical mass, learning from data.
We built each turn on one of them, and on the evidence against it too.
12/ 🚫 What we do not promise: a date, a price, a yield.
What we do: publish the rules before they apply, sign every line, and let you verify your own.
The Dōjō is being built. Hold, and let time count. 🥋
Here is how it turns, and what the research says about each turn. 🧵👇
2/ 🪙 Turn one: hold.
Keep MONARK in your own wallet. Nothing to stake, nothing to lock, nothing to sign up for.
The Dōjō nts: tokens × days, parcel by parcel.
3/ ⏳ Turn two: let time count.
Whatever you hold, the clock is 60 days. A bigger bag does not shorten it.
Sell a parcel, and that parcel's count restarts. No snapshot game. No last-minute buy.
4/ 📚 Why 60 days and not a ladder?
We looked. The literature does not show that a gradual schedule keeps holders better than a hard floor.
What it does show: when a known unlock date arrives, people leave together (IPO lock-ups, Ofek & Richardson).
5/ 🔒 So one rule follows: nothing is "earned once".
Your agent and its budget follow what you hold today. Not what you held on day 60.
There is no unlock date to run for, because there is no unlock.
6/ 🤖 Turn three: get an agent.
Egg, the first cap, opens an agent at your address. Yours.
Points beyond your cap are not wasted: they become inference, paid by MONARK, to train that agent in the Dōjō.
7/ ⚖️ How is the inference shared?
Proportionally to units, from an envelope published before each period. Capped per address. Unused share expires, and the expiry is published.
It is the only rule you cannot game by merging or splitting addresses (Calleja & Llerena). No first come, first served.
8/ 📈 Turn four: the agent trains.
Spot crypto first, then perps. You voted for that order.
It trains in the open, on a public, signed record. No leaderboard of agent performance: the research says a ranking changes how people behave, not how well agents do (Barton et al.).
9/ 🔍 Every line is checkable.
Your count, your share, your agent's budget: each address gets its own line with a proof, the same way proofs of liabilities work (DAPOL). Nothing is declared. Everything is read from the chain.
10/ 🔁 Why it turns.
Holders let time count → the formula opens agents → surplus points train them → their work lands on a public record → the record gives a reason to hold.
11/ 🧠 "Flywheel" is a management word. The mechanisms behind it have names: network effects, adoption complementarity, critical mass, learning from data.
We built each turn on one of them, and on the evidence against it too.
12/ 🚫 What we do not promise: a date, a price, a yield.
What we do: publish the rules before they apply, sign every line, and let you verify your own.
The Dōjō is being built. Hold, and let time count. 🥋
4
8
33
1/ 🔔 Tokenized stocks keep trading after Wall Street closes, overnight, and all weekend. Nobody keeps a public record of those hours. Bell does. Here's what's live, what comes next, and why the real Bell is taking shape now 🧵👇
2/ 📍 Live today at bell.monarkgate.tech: four , NVDAx, AAPLx, SPYx), three sessions a day. After-hours 🌆, overnight 🌙, and the weekend as one long stretch from Friday close to Sunday night 📅
3/ 🧾 Each line tells you four things:
📏 the gap: how far the token traded from its last real close
💵 the price: volume-weighted over the session
📊 the volume: how much moved vs a normal day of the real stock
⛔ the halts: when trading was stopped
4/ 🤫 Bell never invents a number. If a session couldn't be read, the line carries a named abstention instead, and the count of abstentions is published with the numbers. Every time. That's the whole discipline: it abstains, so it can act ✋
5/ 🔏 Every line is signed and names the line before it. Manifests are timestamped in Bitcoin ₿. Anyone with a copy can re-check the whole history with one script, no account, no key. Keep a copy: your copy is what makes any rewrite visible 👀
6/ ⏭️ What comes next, in order.
1️⃣ Every session, every day: Bell runs on its own after each close. What it brings: a continuous record you can rely on daily, not a snapshot someone starts by hand. This is where Bell stops being a demo and becomes a record 📚
7/ 2️⃣ Splits, dividends, delistings ✂️💸. What it brings: a gap that stays right through a split, and a line that says the exact day a token stopped tracking its stock. Corporate actions are where most "tokenized stock" data quietly breaks. Bell will say so, on the record.
8/ 3️⃣ The same stock on a second chain ⛓️⛓️. Ethereum next, same method, another issuer. What it brings: one company read two ways, so you can compare issuers and venues, not just prices.
9/ 4️⃣ More stocks, the same care 🔍. From four names toward the whole tokenized-equity universe. Each new name enters only after its own study on chain, so the record stays worth reading.
10/ 🧭 Where it goes: Robinhood Chain, Base, BSC, more issuers, one method for all of them so lines stay comparable across chains. And Koyomi 🤖: the weekend gap becomes something an agent can act on through the MONARK gate. Commit, defer, or abstain, with Bell's line as the evidence.
11/ 📂 Everything is a plain file, made to be read by people and by programs: /bell, state.json, timeline.jsonl, provenance.json, the public key and the verifier. No date is promised; every status is read from the register. Attested. Adaptive. Gated. Metered. 🦋
2/ 📍 Live today at bell.monarkgate.tech: four , NVDAx, AAPLx, SPYx), three sessions a day. After-hours 🌆, overnight 🌙, and the weekend as one long stretch from Friday close to Sunday night 📅
3/ 🧾 Each line tells you four things:
📏 the gap: how far the token traded from its last real close
💵 the price: volume-weighted over the session
📊 the volume: how much moved vs a normal day of the real stock
⛔ the halts: when trading was stopped
4/ 🤫 Bell never invents a number. If a session couldn't be read, the line carries a named abstention instead, and the count of abstentions is published with the numbers. Every time. That's the whole discipline: it abstains, so it can act ✋
5/ 🔏 Every line is signed and names the line before it. Manifests are timestamped in Bitcoin ₿. Anyone with a copy can re-check the whole history with one script, no account, no key. Keep a copy: your copy is what makes any rewrite visible 👀
6/ ⏭️ What comes next, in order.
