MONARKFleetNarabiUkemiBellit abstains so DeFi can act.
How it works

A coverage-controlled gate. It never says how likely it is to be right.

An upstream predictor gives a reading. Hikae conforms it into a coverage region at a target of one minus α. A closed gate policy reads that region and the remaining budget, and emits one of three words.

commit

The intent lies inside a region small enough to act on, and the budget the caller sent is not below the caller's floor. The act is authorized; B_t comes back as the caller sent it.

defer

The region is too large to act on — the set holds every label, or the interval is too wide. Wait for a better reading. B_t is untouched.

abstain

The gate holds no opinion: the intent is not in the region, the budget is exhausted, or the upstream attestation is absent or timed out. A first-class outcome — it is what lets the gate act at all.

Push an input through the gate
Classification task, label schema up|down. Move the reading, widen the calibration spread, pick an intent — then push.
Intent to authorize
Shōgen · attestpredictor · ŷclockHikae · the gateB_t + region → decisioncommitdeferabstain
B_t = 1.00
region
—
decision · reason
—
{
  "schema_version": "1.0.0",
  "action": "…",
  "allow": false,
  "tool": "perps_order_preview",
  "intent": "up",
  "verdict": "…",
  "remaining_budget": 1,
  "reason": "…"
}
GateDecision, a frozen contract. Note what is absent: no p_correct, no confidence field, no score.
An abbreviated, illustrative view — the frozen CoverageVerdict carries more fields than are shown here; the Hikae panel lists them. The α is the target miscoverage level (coverage is one minus α), not a probability that this region is right. The reason is one of 13 in the frozen enum.
An illustrative simulation of the gate policy — not market activity
In this simulation each commit spends B_t. On the served gate, B_t is caller-carried: the caller keeps B_t and sends it, and the gate returns it unchanged.

The pipeline, contract by contract

Four frozen shapes. Each layer only sees the one before it — sensors never speak to the gate, clients never speak to sensors.

sensorsBuilt
AttestedPrice
Testimony: what was said, its bytes and hash, who signed, and the named residual hypotheses — what is not verified.
schema_version · subject · attestor · residual · transport · utterance · observed_at · octets_recalcules · verifier_revision
absent by design: no price number, no confidence field, no validated flag.
adapterBuilt
Prediction
Any predictor — a model, a curve, a clearing fixed point — emits the reading the gate will conform, tagged with who produced it.
schema_version · task_class · yhat · predictor_id · produced_at
absent by design: no score beside the reading.
gate · calibrate & monitorBuilt
CoverageVerdict
The conformal region at target coverage one minus α, the calibration digest it came from, and the residuals carried through.
schema_version · task_class · method · alpha · n_calib · region · qhat · abstain · reason · residual · calib_digest · produced_at
absent by design: no p_correct.
gate · authorizeBuilt
GateDecision
The word an act is allowed to obey, the tool it applies to, the verdict behind it, and what is left of the fleet’s budget.
schema_version · action · allow · tool · intent · verdict · remaining_budget · reason
absent by design: no probability, no win-rate, no yield.
region · kind = set
Classification — a set of labels
A direction call, a yes/no market, a venue choice. The region is the set of labels the calibration cannot rule out. One label is actionable. Every label → defer · set_too_large.
{ kind: set,
  labels: [ up ],
  label_schema: up|down }
region · kind = interval
Regression — an interval
A liquidable share, a health factor, a curve residual. Ukemi’s clearing outcome is conformed into a low–high interval. Too wide → defer · interval_too_wide. Intent outside → abstain · intent_not_in_region.
{ kind: interval,
  lo: …, hi: … }
remaining_budget · B_t
The budget, not a score
Every GateDecision carries the budget back: B_t is caller-carried: the caller keeps B_t and sends it with each call, and the gate returns it unchanged. When the B_t a caller sends is below that caller’s floor, the gate does not lower its bar — it emits abstain · budget_exhausted. Profit and loss never enter the policy.
What B_t is and is not →

Thirteen reasons, one enum

Every decision names why. The reason is a closed enum in the frozen contract — a new reason needs a deliberate, versioned revision, not a deploy.

Built · frozen schema
coveredcommit
The intent lies inside a region small enough to act on, and the caller's budget is not below its floor.
set_too_largedefer
The set holds every label — nothing is ruled out yet.
interval_too_widedefer
The interval is wider than the act can tolerate.
intent_not_in_regionabstain
What you wanted to do is outside what coverage allows.
under_calibabstain
Too few calibration points to state a region at all.
no_label_schemaabstain
The task declares no label schema to conform against.
budget_exhaustedabstain
The B_t the caller sent is below the caller's floor. No bar is lowered.
clock_expiredabstain
The testimony is older than the task allows.
upstream_timeoutabstain
The sensor did not answer in time.
attestation_absentabstain
No attestation reached the adapter.
attestation_refusedabstain
The verifier refused the testimony — a hash or signature did not hold.
binding_brokenabstain
The prediction is not bound to the testimony it claims.
non_evaluableabstain
The input cannot be evaluated against the contract at all.
the rule

One visible piece per client. Never eleven.

A liquidity vault installs Kaihi. A looping desk installs Ukemi. An agent runtime installs Genkan — the gate as a tool. Behind that one piece the sensors witness and Hikae authorizes; the client never has to know their names, and MONARK appears only as the budget the caller carries.

What the gate commits to

Coverage holds on average over exchangeable calibration data at one minus a chosen miscoverage level α. The gate reads the region and the budget through a closed policy; profit and loss never enter it.

What is not

Coverage is not conditional on the individual input. The error on one committed act is not bounded by α. Hikae is a monitor — a second-level check, not a promise about any single case. It gates order tools; it never calls them.

For the one class calibrated on measured flow, Narabi's redemption-flow velocity, the served description is narrower: the calibration is measured non-stationary across half-years, so the coverage above would need exchangeability, which is not assumed here; no coverage is measured. See the Narabi page.

Where to read more

For integrators for the frozen contracts you send and receive.