Authors: Conceptual framework originated circa 2020 by the founders of Cybopsec Version: 6.4 — May 2026 Status: Working White Paper — Pre-Publication Draft Classification: Open Research / Public Distribution License: Creative Commons Attribution 4.0 International (CC BY 4.0) Supersedes: DARM-ANN v6.3 (May 2026) GitHub Repository: https://github.com/cybopsec/darm-ann GitHub Pages: https://cybopsec.github.io/darm-ann Contact: research@cybopsec.org
| Version | Date | Key Additions |
|---|---|---|
| v3.0 | March 2026 | Core architecture; P1–P21; LSH, B-tree, LoRA/QLoRA, Tendermint, textual backpropagation |
| v4.0 | March 2026 | RLRF; Markov Graph G_M; GRPO; Dec-POMDP; P22–P29 |
| v5.0 | March 2026 | GTE (BFS/DFS/Dijkstra/A*/Bidirectional); BVAS; ESE; P30–P38 |
| v6.0 | April 2026 | Five-tier memory (WM/EB/STM/LTM/RRC); CDCP; RCE; Memory Lifecycle; Assumption Registry A1–A12; P39–P48 |
| v6.1 | April 2026 | NMN/Neuromorphic substrate; Bio-inspired swarm; sMCP-1 security; A13–A16; P49–P52; Appendix C |
| v6.2 | May 2026 | RCN formal spec; HCP (CRDT/OER/HLC); DCoT; V/P pattern; containerized mesh deployment; P53–P55; A17–A19; §14–§16; §20 expanded |
| v6.3 | May 2026 | MCP Gateway (§21); AI Gateway with fallback chain (§22); Interaction Model Protocol Stack A2A/ACP/OASF (§23); 15-layer stack (§24); P56–P57; A20–A22; references [55]–[61] |
| v6.4 | May 2026 | Context Bridge Layer (§25); DACS integration + KV Prefix Sharing (§26); Context Engineering Architecture Summary (§27); 16-layer stack update; P58–P61; A23–A26; refs [62]–[66] |
| Symbol | Meaning |
|---|---|
| N | Total number of compute nodes |
| k | Number of clusters; cluster size = N/k |
| k_lanes | Number of execution lanes in the RCN orchestration layer (k_lanes ≪ N) |
| d | Dimensionality of agent state / embedding vectors |
| m | Number of states in the B-tree state graph |
| e_avg | Average outgoing transitions per state |
| B | Total LSH buckets = B₁ × B₂ × B₃ |
| n | Records stored in the hash array |
| r | LoRA adapter rank (r ≪ d) |
| p | Parameters in base model |
| α | LoRA scaling factor |
| η | Learning rate |
| τ | Quorum threshold |
| τ_c | CDCP consolidation quorum (= 2/3) |
| ε | Approximation error bound |
| δ | Failure probability |
| λ | Blockchain throughput (tx/s) |
| λ_decay | Ebbinghaus decay rate |
| L | Number of agentic layers |
| A_l | Agents in layer l |
| γ | Markov discount factor |
| G_M | Markov policy graph constructed from blockchain history |
| G_K | Global blockchain knowledge graph |
| W_class | Operation write class: {read_only, local_write, global_write} |
| p_ro | Fraction of read_only operations (≈ 0.70) |
| p_lw | Fraction of local_write operations (≈ 0.25) |
| p_gw | Fraction of global_write operations (≈ 0.05) |
| T_occ | OER checkpoint interval (seconds) |
| D_rb | Maximum OER rollback depth before HLC escalation |
| T(·) | Time complexity |
| S(·) | Space complexity |
| E[·] | Expected value |
| Ω(·) | Lower bound |
| Θ(·) | Tight bound |
DARM-ANN v6.2 is the synthesis of six months of continuous architecture development, combining seven interlocking design principles into a single coherent distributed AI infrastructure framework.
The architecture centers on a five-tier hierarchical memory system (Working Memory, Episodic Buffer, Short-Term Memory, Long-Term Blockchain Memory, Rapid Retrieval Cache) modelled on hippocampal-neocortical consolidation theory. Memory formation, promotion, and decay are governed by the Memory Formation Pipeline, the Consensus-Driven Consolidation Protocol (CDCP), the Replay and Consolidation Engine (RCE), and the Memory Lifecycle Manager.
Epistemic integrity is enforced by three interlocked systems: the Graph Traversal Engine (GTE) validates claims via BFS/DFS/Dijkstra/A*/Bidirectional traversal of the knowledge graph; the Blockchain Validity Algorithm Suite (BVAS) provides active integrity oracles, fork detection, and adversarial state detection; and the Epistemic Skepticism Engine (ESE) implements second-order uncertainty quantification, calibrated confidence gating, and structured abstention.
Self-improvement is driven by Reinforcement Learning with Reasoning Feedback (RLRF) providing step-level verifiable rewards, and the Markov Graph G_M constructed from blockchain history enabling convergent distributed policy propagation.
The Router/Chain-Manager Node (RCN), new in v6.2, is the dedicated orchestration component that holds a self-updating linked list of TinyLM routine handles and dispatches tasks across parallel, sequential, and hybrid execution lanes. The Hybrid Consensus Protocol (HCP) gates every operation through a three-tier decision: CRDT-free reads bypass consensus entirely; local writes use Optimistic Execution with Rollback (OER) with branch DAG checkpointing; and global writes use Hierarchical Lane Consensus (HLC) running consensus over k_lanes ≪ N participants, reducing effective consensus cost from O(N log N) to O(k_lanes log k_lanes) — a ~28× reduction at typical scales.
The Distributed Chain-of-Thought (DCoT) protocol externalizes multi-step reasoning chains to the episodic buffer, enabling small TinyLMs to participate in arbitrarily long reasoning without context window constraints. The Verifier/Proposer (V/P) adversarial pattern provides adversarial verification at TinyLM cost for high-stakes tasks.
Deployment is supported on both physical Beowulf clusters (Raspberry Pi 5, PoE, solar/battery) and containerized fleets, with a WireGuard mesh peer-net providing encrypted inter-agent communication. A neuromorphic substrate integration maps DARM-ANN’s memory tiers to Intel Loihi 2/Hala Point spiking neural hardware.
The architecture is grounded in 55 formal proofs across 19 prior-version proof sets, an Assumption Registry of 19 validated assumptions, and a Proof Dependency DAG tracing every claim to its foundations. A curated Research Resource Catalog of 28+ sources grounds every design decision in peer-reviewed literature.
The year 2025 marked a critical inflection point in artificial intelligence. The era of scaling laws began to show unmistakable signs of diminishing returns [1]. The distillation era emerged: AI capability being compressed, specialized, and redistributed into smaller, faster, more efficient models [2]. Yet the infrastructure response to this shift was paradoxical — the industry doubled down on centralization while capability democratized.
DARM-ANN, first conceived and prototyped in 2020, represents the alternative path. The core insight is unchanged from its origin: intelligence should live close to data, memory should be distributed and tamper-evident, models should be small and specialized, and the underlying data structures should satisfy formally proven performance bounds.
By May 2026, the three pillars required for DARM-ANN’s practical deployment have converged:
The v6.2 release adds the final orchestration and consensus layer — the RCN and HCP — completing the formal specification of every system component from the physical hardware substrate to the application interface.
The complete DARM-ANN v6.2 system state at time t is described by:
Σ(t) = (A(t), M_wm(t), M_eb(t), M_stm(t), M_ltm(t), M_rrc(t),
DS(t), θ(t), H(t), RCN(t), G_M(t), ESE(t))
Where each component is described in its respective section. The system evolves via:
Σ(t+1) = F(Σ(t), I(t), E(t))
Where I(t) is the input set and E(t) is the environmental event set (node failures, power events, network partitions) at time t.
┌──────────────────────────────────────────────────────────────────────┐
│ APPLICATION INTERFACE LAYER │
│ Σ_app(t) = {channels, APIs, orchestration, epistemic reports} │
├──────────────────────────────────────────────────────────────────────┤
│ ROUTER / CHAIN-MANAGER NODE (RCN) [NEW v6.2] │
│ Registry: linked list of RoutineHandle{id,spec,model,lane,W_class} │
│ Gate: W_class(op) → {read_only, local_write, global_write} │
│ HCP: read_only→CRDT | local_write→OER | global_write→HLC │
│ Orchestration: {single, parallel, sequential, hybrid} lanes │
├──────────────────────────────────────────────────────────────────────┤
│ EPISTEMIC SKEPTICISM ENGINE (ESE) [v5.0] │
│ Calibrated confidence gating · Abstention protocol │
│ Second-order uncertainty · Debate claimant/skeptic │
│ R_epistemic → RLRF feedback loop │
├──────────────────────────────────────────────────────────────────────┤
│ BLOCKCHAIN VALIDITY ALGORITHM SUITE (BVAS) [v5.0] │
│ GTE traversal gate · Chain integrity · Fork resolution │
│ Adversarial state detection · Temporal consistency │
│ V_BVAS(claim) → COMMIT / QUARANTINE / REJECT │
├──────────────────────────────────────────────────────────────────────┤
│ GRAPH TRAVERSAL ENGINE (GTE) [v5.0] │
│ BFS/DFS/Bidirectional/Dijkstra/A* over G_M and G_K │
│ Validates claims before BVAS commit │
├──────────────────────────────────────────────────────────────────────┤
│ RLRF + MARKOV GRAPH G_M [v4.0] │
│ Step-level reward {r_1,...,r_K,r_outcome} │
│ G_M from blockchain history · Bellman value iteration │
│ Policy convergence to ε-optimal · Potential-based shaping │
├──────────────────────────────────────────────────────────────────────┤
│ INTERLAYERED AGENTIC NEURAL NETWORK │
│ A(t) = {(l,a,role,prompt,tools) | l∈[1..L], a∈[1..A_l]} │
│ Forward: f_l = σ(W_l·f_{l-1}+b_l) [agent layer analog] │
│ DCoT: reasoning externalized to EB · V/P adversarial check │
├──────────────────────────────────────────────────────────────────────┤
│ HIERARCHICAL SLM / TinyLM CONTEXTUAL PLANE │
│ θ(t) = {θ_base + Σ_j α_j/r_j·B_j·A_j | j∈tiers} │
│ Route(x) = argmax_tier P(tier|x;θ_router) │
│ Verifier TinyLM (process reward model) · Synthesis SLM │
├──────────────────────────────────────────────────────────────────────┤
│ FIVE-TIER HIERARCHICAL MEMORY SYSTEM [v6.0] │
│ WM (in-context, ephemeral) → EB (ring buffer, session) │
│ → STM (node-local, salient) → LTM (blockchain, global) │
│ → RRC (hot-path LSH cache, O(1) retrieval) │
│ CDCP: STM→LTM quorum promotion | RCE: offline replay │
├──────────────────────────────────────────────────────────────────────┤
│ DISTRIBUTED MEMORY / BLOCKCHAIN LAYER │
│ M_ltm(t) = {h_0,...,h_T} (hash chain, Tendermint BFT) │
│ M_branch(t) = {DAG_i | i∈active_branches} [OER writes] │
│ OER: optimistic write → branch DAG → checkpoint reconcile │
│ HLC: lane-local agg → k_lanes votes → O(k log k) consensus │
├──────────────────────────────────────────────────────────────────────┤
│ HIGH-ENTROPY NEURAL DATA STRUCTURE SUBSTRATE │
│ DS(t) = (Cluster, Majority, LSH_Array, BTree, G_M) │
│ T_decision = O(log m) | T_LSH = O(1) avg │
├──────────────────────────────────────────────────────────────────────┤
│ NEUROMORPHIC SUBSTRATE [v6.1] │
│ Intel Loihi 2 / Hala Point spiking neural mesh │
│ WM/EB → spike trains | LTM → synaptic weight consolidation │
│ Mesh NoC ↔ WireGuard peer-net topology correspondence │
├──────────────────────────────────────────────────────────────────────┤
│ LAYER 1 BARE-METAL HYPERVISOR / COMPUTE FABRIC │
│ H(t) = {(node_i, status_i, power_i, load_i) | i∈[1..N]} │
│ WireGuard mesh: 10.200.0.0/16 | RCN at 10.200.0.1 │
│ Container fleet: IaC Generator emits per-agent specs │
└──────────────────────────────────────────────────────────────────────┘
| Layer | Component | Introduced | Key Proofs |
|---|---|---|---|
| 14 | Application Interface | v3.0 | — |
| 13 | RCN + HCP | v6.2 | P53–P55 |
| 12 | ESE | v5.0 | P35–P38 |
| 11 | BVAS | v5.0 | P32–P34 |
| 10 | GTE | v5.0 | P30–P31 |
| 9 | RLRF + Markov G_M | v4.0 | P22–P29 |
| 8 | Agentic Network + DCoT/V/P | v3.0 + v6.2 | P9, P20 |
| 7 | SLM/TinyLM Contextual Plane | v3.0 | P11–P13 |
| 6 | Five-Tier Memory System | v6.0 | P39–P48 |
| 5 | Blockchain / OER / HLC | v3.0 + v6.2 | P14–P19, P53–P55 |
| 4 | Data Structures (LSH, B-tree) | v3.0 | P1–P10 |
| 3 | Neuromorphic Substrate | v6.1 | P49–P52 |
| 2 | Bare-Metal Hypervisor | v3.0 | P20 |
| 1 | Hardware / Container Fabric | v3.0 + v6.2 | — |
Introduced in v6.0. This section is reproduced in full; mathematical content is unchanged.
DARM-ANN’s memory architecture is modelled on hippocampal-neocortical consolidation theory — the Complementary Learning Systems (CLS) framework of McClelland, McNaughton, and O’Reilly (1995), sleep replay research (Klinzing, Niethard & Born, 2019), and 2025–2026 agentic memory systems research (Hu et al. [8]; Yu et al. [20]).
The central design principle: different memory stores serve different cognitive functions, operate on different time scales, and require different hardware and consistency guarantees.
Tier 1 — Working Memory (WM): In-context activations for the duration of a single inference pass. Ephemeral. Zero latency. Capacity = context window W tokens.
M_wm(t) = {token_1, ..., token_W} ⊂ θ_active_context
T_access = O(1)
Persistence = inference pass only
Tier 2 — Episodic Buffer (EB): Per-agent ring buffer of R = 64 recent reasoning traces. Survives across inference calls within a session. Sub-millisecond access.
M_eb = RingBuffer(capacity=R=64, record={claim, confidence, timestamp, step_id})
T_access = O(1) [direct index]
Persistence = session
Tier 3 — Short-Term Memory (STM): Node-local in-memory store (Redis) of salient, validated claims. Persists across sessions. 10,000-record capacity per node. Millisecond-range access.
M_stm = {(claim, salience, timestamp, node_id) | salience ≥ θ_salience}
|M_stm| ≤ 10,000 per node
T_access = O(1) [hash map]
Persistence = sessions, until decay or promotion
Tier 4 — Long-Term Blockchain Memory (LTM): Consensus-committed, tamper-evident, replicated across all N nodes. The canonical ground truth. Accessed via LSH in O(1) average.
M_ltm = {B_0, B_1, ..., B_T} [Tendermint-committed hash chain]
B_i = (data_i, h_{i-1}, nonce_i, sig_i)
T_access = O(1) avg [LSH index]
Persistence = permanent (pruning only by governance vote)
Tier 5 — Rapid Retrieval Cache (RRC): Pre-computed LSH index over the top-K most frequently accessed LTM entries. Refreshed every T_rrc seconds. O(1) access to “hot” long-term memory.