1️⃣ Every session, every day: Bell runs on its own after each close. What it brings: a continuous record you can rely on daily, not a snapshot someone starts by hand. This is where Bell stops being a demo and becomes a record 📚
7/ 2️⃣ Splits, dividends, delistings ✂️💸. What it brings: a gap that stays right through a split, and a line that says the exact day a token stopped tracking its stock. Corporate actions are where most "tokenized stock" data quietly breaks. Bell will say so, on the record.
8/ 3️⃣ The same stock on a second chain ⛓️⛓️. Ethereum next, same method, another issuer. What it brings: one company read two ways, so you can compare issuers and venues, not just prices.
9/ 4️⃣ More stocks, the same care 🔍. From four names toward the whole tokenized-equity universe. Each new name enters only after its own study on chain, so the record stays worth reading.
10/ 🧭 Where it goes: Robinhood Chain, Base, BSC, more issuers, one method for all of them so lines stay comparable across chains. And Koyomi 🤖: the weekend gap becomes something an agent can act on through the MONARK gate. Commit, defer, or abstain, with Bell's line as the evidence.
11/ 📂 Everything is a plain file, made to be read by people and by programs: /bell, state.json, timeline.jsonl, provenance.json, the public key and the verifier. No date is promised; every status is read from the register. Attested. Adaptive. Gated. Metered. 🦋
9
4
28
1/ 📚 Update: the MONARK docs are live.
What is inside: one page per smart piece, the gate, the applications, how to check us without asking us, and a new page, MONARK Building, on what comes next and in which order.
→ monarkgate.tech/docs
→ monarkgate.tech/building
2/ 🔄 ild, in the open.
Read them, break them, tell us where we are wrong. 🧱
What is inside: one page per smart piece, the gate, the applications, how to check us without asking us, and a new page, MONARK Building, on what comes next and in which order.
→ monarkgate.tech/docs
→ monarkgate.tech/building
2/ 🔄 ild, in the open.
Read them, break them, tell us where we are wrong. 🧱
22
6
58
September 2017. Chainlink's first whitepaper, section 4.1, page 11. The authors name the problem: faults are correlated across data sources, one feed quietly copying another. And they propose research into "mapping and reporting the independence of data sources".
Nine years t exist. Oracle networks still aggregate feeds that may share the same upstream, and nobody publishes the overlap.
This is why we are building Shōgen. Its role: an attested perception layer for agents. It captures what each source said, over an attested transport, and turns it into typed facts. It aggregates them into a quorum verdict. And it attaches to that verdict the thing nobody ships: a diversity certificate, the measured independence of the sources behind it, with the shared upstreams, shared hosts and shared failures written down. All of it verifiable offline by a third party, with no trust in Shōgen itself.
An attestation proves what a source said, never that the source is right. Shōgen is built on that line, and it is the smart piece of the MONARK engine every decision starts from, before the gate says commit, defer or abstain.
Every piece of the engine is built the same way: it fits into a gap the current infrastructure leaves open, one of those holes that stay invisible until they cost a fortune in one afternoon. A price feed with no independence record, a liquidation with no measured coverage, an on-chain equity with no session-level gap on file. We do not replace the infrastructure. We fill what it left out, and we write it down.
research.chain.link/whitepaper-v1.…
Nine years t exist. Oracle networks still aggregate feeds that may share the same upstream, and nobody publishes the overlap.
This is why we are building Shōgen. Its role: an attested perception layer for agents. It captures what each source said, over an attested transport, and turns it into typed facts. It aggregates them into a quorum verdict. And it attaches to that verdict the thing nobody ships: a diversity certificate, the measured independence of the sources behind it, with the shared upstreams, shared hosts and shared failures written down. All of it verifiable offline by a third party, with no trust in Shōgen itself.
An attestation proves what a source said, never that the source is right. Shōgen is built on that line, and it is the smart piece of the MONARK engine every decision starts from, before the gate says commit, defer or abstain.
Every piece of the engine is built the same way: it fits into a gap the current infrastructure leaves open, one of those holes that stay invisible until they cost a fortune in one afternoon. A price feed with no independence record, a liquidation with no measured coverage, an on-chain equity with no session-level gap on file. We do not replace the infrastructure. We fill what it left out, and we write it down.
research.chain.link/whitepaper-v1.…
0
4
16
Today we filed a comment letter with the SEC on File No. 4-927, the temporary exemptive order for tokenized NMS stocks.
We did not argue for or against the exemption. We answered Questions 3 and 6 with what MONARK Bell measures on chain: for each session, the gap between the nd the last consolidated close, signed, hash-chained and published. Three URLs in the letter let anyone recompute the chain.
We also suggested four properties any public measurement of tokenized stocks should have: per session, per share, cross-read close, and a public record of every abstention.
The SEC posts comments within 3 to 5 business days. We will share the link as soon as our submission appears here:
sec.gov/rules-regulati…
Until then, the data the letter points to is already live:
bell.monarkgate.tech/state.json
monarkgate.tech/bell/method
We did not argue for or against the exemption. We answered Questions 3 and 6 with what MONARK Bell measures on chain: for each session, the gap between the nd the last consolidated close, signed, hash-chained and published. Three URLs in the letter let anyone recompute the chain.
We also suggested four properties any public measurement of tokenized stocks should have: per session, per share, cross-read close, and a public record of every abstention.
The SEC posts comments within 3 to 5 business days. We will share the link as soon as our submission appears here:
sec.gov/rules-regulati…
Until then, the data the letter points to is already live:
bell.monarkgate.tech/state.json
monarkgate.tech/bell/method
4
2
21
1/ 🧵 The first MONARK releases finally land tomorrow night. Narabi, Ukemi, and Bell right behind. Before that, a story about why this took the time it took, and why the next layer of DeFi is being built in this order. 👇
2/ 🏗️ Remember what DeFi looked like before it was DeFi. s ETHLend, and its token was called LEND. Holders migrated 100 LEND for 1 AAVE. That migration contract stayed open for half a decade; the DAO only proposed closing the LEND chapter in September 2025.
3/ 🦄 Uniswap went live on November 2, 2018. Its founder announced it to about 200 followers. No trusted price feeds, no rollups. Every lending protocol was one bad oracle away from zero.
