# Quiver — Technical Documentation — part 2 of 7

> The complete document, split only because a single fetch truncates. **Nothing is abridged**: the
> parts below concatenate to the whole text, cut at section boundaries. Every part is served as plain
> markdown.
>
> - **Part 1** — `/paper/1` — Abstract  |  At a Glance  |  Contents  |  1. Introduction  |  2. System Architecture  |  3. Design Principles
> - **Part 2** — `/paper/2` — 4. Service Catalogue
> - **Part 3** — `/paper/3` — 5. Methodology
> - **Part 4** — `/paper/4` — 6. Verification and Testing  |  7. Worked Walkthrough  |  8. Limitations and Honest Disclosures
> - **Part 5** — `/paper/5` — 9. Related Work and Positioning  |  10. The Build: Story, Process, and a User Scenario
> - **Part 6** — `/paper/6` — 11. Roadmap: Operating Quiver After the Hackathon  |  12. Conclusion
> - **Part 7** — `/paper/7` — Appendix A · API Reference  |  Appendix B · Reproducibility  |  Appendix C · Checkable Artifacts  |  References
>
> Whole document in one response (247 kB, may truncate in your client): `/paper/full`
> Typeset edition with figures: `/paper`
> Live service: https://quiver-production-c3a8.up.railway.app · Source: https://github.com/Tristan-tech-ai/Quiver

---

## 4. Service Catalogue

The twenty-two services fall into seven groups: options intelligence, transaction and token safety, charting, tape microstructure, prediction-market and protocol tooling, concentrated-liquidity economics, and a verifiable risk brain (perpetual liquidation, cross-venue portfolio risk, position sizing, execution-quality verification, and options-portfolio greeks & SPAN-style margin). Two are treated as the flagship of the set and specified in full; the rest are described at the level of what they compute, from where, and with what guarantees. Section 5 gives the mathematics that several of them share.


### 4.1 options-desk

flagship A single call returns a desk-grade read of the live crypto options market for BTC, ETH, or SOL, sourced from Deribit with an OKX cross-check. No comparable service exists in the agent registry; options analytics is the widest moat in the catalogue because the mathematics is unforgiving and the data is awkward to handle correctly. The response is organised into layers, each independently useful.

**Implied view and the probability ladder.** For the two front liquid expiries the service reports the at-the-money forward implied volatility, the one-sigma expected move in dollars and percent, and a ladder of price levels with the risk-neutral probability that spot finishes above each. The probability is not the textbook `N(d2)`. On a skewed smile that figure is biased, because the true risk-neutral probability carries a term in the volatility slope; Section 5.3 derives it. The service reports the corrected probability and, alongside it, the exact size of the correction at each level, so the caller can see how far the naive number would have been wrong. An earlier draft asserted here that the correction "reaches several percentage points near the money" on a live chain, which was a claim this document nowhere evidenced — the only figure it had measured came from a constructed smile. So it was measured: on a live BTC chain captured for this document, the correction peaks at **+3.3 points** just below the money (63,000 and 64,000 against a spot near 65,000) and **changes sign in the upper wing**, reaching −0.8 points at 68,000. The sign flip is not incidental — it is what equation (8) predicts where the smile slope changes sign, and seeing it in live data is better evidence for the correction than its magnitude is.

**Full risk-neutral distribution.** Beyond point probabilities, the service integrates the Breeden–Litzenberger density into a normalised distribution and reports its quantiles from the 5th to the 95th percentile, the tail expected shortfall on each side, and the distribution's own volatility, skew, and excess kurtosis. The block carries a self-check: under the risk-neutral forward measure the terminal price is a martingale, so its expectation must equal the forward. The service reports the residual `E[S_T]/F − 1`; on a live BTC expiry this reads 0.001%, which is the strongest available evidence that the density is proper and correctly integrated, which is a weaker statement than correct. The distribution is emitted only when the density is a proper, arbitrage-free density that integrates to one; otherwise it is withheld with a diagnostic.