M_rrc = LSH_index(top-K entries from M_ltm by access_frequency)
K = 10,000 (default)
T_rrc = 3600s (refresh interval)
T_access = O(1) avg [pre-built LSH]
Persistence = until next refresh
| Tier | Capacity | Access Latency | Persistence | Consistency |
|---|---|---|---|---|
| WM | W tokens (~256KB) | ~0 (in-context) | Inference pass | Local |
| EB | R=64 traces | < 1ms | Session | Local |
| STM | 10K records/node | 1–5ms | Sessions | Node-local |
| LTM | Unbounded (grows with chain) | 5–50ms (LSH) | Permanent | Global BFT |
| RRC | K=10K hot entries | 1–3ms | Until refresh | Cached |
| Neuroscience | DARM-ANN | Function |
|---|---|---|
| Sensory register | WM (context window) | Immediate transient processing |
| Hippocampal working memory | EB (ring buffer) | Recent episode retention |
| Hippocampal STM | STM (Redis) | Fast, flexible recent storage |
| Neocortical LTM | LTM (blockchain) | Slow, stable, distributed encoding |
| Memory indexing / recall | RRC (LSH cache) | Rapid access to consolidated knowledge |
Introduced in v6.0.
Every claim generated by an agent undergoes encoding before entering the memory pipeline:
encode(claim) → {embedding, salience_score, confidence, timestamp, node_id, step_id}
Embedding: computed by the TinyLM embedding layer, producing a d-dimensional vector φ(claim) ∈ ℝ^d.
Salience score S(claim) ∈ [0, 1] is computed as a weighted combination:
S(claim) = w_f × freq_score + w_c × confidence + w_r × recency + w_n × novelty
Where:
Default weights: w_f = 0.4, w_c = 0.3, w_r = 0.2, w_n = 0.1 (tunable).
P47 — Salience Convergence: As Q → ∞ (queries), the salience rank-ordering converges to the empirical query frequency ordering. The proof follows from the dominance of w_f × freq_score as freq_score accumulates evidence. (Formal proof in v6.0 §16, assumption A10.)
A claim is persisted to STM if and only if:
S(claim) ≥ θ_salience AND confidence ≥ θ_confidence AND GTE_validate(claim) = PASS
The GTE validation (§9) ensures no claim enters STM without graph traversal consistency checking.
Introduced in v6.0; HCP gate integration added in v6.2.
A claim in STM is eligible for LTM promotion when:
age(claim) ≥ t_min_age = 60s AND
S(claim) ≥ θ_consolidation AND
vote_count(claim) ≥ τ_c × N_active_nodes
Algorithm CDCP(claim c):
1. Initiating node broadcasts: PROPOSE(c, hash(c), salience(c))
2. Each receiving node:
a. Validates c via GTE (BFS consistency check)
b. Checks c against current STM for conflicts
c. If valid: sends VOTE(c, node_id, sig_node)
d. If invalid: sends REJECT(c, reason)
3. If votes ≥ τ_c × N: COMMIT(c) → LTM block
Else: QUARANTINE(c) → ESE review
The CDCP operates within the HCP framework (§15). STM reads are read_only (CRDT-free). STM writes are local_write (OER path). LTM commits are global_write (HLC path):
W_class(STM_read) = read_only → CRDT, zero consensus cost
W_class(STM_write) = local_write → OER (optimistic, branch DAG)
W_class(LTM_commit)= global_write→ HLC (hierarchical lane consensus)
This ensures that the vast majority of memory operations (reads and STM writes) incur zero global consensus cost, while only irreversible LTM commits pay the HLC cost.
P39 — CDCP Hallucination Resistance:
The probability that a fabricated claim achieves CDCP quorum is bounded by:
The conservative bound is the operating assumption. Requires A1, A3, A4.
P40 — CDCP Safety: No two contradictory claims can achieve quorum in the same epoch. Proof follows from BFT quorum intersection property — any two quorums of size ≥ 2N/3 share at least one correct node, which cannot vote for contradictory claims. Requires A1, A2.
P41 — CDCP Liveness: Terminates within O(Δ + T_GTE_max) under partial synchrony (GST assumption). Requires A1, A2, A6.
P46 — Optimal τ_c: τ_c = 2/3 is the minimum quorum fraction that provides standard BFT safety (f < N/3 Byzantine nodes). Proof from quorum intersection argument. Requires A1, A2.
Introduced in v6.0.
The RCE models the hippocampal sharp-wave ripple (SWR) phenomenon — offline replay of recently encoded memories during low-activity periods — that neuroscience identifies as critical to long-term memory consolidation (Diekelmann & Born, 2010 [NEURO-1]).
Algorithm RCE(replay_interval T_replay):
Trigger: system enters low-activity period (queue_depth < θ_idle)
1. Sample B records from STM, weighted by salience
2. For each sampled record r:
a. Re-run GTE validation (DFS causal chain audit)
b. If validation passes and S(r) ≥ θ_consolidation:
→ Add r to CDCP candidate queue
c. Update S(r) based on replay (spacing effect reinforcement)
3. Process CDCP queue (§5.2)
4. Update decay scores for all STM records (§8.1)
P42 — Catastrophic Forgetting Bound: During LoRA fine-tuning on new tasks with mixing ratio r = 0.4 (40% replay of consolidated memories, 60% new task data), the gradient signal is:
∇L_mixed = r × ∇L_replay + (1-r) × ∇L_new
= 0.4 × ∇L_replay + 0.6 × ∇L_new
At least 28.6% of the gradient signal (= r/(1+r) = 0.4/1.4) is informed by consolidated knowledge from the RCE replay buffer. This provides an implicit Elastic Weight Consolidation (EWC) correspondence: the replay gradient acts as a regularizer preserving previously learned capabilities. Requires A7, A8.
Design note: The 28.6% figure is a lower bound on the replay signal’s influence, not a claim about parameter proximity. The actual forgetting prevention depends on the semantic overlap between replay and new task data.
Introduced in v6.0.
Algorithm RRC_Build(M_ltm, K, L_tables=3):
1. Rank all M_ltm entries by access_frequency (descending)
2. Select top-K entries: M_hot ⊂ M_ltm, |M_hot| = K
3. Build L=3 independent LSH tables over M_hot:
For each table l ∈ {1,2,3}:
h_l: ℝ^d → {1,...,B} [random projection hash]
For each record r ∈ M_hot:
bucket_l[h_l(φ(r))].append(r)
4. RRC = {bucket_1, bucket_2, bucket_3}
5. Schedule next rebuild at t_now + T_rrc
Algorithm RRC_Query(query_embedding q, k_neighbors):
1. For each table l ∈ {1,2,3}:
candidates_l ← bucket_l[h_l(q)]
2. candidates ← union(candidates_1, candidates_2, candidates_3)
3. Return top-k_neighbors by cosine_similarity(φ(r), q)
P43 — RRC Retrieval Performance: E[T_RRC] = O(1) amortized; recall = 99.9% with L=3 tables at p₁ = 0.9. Follows directly from LSH analysis (P4) applied to the hot-path subset. Requires A9.
P45 — RRC Retrieval Efficiency: RRC provides 25–200× speedup over full LTM scan for hot-path queries. At 60% RRC hit rate, system throughput increases by factor 2.46×. Requires A9, A12.
Introduced in v6.0.
Memory records in STM undergo continuous decay scoring following the Ebbinghaus forgetting curve with spacing effect reinforcement:
DecayScore(r, t) = exp(-λ_decay × Δt) × SpacingFactor(r)
SpacingFactor(r) = 1 + Σ_{i=1}^{n_r} exp(-λ_spacing × (t - t_i))
Where n_r is the number of times record r has been accessed or replayed, and t_i are the timestamps of those accesses.
P48 — Decay Score = Ebbinghaus Curve × Spacing Reinforcement: The DecayScore function is formally equivalent to the Ebbinghaus forgetting curve S(t) = e^{-t/S} (with S = 1/λ_decay) multiplied by a spacing effect enhancement factor. The spacing factor is sublinear in n_r (diminishing returns from repeated access). Requires A10.
Every T_triage seconds, the lifecycle manager evaluates all STM records:
Algorithm LifecycleTriage():
For each record r in STM:
if DecayScore(r) < θ_decay: → PRUNE(r) from STM
elif S(r) ≥ θ_consolidation: → CDCP(r) [promote to LTM]
elif r.age > t_max_stm: → PRUNE(r) unless high-salience
else: → RETAIN(r)
P44 — Retrograde Protection: A new claim c_new cannot overwrite an established LTM record c_old unless:
confidence(c_new) ≥ κ × confidence(c_old) (κ = 1.2, incumbency factor)
AND
GTE_validate(c_new, depth=DFS_full) = PASS
AND
CDCP_quorum(c_new) achieved in fresh epoch
Introduced in v5.0. Full derivations in the v5.0 versioned archive.
The GTE validates claims by traversing the distributed knowledge graph G_K (blockchain memory) and agent policy graph G_M (§13). Five traversal strategies are defined, each formally matched to a validation task class.
| Strategy | Complexity | Use Case |
|---|---|---|
| BFS (Breadth-First) | O(V+E) | Exhaustive local consistency; finds nearest conflicting claims |
| DFS (Depth-First) | O(V+E) | Deep causal chain audit; provenance tracing |
| Bidirectional BFS | O(b^{d/2}) | Cross-reference verification; find connecting evidence path |
| Dijkstra’s | O((V+E) log V) | Minimum-cost evidence path; optimizes for claim quality |
| A* Heuristic | O(b^d) best-case | Guided multi-hop reasoning under time budget |
Where b = branching factor, d = depth, V = vertices, E = edges.
P30 — GTE BFS Correctness: BFS over G_K finds all claims within distance k hops with 100% recall. O(V+E) time, O(V) space.
P31 — GTE A* Admissibility: A* with an admissible heuristic h(n) ≤ h*(n) always finds the minimum-cost evidence path. Requires the heuristic to be consistent (monotone condition).
Select_GTE_Strategy(claim c, time_budget T_budget):
if T_budget = unlimited AND depth_known = shallow: → BFS
elif T_budget = unlimited AND depth_unknown: → DFS
elif cross_reference verification needed: → Bidirectional
elif minimize evidence cost: → Dijkstra
elif T_budget constrained AND heuristic available: → A*
| P29 — GTE total validation cost for a claim requiring k-hop reasoning with | G_K | = V vertices: |
T_GTE = O(min(b^{d/2}, V+E)) [Bidirectional for most cases]
Introduced in v5.0. Full derivations in the v5.0 versioned archive.
BVAS transforms the blockchain from a passive memory store into an active integrity oracle, providing four formal algorithms.
Algorithm ChainIntegrity(chain C):
For each block B_i in C:
assert h_i == Hash(data_i || h_{i-1} || nonce_i || sig_i)
assert Ed25519_verify(sig_i, committing_node_pubkey)
Return VALID or first_violation_index
P32 — Chain Integrity Detection: Any modification to block B_j is detectable in O(T-j) time by checking the hash chain from j to T. The probability of an undetected modification is P(forge) = 2^{-128} (Ed25519 birthday bound).
P33 — Fork Resolution Bound: At most one fork can persist beyond one consensus round (2Δ) under Tendermint safety guarantees (f < N/3 Byzantine nodes). The resolution function selects the fork with higher cumulative validity score V_BVAS.
BVAS computes a composite validity score for every claim entering the commit pipeline:
V_BVAS(claim) = w_1 × chain_integrity + w_2 × temporal_consistency
+ w_3 × gte_traversal_result + w_4 × signature_validity
Threshold: if V_BVAS(claim) ≥ θ_commit: → COMMIT
elif V_BVAS ≥ θ_quarantine: → QUARANTINE (ESE review)
else: → REJECT
P34 — BVAS Adversarial Detection Rate: Byzantine insertion attacks (fabricated blocks with valid signatures from compromised nodes) are detected by the temporal consistency check with probability ≥ 1 - δ_temporal under assumption A2.
A claim is temporally consistent if all referenced predecessor claims have timestamps ≤ t_claim and are reachable in the DAG partial order.
Introduced in v5.0. Full derivations in the v5.0 versioned archive.
The ESE provides calibrated epistemic integrity — the structural guarantee that the system knows what it knows, explicitly represents what it does not know, and verifiably refuses to confabulate.
ESE decomposes total uncertainty into:
U_total(claim) = U_aleatoric(claim) + U_epistemic(claim)
Where:
The decomposition is implemented via deep ensemble disagreement [P35].
| P35 — Calibration Convergence: ESE confidence scores converge to empirical accuracy over Q queries: | conf - acc | → 0 as Q → ∞ under temperature scaling with Adam optimization (lr=0.01). |
ESE instantiates two agents — Claimant and Skeptic — to debate high-uncertainty claims:
Claimant(claim c): generates supporting evidence chain E_support
Skeptic(claim c): generates refuting evidence chain E_refute
Judge (RCN): scores debate outcome → final confidence(c)
P36 — Abstention Optimality: ESE’s structured abstention (refusing to answer when U_epistemic > θ_abstain) minimizes expected calibration error compared to forced-answer strategies. Proof via decision theory under uncertainty.
ESE outputs a reward signal R_epistemic to the RLRF system (§12):
R_epistemic = +1 if abstention was correct (claim later refuted)
R_epistemic = -1 if abstention was incorrect (claim later confirmed)
R_epistemic = 0 for non-abstention outcomes
This closes the epistemic learning loop: the system learns when to be uncertain.
P37–P38 — Skeptic convergence and hallucination reduction bound: Full proofs in v5.0 archive. Key result: hallucination rate ≤ P_hallucinate(unaugmented) × (1 - coverage_BVAS × coverage_ESE).
Introduced in v4.0. Full derivations in the v4.0 versioned archive.
RLRF replaces the v3.0 scalar quality signal Q with a structured reward chain:
R_RLRF = {r_1, r_2, ..., r_K, r_outcome}
Where r_i is the verifiable reward for reasoning step i (computed by a lightweight verifier TinyLM) and r_outcome is the final outcome reward. This provides step-level credit assignment.
P22 — Non-vanishing gradient: The RLRF temporal gradient provides a non-vanishing signal:
E[||∇_θ R_RLRF||] ≥ ε_verifier > 0
The lower bound ε_verifier is set by the verifier TinyLM’s ability to distinguish correct from incorrect reasoning steps.
P23 — Credit assignment superiority:
E_RLRF[||∇R||] ≥ E_RLVR[||∇R||] for K ≥ 2 reasoning steps
RLRF always provides a larger gradient signal than outcome-only RLVR (Reinforcement Learning with Verifiable Rewards) for multi-step reasoning tasks.
P29 — Distributed GRPO cost:
T_GRPO = O(G × L × max_l(A_l) × T_inference)
Where G = group size for Group Relative Policy Optimization, L = agentic layers, max_l(A_l) = peak agents per layer. The GRPO policy optimizer runs on the Markov graph G_M (§13).
Introduced in v4.0. Full derivations in the v4.0 versioned archive.
