building ANS-V3

Building decentralized agentic infrastructure to provide cross-chain execution context to AI agents. building ANS-V3

The calibration registry becomes a decentralized agent.

Today ANS records calibrations and backtests. ANS-V3 makes it the referent agent that proposes them: a decentralized service, trained on how API-consuming agents actually behave, targeting the predictive signal deterministic calibration never reached.

01 · DECENTRALIZED
No single signing key
From one HMAC secret on one host to DON threshold-signature consensus. Each node recomputes the regime from its own RPC. No single point of trust.
02 · AGENT FEEDBACK
An API that learns from behavior
ANS observes what consuming agents actually do: a transaction that fails or is sandwiched after an ACT is a free ground-truth label feeding recalibration.
03 · DELTA, RE-ATTACKED
The predictive signal, re-attacked
The composite delta failed deterministic calibration (no significant lift). It becomes ANS's core research target, explored on decentralized compute (Nosana).

ANS proposes. It never signs.

This is the central invariant. Three environments, each with exactly one role: ANS proposes (exploratory, non-deterministic), the DON validates and signs (deterministic, by consensus), a human arms the decision.

StepWhoWhere it runsNature
PROPOSE (calibrations + matrix / delta) The ANS brain Nosana (decentralized GPU) non-deterministic, exploratory
VALIDATE / PRODUCE the attestation The Chainlink DON CRE / DON deterministic, BFT
ARM (put into force) You / governance human final decision

Nothing non-deterministic ever touches a signature. The brain that searches and proposes (and can be wrong) lives on Nosana; the production of the signed data stays on the DON, deterministic. The two are never mixed.

Why the reference needs an engine

Consensus does not protect against bad calibration: it legitimizes it. When every node computes the same regime from the same thresholds, agreement is guaranteed. But if the thresholds are wrong, every node computes the same wrong answer, in consensus. The exploratory brain exists to attack exactly that:

Risk 1
Calibration too sensitive
S2D2 is returned on a structurally normal network. Agents route away from L1 unnecessarily, creating artificial congestion on L2.
Risk 2
Calibration too lax
S1D1 is returned while the network is under real tension. Agents execute transactions that fail, are sandwiched, or land at unfavorable cost.
Risk 3
Post-upgrade drift
After a protocol upgrade (e.g. Pectra), historical thresholds become obsolete. Classification is systematically wrong until recalibration is triggered.

What is Nosana?

A decentralized marketplace of GPUs, an "Airbnb for GPUs". You package your computation in a container (Docker), submit it, it runs on someone's GPU somewhere in the network, you pay in credits. Why there, and not on a single server? An agent that claims to decentralize attestation cannot run its brain on one machine. A single-server brain is a single point of control, a black box: exactly what ANS promises never to be.

What the brain actually does: two roles

Role 1
Propose calibrations
Find how to set the baseline, the H5 problem: tell a legitimate regime change (e.g. a fork) apart from a pathological drift. The proposer exploring these settings is a language model, and a language model runs on GPU; every candidate it proposes is then scored by a deterministic CPU evaluator.
Role 2
Improve the matrix and the delta
The predictive delta failed in deterministic calibration (refuted: lift 1.05x, p=0.19). ANS searches for feature combinations that actually predict: the exploring brain is a language model running on GPU, and each candidate it proposes is validated by deterministic CPU statistics under sealed holdout. The GPU carries the exploration; the CPU carries the proof.

How the loop works

The fuel is the downstream behavior of the agents that consume the API. That is the point of the design.