**Dealer gamma and second-order greeks.** The service computes dollar gamma exposure (GEX) by strike, the net across the chain, and the gamma-flip spot level where the sign changes, under the conventional assumption that dealers are long call gamma and short put gamma. That assumption is labelled as an assumption, and the reason it is not replaced by a flow-inferred dealer position is stated in the output: the feed does mark block trades — `block_trade_id` and `block_trade_leg_count`, plus `block_rfq_id` on ETH — so they are identifiable, and an earlier version of this paragraph and of the service's own output wrongly said otherwise. The obstacle is attribution, not tagging: a trade's reported direction names the side it was booked from, not whether a dealer was the buyer or the seller, and nothing in the feed says whether a block maker is a dealer at all. Since block-tagged trades are a large share of volume — 48.9% of BTC and 30.2% of ETH option contract volume in a 200-trade window sampled on 27 July 2026 — a flow-based sign would be invertible on exactly the largest trades. Refusing to infer what cannot be inferred is the honest choice. The greek surface includes the second-order volatility greeks vanna and volga, computed analytically and verified against finite differences, and aggregated into a dealer vanna and volga under the same disclosed convention.

**Variance risk premium and its significance.** The service estimates the premium of implied over realised variance from overlapping windows [16],[17] and, critically, tests whether it is statistically distinguishable from zero at the effective independent sample size rather than the inflated count of overlapping pairs. On live BTC the ratio of realised to implied volatility is 0.881 with a p-value of 0.254; the service reports that this is not significant and refuses to present the real-world-calibrated probabilities as anything but indicative. This is the single clearest example of the product holding itself to a real quant standard: it computes the premium, then declines to claim an edge the data does not support.

**Cross-market divergence.** The options market and Polymarket price the same events by different mechanisms. For each live Polymarket threshold market on the coin, the service computes the options-implied probability of the identical question and reports the divergence. Because the market's resolution date is rarely a listed option expiry, the arbitrage-free smile is interpolated to the exact tenor in total variance, linearly in time between the two bracketing expiries, which preserves the calendar no-arbitrage condition; each row discloses whether the smile was interpolated or extrapolated and across which expiries. The raw divergence is then decomposed into the part explained by the variance risk premium, which is structural and not an edge, and the residual dislocation.

**Composite verdict.** The layers above are fused into one continuous score per axis — volatility richness and directional tilt — with the entire construction disclosed in the response: the literal weights, each component's raw value and its bounded transform, and the renormalisation applied when a component is unavailable (missing inputs are listed, never guessed). Two details make the fusion defensible rather than decorative. The risk-neutral density's price-space skewness has a positive lognormal baseline of `(e^w+2)√(e^w−1)` with `w = (σ√T)²` — a market symmetric in log-returns still shows positive price skew — so the directional component scores the *excess* over that baseline, not the raw number. And when a variance-risk-premium fit exists, implied-versus-realised is measured against the asset's *own habitual* premium rather than against parity, since implied exceeding realised is the norm, not a signal. An axis with fewer than two live components refuses to emit a verdict; a leave-one-out pass names any single component whose removal would flip the reading, so the caller sees exactly how fragile the verdict is; and identity self-checks re-derive the published score from the published parts. The front slice for these reads skips sub-two-day expiries, whose annualised volatility is microstructure-dominated — a contamination that surfaced on a live morning chain precisely because the component values are disclosed, and was fixed and regression-locked the same day.

**Model-free calendar bounds.** A single smile prices vanilla options; it does not price a payoff that depends on two dates at once, such as a forward-starting straddle or a calendar spread. Rather than assume a stochastic-volatility dynamics to fill the gap, the service computes the tightest price interval consistent with *every* model that reprices both quoted expiries, by martingale optimal transport (Beiglböck, Henry-Labordère and Penkner [39]): the two fitted marginals, mapped to the martingale coordinate `X = S/F`, become the constraints of a linear program whose optimum is a hard lower and upper no-arbitrage bound. The program is feasible if and only if the two marginals sit in convex order, which by Strassen's theorem is exactly the statement that the pair is free of calendar arbitrage — so the bound doubles as a certificate. Two exact identities gate the output: a payoff in the later date alone must integrate to one under the later marginal, and the expected increment `E[X_2 − X_1]` must be zero. When either fails the bounds are withheld rather than shipped. Section 5.8 gives the construction. No other agent in the registry prices a two-date payoff without assuming a model.

Supporting layers include the implied-volatility term structure and rank against the DVOL history, coverage-honest skew, max pain, put/call open interest, and an implied-rate curve backed out per expiry. The service fetches and normalises the full Deribit chain on each call, fits the surface once, and reuses it across the layers so every number is consistent with a single arbitrage-free surface.


### 4.2 calldata-x

flagship This service answers one question an agent must resolve before it signs anything: what will this actually do to my wallet. It operates in two modes, and the second mode is the reason it matters.

