0x碎碎念

Just finished chatting with a group of friends, and one of them asked me: after Newton Protocol’s "verifiable automation market" goes live, would I directly use the agents in it? I’ve spent some time researching the automation layer of Newton Protocol Mainnet Beta, and I do认可 the design of Scoped Autonomy—users set boundaries, and ZK proofs verify that the agent hasn’t crossed them, shifting trust away from "believing the agent is subjectively honest" to believing in cryptography. At that layer, I really did think it solved the hardest problem for on-chain AI agents.

#Newt @NewtonProtocol

Then I thought about his question and paused. ZK proofs verify this: that the agent’s behavior is within the permissions you set. What it cannot verify is whether the agent’s claimed functionality and what it will actually do under edge cases are the same thing. By analogy: a supply-chain attack in npm, where a package claims to be a utility library but triggers hidden logic under specific conditions. The behavior is within the authorized scope, yet something you didn’t expect still happens. If you transplant that to an on-chain agent market, what gets triggered is not CPU usage, but the real assets in your account. The audit mechanism for agent listings in Newton Protocol’s roadmap has not yet been publicly explained.

If you don’t use any on-chain automation tools, you can skip this post. But if you plan to use third-party agents after the market goes live—my strategy is very clear: only use agents released by Newton’s official partners, and only if there is an independent audit report available. Anything without a verifiable audit record, no matter how good the feature description sounds, I’ll wait until someone else has already walked through it first. "A good claim is nice, but code is what counts"—in an agent market, that’s more valuable than anywhere else.

As for the $NEWT token, I’m waiting for one specific signal: before agents are listed, is there a mandatory audit requirement—not voluntary, but a gate for entry? If yes, then the market is infrastructure; if not, it’s just a riskier code distribution hub. Who should decide the security standards for an on-chain agent market? Whether that’s right or wrong is another matter, but that’s how I see it. #newt $NEWT

I went through the Newton Protocol Mainnet Beta zkPermissions documentation twice, and there was one part that kept me stuck — most of the introductory material describes the scope of ZK proofs too broadly. I worked through the whole mechanism myself. Users set boundaries for the AI agent: spending limits, protocols it can interact with, allowed action types, time constraints. These parameters are written into an on-chain permission system. Every time the agent executes an action, it generates a ZK proof to show the behavior stayed within the boundaries. At the time, I genuinely thought this was the key mechanism that would let AI agents be used by institutions in a real way — shifting trust from "believing the agent is honest" to "believing the math," which is a qualitative difference. #Newt @NewtonProtocol

Then I thought one step further and stopped. A ZK proof verifies that the agent acted within the permission range you set. It cannot verify whether the permission range you set is actually the one you truly wanted. Put that into a scenario. You want the agent to rebalance a DeFi position, set the maximum single order size to "10000," thinking it means USDC, but in fact that field accepts the chain's base precision units, so the value is off by several orders of magnitude. The agent runs, every ZK proof is valid, and every action is completely within "the boundaries you set." Newton Protocol tells you the agent behaved in compliance. At the protocol level, that's true. No one will be held responsible for your loss. @NewtonProtocol

For anyone not using AI agents to manage on-chain assets, this post has no practical significance right now. But if you plan to use Newton agents to manage any meaningful amount of assets, before configuring zkPermissions, first confirm two things: what units each parameter field uses, and whether the actual meaning of the boundary conditions matches your understanding. Right now, there is no public third-party tool that can help you verify whether the configuration intent matches the configuration result — that gap is on the user side, not the protocol side.

As for the $NEWT token, I'm waiting for one concrete thing: whether any independent developer will build a configuration verification tool for Newton zkPermissions. The day that tool exists, this mechanism will truly become safe and usable for ordinary users. ZK proves the agent followed the rules, but the rules are defined by you — if you define them wrong, who is responsible? #newt $NEWT

I just went out for about twenty minutes and came back, and one thing was still turning over in my mind. I found a sample strategy file in the Newton Protocol documentation, opened it, read it carefully for around seven or eight minutes, and then closed it. Newton Protocol Mainnet Beta uses the Rego language under the OPA framework to write execution policies. I actually agree with this choice: Rego has been used in the enterprise security space for almost ten years—Netflix and GitHub both use it. It has strong expressiveness and rigorous logic, and it’s far more robust than the project team inventing their own strategy language.