4/ ⛓️ None of it arrived at once. Pools made lending liquid. Oracles made it survivable. Rollups made it cheap. Each piece was the trigger for the next, and only then did the thing we call DeFi exist. Years. Not weeks.
5/ 🧱 DeFAI is at the LEND stage. And its first brick has already cracked.
6/ 🪪 The first standard is ERC-8004, "Trustless Agents": on-chain registries for agent identity, reputation and validation, authored by people from MetaMask, the EF, Google and Coinbase. Live on mainnet this year. Tens of thousands of agents registered.
7/ 🔬 Then six researchers measured what was behind those registrations, on Ethereum, BSC and Base. Identity: only 3%, 4% and 15% of registered agents expose a valid file with a live endpoint. The rest are placeholders.
8/ 🗳️ Reputation: 73.5%, 59.2% and 90.6% of the reviewers rating those agents show coordinated Sybil behavior. Strip that feedback out and most rated agents on BSC and Base have none left. Their words: the registry "cannot function as a trust signal".
9/ 🔁 Identity by declaration. Reputation by vote. Both failed the moment someone looked. Not a reason to be cynical. It's the oracle problem again, one layer up: a number on-chain that nobody can recompute is a number you take on faith.
10/ 🛠️ The ecosystem noticed. Pocket Network Foundation drafted ERC-8294: instead of one address validating an agent, a network of validators, drawn from at least D distinct operators, returning signed attestations you can verify with the same code anywhere. Sensible.
11/ 🕳️ Now the part the authors wrote themselves. The contract "can count distinct operators but cannot prove they are independent". "The defense is methodology, not a contract field." Every network must publish a concentration analysis. The standard can require diversity. It cannot measure it.
12/ ♻️ The best thing in that draft came from the review thread: a second kind of validator, whose assurance comes from the fact that anyone can recompute the result from public data, with inputs committed before the outcome was known, anchored on Bitcoin via OpenTimestamps. The authors accepted it.
13/ 👀 Hold that thought. That is exactly how we build.
14/ 🔪 MONARK Engine is a Swiss-army knife. One handle that never changes: a gate that answers commit, defer or abstain; a budget the caller carries; six frozen contracts; no confidence field anywhere, enforced in code. Blades: sensors that attest, acts that execute on commit only, one entry point for other agents.
15/ 🎯 What it gives an agent: act on evidence, keep acting while the budget holds, leave a record anyone can replay from chain data. Attested. Adaptive. Gated. Metered. It abstains, so it can act.
16/ 1️⃣ Step one, foundations. 👁️ Narabi: reads the attested USDe redemption flow every day at block finality, publishes a hash-chained timeline anyone can replay. Runs today. It says plainly its printed bound stays above target until it has enough history.
17/ 🛡️ Ukemi: liquidation-cascade survival, the first act of the fleet. Reads the Aave v3 book at an archive block through several independent RPC providers that must agree, computes how far a cascade could spread, goes through the gate before anything is done. Built; calibrating on a fresh episode, scoring frozen before the data.
18/ 🔔 MONARK Bell: an attested witness for tokenized equities and a conformal class for the off-hours gap, in gap space, never in price. Being built. Its counter-verification course hashes every manifest and anchors it on Bitcoin through OpenTimestamps as it runs. ₿ Anchoring Narabi the same way is next.
19/ 🔭 Shōgen, our perception layer, is being built to its full shape: every fact arrives as a testimony (bytes, hash, origin, named residual hypotheses; never truth), and diversity gets measured instead of declared: what was measured, what is observable, what is merely claimed, and an effective quorum where sources behind one upstream count as one.
20/ 📏 That is the kind of object ERC-8294 asks every validation network to publish and leaves each to produce. We specified it for price sources first (one measurement: 4 hosts out of 5 behind the same network provider). Pointing it at validator sets is the obvious next place. Not done yet. We say so.
21/ 2️⃣ Step two, the gate opens to your agents. And that's why the 🥋 Dōjō sits before it, in pre-calibration: the gate can only act for an agent with a track record, and most agents have none. Real data, real conditions, no real money, every call and outcome logged and replayable. Not a promise, a prerequisite. In design.
22/ 3️⃣ Step three, the runners. 🏇 Agents with a record, a budget that can widen with the record, and more room to swing. An agent that knows when it doesn't know is the one you can let run.
23/ 🔎 Verify us, and verify them. Replay Narabi from chain data. Call the gate and watch it abstain outside its served class (design, not outage). Read the contracts: a confidence field throws instead of serialising. Then read ERC-8294's Security Considerations and ask any validation network for its concentration analysis.
24/ 🧭 Foundations first. Then the gate. Then the runners. Patience isn't waiting; it's what building the right layer looks like from the outside. Tomorrow night. 🫡
2/ 🏗️ Remember what DeFi looked like before it was DeFi. s ETHLend, and its token was called LEND. Holders migrated 100 LEND for 1 AAVE. That migration contract stayed open for half a decade; the DAO only proposed closing the LEND chapter in September 2025.
3/ 🦄 Uniswap went live on November 2, 2018. Its founder announced it to about 200 followers. No trusted price feeds, no rollups. Every lending protocol was one bad oracle away from zero.
4/ ⛓️ None of it arrived at once. Pools made lending liquid. Oracles made it survivable. Rollups made it cheap. Each piece was the trigger for the next, and only then did the thing we call DeFi exist. Years. Not weeks.
5/ 🧱 DeFAI is at the LEND stage. And its first brick has already cracked.
6/ 🪪 The first standard is ERC-8004, "Trustless Agents": on-chain registries for agent identity, reputation and validation, authored by people from MetaMask, the EF, Google and Coinbase. Live on mainnet this year. Tens of thousands of agents registered.
7/ 🔬 Then six researchers measured what was behind those registrations, on Ethereum, BSC and Base. Identity: only 3%, 4% and 15% of registered agents expose a valid file with a live endpoint. The rest are placeholders.
8/ 🗳️ Reputation: 73.5%, 59.2% and 90.6% of the reviewers rating those agents show coordinated Sybil behavior. Strip that feedback out and most rated agents on BSC and Base have none left. Their words: the registry "cannot function as a trust signal".
