The Reflex Lane: Real-Time Agent Settlement on a Chain That Also Thinks

Research corpus codename: NOOSPHERE. MindChain research note · 2026-07-10 · Provenance: design synthesis from two source-verified external surveys (research/09-realtime-chains-survey.md, research/10-agent-chain-landscape.md) and the MindChain corpus; every mechanism named here is labeled, and the new ones are THEORY with preregistered falsifiers. No measurement in this note is new unless it cites a lab artifact.

Abstract

Two questions motivate this note: can MindChain be real-time, like MegaETH's "first real-time blockchain"? And can a real-time chain still host a decentralized LLM execution lane, or are there structural trade-offs? We answer from evidence. In the sequencer/preconfirmation class that defines the "real-time" brand (MegaETH 10 ms signed mini-blocks, Base Flashblocks 200 ms), latency is bought by concentrating ordering trust and taking verification off the hot path; the sub-second BFT class (Solana/Sui/Monad) pays in further currencies — pipelined consensus, parallel execution against in-memory state, hardware floors, local fee markets PAPER, survey 09. In neither class does verification sit on the latency path — which is structurally identical to MindChain's Neural Lane, whose verification (chunk-Freivalds disputes, Groth16 receipts) was never on the hot path to begin with. The two lanes are compatible; the missing piece industry-wide — named as the open gap by both surveys — is a protocol that treats the millisecond promise clock and the hours finality clock as first-class typed objects with enforcement between them. MindChain already has the second half of that machinery: typed finality classes (SOFT/ASSURANCE/PROOF/TEE, ch04 §3.6) and a typed capability ABI where text never authorizes effects (A-AGENT-ABI, ch04 §3.1). This note designs the first half — the Reflex Lane — and the bridge law that no surveyed chain ships: finality-class-gated capabilities, where every agent mandate declares the minimum finality class at which each capability may fire, enforced by the protocol rather than by agent prudence. Three new THEORY rows with pass/kill gates are proposed. The note survived its two same-day hostile reviews only partially: the headline v1 gating mechanism and the first lab instrument were both killed and are published below as scars, with the rebuilt instrument (E-REFLEX-02) green on its own preregistered gates.