01
Observe
An AI agent reads Invarians, receives ACT, acts on-chain. Its transaction succeeds, fails, is sandwiched, or lands at unfavorable cost. That downstream outcome is a free ground-truth label. Where the backtest has only 4 events, the stream of consuming agents provides a continuous, real training signal.
02
Propose
On Nosana, the brain digests this feedback and produces a candidate calibration or matrix.
03
Backtest
The candidate is tested automatically against historical events.
04
Anchor
The proposal is written on-chain: dated, versioned, refutable. Total traceability, or ANS becomes a black box again.
05
Validate
The DON (deterministic, many nodes agreeing) verifies the candidate.
06
Arm
You and governance decide whether to put it into force, or not.
The brain (Nosana) never has the last word. It proposes; the DON checks; the human arms.
Honesty about maturity All of this is future. The V3 specification is explicit: PROPOSAL (not implemented), target Q3-Q4 2026. Today ANS is a passive registry: it documents, after the fact, decisions made by hand. What is described here is the shift from "what documents the decision" to "what proposes the decision". Until the behavioral loop produces a measurable gain (p < 0.05, sufficient n), we do not claim a "predictive delta": ANS is the approach to solve it, not the solution.

The loop, and the proof it owes

PROOF OF UTILITY the test the loop must pass ground-truth labels return ANS V3 brain Nosana · proposes Candidate dated, versioned DON validates deterministic Governance arms human puts in force Consuming agents agentic.invarians.com
The brain takes the V2 context (n-1) as input, proposes on Nosana, the candidate is validated deterministically, governance arms it, consuming agents put it to work, and their on-chain outcomes return as free labels. The whole loop turns for one reason: the proof at its center.
Proof of utility · honest status today
Neutral audit An external party attests the execution context, not the agent acting on it. Asserted, not yet measured
Predictive delta The Drift Signal must predict, not just describe what already happened. Refuted today (lift 1.05x, p=0.19)
Cost of abstention In RWA, pausing is not free. The harm avoided must outweigh the certain cost of waiting, false alerts included. Not yet demonstrated

The added value is a hypothesis under test, not a settled claim. This loop exists to prove it, or refute it, in the open.

The DON will validate and sign. Deterministic, by consensus. (target Q3-Q4 2026)

A proposed calibration is not trusted because ANS says so. It is produced under consensus: each DON node recomputes the regime from its own RPC, and a signed attestation is issued only when nodes agree. Determinism is the rule here, the opposite of the exploratory brain.

Prerequisite zero Today the live attestation is HMAC-SHA256, a symmetric signature: whoever can verify it can forge it. Decentralizing means migrating to a threshold signature, where the DON itself signs. Continuous metrics make byte-identical consensus impossible, so consensus is per-field: identical on the discrete decision (BS1 / BS2, S1 / S2), median on timestamps and continuous values.

What is certified and exposed today

Each chain has its own τ (structural) and π (demand) thresholds. Calibration version, data basis, and last update date are published for each.

Ethereum
● Certified
✓ 12 signed codes since 2026-04-29 (S1, S2+, S2- × D1, D2+, D2-, D2±) ✓ τ: rhythm + continuity (M1: 5.07) ✓ π: sigma + size + tx with calibrated lower bounds ⚠ beacon_participation: ratio + epoch live, S2- threshold pending (calibration scheduled May 2026)
Polygon
● Certified
✓ 12 signed codes since 2026-04-29 ✓ τ: rhythm + continuity (M1: 12.60) ✓ π: sigma + size + tx (M1: 3.59) with calibrated lower bounds
Solana
⚠ Partial
✓ τ: structural ⚠ σ: proxy v1 (M1: 0.37) ⚠ tx_count unavailable ⚠ 4 base codes (12 signed scheduled July 2026)
Avalanche
⚠ Partial
⚠ M1: 0.07: insufficient ⚠ Dimensions not certified ⚠ 4 base codes (12 signed scheduled July 2026)
Arbitrum
● Certified
✓ 12 signed codes since 2026-04-29 (multi-dim demand: sigma + size + tx + complexity + gas_complexity) ✓ sequencer_publish_latency (3rd structural axis): halt threshold 600 s, calibrated 2026-05-01 on batch_gap_seconds ✓ Lower-bound demand thresholds active (D2-, D2± classification possible)
Base
● Certified
✓ 12 signed codes since 2026-04-29 (multi-dim demand: sigma + size + tx + complexity + gas_complexity) ✓ sequencer_publish_latency: halt threshold 480 s, calibrated 2026-05-01 ✓ Lower-bound demand thresholds active
Optimism
● Certified
✓ 12 signed codes since 2026-04-29 (multi-dim demand: sigma + size + tx + complexity + gas_complexity) ✓ sequencer_publish_latency: halt threshold 1800 s, calibrated 2026-05-01 ✓ Lower-bound demand thresholds active
Cross-chain bridges
Structural, event-based
✓ CCTP structural state BS1/BS2 on 10 routes, methodology v1.2: I1 attestation success-rate, I2 forced-fallback rate, I5 Standard-mode message stuck past 48h. No latency percentile in the decision path (the prior P97-on-latency calibration is retired). ⚠ CCIP structural state on 10 lanes: J1/J2 execution success-rate plus RMN cursed binary safety override. Window invariants gate on at least 5 eligible messages, so low-throughput lanes report Unavailable rather than a verdict. J3 confounding-by-downtime not yet wired.
Calibration v2.0 3 primitives: Attestation + Regime + Drift Signal Updated 2026-05-01
M1 = metric stability score. Certified = 12 signed codes calibrated and live on the panel API. Partial = legacy 4 base codes only or proxy signal. For newly added structural observables (beacon_participation, sequencer_publish_latency) the regime trigger uses raw ratio or seconds against calibrated bounds; the per-metric Drift Signal shift activates after the long-term EMA stabilizes (~30 days post-launch).