9/ 🔁 Identity by declaration. Reputation by vote. Both failed the moment someone looked. Not a reason to be cynical. It's the oracle problem again, one layer up: a number on-chain that nobody can recompute is a number you take on faith.
10/ 🛠️ The ecosystem noticed. Pocket Network Foundation drafted ERC-8294: instead of one address validating an agent, a network of validators, drawn from at least D distinct operators, returning signed attestations you can verify with the same code anywhere. Sensible.
11/ 🕳️ Now the part the authors wrote themselves. The contract "can count distinct operators but cannot prove they are independent". "The defense is methodology, not a contract field." Every network must publish a concentration analysis. The standard can require diversity. It cannot measure it.
12/ ♻️ The best thing in that draft came from the review thread: a second kind of validator, whose assurance comes from the fact that anyone can recompute the result from public data, with inputs committed before the outcome was known, anchored on Bitcoin via OpenTimestamps. The authors accepted it.
13/ 👀 Hold that thought. That is exactly how we build.
14/ 🔪 MONARK Engine is a Swiss-army knife. One handle that never changes: a gate that answers commit, defer or abstain; a budget the caller carries; six frozen contracts; no confidence field anywhere, enforced in code. Blades: sensors that attest, acts that execute on commit only, one entry point for other agents.
15/ 🎯 What it gives an agent: act on evidence, keep acting while the budget holds, leave a record anyone can replay from chain data. Attested. Adaptive. Gated. Metered. It abstains, so it can act.
16/ 1️⃣ Step one, foundations. 👁️ Narabi: reads the attested USDe redemption flow every day at block finality, publishes a hash-chained timeline anyone can replay. Runs today. It says plainly its printed bound stays above target until it has enough history.
17/ 🛡️ Ukemi: liquidation-cascade survival, the first act of the fleet. Reads the Aave v3 book at an archive block through several independent RPC providers that must agree, computes how far a cascade could spread, goes through the gate before anything is done. Built; calibrating on a fresh episode, scoring frozen before the data.
18/ 🔔 MONARK Bell: an attested witness for tokenized equities and a conformal class for the off-hours gap, in gap space, never in price. Being built. Its counter-verification course hashes every manifest and anchors it on Bitcoin through OpenTimestamps as it runs. ₿ Anchoring Narabi the same way is next.
19/ 🔭 Shōgen, our perception layer, is being built to its full shape: every fact arrives as a testimony (bytes, hash, origin, named residual hypotheses; never truth), and diversity gets measured instead of declared: what was measured, what is observable, what is merely claimed, and an effective quorum where sources behind one upstream count as one.
20/ 📏 That is the kind of object ERC-8294 asks every validation network to publish and leaves each to produce. We specified it for price sources first (one measurement: 4 hosts out of 5 behind the same network provider). Pointing it at validator sets is the obvious next place. Not done yet. We say so.
21/ 2️⃣ Step two, the gate opens to your agents. And that's why the 🥋 Dōjō sits before it, in pre-calibration: the gate can only act for an agent with a track record, and most agents have none. Real data, real conditions, no real money, every call and outcome logged and replayable. Not a promise, a prerequisite. In design.
22/ 3️⃣ Step three, the runners. 🏇 Agents with a record, a budget that can widen with the record, and more room to swing. An agent that knows when it doesn't know is the one you can let run.
23/ 🔎 Verify us, and verify them. Replay Narabi from chain data. Call the gate and watch it abstain outside its served class (design, not outage). Read the contracts: a confidence field throws instead of serialising. Then read ERC-8294's Security Considerations and ask any validation network for its concentration analysis.
24/ 🧭 Foundations first. Then the gate. Then the runners. Patience isn't waiting; it's what building the right layer looks like from the outside. Tomorrow night. 🫡
8
7
24
This is plain inference, end to end.
Prompt in, one forward pass, action out. One output only: commit. Defer and abstain do not exist.
Nothing is refused, so nothing is kept. No reason code, nothing to replay, nothing to audit.
It always answers, so it always acts.
Prompt in, one forward pass, action out. One output only: commit. Defer and abstain do not exist.
Nothing is refused, so nothing is kept. No reason code, nothing to replay, nothing to audit.
It always answers, so it always acts.
0
5
18
Plain inference always answers, so it always acts.
MONARK puts an airlock between the answer and the action: attest, calibrate, gate, act.
Three outputs only: commit, defer, abstain. Every refusal keeps its reason code, so both sides replay.
It abstains, so it can act.
MONARK puts an airlock between the answer and the action: attest, calibrate, gate, act.
Three outputs only: commit, defer, abstain. Every refusal keeps its reason code, so both sides replay.
It abstains, so it can act.
4
10
29
1/ 🔔 Update. MONARK Bell has a face now, and a job.
The bell is a primitive: a dome, a lip, one mint point. The point is the only thing that moves: the session record.
2/ 🌙 The market is closed about 135 hours a week. Bell is awake for all of them.
3/ 🎯 What Bell is for. , SPYx, NVDAx…) trade on-chain 24/7 while the cash market sleeps. The oracles admit it: Chainlink freezes the last on-chain value at the close and publishes nothing until the open. Bell records what happened in between, one number per token per closed session, with a hash.
4/ 📐 The number: g = ln(VWAP_share / P_close). The volume-weighted price the token actually traded at overnight, per share, divided by the last cash close, in log space so a +5% and a −5% are the same distance. Not a guess, not a model. A measurement you can recompute.
5/ 📚 Why this number. Cong et al. (2025), the only primary study on the question, measured Tesla tokens against the last close: on weeknights the gap exceeds 1% in 71% of sessions, 2% in 57%, 5% in 12%. And the token leads the open (β = 0.90, t = 22, N = 1 913). Scharnowski (2026) found 27% of tokenized-stock volume happens while the market is shut. That gap is the object. Bell measures it every night.
6/ ⚖️ "Per share" is the hard part. Some tokens rebase: one token stops being one share. Get it wrong and the log return carries a bias of 2·ln(m), about +0.8% on SPYx. Bell reads the Token-2022 ScaledUiAmount multiplier and every update in the chain history, so the price is converted to a real share before it is compared.