When I saw this selection, I felt relieved at the time: at least it isn’t some wild solution. #Newt @NewtonProtocol

Then I opened that strategy file. The issue is here. One of Newton Protocol’s core values is that on-chain strategies are "public, transparent, and verifiable." You can look up the exact rules you’re using, and the whole execution logic is right there in front of you. That is true—the policy file really can be checked on-chain. But "verifiable" and "understandable" are two completely different things. For ordinary DeFi users, a Rego strategy file is pretty much no different from bytecode: it’s public, but you can’t make sense of it. So-called "transparency" is actually only transparent to security engineers who can read Rego, not transparent to ordinary participants who put their funds into the vault.

So my assessment is very clear now: engineers who can write Rego don’t need to read this—this isn’t an issue for you at all. But if you’re a regular capital participant, the next time you see any claim about Newton’s integration protocol that says "on-chain strategies are publicly verifiable," ask first: does this project have supporting strategy interpretation documentation that ordinary people can read? Being visible and being understandable differ by an entire layer of comprehension.

As for the $NEWT token, I’m watching one very specific thing: whether a third party has started building a human-language translation tool for Newton strategies, or whether Newton officially releases a readability layer. The day that tool comes out will be the real starting point of the "strategy internet" shifting from institutional circles to the general public, and only then will the token’s user base begin to truly broaden. On-chain transparency but ordinary people can’t understand it—does that count as transparent? For now, let’s say this, and talk later. #newt $NEWT

I found that the vast majority of content about the Newton Protocol frames it as a narrative of something “moving toward being implemented.” But there’s one thing that almost never gets singled out for discussion, and today I finally figured it out. Before the Newton Protocol Mainnet Beta went live, Newton’s strategy execution layer was already running in Polymarket. Magic Labs is both a core developer of Newton and the provider of Polymarket’s wallet infrastructure. The stepwise 2FA strategy framework it deployed on Polymarket—extra verification triggered by high-risk actions, withdrawal and trading rules executed dynamically via a strategy ledger, and verifiable on-chain—was essentially the production-grade deployment of Newton’s strategy layer. The entire Magic Labs ecosystem supports over $8.9 billion in Polymarket trading volume. On the night of the 2024 U.S. election, it hit $3 billion in a single night, with zero downtime. #Newt @NewtonProtocol

I took this case apart and studied it myself. Honestly, things got quiet for a moment—because it means Newton isn’t “infrastructure that hasn’t been implemented yet.” It has already withstood real pressure in the world’s largest prediction market. Then I took the next step, and got stuck right here: Polymarket users don’t feel the existence of the Newton Protocol. What they feel are Polymarket’s rules, not Newton’s strategy engine. Newton here is invisible background infrastructure.

Invisible can mean two things. One is that it’s embedded deeply enough that the cost to replace it is too high—that’s the moat. The other is that it can indeed be replaced, it’s just that nobody is moving on it yet—that’s a vulnerability. For these two possibilities, I currently don’t have enough public information to tell them apart.

So for now, I’m only watching one number: the number of independent protocols that proactively integrate Newton Protocol’s strategy layer, outside the Magic Labs ecosystem. If that number starts trending upward, then the story of Newton going from “an internal tool of Magic Labs” to “an industry-wide execution infrastructure” holds. If that number hasn’t moved, then what can be priced is only this: “Polymarket’s compliance provider.” The valuation gap between these two narratives—$NEWT —is enormous. If you only look at price action and don’t care about usage data, this article won’t be useful to you. You tell me: for the invisible infrastructure you think exists, is it ultimately a moat or a risk? Maybe I’m overthinking it. #newt $NEWT

A fellow groupmate asked me: what exactly does the Security execution domain of the Newton Protocol block? I went through the Newton Protocol Mainnet Beta myself. Hexagate, as a security partner, is integrated to perform real-time threat scanning before transaction settlement—flash loan attacks, sandwich attacks, oracle price manipulation. If the strategy threshold is triggered, it gets intercepted, leaving on-chain proof. In 2024, Hexagate participated in the remediation of 5,000+ on-chain threat events. My first reaction: useful—really pushed the line of defense forward by one layer. #Newt

But there’s one part I’ve never managed to fully wrap my head around. Hexagate’s threat recognition is trained from historical attack data. The issue is that the on-chain behavioral features of flash-loan arbitrage and flash-loan attacks in those few hundred milliseconds before settlement are sometimes so similar that even automated systems can struggle to distinguish them. If your arbitrage strategy is mistakenly flagged as a threat, the transaction gets rejected before settlement—on-chain you only get a single "policy rejection" and no reason is given, no appeal channel, and no compensation mechanism. And whoever has the details of the current attack feature database has an early advantage in evading it—this in itself is an information asymmetry vulnerability. @NewtonProtocol

My conclusion is simple: for people who only do normal LP and don’t touch active strategies, the Security execution domain is pure protection for you, no need to dig deeper. But if you’re doing on-chain arbitrage, flash-loan synthesis, or moving funds across protocols, before you connect to Newton’s vault, first make sure whether that security policy has a measurable false positive rate and a revision/appeal mechanism—otherwise it’s basically handing over the authority to decide whether "my transaction is valid".