Each agent sets its own rules.

ANS proposes and the DON signs, but neither decides for you. Every Invarians attestation carries the calibration version that produced it. Each consuming agent reads the attestation and the reference, applies its own risk thresholds, and arms its decision: act, defer, or wait. The reference is shared; the rule is yours.

Shared
The certified reference
Invarians classifies the structural regime into one of 12 signed codes over a ~1h window and exposes a continuous Drift Signal per axis. ANS publishes what "nominal" means for each chain, versioned and dated. Every agent reads the same reference.
Yours
The decision rule
A conservative agent may defer on any S2; an aggressive one may act through D2±. Same signed attestation, two different rules. ANS never decides for the agent: it gives it a verifiable reference to decide against.
Every Invarians attestation carries calibration: { version } in its payload. ANS makes that version field meaningful: not just a number, but a verifiable, dated, documented reference the agent arms its rule against.
See how agents integrate Invarians Concrete patterns for wiring the execution context into an autonomous agent's decision loop.
agentic.invarians.com →

Audit the method independently.

All calibration parameters, backtest results, and methodology are publicly documented. No black box: every threshold has a derivation, every event a trace.

What a block explorer cannot give you.

The raw data is public. Anyone can reconstruct it after the fact. What is not public, and not reconstructible, is the commitment made at the moment of the decision. That is what an attestation is, and what analytics is not.

Neutral attestation is not forensic reconstruction

Reconstruction after the fact (a public analytics query, a block explorer) proves, weeks later, what a chain contained. It cannot prove what a neutral third party asserted at the moment of the decision, nor what an agent could reasonably know when it acted.

The distinction: forensic vs proof. For a regulatory audit trail, this is the whole gap between "we can investigate" and "we hold an exhibit." One is a story you reconstruct later. The other is a signed piece you already own, dated to the instant it mattered.

Be honest about it: the data is public and reconstructible. The gap is not in the data, it is in the commitment apparatus: a signature at the moment T, a frozen methodology, thresholds calibrated with a published false-positive rate, and a third party that is not party to the transaction. The buyer is the one who needs proof, not analytics. If a prospect is satisfied by a database query, they were never the client. Institutional RWA buys audit exhibits.

A normalization layer, value conditioned on real harm

No agent can maintain, chain by chain, an expert definition of what "degraded" means: beacon-chain participation on Ethereum, batch-posting cadence on an OP-Stack rollup, the RMN curse state on a cross-chain lane. The matrix is a normalization layer: one calibrated vocabulary, with a measured false-positive rate. That is real engineering value, on its own.