7/ 🔗 Where the fills come from. Several independent RPC operators, two of them paid archive nodes, every swap on the pools we track, replayed from the raw transactions. A number is published only when the operators agree. When they don't, Bell publishes an abstention and the reason. No quorum, no number. 🤐
8/ 🧾 What Bell writes: an append-only series, one JSON line per token per session, each line hashed and chained to the previous one, signed with an Ed25519 key. ✍️ The signature proves who wrote the line, never that the line is true. The only proof of truth is the replay: one command recomputes the whole series from the chain. 🔁
9/ 💡 The economics underneath. A gap is not a verdict. A token trading 3% under the close on a Sunday night is a fact about a market with no arbitrageur on duty, not about the company. Bell publishes the fact and its regime (weeknight 🌃, weekend 🛌, holiday 🎌) and lets a curator, a market maker or a regulator decide what it means for them.
10/ 🧮 The theorem we hold ourselves to. Bell's second half is a conformal class: for each token and regime, a curator states a forecast, Bell scores |g − ŷ|, and after n sessions the empirical quantile at α = 1% gives an interval. Barber, Candès, Ramdas and Tibshirani (2023, Thm 2): that interval covers 1−α only if tonight's session is distributed like the past ones. We do not assume it. So Bell never prints a coverage rate, and a cell with fewer than 99 sessions is marked under_calib, not filled in. 🚫📊
11/ 🙅 What Bell does not do: no score, no prediction, no green or red, no trading. Numbers are typeset, not graded. What it could not verify is listed as a named residual, not hidden.
12/ 🚧 Bell is being sifted through our gates and checkpoints right now, lot by lot. First census: 322 tokens · 7 chains · 8 issuers · 10 DEXs. It lands when the last gate is green, not before. ✅
13/ 💬 We read your feedback. So every day, we explain one piece. Tomorrow: what a residual is, and why an abstention is more honest than a number. 🔔
The bell is a primitive: a dome, a lip, one mint point. The point is the only thing that moves: the session record.
2/ 🌙 The market is closed about 135 hours a week. Bell is awake for all of them.
3/ 🎯 What Bell is for. , SPYx, NVDAx…) trade on-chain 24/7 while the cash market sleeps. The oracles admit it: Chainlink freezes the last on-chain value at the close and publishes nothing until the open. Bell records what happened in between, one number per token per closed session, with a hash.
4/ 📐 The number: g = ln(VWAP_share / P_close). The volume-weighted price the token actually traded at overnight, per share, divided by the last cash close, in log space so a +5% and a −5% are the same distance. Not a guess, not a model. A measurement you can recompute.
5/ 📚 Why this number. Cong et al. (2025), the only primary study on the question, measured Tesla tokens against the last close: on weeknights the gap exceeds 1% in 71% of sessions, 2% in 57%, 5% in 12%. And the token leads the open (β = 0.90, t = 22, N = 1 913). Scharnowski (2026) found 27% of tokenized-stock volume happens while the market is shut. That gap is the object. Bell measures it every night.
6/ ⚖️ "Per share" is the hard part. Some tokens rebase: one token stops being one share. Get it wrong and the log return carries a bias of 2·ln(m), about +0.8% on SPYx. Bell reads the Token-2022 ScaledUiAmount multiplier and every update in the chain history, so the price is converted to a real share before it is compared.
7/ 🔗 Where the fills come from. Several independent RPC operators, two of them paid archive nodes, every swap on the pools we track, replayed from the raw transactions. A number is published only when the operators agree. When they don't, Bell publishes an abstention and the reason. No quorum, no number. 🤐
8/ 🧾 What Bell writes: an append-only series, one JSON line per token per session, each line hashed and chained to the previous one, signed with an Ed25519 key. ✍️ The signature proves who wrote the line, never that the line is true. The only proof of truth is the replay: one command recomputes the whole series from the chain. 🔁
9/ 💡 The economics underneath. A gap is not a verdict. A token trading 3% under the close on a Sunday night is a fact about a market with no arbitrageur on duty, not about the company. Bell publishes the fact and its regime (weeknight 🌃, weekend 🛌, holiday 🎌) and lets a curator, a market maker or a regulator decide what it means for them.
10/ 🧮 The theorem we hold ourselves to. Bell's second half is a conformal class: for each token and regime, a curator states a forecast, Bell scores |g − ŷ|, and after n sessions the empirical quantile at α = 1% gives an interval. Barber, Candès, Ramdas and Tibshirani (2023, Thm 2): that interval covers 1−α only if tonight's session is distributed like the past ones. We do not assume it. So Bell never prints a coverage rate, and a cell with fewer than 99 sessions is marked under_calib, not filled in. 🚫📊
11/ 🙅 What Bell does not do: no score, no prediction, no green or red, no trading. Numbers are typeset, not graded. What it could not verify is listed as a named residual, not hidden.
12/ 🚧 Bell is being sifted through our gates and checkpoints right now, lot by lot. First census: 322 tokens · 7 chains · 8 issuers · 10 DEXs. It lands when the last gate is green, not before. ✅
13/ 💬 We read your feedback. So every day, we explain one piece. Tomorrow: what a residual is, and why an abstention is more honest than a number. 🔔
0
13
34
🏗️ MONARK Building · Task classes
We read your feedback. So every day, we explain one piece.
Today: "Ukemi does Aave liquidations. Can it do more? Perps? Where the liquidations actually are?"
Yes. Here is how the fleet grows, and what is built, being built, and planned. 🧵
1/ risk model". It ships task classes.
A task class is one measurable question, answered in one conformal cell:
(task_class, predictor_id, stratum) → a region, or an abstention with a named reason.
Each cell has its own scores, its own threshold, its own abstention. Nothing is pooled.
2/ What feeds what 🔁
Shōgen perceives: attested facts at a block (oracle price and its source, market print, quorum of independent RPC operators).
Recorders collect the labels: Ukemi's book at block on Aave v3 core; Bell's fills 24/7 on 5 chains for 330 tokenized stocks.
Ukemi models. Hikae gates. Narabi publishes a hash-chained timeline anyone can recompute.
3/ Classes today 📋
✅ built · depeg-24h (Hikae, stablecoins). Served, tested end to end.