Claims

1. PAPER, surveys 09/10 — external evidence; narrowed after second review Real-time UX and heavyweight AI verification do not conflict architecturally in the sequencer/preconfirmation rollup class: MegaETH-style designs execute in ~10 ms precisely because provers and L1 disputes run behind the hot path. The BFT/parallel-execution chains buy latency in other currencies too — pipelined consensus, in-memory state, hardware floors, local fee markets [survey 09] — a narrowing the second review demanded; "one currency" was an overstatement. The friction is temporal-economic: a signed preconfirmation is promise evidence or credit recourse — compensation only where the protocol defines a payable bond [survey 09] — and agent action graphs are irreversible while every recourse is monetary.
2. THEORY; gate strengthened after adversarial review 2026-07-10 A-REFLEX — the Reflex Lane. The Braid's slot leader can stream signed, bonded reflex ticks (~50–250 ms cadence) carrying agent settlement events between Ground-paced canonical blocks, with the leader's signing key registered on-chain and tick-vs-block contradiction constituting portable, slashable fraud evidence. This imports MegaETH's Rex5 mini-block discipline (signed compact headers, key registry) onto a rotating-leader base chain — a promise clock, never a finality clock. Non-claims: no 10 ms target (rotating leadership + WAN physics put the honest floor at tens of ms regionally); no throughput claim; reflex ticks confer zero consensus weight. Accepted review finding: a slot-handoff pause does not resolve split-view late ticks — the outgoing leader can deliver its final signed tick to part of the network while the successor orders conflicting events, stranding victims without self-contradiction evidence. The pass gate now requires a split-view handoff drill (see Falsifiers).
3. THEORY; v1 specification KILLED by adversarial review 2026-07-10 — see §Adversarial review A-CLASS-GATE — finality-class-gated capabilities. The design intent stands: because MindChain capabilities are protocol objects (A-AGENT-ABI), the protocol can refuse to execute an irreversible capability on evidence below a declared finality class — bounding a hijacked agent by construction, not by prompt (gaps G1+G8 of survey 10). The v1 mechanism — one scalar min_finality_class field — is recorded UNSOUND as specified, on three review findings this program accepts: (i) the finality-class set is not a total order (ASSURED_TEE is deliberately incomparable to ordinary assurance in ch05 §4.5; a scalar "below" comparison either launders TEE trust upward or strands valid private-job evidence); (ii) the check binds a scalar class but not the evidence's causal link to the action's arguments, promise-derived inputs, tick root, and grant/prestate version — a high-class receipt from another job could satisfy it; (iii) capability-local reversibility is not workflow reversibility — many individually reversible REFLEX effects can compose into an irreversible real-world outcome no single-grant check sees. Per ch04 §2 (changing a claim creates a new claim_id), the corrected claim — class lattice with explicit TEE incomparability + causal evidence binding + cross-capability composition budgets — is reserved as A-CLASS-GATE.v2 and not asserted here.
4. THEORY; components fixture-MEASURED 2026-07-10 I-AGENT — the unified agent object. The G10 gap (no chain ties identity, mandates, reputation, escrow, and dispute into one protocol object) has a candidate closure by composition of mechanisms this corpus already registers — closure is asserted only after the composed four-attack drill passes. Two components are measured today at fixture scale: stable AgentID with rotating keys (S-AGENT), typed mandates (A-AGENT-ABI), failure-domain-quotient reputation weighting (M-LINEAGE-QUORUM — 12 clones collapse to weight 1, chorus-quorum-lab MEASURED), and per-job quarantine settlement so one contested agent job freezes while unrelated jobs settle (M-QUARANTINE-SETTLE — 0 double payouts across 4,324,320 interleavings, nel-quarantine-lab MEASURED). Per-job settlement membranes are also the candidate hot-state answer THEORY: survey 09 identifies contended escrow/job-board contracts as the silent killer of parallel-EVM throughput; job-scoped typed resources would shard that state by construction — the fixture measures settlement safety, not contention throughput.
5. MODELED 2026-07-10 The latency budget already parses. The NEL quant model places 2-of-3 executor soft finality at 85 ms regional / 151 ms global mean, 302 ms global p95 (lat_soft_final_, noosphere/research/nel-quant/numbers.py, 163 METRIC lines, gates green in this build) — inside tool-call latency for agent loops — while per-token on-chain anchoring at 12 s blocks fails the 2 s kill line by 12.1× and chunked anchoring at 2 s lane blocks passes at 2.88×. The reflex lane is the protocol-native form of the "Flashblock-style pipelined anchoring" that model already names as the closing lever (b6_kill_multiplier_).
6. SIMULATED 2026-07-10; instrument rebuilt after two reviews — see §Adversarial review The bridge asymmetry, at lab scale. The v1 reflex-lane-lab is withdrawn in full: the first review killed its latency/throughput gates as model artifacts; the second (Codex, verdict REJECT) showed the simulator never implemented the declared hazard — broken-predecessor promises were unreachable, the headline gate could not fail by any code path, bond conservation compared a counter to itself, and the refund gate was the loss gate relabeled. The rebuilt reflex_sim_v2.py (E-REFLEX-02: latent discovery, chain-keyed loss, independent post-run auditor, finite bond ledger with adversarial false claims, refund-then-recompute) passed all 13 preregistered gate instances on its first run: audited NAIVE irreversible loss at victim rate ≈ 2ε across 638,860 pipelines per policy (R1); zero audited GATED violations (R2); integer-exact ledger conservation, 647/647 false claims rejected, zero valid claims stranded (R3); every refunded victim still fails the evidence-history predicate (R4); bit-identical reruns (R5). Latency and throughput are informational only — preregistered as non-gates.

