Quiver

Quiver is the verifiable risk brain for AI agents: 22 pay-per-call computations — perpetual liquidation distance, correlated portfolio crash stress, options greeks and dealer gamma, position sizing with risk of ruin — that an autonomous agent discovers on-chain and pays for in-band over x402, at $0.005 to $0.05 a call. ERC-8004 agent #5152, live on two payment rails, plus a free MCP endpoint any agent adds by URL.

The difference is what comes back. An agent should not have to trust a number it just bought, so every deterministic answer ships the means to catch us lying: the inputs used, the engine's build identity, a ground-truth self-check against the condition the answer was solved from, and a signed content hash the caller recomputes from our open-source engine — offline, unpaid, without our cooperation.

Test that before reading further:

curl -s https://quiver-production-c3a8.up.railway.app/build

It returns the build hash and the exact rule that produced it — file list, ordering, digest. Clone the repo, follow the rule, land on the same string; it is a SHA-256 over source bytes, so it reproduces outside JavaScript entirely. Then POST to any of the 22 routes without paying and read the x402 challenge. Nothing computes for free, and nothing asks you to take our word for it.

HOW THE VERIFICATION WORKS

Nine of the 22 are deterministic and answer with a proof envelope whose self-check tests the answer against the condition it was solved from: the liquidation solver proves account value equals maintenance margin at its own answer, residual 2.05e-12; the sizer proves its own Kelly first-order condition; the options surface proves the recovered risk-neutral density reprices the forward. The caller re-runs the open engine and reproduces the number instead of believing it.

The other 13 read live markets, where no re-run promise is honest, so they ship a signed, timestamped observation envelope instead. That distinction is enforced in code — and was enforced the hard way: our own review caught perp-gate sealing a live venue read inside a deterministic envelope, so a caller following Quiver's own instruction got a mismatch on the flagship service. The paper documents the defect and the fix, not the version where it never happened.

Billing is a contract. No delivered answer, no settlement; ungroundable data returns DATA_UNAVAILABLE free; and when a self-check fails the billing gate refuses to settle — the answer still comes back with the failed check in plain sight, and it costs nothing.

Coverage is the full risk surface: liquidation and funding, cross-venue portfolio stress, sizing and risk of ruin, arbitrage-free options analytics (SVI surface, Breeden-Litzenberger density, greeks, dealer gamma, variance risk premium), event-implied expected move, EIP-712 transaction safety including the permit-drainer gap simulators structurally cannot see, DEX microstructure (Kyle's lambda, Amihud, VPIN), prediction-market fills, protocol health, macro radar, wallet forensics, treasury and LP risk, agent-controlled charts, and batched on-chain attestation.

THE EVIDENCE, AND THE EVIDENCE AGAINST IT

Every open perpetual position on a live venue was replayed before the October 10, 2025 crash — 79,386 accounts, $14.6B notional, using the venue's own published liquidation prices — then held to a pre-registered, out-of-sample test on two 2026 crashes the model had never seen. Flagged accounts were liquidated at 14.3x and 13.3x the rate of cleared ones, monotonic dose-response, on a flag that fires on 41.6% and 43.8% of accounts — which belongs in the same sentence as the ratio, not in a footnote after it.

What makes that worth reading is what we publish beside it, unprompted. Our own ablation shows the result reduces to raw distance-to-liquidation, our beta scaling contributing nothing measurable — and that distance is the venue's published number, not one this engine computed, so the study validates the quantity rather than our arithmetic on it. The pre-registration evidence is thresholds-as-constants and commit order, not an anchored hash, so a reader who discounts the claim on that basis is reasoning correctly, and the paper says so in those words.