But its economic value rests entirely on one hypothesis: that a stress verdict (S2 / BS2) corresponds to real harm avoided. We state this openly. It is exactly what the exploratory loop and the predictive-delta work exist to settle, or to refute, in the open.

Abstaining is itself an action, and in RWA it carries a cost

The naive view treats the signal as an umbrella: when in doubt, wait, the pause is free. In regulated settlement, the pause is not free. Deferring risks a missed cut-off, a penalized settlement fail, an unhonored redemption window, a delayed valuation. Abstention is an action, with a hard and sometimes regulatory cost.

The shift: not an umbrella, a tradeoff. Each time the signal fires, it imposes a certain cost (the pause) against an uncertain avoided harm. The proof is that this trade stays net positive once the cost of abstention is honestly counted, false alerts included. The signal earns the right to stop you only if following it costs less than ignoring it.

This is where the three proofs lock together. One: the pause is defensible (you hold a signed exhibit, dated to the moment it mattered). Two: the pause is rational (acting into that state would genuinely hurt). Three: the pause is affordable (stress windows are shorter than settlement margins, and an agent can often reroute instead of waiting). The keystone: the signal earns the right to impose a cost of abstention only because the state is harmful, and because the qualification is an opposable exhibit, not an opinion.

Where ANS is going.

Today ANS is a passive, signed registry. The path below is published as commitments: dated, versioned, refutable. Targets are proposals until proven.

01
Sharpen the agent: matrix and delta
ANS becomes exploratory. It proposes calibration and matrix improvements. It never signs them.
  • Learn from consumers. When an agent acts on a signal and its transaction fails or is sandwiched, that outcome is a free ground-truth label.
  • Off the signing path. Proposals run on decentralized GPU compute. Nothing non-deterministic ever touches a signature.
  • Problems we name in the open. Slow-drift blindness (tell a legitimate regime change, like a fork, apart from pathological drift); rollup blindness (wire the real-time sequencer-halt signal into the L2 structural axis); the predictive delta is refuted today and stays descriptive until proven (p < 0.05).
02
Decentralize calibration and computation (Q3-Q4 2026)
Replace "one server, trust us" with independent recomputation and public verifiability.
  • Independent recomputation. Each node recomputes regime and bridge_state from its own RPC. The attestation is the agreement of those independent results, not a stamp on one server's output.
  • Consensus by field. Discrete decisions (S1/S2, BS1/BS2) must be identical across nodes; continuous values and timestamps use the median.
  • RPC diversity is mandatory. Nodes must not share a single data provider, or decentralization is cosmetic.
  • Independence where trust is at stake. The decision rests on independent observation; high-frequency raw collection can be proposed, then re-verified on the decisive window. This keeps cost honest.
  • Prerequisite zero. Migrate the live attestation from a shared-secret signature to a publicly verifiable one. Whoever can verify must not be able to forge. This is independent of any vendor.
  • Path. Pilot a decentralized network that recomputes our attestation and produces a threshold signature, the same class of architecture leading cross-chain messaging already relies on. In parallel we evaluate the wider design space: restaking networks, zero-knowledge proofs of the classifier, and trusted hardware.
  • Reversibility, a guarantee not decoration. Invarians always owns the attestation schema, the key registry, and an exit signature. The decentralized signature is a reinforcement. If any provider leaves, the attestation stays valid. Decentralized trust, no lock-in.
03
Help agents integrate
A shared certified reference; each agent keeps its own rule.
  • Shared reference. ANS exposes the certified reference: regime, bridge_state, signed.
  • Your rule. Each agent sets its own decision rule on top. ANS never decides for it.
  • Integration and examples. agentic.invarians.com.
All dates are targets. Calibration versions are anchored on-chain: dated, versioned, refutable.

The full operational roadmap, with quarters and named integrations, lives at invarians.com/roadmap →

The reference agents navigate by

Invarians certifies the state.
You own the decision.

Live execution context across L1, L2, and bridge. Regime (12 signed codes per chain), Drift Signal, structural state: signed and verifiable.