On the $NEWT side, I only watch one number: the actual number of interception requests from the Security layer. That’s evidence of real calls, more indicative than the list of partners. For on-chain security interceptions and transaction review, where do you think the boundaries are? Anyway, that’s where I stand—I haven’t found a good answer to this question. #newt $NEWT

When I was looking at Newton Protocol Mainnet Beta today, I found there are four execution domains: Compliance, Identity, Security, and Risk. What’s been overused is the Compliance part—OFAC sanctions lists, anti-money laundering—everyone keeps talking about it. But for Identity—verification and eligibility screening—I searched the square for a long time, and almost every post was just six words and then it was gone. There’s something in here that’s always made me feel off, and I tried to explain it.#Newt @NewtonProtocol

I took Newton’s documentation apart myself. Doing on-chain eligibility screening with zero-knowledge proofs is technically clean: it doesn’t require putting the original KYC text on-chain. You only need to prove the single conclusion that "this address meets the conditions." The original identity data isn’t exposed; only a cryptographic proof remains on-chain. At the time, I truly thought I’d found the missing piece that DeFi institutions have been waiting for.

Then I thought a couple of steps further and stopped. The underlying color of DeFi is permissionless—if you have a wallet and Gas, you can get in; no one can stop you. What Newton’s Identity execution domain does, structurally, is insert an eligibility check before transaction settlement: your address must satisfy the conditions defined by the policy in order to proceed. Whoever defines those four words—"meets the conditions"—has the key to that door. Newton’s current policy is built in conjunction with institutions like Chainalysis, and none of those institutions are organizations that ordinary users can participate in and influence.#Newt

So what I’m watching now is a specific signal: whether the text of Newton’s Identity policy conditions has been made public, and whether there is independent auditing outside of the institutional partners. If both are absent, then "on-chain verifiability" only guarantees that the execution outcome is transparent—it doesn’t guarantee that the entry rules themselves are sound. People who just do standard public-chain DeFi can skip this article for now, but if you’re evaluating an institutional treasury or an RWA product, you have to clarify this layer.

On the $NEWT track, I only look at one metric: the number of RWA and institutional treasury integrations that require Identity eligibility verification to access. That number is going up, which suggests this execution domain is being genuinely called—the demand for token usage is real; if it doesn’t rise, then this mechanism is still just words on a feature list. Do you think on-chain eligibility screening makes DeFi more mature, or does it rebuild the very door that DeFi has been saying it doesn’t have? I originally didn’t want to say this, but I did.#newt $NEWT

I was reading the Newton Protocol documentation today and got stuck on a phrase: "strategy internet". The final vision of the Newton Mainnet Beta is to create an open marketplace where anyone can publish, discover, and freely compose strategies to execute on-chain—like the App Store, but what’s being sold isn’t apps, it’s rules. Then I scrolled up and looked at what it’s doing right now: institutional compliance onboarding for DeFi vaults, counterparty screening, leverage thresholds, oracle health checks—written as Rego policies, run once before trading, with proofs left on-chain. @NewtonProtocol

The entry point is solid, no problem. The vault risk control relies on off-chain processes and human monitoring—the pain points are real enough. But "institutional procurement compliance strategies" and "any developer listing custom rules in the marketplace" are two distribution logics, two completely different types of users; between them there’s an open-ecosystem action. I haven’t seen a roadmap for that yet. It’s interesting, but I haven’t figured out how to characterize it. #Newt

For the $NEWT token, I’m temporarily not looking at it through the ecosystem marketplace valuation logic. I’m watching a specific metric: how many strategies in the strategy library are contributed by external developers—non-Newton official code. If that number starts to move, then the narrative is actually being fulfilled. Until it moves, the infrastructure logic is enough, and there’s no need to slap a "open ecosystem" premium on it. When will the strategy production side be opened—have you seen any answers to that anywhere? I don’t have that answer yet. #newt $NEWT

I plan to start researching the Newton Protocol and the Newton Mainnet Beta today. On the day Mainnet Beta for @NewtonProtocol went live, I didn’t write anything right away because I dug back into the whitepaper and reread the “Risk” execution domain. I tested a vault with a similar risk-control mechanism using a small amount of my own funds, and at the time I truly felt that the experience was completely different from before—the strategy wasn’t just a promise written in a document; it really would block trades that don’t meet the conditions. Back then, I thought I had found something that was rare and long unseen.