🔧 building · liquidation-realized-given-oracle-path-24h (Ukemi, per position). Debt actually liquidated within 24 h, decomposed: repayment, seized collateral, deficit. Aave v3 core: WETH first, then sUSDe/USDe and the LST e-mode.
🔧 building · cluster-shortfall-given-oracle-path-24h (Ukemi, per cluster). Bad debt aggregated per cluster, for risk curators and underwriters. It will abstain almost everywhere, and say so with the count.
🔧 building · Bell, tokenized stocks. Not a prediction: a witness. Gap ln(P_token / P_close) and volume ratio per session (overnight, weekend, holiday, halt), residuals first-class.
4/ Why Aave v3 core first, and not the whole DeFi map 🗺️
Because we measured before we decided. On these clusters the "oracle cascade" loop is closed by construction: sUSDe/USDe moved to a USDT/USD source at block 22002625, LSTs use a capped rate × ETH/USD, WETH sits on Chainlink SVR. On the largest crash we studied, the oracle update preceded the liquidation 15 times out of 15. We have three real events with real labels. That is where a calibration can honestly begin.
5/ Perpetuals: planned 📌
You are right that perps are where liquidations are largest. The mechanics differ: mark price instead of spot oracle, funding, partial liquidation by the venue itself, auto-deleveraging, insurance fund. So the target is different (trader loss vs insurance-fund deficit), and "eligible is not liquidated" reads differently when the liquidator is the venue.
It becomes a new recorder leg (venue by venue, sha-pinned census, quorum) and a class of its own, on the model of perp-liquidation-realized-given-mark-path-24h. Two advisory reviews come first: the mechanics, and who actually consumes it (venues, insurance-fund LPs, market makers). Scheduled after the first real calibration lands on Aave.
6/ Candidates, not scheduled 🧭
LST/LRT exchange-rate paths. Tokenized treasuries. Bridge-wrapped assets. A candidate becomes a class only once a census of real events exists. Proposals welcome, with a data source.
7/ How a class is born: five gates, no shortcuts 🚪
① An observable target Y, decomposed, measurable after the fact. Never "risk".
② A predictor ŷ, plus what the caller must carry (here: the realized oracle path). No hidden guess.
③ Real labels, sha-pinned: a census of real events, hashed and replayable. Never synthetic pairs. That was the lesson of Ukemi v0.
④ Mondrian strata: cells by class × predictor × stratum (e-mode, health factor, size).
⑤ Abstention in numbers: fewer than 100 positions in a cell at α = 0.01 ⇒ abstain, count shown. New event ⇒ under_calib.
8/ Four things that never change 🔒
The frozen Prediction contract: adding a class never changes the schema, only the taxonomy grows.
No confidence field, anywhere. Not a score, not an accuracy, not a "verified" stamp.
Abstain ≠ refuse: a class without a committed calibration still answers "abstained: under_calib", with the numbers.
Built means wired: a served path plus a non-LLM integration test. Otherwise it stays "upcoming", whatever the code says.
9/ Everything is replayable. Nothing has to be trusted.
github.com/KraidleAI/Mona… · monarkgate.tech
Tomorrow: another piece. Keep the questions coming.
We read your feedback. So every day, we explain one piece.
Today: "Ukemi does Aave liquidations. Can it do more? Perps? Where the liquidations actually are?"
Yes. Here is how the fleet grows, and what is built, being built, and planned. 🧵
1/ risk model". It ships task classes.
A task class is one measurable question, answered in one conformal cell:
(task_class, predictor_id, stratum) → a region, or an abstention with a named reason.
Each cell has its own scores, its own threshold, its own abstention. Nothing is pooled.
2/ What feeds what 🔁
Shōgen perceives: attested facts at a block (oracle price and its source, market print, quorum of independent RPC operators).
Recorders collect the labels: Ukemi's book at block on Aave v3 core; Bell's fills 24/7 on 5 chains for 330 tokenized stocks.
Ukemi models. Hikae gates. Narabi publishes a hash-chained timeline anyone can recompute.
3/ Classes today 📋
✅ built · depeg-24h (Hikae, stablecoins). Served, tested end to end.
🔧 building · liquidation-realized-given-oracle-path-24h (Ukemi, per position). Debt actually liquidated within 24 h, decomposed: repayment, seized collateral, deficit. Aave v3 core: WETH first, then sUSDe/USDe and the LST e-mode.
🔧 building · cluster-shortfall-given-oracle-path-24h (Ukemi, per cluster). Bad debt aggregated per cluster, for risk curators and underwriters. It will abstain almost everywhere, and say so with the count.
🔧 building · Bell, tokenized stocks. Not a prediction: a witness. Gap ln(P_token / P_close) and volume ratio per session (overnight, weekend, holiday, halt), residuals first-class.
4/ Why Aave v3 core first, and not the whole DeFi map 🗺️
Because we measured before we decided. On these clusters the "oracle cascade" loop is closed by construction: sUSDe/USDe moved to a USDT/USD source at block 22002625, LSTs use a capped rate × ETH/USD, WETH sits on Chainlink SVR. On the largest crash we studied, the oracle update preceded the liquidation 15 times out of 15. We have three real events with real labels. That is where a calibration can honestly begin.
5/ Perpetuals: planned 📌
You are right that perps are where liquidations are largest. The mechanics differ: mark price instead of spot oracle, funding, partial liquidation by the venue itself, auto-deleveraging, insurance fund. So the target is different (trader loss vs insurance-fund deficit), and "eligible is not liquidated" reads differently when the liquidator is the venue.
It becomes a new recorder leg (venue by venue, sha-pinned census, quorum) and a class of its own, on the model of perp-liquidation-realized-given-mark-path-24h. Two advisory reviews come first: the mechanics, and who actually consumes it (venues, insurance-fund LPs, market makers). Scheduled after the first real calibration lands on Aave.
6/ Candidates, not scheduled 🧭
LST/LRT exchange-rate paths. Tokenized treasuries. Bridge-wrapped assets. A candidate becomes a class only once a census of real events exists. Proposals welcome, with a data source.
7/ How a class is born: five gates, no shortcuts 🚪
① An observable target Y, decomposed, measurable after the fact. Never "risk".