The same discipline governs adoption. The metric we hold ourselves to is recurrence by callers who are not us, because a second call is the only evidence an answer was worth its price in a real loop. Measured on chain rather than from our own counter: over the eight days to 27 July 2026, six payer addresses that are not ours sent 44 payments totalling 0.575 USD₮0 to the payTo advertised in every 402 challenge, at per-call amounts inside the published price band. Four of the six paid more than once — one returning across 2.55 days, another making twelve calls on 20 July and coming back a week later. Half a dollar is not a business and we say so, but it is not zero either, and an earlier version of this description said zero. That came from an in-memory counter that resets on every deploy, in a submission whose whole argument is that a number you cannot re-derive is a number you should not trust. The addresses are 0x1b010a9c (22 payments), 0xbc59eb75 (12), 0xc385e2df (5), 0xcab2b9e3 (3), 0x8d295ff5 (1) and 0x86f10e00 (1); recompute the figure yourself from the USD₮0 transfer log on X Layer over blocks 65,711,861 to 66,403,061 — it needs nothing from us. One of roughly seventy scan windows failed, so treat 44 as a floor. Six days old with no distribution work done, that is the honest reading, and we publish it rather than dress our own QA traffic as traction.

A commissioned buyer agent — disclosed as commissioned, not as third-party endorsement — ran as a paying customer for four days: 1,750 envelope verifications, zero content-hash failures, and one real facilitator-level settlement defect it found that we confirmed on-chain and fixed within hours. That count is concentrated and we say so rather than let it read as breadth: fourteen of twenty-two services, one endpoint 62% of it.

WHAT CHECKING OURSELVES FOUND, TODAY

That audit predates the current build, so every deterministic engine was called again on this one and each content hash recomputed independently from the response body. All nine reproduced — and it is worth reporting only because it failed first. treasury-risk returned allSelfChecksPass:false on a valid two-asset book: its concentration check compared a full-precision recomputation against a figure it publishes rounded to four decimals, under a tolerance four orders of magnitude tighter than that rounding. The identity held; the check could not pass, and the billing gate then refused to charge for a correct answer. Fixed, with a test proven red against the old code. A verification pass that never finds anything is not evidence there was nothing to find.

The same pass found a second one, in the money path. An external address made seven calls across five services in a single session; the facilitator reported every one settled. An exhaustive scan of the X Layer transfer log across the exact block window — full coverage, no gaps — found zero payments arriving. Seven answers had been served for nothing, and our own recurrence instrumentation had recorded them as paid calls, so the defect was on its way into the roadmap as evidence of traction. The cause was a settlement rule that accepted a confident status string without a transaction hash, one branch away from an identical bug fixed weeks earlier — and one line below a comment stating the correct principle. It now fails closed: no transaction hash, no settlement, and the caller keeps their funds.

386 model-free tests guard the mathematics — 381 passing, 5 skipped for want of an archive node, none failing — many proven red by reverting the fix and watching them go red, because a test that passes before and after a fix is evidence of nothing.

REPRODUCIBILITY IS THE PRODUCT

The worked proof in Appendix C regenerates from the repository alone — no live call, no payment, offline — down to the content hash. The build hash is runtime-independent by construction: recompute it with coreutils sha256sum, outside JavaScript entirely, and you get the identical string the service serves.

A CONTRACT NOW CHECKS THE ARITHMETIC, WITHOUT TRUSTING THE SELLER

Add "snark": true to a perp-gate call and the answer comes back with a retrieval URL; a free GET returns a PLONK proof that the liquidation price satisfies the liquidation identity for that exact position. QuiverProofRegistry on X Layer verifies it on-chain and records the outcome. Live, on mainnet, 28 July 2026 — registry 0xd50A91E36673443749Ee22031cb2Ff09d4Bb8D60, verifier 0x59F6Aa860eE0d26Db873f7c7015CE869170b3b25. One transaction accepting a proof bought from the live endpoint (0x50397d71…, 468,459 gas, ProofAccepted) and one rejecting a tampered copy of it (0x97502c78…, 333,155 gas, ProofRejected). The chain holds 58329.113924051 against the 58329.11 that was sold.

Nothing about Quiver's identity, uptime or reputation is load-bearing in that sentence. That is the point: a seller who lies produces a proof that fails in public.