**Transaction mode.** Given raw calldata, the service decodes the four-byte selector against a signature registry and renders the function and arguments in plain language. Given the full unsigned transaction, it goes further and simulates the transaction against live chain state with `eth_simulateV1`, reading the exact asset transfers and approval changes from the simulated Transfer and Approval logs rather than inferring them from the inputs. It reports the gas the transaction would consume, priced at the live gas price into a native-token fee. The target contract is checked for an upgradeable proxy: a non-zero implementation slot under EIP-1967 [22], or the legacy OpenZeppelin slot used by older proxies such as USD Coin, means the logic behind the address can be replaced by its admin after the caller approves it, so today's simulation is not binding on tomorrow's behaviour.

**Signature mode.** Modern wallet drainers rarely use a transaction. They use an off-chain signature: a Permit or Permit2 authorization under EIP-712 [20],[21] that grants a spender the right to move tokens, signed by the victim and submitted later by the attacker. Such a signature is never calldata and never appears in a transaction simulator, so a service that only simulates transactions is structurally blind to the most common way people are drained today. calldata-x decodes the typed-data payload, identifies the permit type, extracts the spender, amount, and expiry, and flags the dangerous combinations: an unlimited allowance, a permit that never expires, a spender that is an externally owned wallet rather than an audited contract, or a domain that does not match the canonical Permit2 deployment. Closing this gap is the highest real-user value in the catalogue.

**The verdict.** Both modes feed a one-glance verdict keyed on the spender's reputation combined with the effect, not on the allowance number alone. An unlimited approval to a recognised router is routine and labelled a note; the same unlimited approval to a fresh externally owned wallet is a drainer pattern and labelled danger. Reputation is resolved from a router allowlist, from `eth_getCode` which distinguishes a contract from a wallet and detects EIP-7702 delegated accounts [23], and from an on-chain activity signal. This keying is what removes the false positive that a naive "unlimited approval is always dangerous" rule produces on every legitimate DeFi interaction.


### 4.3 chart-press

An agent that reasons over price action needs a chart it can attach to a message, and it needs the numbers on that chart to be trustworthy. chart-press renders a PNG from OKX DEX candles in two tiers: a fast browserless tier built on server-side Apache ECharts [32] rasterised to PNG, and an opt-in high-detail tier that drives a headless browser and falls back to the fast tier on any failure, so a render never errors. The indicator library is a fork of a maintained package of over one hundred indicators [33], replacing four hand-rolled ones. Chart types include candles, Heikin-Ashi, line, area, and Renko, with an optional logarithmic price axis; the drawing primitives include horizontal and vertical lines, rectangles, trend lines, rays, channels, Fibonacci retracement and extension, and measured moves. Every render returns a facts block, the price, change, volume, high, and low, computed from the same candle series that is drawn, so the numbers an agent reads back cannot drift from the picture it shows.


### 4.4 tape-pulse

tape-pulse reads the recent DEX trade tape for a token and reports its microstructure. The tape is first cleaned: routed multi-leg swaps that share one transaction hash are deduplicated so volume is not double-counted, and exchange-flagged rows are dropped. On the clean tape the service reports buy/sell imbalance, net dollar flow, tape VWAP against spot, whale prints, and trade-rate acceleration, and then computes three real microstructure estimators that a desk would recognise: Kyle's lambda, the price impact per unit of signed order flow [10]; Amihud illiquidity, the price move per dollar traded [11]; and VPIN, the order-flow toxicity measured as buy/sell imbalance across equal-volume buckets [12]. Section 5.5 explains why the first two are computed on volume blocks rather than tick by tick, a choice forced by ground-truthing. Trade direction comes from the exchange's own label, which is superior to a classifier such as Lee–Ready [14] because it introduces no classification error. Each estimator carries a quality gate and returns null on a tape too thin or too flat to support it; Kyle's lambda additionally reports its fit R-squared and a confidence label, so a weak read is visible rather than dressed up.


### 4.5 poly-fill, poly-desk, updown-pulse

**poly-fill** simulates a pre-trade fill on a Polymarket order book. It walks the live book for a requested notional and reports the volume-weighted executable price, the slippage against the midpoint, and the largest size that stays within a target slippage. The midpoint on a thin book is a fiction; the walk is the truth. Beyond the walk, the service fits the executable-cost curve to the square-root market-impact law [13],[15] and reports how closely this particular book follows it, so the fit quality is measured rather than assumed, together with the two-sided depth imbalance and a maker-versus-taker note that surfaces the adverse-selection a resting order carries. On a live Bitcoin-threshold market the fit R-squared is around 0.55, an honest number for a discrete prediction-market book.