② A predictor ŷ, plus what the caller must carry (here: the realized oracle path). No hidden guess.
③ Real labels, sha-pinned: a census of real events, hashed and replayable. Never synthetic pairs. That was the lesson of Ukemi v0.
④ Mondrian strata: cells by class × predictor × stratum (e-mode, health factor, size).
⑤ Abstention in numbers: fewer than 100 positions in a cell at α = 0.01 ⇒ abstain, count shown. New event ⇒ under_calib.
8/ Four things that never change 🔒
The frozen Prediction contract: adding a class never changes the schema, only the taxonomy grows.
No confidence field, anywhere. Not a score, not an accuracy, not a "verified" stamp.
Abstain ≠ refuse: a class without a committed calibration still answers "abstained: under_calib", with the numbers.
Built means wired: a served path plus a non-LLM integration test. Otherwise it stays "upcoming", whatever the code says.
9/ Everything is replayable. Nothing has to be trusted.
github.com/KraidleAI/Mona… · monarkgate.tech
Tomorrow: another piece. Keep the questions coming.
4
7
37
🗺️ MONARK, as it stands today.
Two tiers, one spine: attested conformal inference on top, DeFi rails underneath, every handoff replayed by a test.
This is a snapshot, not a finish line. Pieces are still being built and reviewed, so this map will keep evolving. What is marked ng until it is wired and proven. 🧱
Two tiers, one spine: attested conformal inference on top, DeFi rails underneath, every handoff replayed by a test.
This is a snapshot, not a finish line. Pieces are still being built and reviewed, so this map will keep evolving. What is marked ng until it is wired and proven. 🧱
9
14
48
1/People keep asking what solana:FYZcYCHSp8FzNba1UtDZydKKGosmxVNpFBiVuia38AhT actually does.
Here is the version I would tell a friend over coffee. 🤍
It is not a yield. It is a budget. We call it B_t. Every time the engine is willing to stand behind a call, it says commit, dget is spent. If it is not sure, it says defer. If it cannot cover the call, it says abstain. Those two cost nothing. Hold is free on purpose.
When the tank is empty the gate does not guess. It abstains, with a reason: budget_exhausted.
2/Where that comes from, because it did not come from a launchpad.
In 1939 Jean Ville showed that a fair game is one where you cannot multiply your capital forever. In 2001 Glenn Shafer and Vladimir Vovk turned that into a whole theory of probability: two players, Skeptic and World. Skeptic only gets rich if the forecasts were a lie. Your capital process is the proof. That capital is our B_t.
Conformal prediction is the same game with a coverage number instead of a vibe. Vovk. Then Gibbs and Candès, then Angelopoulos, Barber and Bates: the region moves when you miss, the budget of errors is finite. Hikae is that rule on the wire. remaining_budget on every decision. Commit if the intent sits in the region and B_t is still above the floor. Otherwise the honest word is hold.
3/Why we mapped that onto a token.
Agents already rent inference by the call. @UsePodAI said it plainly: inference is becoming a commodity. What was missing was a price on the hop after ŷ. Not “how confident is the model”, a region you can recompute, and a budget you can watch.
If we charged you to abstain, we would be paying the engine to talk. So we do not. The expensive thing is the act we will stand behind. A faulty commit, once someone recomputes the frozen bytes, is supposed to cost the operator who posted the bond, not the company. Watchers get paid for catching that. Staking, if we do it, has to be useful, tied to that work. The rest of the tokenomics is still being written.
Same picture. The tank only drops on commit.
It abstains so DeFi can act. 🚪
Here is the version I would tell a friend over coffee. 🤍
It is not a yield. It is a budget. We call it B_t. Every time the engine is willing to stand behind a call, it says commit, dget is spent. If it is not sure, it says defer. If it cannot cover the call, it says abstain. Those two cost nothing. Hold is free on purpose.
When the tank is empty the gate does not guess. It abstains, with a reason: budget_exhausted.
2/Where that comes from, because it did not come from a launchpad.
In 1939 Jean Ville showed that a fair game is one where you cannot multiply your capital forever. In 2001 Glenn Shafer and Vladimir Vovk turned that into a whole theory of probability: two players, Skeptic and World. Skeptic only gets rich if the forecasts were a lie. Your capital process is the proof. That capital is our B_t.
Conformal prediction is the same game with a coverage number instead of a vibe. Vovk. Then Gibbs and Candès, then Angelopoulos, Barber and Bates: the region moves when you miss, the budget of errors is finite. Hikae is that rule on the wire. remaining_budget on every decision. Commit if the intent sits in the region and B_t is still above the floor. Otherwise the honest word is hold.
3/Why we mapped that onto a token.
Agents already rent inference by the call. @UsePodAI said it plainly: inference is becoming a commodity. What was missing was a price on the hop after ŷ. Not “how confident is the model”, a region you can recompute, and a budget you can watch.
If we charged you to abstain, we would be paying the engine to talk. So we do not. The expensive thing is the act we will stand behind. A faulty commit, once someone recomputes the frozen bytes, is supposed to cost the operator who posted the bond, not the company. Watchers get paid for catching that. Staking, if we do it, has to be useful, tied to that work. The rest of the tokenomics is still being written.
Same picture. The tank only drops on commit.
It abstains so DeFi can act. 🚪
6
14
33
About Shogen 🧵
1/
As we are preparing to put Shōgen on every oracle we already read, @Hookrfun makes a second surface honest. Not a new block on their catalog. Three witnesses the native callback does not attest. 🪝
One hook, many pools. Rules freeze at creation. Six callbacks quidity can leave without a callback. Their own writing is the split: surge reads depth, not a feed. The contracts are live, and unaudited. That is the right place to start.
1/
As we are preparing to put Shōgen on every oracle we already read, @Hookrfun makes a second surface honest. Not a new block on their catalog. Three witnesses the native callback does not attest. 🪝
One hook, many pools. Rules freeze at creation. Six callbacks quidity can leave without a callback. Their own writing is the split: surge reads depth, not a feed. The contracts are live, and unaudited. That is the right place to start.
10
9
34
We locked 21.8 million on-chain for three years.