Construction

The clock ladder (existing + one new rung; a chain, not the whole order)

flowchart LR
  subgraph LADDER["the comparable public-finality subchain"]
    direction LR
    R["REFLEX tick<br>50-250 ms<br>signed leader promise"] --> S["SOFT<br>2-of-3 executor match<br>85-302 ms modeled"]
    S --> A["ANCHORED<br>canonical block inclusion<br>seconds"]
    A --> U["ASSURANCE<br>challenge window closed<br>hours"]
    U --> P["PROOF<br>verified receipt<br>288 B Groth16"]
  end
  T["ASSURED_TEE<br>hardware-attested<br>deliberately incomparable<br>(ch05 §4.5)"]

Five clocks of one chain — drawn, after the second review, as what it is: the comparable subchain of the finality-class partial order. REFLEX is new; SOFT/ASSURANCE/PROOF are the ch04 §3.6 classes; ANCHORED names ordinary inclusion. ASSURED_TEE sits outside every "below" comparison by design — the scalar comparison that ignored this is the killed A-CLASS-GATE.v1. Every receipt, API, and contract preserves the class; REFLEX joins at the bottom of the chain, not of a total order. THEORY

Reflex ticks. Within its slot, the current Braid leader streams compact signed tick headers (tx root, receipt root, cumulative gas; no state root — fast consumers trust-then-verify, exactly the MegaETH mini-block trade) at a declared cadence. The signing key lives in an on-chain registry; a tick contradicted by the leader's own canonical block, or by the next finalized checkpoint, is portable fraud evidence against the leader's Ground bond. Between slot handoffs the reflex stream pauses for one leader rotation (a gap the single-sequencer chains do not have and we accept as the price of no ordering monopoly).

Class-gated capabilities. CapabilityGrant (A-AGENT-ABI) gains one field:

CapabilityGrant {
  ...existing fields...,
  min_finality_class: REFLEX | SOFT | ANCHORED | ASSURANCE | PROOF
}

The validator-side intent gate — which already refuses effects not authorized by a typed grant — additionally refuses any effect whose evidence class is below the grant's declared class. Irreversibility is declared per capability, not inferred: an agent's pay-per-tool-call capability may declare REFLEX (small, reversible, escrow-accrued); its release-job-escrow capability declares ASSURANCE; its delegate-mandate capability declares ANCHORED or above. Prompt injection that convinces the model to fire a gated capability early meets a deterministic refusal — the same firewall philosophy as S-FREYSA, extended along the time axis.

Nanopayment economics without a fee-floor miracle. Survey 10 measures the market's real average machine payment at $0.32 (x402, 75.41M tx/30d) and finds no L1 fee floor below ~$10⁻⁴ — Solana's ~$0.0005–$0.00075 is its quoted example, not a universal bound. MindChain does not promise per-call on-chain transactions; it reuses the NEL chunk-amortization discipline: per-call payment events accrue inside a session object at reflex speed and settle as one chunk claim (the measured DA form already amortizes 292 B/token naive to 51.06 B/token at T=32, da_claim_bytes_* MODELED). Per-call marginal cost approaches DA bytes, not base fees. Non-claim: this is a design symmetry, not a measured fee schedule.

Why the LLM lane is unharmed — and unique

The decentralized LLM lane (NEL) is an async job→claim→verify→settle pipeline; only its settlement events ride the reflex lane. Verification stays where it always was: off the hot path, in the dispute ladder with its measured 1/T law and 288 B Groth16 settlement MEASURED, papers 01/02. The surveyed field verifies agent execution by TEE fiat (NEAR Shade Agents — Intel/NVIDIA trust) or not at all (gap G4); MindChain's dispute calculus is the cryptographic alternative, and it is the one lane no real-time competitor ships. The combined position — reflex settlement for agents, cryptographically verified heavy compute underneath, one trust model — is precisely gap G9, unclaimed by every chain in both surveys.