The Markov policy graph G_M is constructed directly from the blockchain history — every committed LTM block encodes a (state, action, reward, next_state) tuple, making the blockchain a free experience replay buffer:
G_M = (S, A, P, R, γ)
S = {s_i | s_i ∈ agent_states extracted from LTM}
A = {a_i | a_i ∈ actions committed to LTM}
P = transition probabilities estimated from LTM frequency counts
R = reward function from RLRF
γ = discount factor (default 0.95)
P24 — Stationary distribution convergence:
||ρ^(t) - ρ*|| ≤ (λ_2)^t × ||ρ^(0) - ρ*||
Where λ_2 is the second-largest eigenvalue of the transition matrix.
P25 — Spectral gap lower bound:
λ_1 - λ_2 ≥ 1/(m × D_max)
Where m = state count, D_max = maximum node degree.
P26 — Bellman contraction:
||V^(t+1) - V*||_∞ ≤ γ × ||V^(t) - V*||_∞
The value function converges geometrically to V* at rate γ per iteration.
P27 — Full policy convergence: Under conditions (1) ergodic G_M, (2) bounded rewards, (3) RLRF reward consistency, (4) sufficient exploration, the distributed multi-agent policy converges:
||π^(t) - π*||_1 ≤ ε for t ≥ T_converge = O(log(1/ε) / (1-γ))
P28 — Potential-based shaping invariance:
V^{π*}_{shaped} = V^{π*}_{original} + ρ/(1-γ)
Potential-based reward shaping does not change the optimal policy — only the rate of convergence.
The distributed multi-agent setting is formally a Decentralized Partially Observable Markov Decision Process (Dec-POMDP). Each agent l observes a partial view of G_M and maintains a local value estimate V_l. The κ-hop neighborhood policy propagation:
V_l^{(t+1)} = R_l + γ × max_{a∈A_l} Σ_{l'∈κ-hop(l)} P(l'|l,a) × V_{l'}^{(t)}
New in v6.2.
Prior versions of DARM-ANN defined routing as the function Route(x) = argmax_tier P(tier|x; θ_router) — a per-query classification with no state. This is insufficient for a production multi-agent system handling concurrent chains, multi-step tasks, and parallel execution lanes. The Router/Chain-Manager Node (RCN) is the dedicated orchestration component that fills this gap.
The RCN is a first-class node type in the DARM-ANN topology, distinct from inference agents. It holds no model weights and performs no inference — its function is entirely orchestration, classification, and consensus gating.
Routine Registry (self-updating linked list):
struct RoutineHandle {
routine_id: u64
specialization: Specialization
// {retrieval, classification, reasoning,
// scoring, synthesis, verification, memory}
model: &TinyLM
lane: ExecutionLane
// {single, parallel, sequential, hybrid}
write_class: WriteClass
// {read_only, local_write, global_write}
avg_latency_ms: f32 // EWMA-updated online
success_rate: f32 // EWMA-updated online
confidence_threshold: f32 // below → escalate
next: *RoutineHandle // linked list pointer
}
The registry self-orders by priority score P = success_rate / avg_latency_ms using EWMA updates with decay factor β = 0.95:
avg_latency_ms(t+1) = β × avg_latency_ms(t) + (1-β) × measured_latency
success_rate(t+1) = β × success_rate(t) + (1-β) × task_success
This is the recursive self-organization principle (§ agentic layer) made concrete at the orchestration layer — the list continuously re-sorts to put the fastest, most reliable routines first.
Orchestration Config Table:
| Complexity Class | Pattern | Consensus Path |
|---|---|---|
| Trivial | Single-shot | W_class of the single agent |
| Decomposable | Parallel fan-out | Lane-local agg → HLC if global_write |
| Dependent | Sequential chain | Each step’s W_class evaluated independently |
| Complex | Hybrid fork/join | Sub-chain results merged before consensus |
| Adversarial | Verifier/Proposer | Proposer writes local; verifier confirms; global_write on agreement |
Execution Context Stack:
struct ExecutionContext {
task_id: u64
chain_config: OrchestrationConfig
active_steps: Vec<StepState>
partial_results: BranchDAG_ref // OER path
deadline_ms: u64
rollback_depth: u32 // tracks D_rb countdown
}
The stack enables suspension, retry, and rollback without losing partial results, since all intermediate writes land in the branch DAG before any global consensus is attempted.
The system state tuple is extended in v6.2:
Σ(t) = (A(t), M_wm(t), M_eb(t), M_stm(t), M_ltm(t), M_rrc(t),
DS(t), θ(t), H(t), RCN(t), G_M(t), ESE(t))
RCN(t) = (Registry(t), ExecStack(t), HCP_state(t))
The RCN state is checkpointed to the branch DAG every T_occ seconds. If the RCN node fails, a standby RCN reconstructs ExecStack(t) from the branch DAG — the orchestration state is recoverable.
A17 — Registry self-ordering validity: The EWMA priority score P = success_rate / avg_latency_ms is a valid proxy for expected task efficiency, assuming task difficulty is stationary over the EWMA window (β = 0.95, effective window ≈ 20 tasks). Validation: measure rank correlation between P and independently-measured task quality over 1,000 task runs.
New in v6.2. Resolves the O(N log N) consensus overhead identified as Risk T1 in v3.0–v6.1.
Every version from v3.0 through v6.1 identified global consensus at O(N log N) as a structural disadvantage (§21, P1, P10 of the data structures treatment). The HCP is the unified protocol that gates every operation through the cheapest consensus tier consistent with its semantics, reducing amortized consensus cost to near-zero for the 95% of operations that do not require global agreement.
Every operation arriving at the RCN is classified:
W_class(op) → {read_only, local_write, global_write}
Classification rules:
| Operation | W_class | Basis |
|---|---|---|
| Memory read (WM/EB/STM/LTM/RRC) | read_only | No state modification |
| Inference (no memory update) | read_only | No state modification |
| Agent state / STM write | local_write | Branch DAG; eventual consistency |
| LoRA adapter delta | local_write | FedAvg propagation; async |
| LTM commit (CDCP) | global_write | Requires cross-node BFT agreement |
| Model version publish | global_write | Canonical state change |
| Recursive layer spawn/destroy | global_write | Topology change |
Empirical distribution from reference cluster operation:
p_ro ≈ 0.70 (reads dominate at inference time)
p_lw ≈ 0.25 (local learning and adaptation)
p_gw ≈ 0.05 (infrequent LTM commits)
p_ro + p_lw + p_gw = 1.0
HCP(op):
W_class ← Classify(op)
if W_class = read_only:
→ CRDT_Read(op) // zero consensus cost; nearest tier
elif W_class = local_write:
→ OER_Write(op) // Optimistic Execution with Rollback
elif W_class = global_write:
→ HLC_Consensus(op) // Hierarchical Lane Consensus
Tier 1 — CRDT Read: Memory reads are served from the nearest available tier (RRC → STM → LTM). No locks, no coordination. This is the CRDT eventual-consistency read model of §3 and §8.1, formally gated by HCP.
Tier 2 — Optimistic Execution with Rollback (OER):
Phase 1 — Optimistic write: The agent writes to its local branch DAG immediately without lock:
branch_DAG_i.append(record, timestamp=t_now, version=v_local)
Phase 2 — Checkpoint reconciliation: RCN triggers reconciliation every T_occ seconds:
for each active branch DAG_i:
for each record r written since last checkpoint:
if Conflicts(r, other_branch_records):
Rollback(branch_DAG_i, to=last_clean_checkpoint)
re_queue(task_that_produced_r)
else:
Promote(r, to=STM)
Phase 3 — Global promotion: Records surviving D_rb clean reconciliation cycles are promoted to LTM via HLC:
if r.clean_reconciliation_count ≥ D_rb:
HLC_Consensus(Merkle_root(branch_DAG_i))
Conflict definition:
Conflict(r_a, r_b) ≡ addr(r_a) = addr(r_b) ∧ val(r_a) ≠ val(r_b)
∧ ¬(r_a ≺ r_b) ∧ ¬(r_b ≺ r_a)
Maximum rollback depth D_rb: if a record conflicts D_rb consecutive times, it is escalated to HLC. Default D_rb = 3.
Assumption A18 — OER conflict rate: The fraction of local_write operations that result in a detectable conflict is p_conflict ≤ 0.10 (≤10% of local writes). This is a design assumption based on the expectation that DARM-ANN agents are specialized and work on non-overlapping memory regions. Validation: measure conflict rate in reference cluster over 30 days.
Tier 3 — Hierarchical Lane Consensus (HLC):
The RCN partitions the N agents into k_lanes execution lanes. Each lane aggregates its result locally before the RCN runs lightweight consensus over k_lanes ≤ 8 results.
Step 1 — Intra-lane aggregation:
T_lane_agg = O(N/k_lanes × d) [QuickSelect median, §21]
Step 2 — Inter-lane consensus:
T_inter_lane = O(k_lanes log k_lanes)
Step 3 — Global chain write:
T_chain_write = O(1) [amortized; one Merkle root per round]
P53 — HLC cost for fixed lane size:
Claim: For N/k_lanes = c (constant lane size), T_HLC = O(k_lanes log k_lanes).
Proof: When N/k_lanes = c, the term O(N·d/k_lanes) = O(c·d) = O(1) with respect to k_lanes. Therefore:
T_HLC = O(1) + O(k_lanes log k_lanes) + O(1) = O(k_lanes log k_lanes)
QED.
P54 — HLC strictly less than global consensus:
Claim: T_HLC < T_global whenever k_lanes < N.
Proof: Since x log x is strictly increasing for x > 1, k_lanes log k_lanes < N log N iff k_lanes < N. By construction k_lanes ≪ N. The reduction ratio:
T_HLC / T_global = (k_lanes/N) × (log k_lanes / log N)
For k_lanes = 8, N = 100: ratio = (8/100) × (3/6.64) ≈ 0.036 — a ~28× reduction. QED.
P55 — OER reduces expected consensus invocations:
Claim: Under the HCP gate, the fraction of operations invoking global consensus is p_gw ≈ 0.05, not 1.0.
Proof: By the operation classifier, only W_class = global_write operations invoke HLC. Therefore:
E[consensus_invocations] = p_gw × total_ops ≈ 0.05 × total_ops
This is a 20× reduction. The amortized cost per operation:
C_amortized = p_ro × O(1) + p_lw × O(branch_append) + p_gw × O(k_lanes log k_lanes)
≈ 0.95 × O(1) + 0.05 × O(k_lanes log k_lanes)
The dominant term is O(1). QED.
Assumption A19 — WireGuard mesh isolation: The WireGuard mesh provides cryptographic isolation between agent communication channels such that AllowedIPs = peer_ip/32 routing prevents cross-agent traffic leakage. Validation: formal WireGuard security proof [49] provides this guarantee.
Risk T1: Coordination Failure in Distributed Consensus
New in v6.2.
Individual TinyLMs under 500M parameters cannot hold long reasoning chains in their context window. The DCoT protocol solves this by externalizing the reasoning chain to the Episodic Buffer, partitioning it into single-step sub-tasks each handled by one TinyLM agent.
Formal definition:
Let T be a task requiring reasoning chain C = [c_1, …, c_R]. DCoT protocol:
Step 1 — Decomposition:
[t_1, t_2, ..., t_R] = RCN.Decompose(T; θ_classifier)
The RCN’s classification agent decomposes T into R ordered sub-tasks.
Step 2 — Sequential dispatch:
for i in 1..R:
context_i = EB.read(steps 1..i-1) // read prior steps
result_i = TinyLM_agent(t_i, context_i) // single-step inference
EB.write(result_i, W_class=local_write) // OER path; zero consensus cost
Step 3 — Synthesis:
answer = Synthesizer_agent([result_1, ..., result_R])
EB.write(answer, W_class=local_write)
if classifier.is_significant(answer):
→ HCP(answer, W_class=global_write) // promote to LTM via HLC
Episodic buffer capacity for DCoT:
M_eb_chain = R × d_step bits
For R = 20 steps at d_step = 2KB per result: M_eb_chain = 40KB — trivial.
DCoT and OER integration: Every EB.write in DCoT is a local_write dispatched through the OER path. The full reasoning chain is only promoted to global consensus at the synthesis step, if warranted by classifier confidence. The consensus cost of a 20-step reasoning chain equals one single-step write.
Literature grounding:
For verification-class tasks — security analysis, formal proof checking, high-stakes decisions, adversarial inputs — DCoT alone is insufficient. The V/P pattern instantiates an adversarial check on the reasoning itself.
Pattern definition:
Proposer := TinyLM(specialization=reasoning)
→ generates candidate answer A_prop
Verifier := TinyLM(specialization=verification,
fine_tuned=process_reward_model,
confidence_threshold=0.85)
→ evaluates A_prop: {accept | reject | partial}
Arbiter := RCN (no inference cost)
if accept: A_final = A_prop; W_class = local_write
if reject: re_queue(Proposer), max 3 rounds
if partial: escalate to SLM-Medium for synthesis
V/P consensus cost: The V/P debate runs entirely in the local_write path — zero global consensus cost until the final accepted answer. Only the final A_final triggers a write, and only global_write if it constitutes a significant new memory.
RCN trigger conditions:
Invoke V/P when:
task.risk_class ∈ {security_analysis, formal_verification,
high_stakes_decision, adversarial_input}
OR Proposer.confidence < confidence_threshold
The second condition integrates V/P with the confidence gating mechanism (§15.2), ensuring any TinyLM uncertainty automatically triggers adversarial verification.
Literature grounding:
Introduced in v6.1. Summarized here; full derivations in v6.1 archive.
Intel’s Hala Point system (January 2025) provides 1.15 billion spiking neurons organized as a mesh network-on-chip, representing the first neuromorphic system at the scale required for DARM-ANN’s distributed memory architecture [NMN-1].
Key specifications relevant to DARM-ANN:
| DARM-ANN Tier | Neuromorphic Analog | Hardware | Latency |
|---|---|---|---|
| WM | Dendritic computation / active potentials | Neuron cores | ~1μs |
| EB | Hippocampal CA3 recurrent activity | On-chip SRAM | ~10μs |
| STM | Hippocampal CA1 short-term potentiation | Off-chip DRAM | ~100μs |
| LTM | Neocortical synaptic weight consolidation | Blockchain + SSD | ~10ms |
| RRC | Cerebellar-like rapid lookup | On-chip weight cache | ~1μs |
P49 — Spike-Rate to Embedding Equivalence: Under rate coding, a Loihi 2 neuron population of size d firing at rates ρ_1,…,ρ_d produces a vector φ_spike ∈ ℝ^d equivalent to a dense embedding φ(claim) within L2 distance ε with probability ≥ 1-δ. Requires A13 (spike rate stability).
P50 — Neuromorphic Memory Consolidation: The Loihi 2 on-chip learning rule (STDP + homeostatic plasticity) implements an approximation of the RCE replay algorithm (§6) with convergence rate bounded by A14 (STDP learning rate).
P51 — Mesh NoC Consensus Correspondence: The Hala Point mesh NoC topology (torus, k×k nodes) supports a distributed consensus protocol with latency T_consensus_neuro = O(√k × hop_latency), comparable to Tendermint at equivalent node count. Requires A15.
P52 — Energy Efficiency Bound: Neuromorphic inference on Loihi 2 consumes E_neuro ≤ E_TinyLM / 10 per inference operation for sparse activation patterns (A16: sparsity ≥ 90%). Full derivation in v6.1 §22.
| ID | Statement | Used By |
|---|---|---|
| A13 | Spike firing rates are stable over the EWMA window (100ms) | P49 |
| A14 | STDP learning rate is within convergence regime [0.001, 0.1] | P50 |
| A15 | Hala Point mesh NoC diameter ≤ 2√k hops | P51 |
| A16 | Activation sparsity ≥ 90% for TinyLM inference workloads | P52 |
Introduced in v6.1. Summarized here; full derivations in v6.1 archive.