**poly-desk** returns a Polymarket wallet's live book: open positions with current marks, unrealised PnL, cash-out value, and the biggest movers, for copy-trading and portfolio agents that track a specific trader.

**updown-pulse** reads the live short-window BTC or ETH up-or-down market and reports the market's own implied odds, the true time to resolution, a spot observation, and a driftless estimate of how far price could move before the market resolves, scaled from daily realised volatility. It deliberately outputs no fair value and no edge. Short-horizon directional prediction is empirically indistinguishable from a coin flip, so a predictive number here would be false precision that contradicts the product's own thesis. The service surfaces the market and the risk and leaves the directional call to the caller.


### 4.6 protocol-pulse, macro-sentry, loop-digest

**protocol-pulse** compiles a DeFi protocol's health from DefiLlama: TVL level and trend, ninety-day maximum drawdown, chain concentration, age, and the hack registry. It does not emit a single composite grade. A 0–100 health score would imply a calibrated, out-of-sample-validated model, and with no labelled dataset of protocol failures to validate weights against, a hand-tuned composite would be goal-seeking. The service instead reports the factual signals and a set of individually defensible risk flags, each a concrete condition with its threshold and rationale disclosed: a hack in the last twelve months, a deep drawdown, a sustained outflow, a very new protocol, a micro-cap TVL, a single-chain dependency. The risk level is a transparent function of the flags present, not a scored model.

**macro-sentry** returns the high-impact US macro events, FOMC decisions and CPI, PCE, and payrolls releases, that fall inside a caller's lookahead window (the `hours` input), so a trading agent can de-risk before a print. The calendar is curated from published institutional schedules, which are fixed and durable, and the computation is dependency-free. Because the result is filtered against the call time (only events still ahead are returned), the answer is a signed, timestamped *observation* rather than a re-runnable proof — the same honest distinction the deterministic services draw in Section 5.

**loop-digest** is built for the top of an agent's loop. Given a cursor from the caller's previous call, it returns a compact diff of a wallet's world since then, new fills and per-token PnL drift, so the agent reads one small object instead of re-fetching and re-paying for the entire state on every iteration.


### 4.7 token-scan, wallet-audit

**token-scan** answers a question that a price chart cannot: what share of a token's recent DEX volume is organic rather than manufactured. It aggregates the recent tape per wallet and scores the fingerprints of wash trading — round-trip churn, machine-regular timing cadence, buy/sell ping-pong alternation, and volume concentration in a handful of addresses — cross-referenced against OKX holder-cluster funding priors. Every verdict ships its evidence: the specific wallets and transaction hashes behind the score, and a confidence that is lowered rather than hidden when the tape is thin. The number an agent acts on can be audited back to the trades that produced it.

**wallet-audit** asks the same authenticity question of a track record. Native OKX endpoints report a wallet's PnL and win rate; this service grades whether those numbers reflect skill or are statistically hollow. A win rate over a handful of trades is not evidence, so the audit reports the Wilson score interval on the win rate at the real sample size, flags a record too short to support the claimed edge, and reuses token-scan on the wallet's own traded tokens to catch a PnL inflated by self-manufactured volume. It returns a grade with its working shown, or an explicit insufficient-data verdict, never a flattering point estimate on its own.


### 4.8 lp-desk

lp-desk is a concentrated-liquidity reality-check, and it is built to *refuse* a product the rest of the market sells. Every "range optimiser" promises an optimal width for a Uniswap-V3 position. The service reconstructs what a chosen range would actually have earned by replaying the pool's real on-chain swap history — fetched over a keyless public archive node, with pool metadata read from the chain rather than assumed — and nets the realised fees against the divergence loss (loss-versus-rebalancing) the position bleeds as price moves through it. The finding, measured on hundreds of thousands of real swaps across two eighteen-month-separated windows, is that no capturable optimal width exists: narrow ranges are destroyed by rebalance bleed rather than gas, the widely shipped hardcoded ±5% band was net-negative in both windows, and a volatility-fitted width — the entire premise of an optimiser — failed to beat a constant reliably out of sample. So lp-desk sells the measurement, not a false optimum, and says plainly when the honest answer is "don't provide this liquidity." Its own biases are disclosed and both happen to favour narrow ranges, which still lose, so the conclusion is robust; the limitation that swap logs carry only aggregate active liquidity, making the tool exact for relative strategy ranking at small size but not absolute PnL at scale, is stated in the output rather than buried. Section 5.9 gives the position mathematics.