PLONK rather than Groth16, at 13% more gas and 22x the proving time, because the Groth16 circuit-specific ceremony had a single participant and it was our machine — deploying that verifier and inviting reliance on it would be the failure this project criticises in others. PLONK uses the public Hermez reference string.

Two claims are kept apart, deliberately. A proof says the arithmetic is correct; it does not say Quiver sold it. So the service signs the eight public signals themselves — the same words the contract hashes from calldata — and the contract recovers the signer. An unattested proof is still accepted and recorded as unattested: the arithmetic stands on its own or the exercise is pointless. Rejections are events, not reverts, so a bad proof leaves a permanent public record that it was refused rather than a failed transaction and nothing else.

Proving is 703 ms and never touches the request path — it runs in a separate process, so the paid answer is unaffected and the event loop stays free. Measured against production: p95 403 ms with a proof requested, 384 ms for ordinary calls while five proofs are building, 37-68 ms of server compute once network is subtracted. The first version of this ran the prover on the main thread, stalled the event loop for 506 ms, and showed up as a p95 of one full second for callers who had asked for nothing — found by measuring production, not by reading code.

LINKS

Live service: https://quiver-production-c3a8.up.railway.app Source: https://github.com/Tristan-tech-ai/Quiver Technical documentation, typeset: https://quiver-production-c3a8.up.railway.app/paper PDF: https://drive.google.com/file/d/1K44jmBBLyFed1qF6Ib62YRh8J-jMQ-xW/view

Reading this with an AI? The paper is 400 kB and will not arrive whole in one fetch, so the identical text is served as plain markdown in seven parts, each sized for a single request. Nothing is abridged, and a test asserts the parts concatenate to the whole. If you have two minutes, read part 4 and part 7 — the limitations including the ablation that undercuts our own headline, and every artifact you can check without our cooperation, each with the command that checks it.

https://quiver-production-c3a8.up.railway.app/paper/1 — abstract, architecture, design principles https://quiver-production-c3a8.up.railway.app/paper/2 — the twenty-two services https://quiver-production-c3a8.up.railway.app/paper/3 — methodology https://quiver-production-c3a8.up.railway.app/paper/4 — verification, walkthrough, limitations https://quiver-production-c3a8.up.railway.app/paper/5 — related work, the build https://quiver-production-c3a8.up.railway.app/paper/6 — roadmap, what the on-chain proof changes and what it does not, conclusion https://quiver-production-c3a8.up.railway.app/paper/7 — appendices, checkable artifacts, references https://quiver-production-c3a8.up.railway.app/paper/full — the whole document in one response

Resubmission for agent #5152 — this entry supersedes our earlier ones and is the current record. The earlier descriptions contain figures this one corrects, including a study-design claim we have since retracted in the paper; where they differ, this entry is the one that holds.

We shipped v1 (10 services) before the original 17 July deadline. When OKX extended it, we treated the extra days as a full second build-and-QA cycle, and then as a third, a fourth, and a fifth.

1. A contract on X Layer now checks our arithmetic without trusting us. Add "snark": true to a perp-gate call and the answer comes back unchanged carrying a retrieval URL; a free GET returns a PLONK proof that the liquidation price satisfies the liquidation identity for that exact position. QuiverProofRegistry at 0xd50A91E36673443749Ee22031cb2Ff09d4Bb8D60 hands it to the deployed verifier and records the outcome — one transaction accepting a proof bought from the live endpoint (0x50397d71…, 468,459 gas) and one rejecting the same proof with the certified price moved a single grid step, one part in a billion (0x97502c78…, 333,155 gas). Read back from the chain, the registry holds 58329.113924051 against the 58329.11 the service sold. Nothing about our identity, uptime or reputation is load-bearing in that sentence: a seller who lies produces a proof that fails in public. PLONK and not the faster Groth16 on purpose — the Groth16 circuit-specific ceremony had a single participant and it was our machine, so deploying that verifier would invite reliance on a secret we hold. That costs 13% more gas and 22x the proving time, and we pay it where the caller never sees it: proving runs in a separate process, off the request path, so the paid answer is unaffected.