Then, when I kept reading, I realized it wasn’t that simple. Most people believe a vault’s risk limits are “up to the project team”—a statement to the effect of “we’ll announce it after something goes wrong.” But in reality, the risk-control logic of most leading vaults today isn’t even on-chain. It’s in an off-chain Excel-style strategy document that the team manually monitors. When oracle health deteriorates, counterparty concentration exceeds thresholds, or leverage is quietly increased—no one blocks you on-chain. By the time the announcement is published, you’re already inside it. #Newt

For vaults with assets in the billions, risk limits rely on people staying awake. I can’t not care about this fact. So my strategy is very clear now: until a vault can provide an on-chain, verifiable proof of its strategy, I will only put in the money I can afford to lose to zero. Not because I don’t trust the team, but because I’ve seen what it looks like when off-chain risk controls fail. It’s not a mechanism problem—it’s a human reaction-time problem.

If you only deal with spot, and your per-trade position size is already small, this won’t mean much to you. But if you’re managing a multisig vault or helping someone manage their finances, you should take a look: is the “risk control” you believe in written into the contract, or is it written on-chain? Who should be responsible for this? I haven’t stepped into this pit myself, but I’ve seen it.

One more thing related to $NEWT . If this risk execution layer is truly integrated by multiple vaults, the token-demand logic will gradually shift from “emotion-driven” to “driven by how many strategies are being called”—and I’d rather watch this metric than the candlestick chart right now. I don’t try to predict price moves, but for the line of how many integrations there are, I’ll keep watching. #newt $NEWT

I took OPG’s governance powers apart and looked into it, and it got stuck on a single line of text. Most people, when they say “governance,” think of something like “vote to change a parameter.” But in the governance of @OpenGradient there’s one item that’s very different: the TEE enclave code registry.

In plain terms, it’s about deciding which code can run inside a trusted execution environment. This kind of power isn’t just ordinary parameter tweaking. Whether all of OpenGradient Chat’s privacy promises—identity decoupling, content encryption, TEE isolation—can actually hold up ultimately depends on whether the code running in the enclave is the exact code it claims to be. And what determines that is governance.

I don’t know why, but I’ve kept thinking about this: if one day the enclave registry gets bypassed by malicious code, then all the privacy architecture in front of it is meaningless. For this issue, governance power is closer to the network’s lifeblood than most people think—it’s not a peripheral feature. For now, that’s it. We’ll talk more later.#OPG

Back to $OPG : holding OPG and participating in this kind of governance, the value isn’t in the voting itself, but in who controls the foundation of network trust. This weight is not priced by the market yet.#opg $OPG

Cross-chain bridge incidents are never small matters—this is almost a rule in the crypto circle. Ronin, Wormhole, Nomad—every time a bridge gets hacked, the losses are often in the hundreds of millions of dollars, and usually by the time users react, it’s already too late. So when @OpenGradient ’s OPG went live on multiple exchanges, my first reaction wasn’t to check the price—I went to see how the cross-chain works.

The official documentation is very clear: Base is the reference chain for OPG, and cross-chain transfers are handled via the LayerZero OFT Adapter. What is OFT? It’s an Omnichain Fungible Token. The logic of traditional cross-chain bridges is: lock tokens on chain A, then mint a “wrapped” version on chain B. The combined token amounts on both chains may exceed the total supply, and the security boundary depends on whether the locking contract has vulnerabilities. #OPG

The LayerZero OFT logic is different: tokens are destroyed on the source chain and minted on the destination chain, so the total supply across the entire chain remains fixed at 1 billion. There’s no “wrapped version,” and no lock contract as an attack surface. This doesn’t mean LayerZero has no risk—every cross-chain system has risk; it’s just that the risk points are different. The risk of OFT lies in the LayerZero protocol layer itself, not in the locking contracts. These two types of risk are completely different in nature and have different scopes of impact. @OpenGradient

If you hold OPG, there’s one thing you should verify yourself: is the OPG you hold the native ERC-20 on Base, or a version that came over from another chain via OFT? Check the contract address from the official documentation—don’t trust any address someone sends you via DMs. What do you think: compared with the traditional lock-and-mint bridge, is this all-chain unified-supply design of OFT a real security improvement, or is it just swapping in a different attack surface?