Unlock starts 12 September 2027. Fully unlocked 11 September 2029. First lock, not the last. We will keep accumulating, and we will lock each new lot for the same horizon. A budget sold as inventory is not a budget. 🔒
Proof: solscan.io/account/63dKEi…
Stay close. The next pieces land in public. It abstains so DeFi can act.
Unlock starts 12 September 2027. Fully unlocked 11 September 2029. First lock, not the last. We will keep accumulating, and we will lock each new lot for the same horizon. A budget sold as inventory is not a budget. 🔒
Proof: solscan.io/account/63dKEi…
Stay close. The next pieces land in public. It abstains so DeFi can act.
14
11
29
Update 📪
1/8 📷
We are moving on more than one front. 🌊
Narabi is being specified as the next sensor. Task classes for the file, not the peg. msUSD is one of them. Main Street, June 15 to 20. The print stayed at one dollar while eight million left. Other classes are in the ion. attestor silence. cascade that finally gets a book. 🧾
Calibrate is not a slider. Exchangeability wants time. Weekday is not weekend. Kaiko measured weekend volume at about half. If we fit the region on Tuesday only, Friday night is a different world. That is why this takes weeks, not a demo afternoon. 📐
1/8 📷
We are moving on more than one front. 🌊
Narabi is being specified as the next sensor. Task classes for the file, not the peg. msUSD is one of them. Main Street, June 15 to 20. The print stayed at one dollar while eight million left. Other classes are in the ion. attestor silence. cascade that finally gets a book. 🧾
Calibrate is not a slider. Exchangeability wants time. Weekday is not weekend. Kaiko measured weekend volume at about half. If we fit the region on Tuesday only, Friday night is a different world. That is why this takes weeks, not a demo afternoon. 📐
2
3
14
You produce ŷ. We sit on the wire.
@OpenRouter is the catalog. @UsePodAI routes it, Surplus, Groq, Anthropic, a GPU with a bond. A spend ceiling is not coverage. A price cap is not 1−α. 🔌
MONARK captures the reasoning before the agent sees it. Not after the hop. Between the nt.
Shōgen attests the print: bytes, hash, named residuals. The model stays yours. 🧾
Then calibrate. Bring that ŷ. Bring its track record. We fit the region to YOUR predictor, not ours.
Coverage, not a probability of being right. That is the whole product. 📐
The agent is downstream of the verdict. commit · defer · abstain. If the region cannot cover the call, it holds. It abstains so it can act. No custody. No funds. Ever. 🚪
You keep the router. We keep the hop.
monarkgate.tech live on @clawpumptech 👀👇
@OpenRouter is the catalog. @UsePodAI routes it, Surplus, Groq, Anthropic, a GPU with a bond. A spend ceiling is not coverage. A price cap is not 1−α. 🔌
MONARK captures the reasoning before the agent sees it. Not after the hop. Between the nt.
Shōgen attests the print: bytes, hash, named residuals. The model stays yours. 🧾
Then calibrate. Bring that ŷ. Bring its track record. We fit the region to YOUR predictor, not ours.
Coverage, not a probability of being right. That is the whole product. 📐
The agent is downstream of the verdict. commit · defer · abstain. If the region cannot cover the call, it holds. It abstains so it can act. No custody. No funds. Ever. 🚪
You keep the router. We keep the hop.
monarkgate.tech live on @clawpumptech 👀👇
0
1
15
First lock is live. 🔒
We just locked 21.8 million tokens on-chain for 3 years.
Unlock starts September 12, 2027. Fully unlocked September 11, 2029.
This is the first lock of a series still to come.We think long term. We believe in the work.
📷Buyers can see on-chain that schedule.
Proof is in the transaction. 📷
solscan.io/account/63dKEi…
We just locked 21.8 million tokens on-chain for 3 years.
Unlock starts September 12, 2027. Fully unlocked September 11, 2029.
This is the first lock of a series still to come.We think long term. We believe in the work.
📷Buyers can see on-chain that schedule.
Proof is in the transaction. 📷
solscan.io/account/63dKEi…
1
2
13
We are opening the Narabi phase. 🌊
Not a fifth tool. A sensor. Same frozen contract as Shōgen: bytes, hash, named residuals. It attests the queue. It never writes a price. 🧾
What it plugs into, already built: Shōgen attests the print. Hikae gates. Calibrate fits the region to ts for a live book. Narabi is that book: mint, burn, redeem, utilization, attestor silence. 🔌
Task classes it brings, or finally makes honest:
1⃣flow-redeem-1h -> velocity of the file, not the peg.
2⃣utilization-lock-1h -> u → 1 before the depeg.
3⃣cascade-liquidable-24h leaves the fixture. The cascade ŷ gets qty, debt, K, the queue. 📐
The gate does not change. commit · defer · abstain. When the print still says 1.00 and the file has started, the honest word is hold. It abstains so it can act. 🚪
Honesty, because it is due: the MVP is still in stress test. Ergonomics and the practical path (the text channel, the clients that drop structuredContent, the way a human reads a verdict) can still move. Narabi does not skip that. It ships behind the same door. 🔧
Bring a wrapping. Bring a chain. We will hash the burns.
monarkgate.tech
Not a fifth tool. A sensor. Same frozen contract as Shōgen: bytes, hash, named residuals. It attests the queue. It never writes a price. 🧾
What it plugs into, already built: Shōgen attests the print. Hikae gates. Calibrate fits the region to ts for a live book. Narabi is that book: mint, burn, redeem, utilization, attestor silence. 🔌
Task classes it brings, or finally makes honest:
1⃣flow-redeem-1h -> velocity of the file, not the peg.
2⃣utilization-lock-1h -> u → 1 before the depeg.
3⃣cascade-liquidable-24h leaves the fixture. The cascade ŷ gets qty, debt, K, the queue. 📐
The gate does not change. commit · defer · abstain. When the print still says 1.00 and the file has started, the honest word is hold. It abstains so it can act. 🚪
Honesty, because it is due: the MVP is still in stress test. Ergonomics and the practical path (the text channel, the clients that drop structuredContent, the way a human reads a verdict) can still move. Narabi does not skip that. It ships behind the same door. 🔧
Bring a wrapping. Bring a chain. We will hash the burns.
monarkgate.tech
3
1
7