The CDCP’s multi-node quorum voting (§5) has a formal correspondence to bee colony foraging optimization (Artificial Bee Colony, ABC algorithm):
| ABC Algorithm | DARM-ANN CDCP |
|---|---|
| Employed bees explore food sources | Agents evaluate claim evidence |
| Onlooker bees select high-quality sources | Quorum votes select high-salience claims |
| Scout bees discover new sources | New-agent joins propose fresh claims |
| Waggle dance (quality signal) | CDCP PROPOSE broadcast (salience score) |
| Colony consensus on best food source | CDCP quorum on LTM commit |
This correspondence validates CDCP’s convergence properties: bee colony optimization converges to the global optimum with probability 1 as colony size N → ∞ (Karaboga & Basturk, 2007), providing an additional convergence argument for CDCP beyond the BFT proof.
The bio-inspired swarm architecture introduces new attack surfaces addressed in §19:
Introduced in v6.1; WireGuard mesh security added in v6.2.
The sMCP-1 (Secure Model Context Protocol, Draft 0.3) is a comprehensive hardening proposal for the Model Context Protocol covering:
sMCP-1 integrates directly with the CDCP signature chain: every claim entering the memory pipeline carries an Ed25519 signature from its originating node, providing end-to-end provenance from WM through LTM.
The inter-agent WireGuard mesh (§20.2) provides the following formally guaranteed security properties:
| Property | Mechanism | Guarantee |
|---|---|---|
| Confidentiality | ChaCha20-Poly1305 | IND-CPA secure under random oracle model |
| Authentication | Curve25519 ECDH | Authenticated key exchange; prevents MITM |
| Integrity | Poly1305 MAC | Existential unforgeability per packet |
| Forward secrecy | New session keys per handshake | Past sessions secure even if key compromised |
| Isolation | AllowedIPs = peer_ip/32 | No cross-subnet routing; lateral movement prevented |
Cryptographic note: WireGuard’s formal security proof [Donenfeld, 2017, reference 49] provides composable security guarantees. The DARM-ANN mesh inherits these guarantees provided the IaC Generator correctly generates per-node key pairs (guaranteed by the Curve25519 key generation in the IaC Generator — see §20.3).
| Threat | Attack Vector | DARM-ANN Countermeasure |
|---|---|---|
| Memory injection | Fabricated LTM blocks | P39 CDCP hallucination resistance |
| Chain poisoning | Modified block hash | P32 chain integrity detection |
| Model weight poisoning | Adversarial LoRA delta | Byzantine-robust FedAvg (trimmed mean) |
| Prompt injection | Crafted task inputs | ESE abstention + V/P verification |
| Swarm DDoS | Fake agent flood | SPIFFE identity + rate limiting |
| Key exfiltration | Memory side-channel | WireGuard forward secrecy; short key lifetime |
Physical deployment introduced in v3.0; containerized deployment new in v6.2.
Validated hardware (2026):
mpiexecStatic IP scheme:
Head node: 192.168.1.1 (server-01)
Pi 5 nodes: 192.168.1.10–15 (node-01 through node-06)
Pi 4 nodes: 192.168.1.20–25 (node-07 through node-12)
All agent nodes — physical and containerized — communicate over a WireGuard encrypted mesh. The topology is analogous to Tailscale/Headscale with the RCN as the coordination server:
RCN = coordination server + WireGuard endpoint
(only node with external listen address)
Agents = peers; dial RCN on first handshake;
direct peer-to-peer tunnels thereafter
Subnet = 10.200.0.0/16
RCN IP = 10.200.0.1
Agent IPs = 10.200.0.10 + routine_id
(deterministic, from registry order)
All agent-to-agent data traffic (DCoT intermediate results, lane aggregation votes, FedAvg adapter deltas) flows over direct WireGuard tunnels after the initial handshake. The RCN is not in the data path for agent-to-agent communication — only in the control path (task dispatch, consensus gate).
The RCN IaC Generator reads the routine registry (O(N_agents) linked list traversal) and emits the complete deployment manifest:
1. Traverse registry: assign deterministic IPs, generate Curve25519 key pairs
2. For each RoutineHandle:
Emit: environment vars (DARM_NODE_ROLE, DARM_SPECIALIZATION, DARM_WRITE_CLASS,
DARM_MODEL, DARM_CONFIDENCE_THRESHOLD, DARM_WG_IFACE)
volume mounts (model weights, branch DAG, WireGuard config)
resource limits (cpu_cores, ram_mb from RoutineHandle)
3. Emit RCN container spec (NET_ADMIN cap, WireGuard endpoint, consensus.toml)
4. Emit Terraform resource definitions (optional; cloud deployment)
5. Emit deploy.sh (up / down / status / wg-status lifecycle)
Generated artifacts:
| Artifact | Purpose |
|---|---|
docker-compose.yml |
Local single-host deployment |
terraform/main.tf |
Multi-host cloud deployment |
wireguard/<node>_wg0.conf |
Per-node mesh config (keys + AllowedIPs) |
consensus.toml |
HCP parameters (T_occ, D_rb, k_lanes, p_gw) |
registry.json |
Serialized routine registry |
deploy.sh |
Cluster lifecycle management |
The recommended production configuration:
| Component | Software | Role |
|---|---|---|
| OS | Ubuntu 24.04 LTS ARM64 | All nodes |
| Inference | Ollama | TinyLM/SLM serving |
| Distributed inference | Exo / Petals | Model splitting |
| Model management | HuggingFace Hub CLI | Download/cache |
| Coordination | OpenMPI / mpiexec | Parallel batch jobs |
| Web UI | Open WebUI | Interface |
| Monitoring | Netdata | Per-node real-time stats |
| Consensus | Tendermint (lightweight) | Permissioned LTM consensus |
| Fine-tuning | llama.cpp / lit-gpt | LoRA adapter training |
| Container orchestration | Docker Compose / Terraform | Fleet management |
| Peer-net | WireGuard | Encrypted inter-agent mesh |
| STM store | Redis | Node-local short-term memory |
| Branch DAG | SQLite (dev) / RocksDB (prod) | OER local write substrate |
New in v6.3. Extends sMCP-1 (§19) from protocol security hardening to full gateway orchestration.
The naive architecture is direct connections: each agent talks directly to each tool. That works for demos. It falls apart immediately at enterprise scale because you end up with the N×M problem — ten agents, each needing access to five tools, gives you fifty independent integration points to secure, monitor, and maintain.
DARM-ANN faces this problem at two levels simultaneously. First, the RCN’s RoutineHandles need access to external tools (memory stores, search APIs, code execution, databases). Second, as the cluster scales to hundreds of containerized agents, direct tool connections become operationally impossible. The MCP Gateway collapses N×M to N+M.
Without MCP Gateway:
N agents × M tools = N×M integration points
With MCP Gateway:
N agents → 1 gateway → M tools = N+M integration points
P56 — MCP Gateway N×M Reduction:
Claim: A centralized MCP Gateway reduces integration point count from O(N×M) to O(N+M).
Proof: In the direct topology, each of the N agents maintains independent auth credentials, transport connections, and error handling for each of the M tool servers. Total integration points = N×M. In the gateway topology, each agent connects to one gateway endpoint (N connections), and the gateway maintains M tool server connections. Total = N+M. Since N+M < N×M for N,M > 1: O(N+M) < O(N×M). QED.
The MCP Gateway sits between the RCN and all external tool servers:
DARM-ANN AGENTS (N agents, any lane/specialization)
│ MCP Streamable HTTP + OAuth 2.1
▼
┌─────────────────────────────────────────────────────────┐
│ MCP GATEWAY │
│ Tool Registry │ Auth (OAuth 2.1/SPIFFE) │
│ Protocol Bridge│ Rate Limiting │ Audit Log │
│ Federation │ Semantic Cache │ Policy Engine │
└──────┬──────────┬───────┬─────────┬──────────┬─────────┘
▼ ▼ ▼ ▼ ▼
Memory(Redis) Search Code Database External
LTM(Tendermint) APIs Sandbox Postgres REST/gRPC
Streamable HTTP, introduced in the November 2025 MCP spec, replaces the legacy SSE transport and enables MCP servers to run as remote services. The key evolution on the 2026 roadmap is stateless operation — standardizing session creation, resumption, and migration so server restarts and scale-out events are transparent to connected clients.
The stateless MCP operation is directly compatible with DARM-ANN’s OER protocol (§15): branch DAG state is held in the ledger rather than in-flight connections, so MCP session migration during gateway scale-out does not trigger OER rollbacks.
Remote MCP servers adopted OAuth 2.1 as the authentication standard starting with the June 2025 spec. MCP servers are classified as OAuth Resource Servers and advertise their authorization server location through .well-known endpoints.
DARM-ANN’s MCP Gateway extends this with SPIFFE workload identity for intra-cluster tool calls — the same attestation specified in sMCP-1 (§19.1), providing a cryptographically verifiable identity chain from originating agent through gateway to tool server.
ContextForge supports protocol bridging, so legacy REST and gRPC services can be exposed as MCP tools without rewriting them.
Protocol Bridge mappings for the DARM-ANN reference cluster:
Redis (TCP/RESP) → MCP tool: memory_read / memory_write
RocksDB (embedded) → MCP tool: branch_dag_append / branch_dag_read
Tendermint (ABCI/gRPC) → MCP tool: ltm_commit / ltm_query
Ollama (REST) → MCP tool: tinylm_inference
WireGuard peers (UDP) → MCP resource: mesh_topology
Multiple gateway instances auto-discover each other, merge tool registries, and operate as a unified system across regions.
For DARM-ANN’s hybrid physical/cloud deployment (§20.4), federated gateways give any agent access to any tool in the full fleet — cloud GPU inference from a Pi node, local memory from a cloud burst agent — with O(1) tool lookup via the federated registry.
Assumption A20 — MCP Gateway stateless compliance: The deployed gateway implements the 2026 stateless operation spec (SEP-1649), ensuring session migration is transparent to DARM-ANN agents during restarts or scale events.
New in v6.3. Extends the RCN’s internal tier routing to include external provider fallback, cost tracking, and universal model access.
DARM-ANN’s inference hierarchy routes tasks across TinyLM → SLM-Small → SLM-Medium → SLM-Large. Two cases remain unaddressed: (1) tasks that genuinely exceed local model capability, and (2) node failures mid-chain requiring immediate alternative inference. The AI Gateway resolves both via a single OpenAI-compatible endpoint with intelligent backend selection.
An AI gateway is purpose-built for LLM traffic: it enforces token-based rate limits that match how providers bill, tracks per-model and per-team spend, performs semantic caching on prompt similarity rather than exact-match, and handles provider authentication and failover.
DARM-ANN Agent
│ POST /v1/chat/completions (OpenAI-compatible)
▼
┌───────────────────────────────────────────────────────┐
│ ROUTING DECISION ENGINE │
│ task_complexity → tier | cost_budget → provider │
│ latency_target → local_vs_cloud | availability │
├───────────────────────────────────────────────────────┤
│ Semantic Cache(RRC) │ Token Limiter │ Cost Tracker │
│ PII Redaction │ Guardrails │ Audit Log │
└───┬────────┬──────────┬──────────┬───────────────────┘
▼ ▼ ▼ ▼
TinyLM SLM-Med Local GPU External Providers
(Ollama) (Ollama) (vLLM) (Anthropic/OpenAI/Groq)
FallbackChain := [
(TinyLM, local_ollama, cost=0, latency=fast ),
(SLM_Small, local_ollama, cost=0, latency=medium),
(SLM_Med, local_vllm, cost=low, latency=medium),
(Cloud_Fast, groq_llama4, cost=medium,latency=fast ),
(Cloud_Best, anthropic_claude, cost=high, latency=medium),
]
For each request: try each tier in order; return first confident response.
P57 — Fallback Chain Reliability:
Claim: For k tiers each with independent availability p_i, P(success) = 1 - Π(1 - p_i).
Proof: Failure requires all k tiers to fail simultaneously. By independence (A21): P(all fail) = Π(1-p_i). Therefore P(success) = 1 - Π(1-p_i). QED.
For a 5-tier chain with p_i = {0.95, 0.97, 0.999, 0.9999, 0.99999}:
P(success) = 1 - (0.05 × 0.03 × 0.001 × 0.0001 × 0.00001)
= 1 - 1.5×10⁻¹⁵ ≈ 1.0
Effective 15-nines availability from a 5-tier chain combining local and cloud resources.
Rather than exact-match caching, semantic caching uses embedding similarity to return cached responses for semantically equivalent prompts. This has higher cache hit rates than Redis exact-match but adds a ~10-30ms embedding lookup on each request.
The AI Gateway’s semantic cache integrates directly with DARM-ANN’s RRC (§7), eliminating a redundant cache layer. Cache lookup uses the RRC’s existing LSH index:
1. Compute φ(prompt) via TinyLM embedding
2. Query RRC: nearest = RRC.LSH_query(φ(prompt))
3. If cos_similarity ≥ θ_cache: return nearest.response (P43 guarantees O(1))
4. Else: route fallback chain; write response to RRC
Enterprise LLM API spend reached $12.5 billion in 2025, and 53% of AI teams report costs exceeding forecasts by 40% or more during scaling.
Every inference writes a cost record as a local_write via OER — zero global consensus overhead — with tamper-evident LTM promotion at the standard checkpoint interval. This gives DARM-ANN a cryptographically auditable cost ledger over the full operational history.
Assumption A21 — Provider availability independence: External provider availability events are independent (separate infrastructure, historically independent outage patterns).
New in v6.3. Standardizes inter-agent communication and enables protocol-agnostic model routing.
The Model Context Protocol (MCP) manages agent-to-tool interactions, enabling agents to interact with external resources via standardized interfaces. Agent Communication Protocol (ACP) handles structured messaging within localized environments.
MCP serves as a universal adapter — connecting AI agents to tools, APIs, and data sources — while A2A is the standard for secure, structured communication and delegation between autonomous AI agents. Most modern, scalable agentic AI systems will ultimately leverage both: MCP for reliable tool and context integration, and A2A for orchestrating teamwork across agents and distributed processes.
Layer 3: A2A — horizontal agent-to-agent: discovery, delegation, task handoff
Layer 2: ACP — REST-native structured messaging, lowest-friction onboarding
Layer 1: MCP — vertical agent-to-tool: capabilities, context, data access
A2A standardizes the agent-to-agent contract: agent cards for discovery, a typed task lifecycle, streaming status, and vendor-neutral interoperability. The architectural win is decoupling: swap a model, a framework, or even a vendor without touching the orchestrator.
Every DARM-ANN agent exposes an Agent Card — a live-updated JSON document advertising capabilities and status. The RCN queries Agent Cards for routing decisions, extending the static RoutineHandle registry with live availability data:
{
"id": "darm-retrieval-a.10.200.0.10",
"specialization": "retrieval",
"model": "tinyllama:1.1b",
"lane": "parallel",
"write_class": "read_only",
"skills": ["semantic_search", "lsh_query"],
"endpoint": "https://10.200.0.10:8080/a2a",
"auth": "spiffe://darm-ann/retrieval-a",
"status": "available",
"avg_latency_ms": 12.3,
"success_rate": 0.97
}
The A2A task lifecycle maps onto DARM-ANN’s ExecutionContext states:
| A2A State | ExecutionContext State | HCP Path |
|---|---|---|
| submitted | step_queued | — |
| processing | step_active | OER write |
| completed | step_done | OER committed |
| failed | step_rolled_back | OER rollback |
| streaming | step_partial | EB.write() |
MCP servers expose tools to agents; they don’t orchestrate agents. Not every system needs multiple agents. Start with one agent + MCP tools. This separation is preserved in DARM-ANN: RCN handles orchestration; MCP handles tool access; A2A handles inter-agent peer communication.