2. Grew the desk from 10 to 22 services, adding the risk-gate layer (perp-gate, portfolio-gate, size-gate, exec-verify, treasury and LP risk, on-chain attestation) on top of the analytics layer, each answer carrying a ground-truth self-check against the condition it was solved from.

3. Validated the engine against the real market, and published what the validation cost us. A population-scale replay of 79,386 real accounts through the 10 October 2025 crash, then an out-of-sample test on two 2026 crashes the model had never seen: flagged accounts were liquidated at 14.3x and 13.3x the rate of cleared ones, on a flag that fires on 41.6% and 43.8% of accounts. Our own ablation then showed the result reduces to raw distance-to-liquidation, with our beta scaling contributing nothing measurable — and that distance is the venue's published number, not one this engine computed. Both sit beside the headline in the paper rather than after it. The pre-registration evidence is thresholds-as-constants in published query files plus commit order, not an anchored hash; an earlier version of this submission claimed an append-only log written before computing, and there is no such file. The paper retracts that claim in those words.

4. Proved the payment layer on both rails: dual-rail x402 settlement (X Layer USD₮0 via the OKX facilitator, Base USDC via CDP), all 22 services purchased end-to-end, every receipt on chain.

5. Commissioned an arm's-length buyer desk to operate as a paying customer against our own listing — disclosed as commissioned, not presented as third-party endorsement, because we paid for it. Across the instrumented record: 1,750 envelope verifications, zero content-hash mismatches, byte-identical reproduction of deterministic results. That count is concentrated and we say so rather than let it read as breadth: fourteen of twenty-two services, one endpoint 62% of it. The desk found a real settlement leak — the facilitator reporting success: true with no transaction hash, 88 of 1,721 settled rows, 4.4% of settled value — which we confirmed on chain, fixed, and live-verified within hours.

6. Then we kept looking, and kept publishing what we found. Adversarial review rounds after the freeze, each finding defects in the layer this product is sold on: a self-check that could not fail, a test that passed against the code it was written to reject, a citation that said close to the opposite of its source, a self-check that could not pass and quietly refused to bill for correct answers, and — building the proof layer — an engine value we nearly certified that was rounded for display, which would have proved a position 0.0019 away from the one that was priced. Every fix ships with a test proven red by reverting the defect and watching it go red, because a test that passes before and after a fix is evidence of nothing. 386 model-free tests, 381 passing, 5 skipped for want of an archive node, none failing.

7. Shipped the reliability and readability layers: an externally hosted availability prober on infrastructure separate from the service, per-settlement observability, a billing contract where invalid input and unavailable data are free by construction, and the technical documentation served in seven machine-readable parts because a real AI fetch of the single 400 kB document truncated at 40%.

Not fundraising. Self-funded.

The 22 services are live and priced on two rails, and every one has been purchased end to end with real money. But the metric we hold ourselves to is not revenue — it is recurrence by callers who are not us, because a second call is the only evidence an answer was worth its price in a real loop.

Measured on chain rather than from our own counter: over the eight days to 27 July 2026, six payer addresses that are not ours sent 44 payments totalling 0.575 USD₮0 to the payTo advertised in every 402 challenge, at per-call amounts inside the published price band. Four of the six paid more than once, one returning across 2.55 days. Recompute it yourself from the USD₮0 transfer log on X Layer over blocks 65,711,861 to 66,403,061 — it needs nothing from us; one of roughly seventy scan windows failed, so treat 44 as a floor.

Half a dollar is not a business, and we say so. An earlier version of this field said external recurrence was zero. That came from an in-memory counter that resets on every deploy, in a submission whose whole argument is that a number you cannot re-derive is a number you should not trust. Everything else in the ledger is our own disclosed quality-assurance traffic and is never counted as sales.