Trade-offs, stated against the evidence

Results

All numbers SIMULATED 2026-07-10 from reflex-lane-lab/ (deterministic, stdlib-only, seed 20260710). The v1 instrument (reflex_sim.py) is withdrawn in full — see §Adversarial review; its record survives in the lab README with zero evidentiary weight. The rebuilt reflex_sim_v2.py (E-REFLEX-02) models latent discovery (tick honesty revealed only at the first anchor ≥ the tick), evidence chains (irreversible loss keyed to the promises actually consumed), an independent post-run auditor (gate quantities recomputed from records + ground truth, never from policy-branch counters), a finite bond ledger (per-claim ground-truth validation, FIFO payment, exhaustion recorded, adversarial false claims injected), and a real refund transition (failure recomputed from the evidence-history predicate after payment). 638,860 pipelines per policy per ε (400 agents, 5,000 ticks, anchors every 20).

Latency and throughput are NO-GATE by preregistration (v1's G3/G4 lesson): the settlement-tail p50 of 3 → 12–13 ticks is reported, not asserted. Full sweep table and model notes: reflex-lane-lab/README.md.

Adversarial review (2026-07-10)

This note was reviewed twice on the day it was written, by two independent hostile reviewers. All findings from both were accepted; none was tuned away.

First review (Reviewer A — an isolated reviewer agent with no stake in the design)

Second review (Codex, same day — verdict REJECT, accepted in full)

A second independent reviewer (Codex) received the note and lab the same day (12 findings, verbatim in reflex-lane-lab/codex-review.md). The verdict on the draft it read was REJECT. Response, finding by finding:

• The lab (F1–F5, one FATAL): the v1 simulator never implemented the declared hazard — A2 retried past broken ticks before A3 could consume its promise (the code's own unreachable comment), so NAIVE loss was keyed to the wrong tick; G2 could not fail by any code path; G5 compared a counter to itself; G6 was G1 relabeled; "2,000 pipelines" was 2,000 agents launching ~4,000,000. Response: v1 withdrawn in full. reflex_sim_v2.py rebuilt to the review's remedies under new preregistered gates (E-REFLEX-02) — latent discovery, chain-keyed loss, independent auditor, finite validated bond ledger, refund-then-recompute. Green on its first run; results above.
• The prose (F6–F8, F10–F12): "exactly one currency" and "compensation, not execution" overstated survey 09 — narrowed in the Abstract and Claim 1; the fee floor now quotes the survey's ~$10⁻⁴ threshold instead of promoting its Solana example to a bound; the clock ladder is relabeled the comparable public-finality subchain with ASSURED_TEE explicitly outside it; I-AGENT's "closed" became "candidate closure"; the hot-state trade-off row no longer launders the quarantine fixture into a throughput claim.
• The spec gap (F9): A-REFLEX's fraud proof was not mechanically defined. Accepted as a prerequisite in the falsifier row: a canonical tick accumulator, inclusion/omission rules, receipt-root mapping, and a deterministic contradiction predicate must be specified before the devnet drill can count.

A same-day kill of our own headline proposal — twice, by two independent reviewers, the second rejecting the draft outright — is this program's evidence discipline working as designed (ch08 §3.4): the most damaging thing a reviewer can find is something we publish ourselves, first.

Falsifiers & kill thresholds

Proposed reservations in the ch04 §2 voice (to be appended to 04-addendum-A.md §A.3):