An agent communication hub in 2026 must simultaneously support MCP clients and servers for tool integration, A2A agent orchestration for inter-agent task delegation, ACP REST-native connections for lowest-friction agent onboarding, and OpenAPI tool-use for existing API integration without MCP server overhead.
ACP bridges non-native services into DARM-ANN task chains via the Protocol Bridge (§21.4). Once registered, a legacy REST service appears identically to a native TinyLM agent in the RCN routing table — same audit logging, cost tracking, and OER/HLC path management.
If agent descriptions can be expressed in OASF regardless of which protocol the agent implements, routing and orchestration systems can treat A2A agents, ACP agents, and MCP servers as equivalent capability sources.
DARM-ANN’s Agent Card format (§23.2) is OASF-compatible, enabling:
This is the formal guarantee of “run any model the system needs”: the RCN routing layer is protocol-agnostic at the agent boundary. TinyLlama, Phi-3, Claude, GPT-4o, a fine-tuned Mistral, or a legacy REST service — the RCN sees only the Agent Card.
Assumption A22 — Agent Card freshness: Cards are updated within 1 heartbeat interval (T_heartbeat = 5s) of a state change. RCN treats cards older than 3 × T_heartbeat as stale and falls back to last-known-good status.
Task arrives at RCN
→ HCP gate classifies W_class
→ DCoT decomposes into steps (if multi-step)
→ For each step:
A2A Agent Card query: find best available agent
MCP Gateway: agent acquires tools via OAuth 2.1 / SPIFFE
AI Gateway: model inference with semantic cache + fallback chain
ACP bridge: for non-native agents in the chain
Result: OER write (local) or HLC (global) per W_class
→ Synthesis + V/P check if adversarial
┌──────────────────────────────────────────────────────────────────────┐
│ APPLICATION INTERFACE LAYER │
├──────────────────────────────────────────────────────────────────────┤
│ INTERACTION MODEL PROTOCOL STACK [NEW v6.3] │
│ A2A: horizontal agent coordination + Agent Cards + task lifecycle │
│ ACP: REST-native non-native agent onboarding │
│ OASF: vendor-neutral description; protocol-agnostic RCN routing │
├──────────────────────────────────────────────────────────────────────┤
│ AI GATEWAY [NEW v6.3] │
│ OpenAI-compatible unified API · Fallback chain P57 · P(success)≈1 │
│ RRC semantic cache (P43) · Token tracking · OER cost ledger │
├──────────────────────────────────────────────────────────────────────┤
│ MCP GATEWAY [NEW v6.3] │
│ N×M → N+M reduction (P56) · OAuth 2.1/SPIFFE · Protocol bridge │
│ Federated multi-cluster tool registry · Stateless (2026 spec) │
├──────────────────────────────────────────────────────────────────────┤
│ ROUTER / CHAIN-MANAGER NODE (RCN) [v6.2] │
│ RoutineHandle registry · HCP gate · A2A Agent Card queries │
├──────────────────────────────────────────────────────────────────────┤
│ ESE + BVAS + GTE [v5.0] │
├──────────────────────────────────────────────────────────────────────┤
│ RLRF + MARKOV GRAPH G_M [v4.0] │
├──────────────────────────────────────────────────────────────────────┤
│ AGENTIC NETWORK + DCoT / V/P [v3.0 + v6.2] │
├──────────────────────────────────────────────────────────────────────┤
│ HIERARCHICAL SLM/TinyLM (AI Gateway-backed) [v3.0] │
├──────────────────────────────────────────────────────────────────────┤
│ FIVE-TIER HIERARCHICAL MEMORY [v6.0] │
├──────────────────────────────────────────────────────────────────────┤
│ BLOCKCHAIN + OER + HLC [v3.0 + v6.2] │
├──────────────────────────────────────────────────────────────────────┤
│ DATA STRUCTURES (LSH, B-tree, G_M) [v3.0] │
├──────────────────────────────────────────────────────────────────────┤
│ NEUROMORPHIC SUBSTRATE [v6.1] │
├──────────────────────────────────────────────────────────────────────┤
│ BARE-METAL HYPERVISOR + CONTAINER FABRIC [v3.0 + v6.2] │
│ WireGuard mesh 10.200.0.0/16 │
└──────────────────────────────────────────────────────────────────────┘
New in v6.4. Formalizes the bidirectional protocol connecting the Working Memory context window to the local branch DAG and global blockchain memory tiers.
The context window is good at holding the active working state of the current task. Using it for long-term facts, cross-session preferences, or hard constraints produces the failure modes that look like model problems but are not.
A 2026 study across 4,416 trials at six conversation depths confirmed that commission constraints hold near 100% while omission constraints decay with depth — this is a memory architecture problem, not a model problem.
DARM-ANN v6.3 specified five memory tiers but left one critical gap: the formal protocol governing what enters and leaves the context window (WM) at inference time, how it is assembled from the blockchain tiers below, and how WM outputs are committed back. The Context Bridge Layer closes this gap.
Core principle: The context window (WM tier) is transient RAM. The blockchain (LTM) is permanent tamper-evident storage. The Context Bridge is the bidirectional protocol mediating between them across the full five-tier stack.
The Context Bridge specifies four distinct information flows:
┌─────────────────────────────────────────────────────────────────────┐
│ CONTEXT BRIDGE LAYER │
│ │
│ Flow A: Downward Assembly LTM/RRC/STM/EB → WM (inference start) │
│ Flow B: Upward Commit WM outputs → EB → STM → LTM │
│ Flow C: Cross-session WM state → LTM anchor at session end │
│ Flow D: Cross-agent Agent_i WM summary → Agent_j WM (DCoT) │
│ │
│ Mechanisms: │
│ • Context Assembly Engine (CAE) — governs Flow A │
│ • Context Budget Manager (CBM) — enforces token limits all flows │
│ • Anchor Token Injector (ATI) — LTM constraints → WM persistence │
│ • KV Prefix Share Protocol (KVPSP) — cross-agent KV reuse │
│ • DACS — context isolation preventing cross-agent pollution │
└─────────────────────────────────────────────────────────────────────┘
At inference start, the CAE constructs WM content from lower tiers using six context types grounded in Google’s 2025 context engineering taxonomy:
ContextTypes := {
instructions: system prompt, task specification, constraints
anchor_tokens: high-salience LTM facts (re-injected via ATI)
agent_state: current task, step_id, ExecutionContext ref
background: RRC retrieval (P43: O(1) avg)
conversation: EB ring buffer — recent reasoning traces
tool_outputs: last MCP Gateway tool call results
}
CAE priority-weighted budget allocation:
Algorithm CAE(agent_a, task_t, W_budget_tokens):
slots = {instructions: 0.15, anchor_tokens: 0.10, agent_state: 0.10,
background: 0.40, conversation: 0.20, tool_outputs: 0.05}
wm.instructions = STM.fetch(agent_a.specialization_prompt)
wm.anchor_tokens = ATI.get_anchors(agent_a, task_t)
wm.agent_state = ExecContext.serialize(task_t)
wm.background = RRC.query(task_t.embedding, k=top_k)
wm.conversation = EB.tail(agent_a, n_tokens=slots.conversation × W_budget)
wm.tool_outputs = MCP_log.last(agent_a, n_tokens=slots.tool_outputs × W_budget)
for slot, content in wm:
if len(content) > slots[slot] × W_budget:
wm[slot] = CBM.compress(content, target=slots[slot] × W_budget)
return assemble_prompt(wm)
P58 — Context Assembly Optimality:
Claim: The CAE priority ordering maximizes expected task completion quality Q(wm) per token budget W_budget.
Proof sketch: Decompose Q(wm) = Σ_s w_s × MI(slot_s; task_output). Instructions and anchor tokens have highest MI — they encode task specification and hard constraints that gate output correctness. Background (RRC) has high MI for factual tasks. Conversation has bounded MI (diminishing returns beyond k turns). Tool outputs are conditionally useful. The priority ordering follows empirical MI ranking: Mem0’s 2026 LoCoMo benchmark showed hierarchical extraction outperformed full-context by 18.7 percentage points while maintaining a 4× reduction in token count. Requires A23. QED sketch.
| Model Tier | W_budget | KV Cache Budget |
|---|---|---|
| TinyLM (0.5–2B) | 3,072 tokens | 512MB |
| SLM-Small (3–7B) | 6,144 tokens | 2GB |
| SLM-Medium (7–13B) | 24,576 tokens | 8GB |
| SLM-Large (13–70B) | 96,000 tokens | 32GB |
CBM compression priority: trim EB traces first, summarize background second, truncate tool outputs third. Never compress: instructions, anchor tokens, agent_state — compressing these causes correctness failures.
Context management for LLM agents has been studied at three levels of granularity: single-agent memory across turns, single-agent tool/retrieval bloat, and multi-agent orchestration. The omission constraint decay problem — constraints followed at turn 1 violated at turn 10 — occurs at all three levels and is structural, not model-dependent.
The ATI prevents decay by re-injecting high-salience LTM constraints with injection priority that increases with step depth — directly counteracting the decay process:
Algorithm ATI(agent_a, step_i, wm):
anchors = LTM.query(filter={type:"constraint", agent:agent_a})
for a in anchors:
a.injection_priority = a.salience × (1 - exp(-λ_atf × step_i))
top_anchors = sort_by(anchors, injection_priority)[:k_anchors]
wm.anchor_tokens = serialize(top_anchors)
return wm
P61 — Anchor Token Injection Prevents Omission Constraint Decay:
Claim: With ATI injection at frequency λ_atf, constraint recall at step D ≥ 1 - exp(-λ_atf × D × w_anchor/W_budget).
Proof: Attention weight on a token decays approximately exponentially with intervening tokens. Each re-injection resets the decay clock. Expected injections by step D = λ_atf × D. Minimum recall is bounded by the formula above. Requires A26.
ATI + blockchain integration: Constraint records in LTM carry the highest salience scores, are retrograde-protected (P44, κ=1.2), and are consensus-committed. The ATI reads from LTM — so even constraints introduced post-deployment are automatically picked up at the next injection cycle. The blockchain is the canonical source of active constraints.
Already specified in §4 (Memory Formation Pipeline) and §5 (CDCP). The Context Bridge formalizes the W_class gate:
UpwardCommit(output): EB.write() always
if salience ≥ θ_stm: STM.write(W_class=local_write) // OER
if salience ≥ θ_ltm: CDCP.propose(W_class=global_write) // HLC
Entirely absent from v6.3. Answers: what persists across session boundaries?
SessionEnd(agent_a, session_id):
session_anchor = {session_id, agent_id, task_context,
key_facts=[e∈EB if e.salience≥θ_anchor],
constraint_set=wm.anchor_tokens,
hash=blake3(concat(above_fields))}
LTM.commit(session_anchor, block_type="session_boundary") // HLC path
SessionStart(agent_a):
anchor = LTM.query(filter={agent:agent_a, type:"session_boundary"},
sort=desc_timestamp, limit=1)
if anchor: EB.preload(anchor.key_facts); return CAE(agent_a, anchor.task_context)
else: return CAE(agent_a, new_task)
Session anchors are global_write (HLC path) — tamper-evident, BFT consensus-committed. No agent can falsify its prior session context.
Formalizes DCoT step context transfer with provenance:
ContextHandoff(agent_src, agent_dst, step_result):
handoff = {result: step_result,
reasoning: EB.last_n(agent_src, n=5),
constraints: ATI.get_anchors(agent_src, task),
provenance: LTM.hash(step_result)}
EB.write(handoff, agent=agent_dst, W_class=local_write)
Each DCoT agent inherits the previous step’s result AND the active constraint set. Constraint decay across agent boundaries is prevented because constraints carry over via the handoff, not just via the new agent’s fresh context window.
New in v6.4.
Multi-agent LLM orchestration systems suffer from context pollution: when N concurrent agents compete for the orchestrator’s context window, each agent’s task state, partial outputs, and pending questions contaminate the steering interactions of every other agent, degrading decision quality.
Context isolation is agent-triggered, asymmetric, and deterministic: the context window contains exactly F(a_i) + R_{-i} during steering, eliminating cross-agent contamination without requiring context compression or retrieval.
Paper: Patel, N. (2026). Dynamic Attentional Context Scoping. arXiv:2604.07911.
DACS maps directly onto the RCN’s existing architecture. The RCN already holds two context views:
DACS formalizes the switch protocol:
REGISTRY mode: hold Agent Cards for all N agents (≤200 tokens × N)
FOCUS(a_i) mode: F(a_i) = CAE(a_i, task_t, W_budget)
R_{-i} = {AgentCard(a_j) | j≠i}
WM_RCN = F(a_i) ∪ R_{-i}
Switch REGISTRY → FOCUS(a_i):
agent_a_i emits STEERINGREQUEST
OR a_i.confidence < threshold
OR a_i triggers V/P pattern
Switch FOCUS(a_i) → REGISTRY:
steering resolved OR timeout T_focus (default 30s)
For N=10, W_budget=6,144 (SLM-Small): WM_RCN = 6,144 + 1,800 = 7,944 tokens — within budget.
DACS and blockchain grounding: FOCUS mode context is pulled from the Branch DAG. Every fact in F(a_i) is either a CDCP-committed LTM record, a salience-gated STM entry, or a branch DAG OER write. Context pollution from fabricated agent states is structurally prevented — the source of truth is the cryptographically chained branch DAG.
P59 — DACS Steering Accuracy: Across all 8 synthetic scenarios, DACS achieves 90.0–98.4% steering accuracy versus 21.0–60.0% for a flat-context baseline (p < 0.0001 throughout), with wrong-agent contamination falling from 28–57% to 0–14% and context efficiency ratios of up to 3.53×. Source: Patel (2026) arXiv:2604.07911. Requires A24.
The KV cache stores per-layer key and value tensors for every token in the context window so that subsequent tokens can attend to them without recomputing. Memory grows linearly with context length, layer count, and head dimension.
For DCoT chains, agents sharing task ancestry also share a large common context prefix. KVPSP uses the Branch DAG’s ancestry structure to compute the prefix once and share it:
KVPSP(agent_a, agent_b, task_t):
ancestor = Branch_DAG.common_ancestor(a.step_id, b.step_id)
shared_prefix = CAE_prefix(ancestor, W_budget)
KV_shared = compute_kv(shared_prefix)
Branch_DAG.write(hash(shared_prefix), KV_shared,
W_class=local_write, ttl=T_occ×3)
agent_a.kv_cache = KV_shared + compute_kv(agent_a.unique_tokens)
agent_b.kv_cache = KV_shared + compute_kv(agent_b.unique_tokens)
P60 — KV Prefix Sharing Compute Reduction:
Claim: For agents sharing d_shared of d_total context tokens, KVPSP reduces total KV compute by d_shared / (2 × d_total).