Coming back to $OPG , this cross-chain design itself doesn’t directly consume OPG tokens, but it determines OPG’s liquidity structure across multiple chains. If the OFT mechanism runs reliably, OPG can be used in DeFi protocols on different chains, so settlement demand won’t be limited to Base alone. It’s a multiplication, not an addition. But the condition is that the cross-chain system truly hasn’t had any incidents. #opg $OPG

The 麦通 MSX finally went TGE. This is a world-leading RWA trading platform. If you want to get in via Alpha, the expected cutoff is around 225–230 points.

A friend in my group asked me where the model with @OpenGradient is located. I answered offhandedly, “On-chain.” Then I realized something was off. I went back and checked the technical documentation: the model is not on-chain. On-chain there’s only a Blob ID. OpenGradient uses Walrus for decentralized storage, and the large files—everything like the AI model itself and the zkML proofs—are all stored as blobs off-chain. What the blockchain records is just the ID pointing to that blob, nothing more.

My first reaction was: isn’t that a compromise? But after thinking it through, I realized it’s not a compromise—it’s the only workable approach. A medium-sized AI model is already several GB, and a complete zkML proof file is also not small. If you really put all of that on-chain, the blockchain would get overwhelmed immediately: astronomical gas fees, and the network simply wouldn’t be able to run. Walrus’s design separates storage from verification. You don’t need to put the data on-chain; you only need to put the proof of “this data exists and hasn’t been tampered with” on-chain. The chain is the verification layer, not the storage layer.

This is a question many people haven’t thought through when they say “on-chain AI”: what exactly should be stored on-chain? OpenGradient’s answer is: store only the most minimal verifiable proof, and leave everything else to decentralized storage. This allows the model behind OpenGradient Chat to be any size, without being constrained by on-chain storage limits.

My judgment right now is very clear: until there’s publicly verifiable data about the stability of the Walrus storage layer, I’m treating this as the key link in the architecture integrity—not as a certainty. If you’re only doing short-term trading, this doesn’t concern you. But if you’re assessing whether OpenGradient can support real-scale AI workloads, then the reliability of the storage layer is the question nobody asks but should be asked. When do you think the market will start seriously pricing this “on-chain AI storage” issue?

Back to $OPG : the Walrus storage piece itself doesn’t directly consume OPG, but it’s the prerequisite for running large models across the inference network. Without reliable decentralized storage, the 4500+ models in the Model Hub are basically just display items. Whether the storage layer is stable determines whether the inference demand curve above can actually be fulfilled in practice. #opg $OPG

Today I swapped alpha trading for $ARX . Everyone should only swap during the uptrend; the wear and tear is very serious.

In the technical documentation for @OpenGradient , there’s a line. I read it twice again: "Data nodes run inside a TEE, establishing an encrypted link with third-party data sources." I glanced over it at the time, and later came back to reread it—I stopped there. Because I realized the whole community discussing OpenGradient was collectively ignoring something more foundational than proof and verification. Everyone’s focused on: "Can the inference result be verified?" Nobody asks: "Hey, is the data fed into the model, to begin with, trustworthy?"

This is a structural blind spot in on-chain AI. The zkML proof, TEE isolation, on-chain settlement—this whole architecture proves that the model processes the input data according to the prescribed workflow. But what if the input data itself is coming from a poisoned API or a fabricated oracle quote? Then the proof only shows that the model faithfully processed a bunch of fake data. Garbage in, garbage out. No matter how perfect the verification is, it’s still useless. #OPG

OpenGradient’s data nodes are addressing this very prerequisite problem. Before data enters the network, trusted validation is completed inside the TEE, and the link to the third-party data sources is encrypted. Each time OpenGradient Chat makes a call that requires external data, this part is running.

I didn’t step into this trap myself, but I’ve seen it. Most "verifiable AI" projects only do the second half; they don’t do the first half.

My assessment is now very clear: before real on-chain DeFi protocols actually integrate OpenGradient data nodes, I treated it as an architectural advantage—not as a deployed moat. Those two things are different. If you’re only doing pure short-term trades, this part really doesn’t help you. But if you’re evaluating this network’s long-term barrier—the data layer’s trustworthy closed loop—that’s the truly difficult part to copy. You think: is the trust problem in on-chain AI solved first by inference verification, or solved first by data trustworthiness?

Back to $OPG : every time the data node performs a trusted query and goes through OPG settlement, it’s a continuous need, not a one-time expense. If DeFi protocols start using OpenGradient as their data layer, the slope of that demand curve will be completely different in magnitude from what OpenGradient Chat currently brings.

I’m watching this signal. Until it appears, I’m not going to pretend I’ve already figured everything out. #opg $OPG