### 4.9 Risk Brain — perp-gate, size-gate, exec-verify, options-risk, portfolio-gate

The Risk Brain is the layer beneath the risk gate. An autonomous agent moving money on a loop does not fail for want of alpha; it fails on the arithmetic. In a public contest, six frontier models each traded ten thousand dollars of perpetuals autonomously for seventeen days. Four of the six finished in the red and the worst lost 62%; the other two finished ahead, one of them up 22% [43]. That is one short contest with six participants and no control arm, so it establishes that unsupervised agents *can* lose most of their capital on perpetuals, not how often they do, and nothing about which specific failure caused it. An earlier draft of this sentence said four of the six lost more than 60%, which is false and flattered the argument: only one did. The measured claim underneath does not depend on a contest, and it is narrower than an earlier draft of this document made it. On a benchmark of numerical reasoning over real S&P 500 filing tables, the strongest models tested reach 91.9–95.6% overall but still fail 10–20% of the multi-step calculations, which the authors call a critical barrier for accuracy-sensitive financial work; the smaller open-weight models fail essentially all of them [42]. This document previously described that as top models collapsing "from 95.6% accuracy on lookups to near zero", which misread the source in three ways: 95.6% is one model's *overall* score rather than its lookup score (its lookup score is higher still, 97.0%), the near-zero results belong to the small open-weight models rather than to the leaders, and the tier in question holds ten items. The corrected version is weaker and is the one the source supports. It is also enough for the argument here, because a one-in-five failure rate on multi-step arithmetic is disqualifying for an agent sizing a position, whether or not the failure rate is total. The agent risk products now shipping from exchanges and startups enforce user-set *limits* (max size, leverage caps, drawdown stops) but assume the correct risk numbers as input; they do not compute them. These services compute them, deterministically, and prove each answer.

**perp-gate** returns a perpetual-futures position's exact liquidation price, the adverse move to liquidation, effective leverage, and — given a funding rate — the funding drag. The liquidation price is not copied from a venue formula; it is *derived* from Hyperliquid's stated liquidation condition (account value below maintenance margin) and then *verified* numerically against that condition on every call, so a wrong derivation fails loudly rather than shipping a confident wrong number. Section 5.10 gives the derivation. **size-gate** converts an edge — discrete odds or a return/volatility pair — into a fractional-Kelly position and the probability of ever drawing down to 50/75/90% of capital; it defaults to quarter-Kelly because full Kelly rides thin, over-estimated edges to ruin, and it self-checks the returned fraction against the first-order condition that *defines* Kelly optimality. **exec-verify** takes a completed swap and the pre-trade pool state and reports how many basis points the fill lost to *adverse* execution — sandwiching, MEV, or a stale quote — beyond the unavoidable fee and own price impact, proving the uncomfortable fact that a fill "within slippage tolerance" can still have been robbed; its benchmark is the constant-product invariant, asserted on every call that supplies pool reserves. A fourth, **options-risk**, aggregates a whole options book: net greeks (delta, gamma, vega, theta, and the second-order vanna and volga) and a SPAN-style scenario margin — the worst repriced P&L over a price×vol grid — because an options book's true risk is not the sum of per-leg notionals. Its self-check is the strongest in the catalogue: all six analytic portfolio greeks are verified against finite-difference derivatives of the actually-repriced book, a discrepancy that surfaced (and forced the upgrade to a machine-precision normal CDF, since the greeks must be consistent with the prices to the last figure). A fifth, **portfolio-gate**, is the whole-book view the others lack: it aggregates perpetual legs *across venues* — Hyperliquid and dYdX — into the true net exposure per underlying (signed notionals summed, so a long on one venue and a short of the same asset on another net out instead of double-counting), the leg that liquidates *first* across the book, a concentration index that exposes when a nominally diversified book is secretly one directional bet, and a correlated-crash stress that moves every leg together as correlations go to one — the regime in which an October 2025 day on which industry trackers put single-day liquidations between roughly $9 billion and $19 billion, depending on the venue coverage each one reaches. Section 5.18 derives the aggregation and the four identities it self-checks. Each of these five ships the proof envelope of Section 3: echoed inputs, code identity, a content hash, and the self-check result, so the caller reproduces the number rather than trusting it.

---

**Continues in part 3 of 7: `/paper/3` — 5. Methodology**