Proof: Without sharing: 2×d_total KV computations. With sharing: d_shared + 2×(d_total - d_shared) = 2×d_total - d_shared. Reduction fraction = d_shared / (2×d_total). For d_shared = 0.60×d_total: reduction = 30%. QED.
FP8 KV cache halves memory with sub-0.7 point accuracy regression — within noise for most production workloads — and the 50% memory savings translate to 30–50% throughput gains via larger batch size at the same VRAM budget.
Combined KVPSP (30%) + FP8 (50%): ~65% total KV memory reduction for DCoT workloads. TinyLM agents on Pi nodes handle substantially longer reasoning chains before triggering AI Gateway fallback.
Assumption A25 — Branch DAG ancestry correctly identifies shared prefix tokens. Validated by construction: CAE uses deterministic priority-weighted assembly, so identical ancestry → identical prefix tokens.
New in v6.4.
┌──────────────────────────────────────┐
│ CONTEXT BRIDGE LAYER │
┌─────────────────┼──────────────────────────────────────┤
│ INFERENCE → │ CAE: 6-slot priority assembly │
│ CROSS-AGENT → │ CBM: per-tier token budgets │
│ SESSION END → │ ATI: LTM constraint re-injection │
│ KV SHARING → │ KVPSP: Branch DAG prefix cache │
│ STEERING → │ DACS: Registry/Focus mode switching │
└─────────────────┴──────────────────────────────────────┘
↑↓ Flow A (assembly) ↑↓ Flow B/C/D (commit)
┌──────────────────────────────────────────────────────────┐
│ FIVE-TIER MEMORY STACK │
│ WM [context window → KV cache] ← CAE fills │
│ EB [session ring buffer] ← Flow B/D writes │
│ STM [node-local Redis] ← salience gate │
│ LTM [blockchain; Tendermint] ← CDCP/HLC │
│ RRC [hot LSH cache] ← feeds CAE background │
└──────────────────────────────────────────────────────────┘
| Operation | Bridge Flow | HCP Path | Blockchain Touch |
|---|---|---|---|
| Inference start | Flow A: CAE | read_only | RRC/STM/LTM read |
| Anchor injection | ATI re-inject | read_only | LTM read |
| Reasoning output | Flow B: EB write | local_write | Branch DAG |
| Significant finding | Flow B: CDCP | global_write | LTM commit |
| Session end | Flow C: session anchor | global_write | LTM session block |
| DCoT handoff | Flow D: cross-agent EB | local_write | Branch DAG |
| RCN steering | DACS FOCUS | read_only | Branch DAG read |
| KV prefix | KVPSP branch lookup | read_only | Branch DAG read |
The storage of memories is done on a blockchain to provide a persistent, decentralized storage. The extension builds a lasting bridge between AI tools as a continuous context provider.
DARM-ANN formalizes and extends this pattern across every architectural dimension:
| Dimension | Browser-layer context tools | DARM-ANN Context Bridge |
|---|---|---|
| Persistence | Centralized cloud DB | BFT blockchain; f < N/3 Byzantine |
| Tamper evidence | None | Cryptographic hash chain (P14) |
| Cross-agent | Manual copy | Flow D with provenance hash |
| Constraint enforcement | User-managed | ATI with salience decay prevention (P61) |
| Context assembly | Manual prompting | CAE priority-weighted 6-slot budget |
| Cross-session | Session-scoped DB | LTM session boundary blocks via HLC |
| Provenance | None | Every context entry has LTM hash |
The blockchain is not supplementary to context management in DARM-ANN — it IS the context store. The Context Bridge formalizes the interface.
┌──────────────────────────────────────────────────────────────────────┐
│ APPLICATION INTERFACE LAYER │
├──────────────────────────────────────────────────────────────────────┤
│ INTERACTION MODEL PROTOCOL STACK (A2A/ACP/OASF) [v6.3] │
├──────────────────────────────────────────────────────────────────────┤
│ AI GATEWAY [v6.3] │
├──────────────────────────────────────────────────────────────────────┤
│ MCP GATEWAY [v6.3] │
├──────────────────────────────────────────────────────────────────────┤
│ ROUTER / CHAIN-MANAGER NODE (RCN) [v6.2] │
│ + DACS Registry/Focus context modes [v6.4] │
├──────────────────────────────────────────────────────────────────────┤
│ CONTEXT BRIDGE LAYER [NEW v6.4] │
│ CAE · CBM · ATI · KVPSP · Flow A/B/C/D │
│ Bidirectional WM ↔ Blockchain protocol │
├──────────────────────────────────────────────────────────────────────┤
│ ESE + BVAS + GTE [v5.0] │
├──────────────────────────────────────────────────────────────────────┤
│ RLRF + MARKOV GRAPH G_M [v4.0] │
├──────────────────────────────────────────────────────────────────────┤
│ AGENTIC NETWORK + DCoT / V/P [v3.0 + v6.2] │
├──────────────────────────────────────────────────────────────────────┤
│ HIERARCHICAL SLM/TinyLM (AI Gateway-backed) [v3.0] │
├──────────────────────────────────────────────────────────────────────┤
│ FIVE-TIER MEMORY (WM/EB/STM/LTM/RRC) [v6.0] │
│ Context Bridge interfaces all five tiers [v6.4] │
├──────────────────────────────────────────────────────────────────────┤
│ BLOCKCHAIN + OER + HLC [v3.0 + v6.2] │
│ Context Bridge commits via OER/HLC [v6.4] │
├──────────────────────────────────────────────────────────────────────┤
│ DATA STRUCTURES (LSH, B-tree, G_M) [v3.0] │
├──────────────────────────────────────────────────────────────────────┤
│ NEUROMORPHIC SUBSTRATE [v6.1] │
├──────────────────────────────────────────────────────────────────────┤
│ BARE-METAL HYPERVISOR + CONTAINER FABRIC [v3.0 + v6.2] │
└──────────────────────────────────────────────────────────────────────┘
Introduced in v3.0. All proofs P1–P10 unchanged.
P1: T_global = Θ(N log N) for comparison-based consensus — tight lower bound from information-theoretic argument (N! orderings require Ω(N log N) comparisons).
P2: T_recovery = O(log N) for node failure replacement via binary search over standby pool.
v6.2 Note: P1 establishes the fundamental lower bound that HLC (§15, P53–P55) circumvents by operating over k_lanes ≪ N participants rather than all N nodes.
P3: E[bucket_occupancy] = n/B; P(O(1) lookup) = 99.997% for B = 256³, n = 10⁷.
P4: P(false_negative) with L tables = (1-p₁)^L. For L=3, p₁=0.9: P(false_negative) = 0.001.
P5: P(false_positive) is negligible ≈ 10^{-7×10⁷}.
P6: E[T_LSH_query] = O(1) amortized.
P7: B-tree height h ≤ log_t((m+1)/2) + 1 = O(log m).
P8: T_lookup = T_insert = T_delete = O(log m).
P9: T_decision = O(log m) (composition: O(1) LSH + O(1) routing + O(log m) B-tree).
P10: Any comparison-based consensus on N elements requires Ω(N log N) comparisons. Combined with P1: T_global = Θ(N log N) is optimal for full global consensus.
P11: LoRA parameter reduction = 2r/d = 0.78% for d=4096, r=16.
P12: QLoRA memory = 0.5p + 12dr bytes = 3.5 GB for 7B model, r=16, d=4096.
P13: LoRA FedAvg converges 256× faster than full-model FedAvg (gradient space reduction by r/d).
P14: Tamper evidence: modifying B_j invalidates all B_k for k > j; detectable in O(1) by any node.
P15: Collision resistance: P(forge) = 2^{-128} ≈ 3×10^{-39} (Ed25519 birthday bound).
P16: DAG causal order ≺ is a valid partial order (reflexive, antisymmetric, transitive).
P17: Merkle inclusion proof size = O(log n) × 256 bits = 640 bytes for n = 10⁶ records.
P18: Tendermint safety: no two correct nodes commit different values (quorum intersection). Requires f < N/3 Byzantine nodes.
P19: Tendermint liveness: consensus terminates in T_consensus = 2Δ under GST.
P20: A_l_max ≤ T_inference / T_message = 500 agents/layer at T_inference=50ms, T_message=0.1ms.
P21: Partition recovery: T_recovery = Q_max / λ_global_chain ≤ 8,640s for 24h partition, λ=1000 tx/s.
Introduced in v3.0. Proof P_energy unchanged.
P_node(t) = P_idle + P_compute(t) + P_memory(t) + P_network(t)
| Node type | P_idle | P_max | P_avg inference |
|---|---|---|---|
| Raspberry Pi 5 (TinyLM) | 2.5W | 8W | 5W |
| x86 server (SLM-Medium) | 50W | 200W | 120W |
| Intel Loihi 2 node | 0.5W | 2W | 1W |
Energy per inference:
E_TinyLM = 5W × 0.005s = 25 mJ
E_SLM_Med = 120W × 0.05s = 6,000 mJ = 6 J
E_SLM_Large = 200W × 0.5s = 100 J
P_energy — Energy ratio: TinyLM / SLM-Medium = 25mJ / 6,000mJ = 300× energy reduction per inference.
For 12-node cluster at P_avg = 60W total:
Introduced in v3.0; updated in v6.2 for Risks T1, T7, and T8.
| ID | Risk | v6.2 Likelihood | Impact | Key Mitigation | Residual |
|---|---|---|---|---|---|
| T1 | Coordination failure / consensus overhead | Very Low (↓ from Medium) | High | HCP gate (P55): 20× reduction; HLC (P53): k_lanes participants; OER rollback | Very Low |
| T2 | Runaway recursive layer spawning | Low | Medium | Hard quota at hypervisor; spawn requires E[Q] AND Var[Q] conditions | Low |
| T3 | LSH hash collision clustering | Very Low | Medium | Monitor bucket occupancy; adversarial resistance via random seed rotation | Very Low |
| T4 | LoRA adapter poisoning | Low-Medium | High | Byzantine-robust FedAvg (trimmed mean); gradient norm anomaly detection | Low |
| T5 | B-tree state space explosion | Low | Medium | Active pruning: remove states not visited in N_prune = 10,000 sweeps | Low |
| T6 | Bare-metal hypervisor bugs | Medium | High | Formal verification (Coq/Isabelle); staged migration; OS fallback | Medium |
| T7 | Multi-step reasoning failure in TinyLMs | Low (↓ from High) | Medium | DCoT protocol externalizes chain to EB; V/P adversarial check | Low |
| T8 | Emergent reasoning ceiling | Low (↓ from Medium) | Medium | V/P pattern with process reward model; ESE calibrated abstention | Low |
| ID | Risk | Mitigation |
|---|---|---|
| S1 | Adversarial memory injection | P39: P(fabrication passes CDCP) ≤ 10⁻⁶; Ed25519: P(forge) = 2^{-128} |
| S2 | Prompt injection via crafted inputs | ESE abstention; V/P verification; sMCP-1 context attestation |
| S3 | Model weight poisoning via FedAvg | Byzantine-robust aggregation (trimmed mean); adapter integrity chain (P14) |
| S4 | WireGuard key exfiltration | Forward secrecy; short key lifetime; IaC Generator fresh keys per deployment |
| S5 | AI swarm attack on mesh | SPIFFE identity; rate limiting; AllowedIPs isolation (A19) |
Open problems updated in v6.2 to reflect new components.
| Problem | Statement | Key Open Question |
|---|---|---|
| OP1 | Agentic universal approximation | Does T_ANN = T_LLM for sufficient L and A_l? |
| OP2 | Textual backpropagation convergence | Is the adaptation function F a contraction? |
| OP3 | LSH optimality for agent memory | Is Euclidean LSH optimal for SLM embeddings? |
| OP4 | Optimal LoRA rank selection | What is r_knee by model size and task type? |
| OP5 | DAG branch merge semantics | Does median merge preserve semantic coherence? |
| OP6 | Bare-metal hypervisor formalization | Minimal formal spec for AI-native hypervisor? |
| OP7 | Optimal cluster size and topology | What N* and k minimize cost C = α×Latency + β×Energy? |
| OP8 | OER conflict rate empirical bound | Is p_conflict ≤ 0.10 (A18) valid in practice? |
| OP9 | RCN registry self-ordering validity | Does EWMA priority score correlate with task quality? |
| OP10 | DCoT optimal decomposition depth | What R (chain length) maximizes quality vs. latency? |
| OP11 | Neuromorphic memory consolidation | Does STDP implement a valid approximation of RCE (P50)? |
| OP12 | V/P convergence with small Verifier | What minimum Verifier size provides effective P44 protection? |
A1–A12 introduced v6.0; A13–A16 introduced v6.1; A17–A19 new v6.2.
| ID | Statement | Used By | Validation Path |
|---|---|---|---|
| A1 | f < N/3 Byzantine nodes at any time | P18, P39, P40, P44, P46 | Monitor node anomaly scores; maintain N ≥ 3f+1 |
| A2 | Network eventually synchronous (GST exists) | P19, P40, P41 | Empirical: measure GST window in reference cluster |
| A3 | GTE knowledge graph density ≥ threshold | P39 (conservative bound) | Measure graph density over 30-day operation |
| A4 | Claim fabrication requires independent hallucination at each node | P39 (conservative bound) | Adversarial audit: attempt coordinated fabrication |
| A5 | Cross-node hallucination events are independent | P39 (optimistic bound only) | Strong assumption; not used for conservative bound |
| A6 | T_GTE_max is bounded (finite traversal time) | P41 | Empirical: measure GTE latency distribution |
| A7 | Replay batch mixing ratio r = 0.40 is stable | P42 | Implementation invariant; enforce in RCE |
| A8 | Old-task and new-task gradient spaces are not orthogonal | P42 | Empirical: measure gradient cosine similarity |
| A9 | Access frequency distribution is Zipfian (top-K captures most queries) | P43, P45, P47 | Measure access frequency CDF over 30-day operation |
| A10 | Ebbinghaus decay model applies to agent memory salience | P47, P48 | Empirical: track salience vs. access frequency over time |
| A11 | Incumbency factor κ = 1.2 is sufficient for retrograde protection | P44 | Adversarial audit: attempt retrograde injection |
| A12 | RRC hit rate ≥ 60% under normal query distribution | P45 | Empirical: measure RRC hit rate in reference cluster |
| A13 | Spike firing rates stable over 100ms EWMA window | P49 | Hardware characterization: Loihi 2 firing rate stability |
| A14 | STDP learning rate within convergence regime [0.001, 0.1] | P50 | Hardware configuration: Loihi 2 learning parameters |
| A15 | Hala Point mesh NoC diameter ≤ 2√k hops | P51 | Intel Hala Point datasheet / architecture specification |
| A16 | Activation sparsity ≥ 90% for TinyLM inference | P52 | Empirical: measure activation sparsity on reference models |
| A17 | EWMA priority score is valid proxy for task efficiency | RCN (§14.4) | Rank correlation study: P vs. measured quality, 1000 tasks |
| A18 | OER conflict rate p_conflict ≤ 0.10 | OER (§15.3) | Empirical: measure conflict rate, reference cluster, 30 days |
| A19 | WireGuard AllowedIPs=peer_ip/32 prevents cross-agent leakage | Mesh security (§19.2) | WireGuard formal security proof [49] |
| A20 | MCP Gateway implements 2026 stateless operation spec (SEP-1649) | MCP Gateway (§21.3) | Test session migration under simulated gateway restart |
| A21 | External model provider availability events are independent | AI Gateway (§22.3, P57) | Compare observed joint outage frequency vs. independent probability product over 12 months |
| A22 | Agent Cards updated within 1 heartbeat (T_heartbeat=5s) of state change | A2A (§23.4) | Measure card staleness under network partition |
| A23 | Context type MI ranking (instructions>anchors>state>background>conversation>tools) holds for ≥85% of task types | P58 | Measure task quality by slot priority across 10,000 runs |
| A24 | DACS Focus ExecutionContext captures all RCN steering information | P59 | Measure DACS vs. flat-context steering accuracy; verify ≥90% |
| A25 | Branch DAG ancestry correctly identifies shared context prefix tokens | P60 | Structural verification: deterministic CAE assembly |
| A26 | ATI injection frequency λ_atf can prevent omission constraint decay within token budget | P61 | Measure omission constraint recall vs. λ_atf across 6 conversation depths |
Introduced in v6.0; updated in v6.2 with P53–P55.