• A-REFLEX THEORY; gate strengthened 2026-07-10, prerequisite added by second review. Exact claim: a rotating Braid leader can stream signed bonded reflex ticks at ≤ 250 ms cadence carrying agent settlement events, with tick-vs-canonical contradiction slashable from the Ground bond, zero consensus weight, and clean pause/handoff at slot boundaries. Prerequisite (F9): before any drill counts, the fraud proof must be mechanically specified — canonical tick accumulator, inclusion/omission rules, receipt-root mapping into canonical blocks, and a deterministic contradiction predicate. Adversary: equivocating leader, tick withholding, cross-slot promise laundering, split-view late ticks at handoff (first-review finding), MEV inside ticks. Pass: on a lab devnet, zero accepted contradictions survive a checkpoint; handoff gap ≤ 2 ticks p95; a split-view drill (partitioned delivery of the outgoing leader's final tick) assigns liability unambiguously in 100% of trials; all promise victims compensated from bonds, integer-exact. Kill: any reflex evidence upgrading to consensus weight, any uncompensated equivocation inside the bond bound, any split-view trial with unassignable liability, or measured handoff gaps making the lane slower than plain SOFT — then the lane is deleted and SOFT remains the fastest class. Rollback: agents key off SOFT; nothing else changes.
• A-CLASS-GATE.v1 [KILLED at specification, 2026-07-10]. The scalar min_finality_class claim is dead per the §Adversarial review findings; recorded, not retuned. A-CLASS-GATE.v2 [reserved, unasserted]: class lattice with explicit TEE incomparability + causal evidence-to-action binding (arguments, promise-derived inputs, tick root, grant/prestate version) + cross-capability composition budgets. v2 receives its own preregistered thresholds before any lab run; nothing here asserts them. The rebuilt lab's gates (E-REFLEX-02, R1–R5) carry over as motivation only, not as v2 evidence.
• Same-build update (2026-07-10, later the same day): both review-imposed prerequisites were discharged at model scope by preregistered labs (addendum §A.4). F9: reflex-fraud-lab/ specifies the tick accumulator, inclusion/omission rules, and a total deterministic contradiction predicate whose domain excludes delivery schedules — exhaustive over 438 adversary configs: 498/498 victims assigned liability, 0 false liability, view-independence across all delivery subsets, 63/63 split-view handoff instances assigned SIMULATED. A-CLASS-GATE.v2: class-gate-lab/ specifies the product lattice + causal provenance meets + cross-capability budgets and verifies them exhaustively over 101,385 traces — the killed v1 control falls 116,909 times across the three review attack classes; v2 admits zero violations; every anchored flow is admitted SIMULATED. The devnet drills for both remain open; the THEORY labels stand.
• I-AGENT THEORY; two components fixture-MEASURED. Exact claim: AgentID + typed mandates + lineage-quotient reputation + membrane settlement compose into one protocol-level agent object with no new consensus mechanism. Adversary: clone-farm reputation, cross-job resource reuse, key-rotation identity theft, mandate replay. Pass: each component's own row passes (M-LINEAGE-QUORUM and M-QUARANTINE-SETTLE fixtures already green 2026-07-10) plus a composed drill with all four attacks simultaneously. Kill: any component kill kills the composition claim; components keep their own rows.

Reproduction

# the bridge lab, rebuilt instrument (this build)
cd reflex-lane-lab && python reflex_sim_v2.py          # exit 0, all 13 gate instances
# v1 remains on disk as the withdrawn record: reflex_sim.py + codex-review.md
# the measured components it composes
cd chorus-quorum-lab && python chorus_adapter.py       # 12 clones -> weight 1
cd nel-quarantine-lab && python nel_adapter.py         # 4,324,320 interleavings, 0 double payouts
# the latency/anchoring model
cd noosphere/research/nel-quant && python numbers.py   # lat_soft_final_*, b6_* multipliers

Related work

External (source-verified in the two surveys, URLs there): MegaETH architecture and Rex5 signed mini-blocks (docs.megaeth.com), Base Flashblocks, Arbitrum Timeboost, based-preconfirmation research (ethresear.ch), Block-STM (arXiv:2203.06871), Mysticeti (arXiv:2310.14821), Autobahn (arXiv:2401.10369), x402 (x402.org, measured 75.41M tx/30d), ERC-8004 Draft (eips.ethereum.org/EIPS/eip-8004), EIP-7702, Google AP2 mandates, NEAR Shade Agents. Internal: research/09-realtime-chains-survey.md, research/10-agent-chain-landscape.md, papers 01/02/04/05, ch04 §3.1 (A-AGENT-ABI), §3.5 (S-AGENT, S-FREYSA), §3.6 (finality classes), noosphere/research/nel-quant/.

The honest summary: yes, MindChain can carry a real-time lane — as a promise clock with named, bonded, class-gated semantics, at tens of milliseconds, not ten. And the decentralized LLM lane is not merely compatible with it; it is the one thing the real-time class cannot copy without abandoning its trust model. The trade-offs are real, priced above, and three of them are now preregistered kill conditions rather than marketing.