The proof dependency DAG shows which proofs depend on other proofs (solid arrows) and which assumptions each proof requires (dashed). Key dependency chains:
v3.0 Foundation Chain:
P1 (cluster sync) → P9 (decision latency) → P10 (optimality)
P4 (LSH) → P6 (O(1) lookup) → P9
P17 (Merkle) → P14 (tamper evidence)
P18 (BFT safety) → P19 (liveness)
v4.0 Chain:
P18 → P22 (RLRF gradient) → P23 (credit assignment)
P26 (Bellman) → P27 (policy convergence)
P24 (stationary dist) → P25 (spectral gap) → P27
v5.0 Chain:
P4 → P30 (GTE BFS) → P39 (CDCP hallucination) ← P18
P18 → P40 (CDCP safety) → P44 (retrograde protection)
P18, P19 → P41 (CDCP liveness)
P35 → P36 (abstention) → R_epistemic → P22
v6.0 Chain:
P4 → P43 (RRC performance) → P45 (RRC efficiency)
P39, P40 → P44 (retrograde protection)
P18 → P46 (optimal τ_c)
v6.2 Chain (NEW):
P1 → P53 (HLC cost) → P54 (HLC vs. global) [v6.2]
P55 (OER reduction) — standalone, depends on A18 [v6.2]
P43 → P55 (OER + RRC combined cost) [v6.2]
Updated in v6.2 to include RCN, HCP, OER, DCoT, V/P, and containerized deployment.
DARM-ANN v6.2 is the most complete specification of the DARM-ANN architecture to date. It synthesizes 55 formal proofs, 19 validated assumptions, and six months of iterative development into a unified framework covering every layer from hardware substrate to application interface.
The key technical contributions across the full version history:
v3.0–v4.0 Foundations:
v5.0 Epistemic Integrity:
v6.0 Five-Tier Memory:
v6.1 Neuromorphic:
v6.2 Orchestration and Consensus (NEW):
v6.3 Gateway and Protocol Stack (NEW):
The convergence of neuromorphic hardware maturity, small language model proliferation, and distributed AI infrastructure research means that by 2026, every component required for practical DARM-ANN deployment exists. The MCP Gateway and AI Gateway layers complete the external connectivity story: DARM-ANN agents can now access any tool, call any model, and interoperate with any external agent — all through formally proven, tamper-evident, consensus-gated protocols.
v6.4 Context Bridge and Engineering (NEW):
The Context Bridge Layer completes the final formal gap: the blockchain is not a supplementary memory store — it IS the persistent context substrate. Every context token has cryptographic provenance. Every constraint is consensus-committed. Every session boundary is tamper-evident. Context management in DARM-ANN is a formally specified, proof-backed, blockchain-grounded protocol.
The mathematics support the architecture. The architecture supports the vision. The vision is one of intelligence that belongs to the many, not the few.
[1] Sevilla, J., et al. (2022). Compute Trends Across Three Eras of ML. arXiv:2202.05924. [2] Gunasekar, S., et al. (2023). Textbooks Are All You Need. arXiv:2306.11644. [3] Belcak, P. & Heinrich, G. (2025). Small Language Models are the Future of Agentic AI. arXiv:2506.02153. [4] Duy, T.N., et al. (2024). Review of Blockchain Application with GNNs. arXiv:2410.00875. [5] Ma, X., et al. (2025). Agentic Neural Networks: Self-Evolving Multi-Agent via Textual Backpropagation. arXiv:2506.09046. [6] Reghenzani, F., et al. (2019). The Real-Time Linux Kernel. ACM Computing Surveys. https://doi.org/10.1145/3297714. [7] rUv (2025). RuVector: High Performance Self-Learning Vector Graph Neural Network. GitHub. [8] Hu, Y., et al. (2025). Memory in the Age of AI Agents. arXiv:2512.13564. [9] MemTensor. (2025). MemOS: A Memory OS for AI System. arXiv:submit/6596874. [10] Buzsáki, G. (1989). Two-stage model of memory trace formation. Neuroscience, 31(3). https://doi.org/10.1016/0306-4522(89)90423-5. [11] (Anon). (2025). Intelligent Neural Networks: From Layered to Graph-Organised Intelligence. arXiv:2511.22813. [12] Karim, Md. M., et al. (2025). AI Agents Meet Blockchain. Future Internet, 17(2). https://www.mdpi.com/1999-5903/17/2/57. [13] Popov, S., et al. (2018). The Tangle v1.4.3. IOTA Foundation. [14] OpenClaw Contributors. (2026). OpenClaw. GitHub. [15] Hu, E.J., et al. (2021). LoRA: Low-Rank Adaptation of Large Language Models. arXiv:2106.09685. [16] Dettmers, T., et al. (2023). QLoRA: Efficient Finetuning of Quantized LLMs. arXiv:2305.14314. [17] McMahan, B., et al. (2017). Communication-Efficient Learning from Decentralized Data. AISTATS. http://proceedings.mlr.press/v54/mcmahan17a.html. [18] Shen, Y., et al. (2025). Agentic Graph Neural Networks for Wireless Communications. arXiv:2508.08620. [19] Liu, A., et al. (2025). Distributed LLMs and MLLMs: A Survey. arXiv:2503.16585. [20] Zhang, Y., et al. (2025). Survey on Memory Mechanism of LLM-based Agents. ACM TOIS. https://dl.acm.org/doi/10.1145/3748302. [21] Research Collective. (2025). Memory in LLM-based Multi-agent Systems. ResearchGate. [22] Cognitive Edge Computing Research Consortium. (2025). Cognitive Edge Computing: A Survey. Authorea. [23] Blockchain for Deep Learning Review. (2022). Cluster Computing, 25. https://link.springer.com/article/10.1007/s10586-022-03582-7. [24] ScaleChain. (2023). distai: Distributed Neural Networks on Blockchain. GitHub. [25] DeepSeek AI. (2025). DeepSeek R1. arXiv:2501.12948. [26] OpenMPI Contributors. (2024). Open MPI. https://www.open-mpi.org/. [27] Van Renesse, R., et al. (2003). Astrolabe. ACM TOCS, 21(2). https://doi.org/10.1145/762483.762485. [28] Andoni, A. & Indyk, P. (2008). Near-Optimal Hashing for ANN. CACM, 51(1). https://doi.org/10.1145/1327452.1327494. [29] Bayer, R. & McCreight, E.M. (1972). Organization of Large Ordered Indexes. Acta Informatica. https://doi.org/10.1007/BF00288683. [30] ExoLabs. (2025). Exo: Run your own AI cluster at home. GitHub. [31] Borzunov, A., et al. (2022). Petals: Collaborative Inference and Fine-tuning. arXiv:2209.01188. [32] Ollama Contributors. (2024). Ollama. GitHub. [33] Mnih, V., et al. (2015). Human-level control through deep reinforcement learning. Nature, 518. https://doi.org/10.1038/nature14236. [34] Silver, D., et al. (2016). Mastering Go with deep neural networks. Nature, 529. https://doi.org/10.1038/nature16961. [35] Hornik, K., et al. (1989). Multilayer feedforward networks are universal approximators. Neural Networks, 2(5). https://doi.org/10.1016/0893-6080(89)90020-8. [36] Malkov, Y.A. & Yashunin, D.A. (2018). HNSW. IEEE TPAMI. https://doi.org/10.1109/TPAMI.2018.2889473. [37] Jégou, H., et al. (2011). Product Quantization for ANN. IEEE TPAMI. https://doi.org/10.1109/TPAMI.2010.57. [38] Kraska, T., et al. (2018). The Case for Learned Index Structures. SIGMOD. https://doi.org/10.1145/3183713.3196909. [39] Reynolds, J.C. (2002). Separation Logic. LICS. https://doi.org/10.1109/LICS.2002.1029817. [40] Castro, M. & Liskov, B. (1999). Practical Byzantine Fault Tolerance. OSDI. https://pmg.csail.mit.edu/papers/osdi99.pdf. [41] Lamport, L., et al. (1982). The Byzantine Generals Problem. ACM TOPLAS. https://doi.org/10.1145/357172.357176. [42] Dwork, C., et al. (1988). Consensus in the Presence of Partial Synchrony. JACM. https://doi.org/10.1145/42282.42283. [43] Kung, H.T. & Robinson, J.T. (1981). On Optimistic Methods for Concurrency Control. ACM TODS. https://doi.org/10.1145/319566.319567. [44] Wei, J., et al. (2022). Chain-of-Thought Prompting Elicits Reasoning. NeurIPS. arXiv:2201.11903. [45] Wang, X., et al. (2023). Self-Consistency Improves Chain of Thought. ICLR. arXiv:2203.11171. [46] Yao, S., et al. (2023). Tree of Thoughts. NeurIPS. arXiv:2305.10601. [47] Lightman, H., et al. (2023). Let’s Verify Step by Step. arXiv:2305.20050. [48] Irving, G., et al. (2018). AI Safety via Debate. arXiv:1805.00899. [49] Donenfeld, J.A. (2017). WireGuard: Next Generation Kernel Network Tunnel. NDSS. https://www.wireguard.com/papers/wireguard.pdf. [50] McClelland, J.L., McNaughton, B.L. & O’Reilly, R.C. (1995). Why there are complementary learning systems. Psychological Review, 102(3). https://doi.org/10.1037/0033-295X.102.3.419. [51] Diekelmann, S. & Born, J. (2010). The memory function of sleep. Nature Reviews Neuroscience, 11. https://doi.org/10.1038/nrn2762. [52] Klinzing, J.G., Niethard, N. & Born, J. (2019). Mechanisms of systems memory consolidation during sleep. Nature Neuroscience, 22. https://doi.org/10.1038/s41593-019-0467-3. [53] Karaboga, D. & Basturk, B. (2007). A powerful and efficient algorithm for numerical function optimization: ABC. Journal of Global Optimization. https://doi.org/10.1007/s10898-007-9149-x. [54] Intel. (2025). Intel Builds World’s Largest Neuromorphic System. Newsroom. https://newsroom.intel.com/artificial-intelligence/intel-builds-worlds-largest-neuromorphic-system.
[55] Soria Parra, D. (2026). The 2026 MCP Roadmap. Model Context Protocol Blog. https://blog.modelcontextprotocol.io/posts/2026-mcp-roadmap/
[56] Google. (2025). Agent-to-Agent (A2A) Protocol Specification. GitHub. https://github.com/google/A2A
[57] BerriAI. (2024). LiteLLM: Open-source gateway for 100+ LLM providers. GitHub. https://github.com/BerriAI/litellm
[58] Maxim AI. (2025). Bifrost: High-performance LLM gateway in Go. GitHub. https://github.com/maximai/bifrost
[59] Kong Inc. (2026). Kong AI Gateway. https://konghq.com/products/kong-ai-gateway
[60] ContextForge Contributors. (2026). ContextForge: Kubernetes-native federated MCP gateway. GitHub. https://github.com/contextforge/contextforge
[61] Zylos AI Research. (2026). Agent Interoperability Protocols 2026. https://zylos.ai/research/2026-03-26-agent-interoperability-protocols-mcp-a2a-acp-convergence
[62] Patel, N. (2026). Dynamic Attentional Context Scoping: Agent-Triggered Focus Sessions for Isolated Per-Agent Steering in Multi-Agent LLM Orchestration. arXiv:2604.07911. https://arxiv.org/abs/2604.07911
[63] Gamage, Y. (2026). Omission Constraints Decay While Commission Constraints Persist in Long-Context LLM Agents. April 2026.
[64] Mem0 Research. (2026). Context Window Is RAM, Not Storage: Why Most Agent Failures Happen. LoCoMo Benchmark Results. https://mem0.ai/blog/context-window-is-ram-not-storage-why-most-agent-failures-happen-how-to-fix-them-in-2026
[65] Milam, K. & Gulli, A. (2025). Context Engineering: Sessions & Memory. Google. November 2025. https://vanducng.dev/2026/01/12/Google-Context-Engineering-Sessions-Memory-Summary/
[66] Digital Applied. (2026). KV Cache Optimization for LLMs 2026: Engineering Guide. https://www.digitalapplied.com/blog/kv-cache-optimization-techniques-2026-engineering-guide
| Term | Definition |
|---|---|
| DARM-ANN | Distributed Agentic Recursive Memory Networks — the full architecture |
| WM | Working Memory — in-context activations; ephemeral |
| EB | Episodic Buffer — per-agent ring buffer; session-persistent |
| STM | Short-Term Memory — node-local Redis store; salience-gated |
| LTM | Long-Term Blockchain Memory — consensus-committed canonical store |
| RRC | Rapid Retrieval Cache — pre-built LSH index over hot LTM entries |
| CDCP | Consensus-Driven Consolidation Protocol — STM→LTM quorum promotion |
| RCE | Replay and Consolidation Engine — offline replay for catastrophic forgetting prevention |
| GTE | Graph Traversal Engine — BFS/DFS/Dijkstra/A*/Bidirectional claim validation |
| BVAS | Blockchain Validity Algorithm Suite — active integrity oracle |
| ESE | Epistemic Skepticism Engine — calibrated uncertainty, abstention, debate |
| RLRF | Reinforcement Learning with Reasoning Feedback — step-level verifiable reward |
| G_M | Markov policy graph constructed from blockchain history |
| G_K | Global blockchain knowledge graph |
| RCN | Router/Chain-Manager Node — orchestration node with RoutineHandle linked list |
| HCP | Hybrid Consensus Protocol — three-tier gate: CRDT / OER / HLC |
| OER | Optimistic Execution with Rollback — local writes to branch DAG; checkpoint reconcile |
| HLC | Hierarchical Lane Consensus — O(k_lanes log k_lanes); reduces full O(N log N) |
| DCoT | Distributed Chain-of-Thought — externalizes reasoning chain to EB across agents |
| V/P | Verifier/Proposer adversarial reasoning pattern |
| RoutineHandle | Linked list node in RCN registry; specifies TinyLM spec, lane, write class |
| ExecutionLane | RCN task pattern: {single, parallel, sequential, hybrid} |
| WriteClass | Operation cost class: {read_only, local_write, global_write} |
| T_occ | OER checkpoint interval |
| D_rb | OER maximum rollback depth before HLC escalation |
| N_tools | Number of MCP tool servers in the federation |
| k_fallback | Number of tiers in the AI Gateway fallback chain |
| p_i | Availability probability of fallback tier i |
| T_heartbeat | A2A Agent Card heartbeat interval (default 5s) |
| k_lanes | Number of execution lanes (k_lanes ≪ N) |
| DAG | Directed Acyclic Graph — branch ledger structure |
| LSH | Locality-Sensitive Hashing — O(1) approximate nearest neighbor |
| LoRA | Low-Rank Adaptation — parameter-efficient fine-tuning |
| QLoRA | Quantized LoRA — LoRA on 4-bit NF4-quantized base model |
| FedAvg | Federated Averaging — Δθ_global = Σ_k (n_k/n) × Δθ_k |
| BFT | Byzantine Fault Tolerant — correct under f < N/3 Byzantine nodes |
| PBFT | Practical Byzantine Fault Tolerance |
| Tendermint | Deterministic BFT consensus with known safety/liveness properties |
| GRPO | Group Relative Policy Optimization |
| Dec-POMDP | Decentralized Partially Observable Markov Decision Process |
| STDP | Spike-Timing-Dependent Plasticity — neuromorphic learning rule |
| SWR | Sharp-Wave Ripple — hippocampal offline replay mechanism |
| CLS | Complementary Learning Systems — McClelland et al. 1995 memory theory |
| EWC | Elastic Weight Consolidation — regularization to prevent catastrophic forgetting |
| sMCP-1 | Secure Model Context Protocol Draft 0.3 — DARM-ANN security hardening spec |
| NMN | Neural Mesh Network — the neuromorphic deployment architecture |
| IaC | Infrastructure as Code — generated deployment manifests |
| WireGuard | Cryptographic peer-to-peer VPN used as DARM-ANN inter-agent mesh |
| EWMA | Exponentially Weighted Moving Average — used in RCN registry self-ordering |
| Ebbinghaus curve | Forgetting curve: S(t) = e^{-t/S}; used in memory decay scoring |
| MCP Gateway | Centralized gateway collapsing N×M agent-tool connections to N+M |
| AI Gateway | Unified OpenAI-compatible API over all model providers with fallback chain |
| A2A | Agent-to-Agent Protocol — horizontal inter-agent coordination; agent cards, task lifecycle |
| ACP | Agent Communication Protocol — REST-native structured inter-agent messaging |
| OASF | Open Agent Schema Framework — vendor-neutral agent description enabling protocol-agnostic routing |
| Agent Card | A2A structured JSON document advertising an agent’s capabilities, model, and live status |
| Fallback chain | Ordered list of model tiers; gateway tries each until a successful confident response |
| Semantic cache | Embedding-similarity cache returning responses for semantically equivalent prompts; backed by RRC |
| AAIF | Agentic AI Foundation — Linux Foundation directed fund governing MCP and A2A standards |
| SEP | Spec Enhancement Proposal — formal MCP specification change process |
| OAuth 2.1 | Authentication standard adopted by MCP for remote server authorization (June 2025 spec) |
| SPIFFE | Secure Production Identity Framework for Everyone — workload identity for intra-cluster calls |
| Protocol Bridge | Gateway component exposing legacy REST/gRPC services as MCP tools |
| Context Bridge | Bidirectional protocol mediating between WM context window and blockchain memory tiers |
| CAE | Context Assembly Engine — six-slot priority-weighted assembly of WM content from RRC/STM/EB/LTM |
| CBM | Context Budget Manager — enforces per-tier token limits; compression priority order |
| ATI | Anchor Token Injector — periodically re-injects high-salience LTM constraints into WM to prevent omission decay |
| KVPSP | KV Prefix Sharing Protocol — uses Branch DAG ancestry to share KV cache prefix across DCoT chain agents |
| DACS | Dynamic Attentional Context Scoping — RCN operates in Registry mode (Agent Cards ≤200 tokens) or Focus mode (full agent context); prevents context pollution |
| Flow A | Downward context assembly: LTM/RRC/STM/EB → WM at inference start |
| Flow B | Upward context commit: WM outputs → EB → STM → LTM via OER/HLC |
| Flow C | Cross-session serialization: WM state → LTM session boundary block at session end |
| Flow D | Cross-agent context handoff: Agent_i WM summary → Agent_j EB for DCoT chain |
| λ_atf | Anchor Token Frequency — ATI injection rate parameter; higher = more frequent re-injection |
| Session boundary block | LTM block type committing WM state at session end; enables cross-session continuity |
| Context poisoning | Contamination of the context window with incorrect, outdated, or adversarially crafted information |
| Proof | Version | Section | Statement |
|---|---|---|---|
| P1 | v3.0 | §21.1 | T_global = Θ(N log N) for comparison-based consensus |
| P2 | v3.0 | §21.1 | T_recovery = O(log N) for node failure replacement |
| P3 | v3.0 | §21.2 | E[bucket_occupancy] = n/B; P(O(1)) = 99.997% |
| P4 | v3.0 | §21.2 | P(false_negative) with L tables = (1-p₁)^L |
| P5 | v3.0 | §21.2 | P(all_same_bucket) ≈ 10^{-7×10⁷} (negligible) |
| P6 | v3.0 | §21.2 | E[T_LSH_query] = O(1) amortized |
| P7 | v3.0 | §21.3 | B-tree height h = O(log m) |
| P8 | v3.0 | §21.3 | T_lookup = T_insert = T_delete = O(log m) |
| P9 | v3.0 | §21.3 | T_decision = O(log m) (composition) |
| P10 | v3.0 | §21.4 | Lower bound: Ω(N log N) for any comparison-based consensus |
| P11 | v3.0 | §21.5 | LoRA param reduction = 2r/d = 0.78% for d=4096, r=16 |
| P12 | v3.0 | §21.5 | QLoRA memory = 3.5 GB for 7B, r=16 |
| P13 | v3.0 | §21.5 | LoRA FedAvg 256× faster than full-model FedAvg |
| P14 | v3.0 | §21.6 | Blockchain tamper-evidence: modifying B_j invalidates B_{k>j} |
| P15 | v3.0 | §21.6 | Collision resistance: P(forge) = 2^{-128} |
| P16 | v3.0 | §21.6 | DAG causal order ≺ is a valid partial order |
| P17 | v3.0 | §21.6 | Merkle inclusion proof = O(log n) × 256 bits |
| P18 | v3.0 | §21.6 | Tendermint safety under f < N/3 Byzantine nodes |
| P19 | v3.0 | §21.6 | T_consensus = 2Δ under GST |
| P20 | v3.0 | §21.7 | A_l_max ≤ T_inference / T_message |
| P21 | v3.0 | §21.7 | Partition recovery T = Q_max / λ_global_chain |
| P22 | v4.0 | §12.2 | RLRF non-vanishing gradient: E[ |
| P23 | v4.0 | §12.2 | RLRF credit assignment: E_RLRF ≥ E_RLVR for K ≥ 2 |
| P24 | v4.0 | §13.2 | G_M stationary distribution convergence |
| P25 | v4.0 | §13.2 | Spectral gap lower bound: λ_1 - λ_2 ≥ 1/(m·D_max) |
| P26 | v4.0 | §13.2 | Bellman contraction: |
| P27 | v4.0 | §13.2 | Full policy convergence: |
| P28 | v4.0 | §13.2 | Potential-based shaping policy invariance |
| P29 | v4.0 | §12.3 | Distributed GRPO cost: O(G·L·max_l(A_l)·T_inference) |
| P30 | v5.0 | §9.1 | GTE BFS correctness: 100% recall within k hops |
| P31 | v5.0 | §9.1 | GTE A* admissibility with monotone heuristic |
| P32 | v5.0 | §10.1 | Chain integrity detection: P(undetected mod) = 2^{-128} |
| P33 | v5.0 | §10.2 | Fork resolution bound: ≤ 1 fork per consensus round |
| P34 | v5.0 | §10.3 | BVAS adversarial detection rate ≥ 1-δ_temporal |
| P35 | v5.0 | §11.2 | ESE calibration convergence: |
| P36 | v5.0 | §11.3 | Abstention optimality: minimizes expected calibration error |
| P37 | v5.0 | §11.4 | Skeptic convergence (see v5.0 archive) |
| P38 | v5.0 | §11.4 | Hallucination reduction bound (see v5.0 archive) |
| P39 | v6.0 | §5.4 | CDCP hallucination resistance: P(fabrication) ≤ 10⁻⁶ |
| P40 | v6.0 | §5.4 | CDCP safety: no contradictory claims achieve quorum |
| P41 | v6.0 | §5.4 | CDCP liveness: terminates in O(Δ + T_GTE_max) |
| P42 | v6.0 | §6.3 | Catastrophic forgetting bound: ≥28.6% old-task signal at r=0.4 |
| P43 | v6.0 | §7.3 | RRC E[T] = O(1); recall = 99.9% with L=3 |
| P44 | v6.0 | §8.3 | Retrograde protection: κ=1.2 incumbency requirement |
| P45 | v6.0 | §7.3 | RRC 2.46× throughput at 60% hit rate |
| P46 | v6.0 | §5.4 | Optimal τ_c = 2/3 for standard BFT safety |
| P47 | v6.0 | §4.2 | Salience convergence to empirical query frequency |
| P48 | v6.0 | §8.1 | Decay score = Ebbinghaus × spacing effect |
| P49 | v6.1 | §17.3 | Spike-rate ↔ dense embedding equivalence |
| P50 | v6.1 | §17.3 | STDP ↔ RCE replay correspondence |
| P51 | v6.1 | §17.3 | Neuromorphic mesh NoC consensus latency |
| P52 | v6.1 | §17.3 | Neuromorphic 10× energy reduction vs. TinyLM |
| P53 | v6.2 | §15.4 | HLC cost = O(k_lanes log k_lanes) for fixed lane size |
| P54 | v6.2 | §15.4 | HLC ~28× reduction vs. full global consensus (k=8, N=100) |
| P55 | v6.2 | §15.4 | OER: 20× reduction in expected consensus invocations |
| P56 | v6.3 | §21.1 | MCP Gateway: N×M → N+M integration point reduction |
| P57 | v6.3 | §22.3 | AI Gateway fallback chain: P(success) = 1 - Π(1-p_i); 15-nines for 5-tier chain |
| P58 | v6.4 | §25.3 | CAE priority ordering maximizes Q(wm) per token budget (information-theoretic sketch) |
| P59 | v6.4 | §26.1 | DACS: 90.0–98.4% steering accuracy vs. 21.0–60.0% flat-context baseline (Patel 2026) |
| P60 | v6.4 | §26.2 | KVPSP: KV compute reduction = d_shared / (2×d_total); 30% for 60% shared prefix |
| P61 | v6.4 | §25.5 | ATI: omission constraint recall ≥ 1 - exp(-λ_atf × D × w_anchor/W_budget) |
Introduced in v6.1 as Appendix D. Expanded in v6.2.
| # | Resource | URL | Relevance |
|---|---|---|---|
| NMN-1 | Intel Hala Point (Jan 2025) — 1.15B spiking neurons | https://newsroom.intel.com/artificial-intelligence/intel-builds-worlds-largest-neuromorphic-system | P49–P52, §17 |
| NMN-2 | Open Neuromorphic community hub | https://open-neuromorphic.org/ | §17 |
| NMN-3 | Intel Loihi 2 technical documentation | https://www.intel.com/content/www/us/en/research/neuromorphic-computing.html | §17.2 |
| NMN-4 | UK Neuromorphic Centre research | https://www.manchester.ac.uk/research/neuromorphics/ | §17 |
| # | Resource | URL | Relevance |
|---|---|---|---|
| SLM-1 | NVIDIA LPR SLM Agents | https://research.nvidia.com/labs/lpr/slm-agents/ | §12, §16 |
| SLM-2 | Edge AI Foundation | https://www.edgeaifoundation.org/ | §20 |
| SLM-3 | Microsoft Phi-3 Mini (3.8B) | https://azure.microsoft.com/en-us/blog/introducing-phi-3-redefining-whats-possible-with-slms/ | §20.1 |
| SLM-4 | Textbooks Are All You Need (Phi-1) | https://arxiv.org/abs/2306.11644 | [2] |
| # | Resource | URL | Relevance |
|---|---|---|---|
| SW-1 | Penn xLAB Swarm AI Safety | https://www.seas.upenn.edu/stories/a-new-swarm-ai-project-takes-on-safety-at-scale/ | §18 |
| SW-2 | Bee Colony + Agentic AI | https://towardsdatascience.com/agentic-ai-swarm-optimization-using-artificial-bee-colonization-abc/ | §18.1 |
| SW-3 | ANTS 2027 Conference | https://ants2026.org/ | Publication target |
| SW-4 | AI Swarm Attack Defence 2026 | https://www.kiteworks.com/cybersecurity-risk-management/ai-swarm-attacks-2026-guide/ | §19 |
| # | Resource | URL | Relevance |
|---|---|---|---|
| MEM-1 | MemOS: Memory OS for AI | https://statics.memtensor.com.cn/files/MemOS_0707.pdf | §3, §7, [9] |
| MEM-2 | Survey: Memory Mechanism in LLM Agents | https://dl.acm.org/doi/10.1145/3748302 | §3, [20] |
| MEM-3 | Memory in the Age of AI Agents | https://arxiv.org/abs/2512.13564 | §3, [8] |
| MEM-4 | Agentic Neural Networks (ANN) | https://arxiv.org/html/2506.09046v1 | §9 (agentic), [5] |
| # | Resource | URL | Relevance |
|---|---|---|---|
| CON-1 | Tendermint Consensus | https://tendermint.com/docs/ | §5, §15 |
| CON-2 | PBFT: Castro & Liskov (1999) | https://pmg.csail.mit.edu/papers/osdi99.pdf | §10, [40] |
| CON-3 | WireGuard Formal Security | https://www.wireguard.com/papers/wireguard.pdf | §19.2, [49] |
| # | Resource | URL | Relevance |
|---|---|---|---|
| RL-1 | DeepSeek R1 | https://arxiv.org/abs/2501.12948 | §12, [25] |
| RL-2 | Chain-of-Thought Prompting | https://arxiv.org/abs/2201.11903 | §16.1, [44] |
| RL-3 | Tree of Thoughts | https://arxiv.org/abs/2305.10601 | §16.1, [46] |
| RL-4 | Let’s Verify Step by Step | https://arxiv.org/abs/2305.20050 | §16.2, [47] |
| RL-5 | AI Safety via Debate | https://arxiv.org/abs/1805.00899 | §16.2, [48] |
| # | Resource | URL | Relevance |
|---|---|---|---|
| SEC-1 | Universal Adversarial Attacks on LLMs | https://arxiv.org/abs/2307.15043 | §19 |
| SEC-2 | Extracting Training Data from LLMs | https://arxiv.org/abs/2012.07805 | §19 |
| SEC-3 | Prompt Injection (Perez & Ribeiro) | https://arxiv.org/abs/2211.09527 | §19 |
This white paper is released under Creative Commons Attribution 4.0 International (CC BY 4.0).
Citation: Cybopsec Research (2026). DARM-ANN v6.4: Distributed Agentic Recursive Memory Networks. Working White Paper, May 2026. https://cybopsec.github.io/darm-ann
Version 6.4 supersedes v6.3 (May 2026). All prior versions archived at https://github.com/cybopsec/darm-ann
@techreport{cybopsec2026darmannv64,
title={DARM-ANN v6.4: Distributed Agentic Recursive Memory Networks},
author=,
institution={Cybopsec},
year={2026},
month={May},
type={Working White Paper},
url={https://cybopsec.github.io/darm-ann},
note={Version 6.4 — Context Bridge and Engineering Edition}
}