papers/defense/hanzo-agentic-ai.tex

\documentclass[11pt,letterpaper]{article}
\usepackage{hanzo-defense}

\doctitle{Agentic AI for Autonomous Cyber Operations\\and Multi-Domain Intelligence Fusion}
\docid{HAI-2026-008}
\docversion{Version 1.0 --- February 21, 2026}
\docdate{February 2026}
\docauthors{Hanzo AI Research --- Hanzo Team}
\docorgs{Hanzo Industries\\[email protected]}

\begin{document}
\makecover

\begin{abstract}
We present an agentic AI framework comprising 83 specialized agents and 15 multi-agent orchestrators for autonomous cyber operations, intelligence fusion, and tactical decision support. The framework operates across three tiers: (1) a Playground control plane providing Kubernetes-like orchestration for autonomous AI agents with W3C DID identity, verifiable credentials, and durable state; (2) an agent SDK with async-first execution, OpenAI-compatible APIs, and native Model Context Protocol (MCP) integration exposing 13 canonical tools; and (3) a ZAP-based consensus protocol enabling distributed agent voting with threshold agreement and post-quantum authentication. Agents execute 200--300 sequential tool calls for deep analysis, coordinate via zero-copy binary RPC at 4.2M calls/second, and operate fully disconnected on edge hardware using quantized Zen models (0.8B--27B parameters). The system supports automated red/blue team operations, vulnerability chain analysis, multi-source intelligence correlation, and course-of-action generation with explainable reasoning via chain-of-thought traces. A multi-channel bot platform unifies 20+ messaging channels under local-first privacy controls for secure operator interaction.
\end{abstract}

\paragraph{Executive Summary.}
This framework lets a team field a fleet of AI agents that investigate, defend, and analyze on their own---running on a laptop or a rugged edge device with no connection to the cloud. It is built for cyber-operations teams and intelligence analysts who must act at machine speed and cannot afford to ship sensitive data to an outside service. Every agent action is cryptographically signed, so there is a complete, tamper-proof record of what each agent did and why; and high-stakes calls require several independent agents to agree before anything is recommended, which guards against a single model's mistake. Operationally, this means continuous vulnerability hunting, automated red/blue exercises, and fused multi-source intelligence with a human always in the loop for final decisions---all owned and run by the operator, not rented from a remote provider. The result is autonomous capability without surrendering control, accountability, or the data itself.

\tableofcontents
\newpage

% ============================================================================
\section{Introduction}
% ============================================================================

Modern naval operations generate intelligence from sensors, communications, cyber systems, and open sources at volumes exceeding human analytical capacity. Simultaneously, the cyber domain requires continuous vulnerability assessment, threat hunting, and incident response at machine speed. Traditional automation---rule-based scripts and playbooks---cannot adapt to novel threats or fuse information across domains.

Agentic AI addresses these challenges through autonomous agents that reason, plan, use tools, and collaborate. Unlike chatbots that respond to queries, agents take initiative: they decompose complex tasks, execute multi-step plans, invoke external tools, and coordinate with other agents to produce actionable intelligence.

\subsection{Design Principles}

\begin{enumerate}
\item \textbf{Autonomous but accountable}: Every agent action is signed with a W3C DID and produces a verifiable credential. Full audit trail, zero deniability.
\item \textbf{Disconnected-capable}: Agents run entirely on edge hardware with local models. No cloud dependency.
\item \textbf{Consensus-validated}: High-consequence decisions require threshold agreement among multiple agents, preventing single-agent hallucination.
\item \textbf{Tool-native}: Agents interact with systems through 13 canonical MCP tools, not bespoke integrations.
\end{enumerate}

\subsection{Strategic Context}

This agent framework is one layer of an integrated stack built by Hanzo, an American applied-AI lab founded in 2014 (Techstars '17) whose founder works at the frontier of both AI/ML and cryptography. American frontier AI has consolidated into a closed monoculture---effectively two labs---while the only openly available frontier model weights today are largely foreign. Hanzo is the American open-source frontier alternative: it owns both the model (the Zen family, 0.8B--1T+ parameters, with owned weights) and the cryptography (a production post-quantum stack), so defense and regulated users get sovereign, open, auditable AI without renting from the closed duopoly or depending on foreign open weights. For autonomous cyber and intelligence work that requirement is acute---the agents here reason over the most sensitive data an organization holds, so the model performing that reasoning must be one the operator can own, inspect, and run disconnected, on their own hardware, where the data already lives. The same agentic stack is what makes this practical at scale: Hanzo used it to deliver a FINRA/SEC-approved, SOC2-compliant securities platform to production---a full ATS/BD/TA stack consolidated from 200+ microservices into 3 compiled binaries, in record time, with a small team---demonstrating that agent-driven engineering meets the bar of a heavily regulated, audited domain.

% ============================================================================
\section{Agent Architecture}
% ============================================================================

\subsection{Specialization Taxonomy}

\begin{table}[H]
\centering
\small
\begin{tabular}{@{}lrp{5.5cm}@{}}
\toprule
\textbf{Domain} & \textbf{Count} & \textbf{Capabilities} \\
\midrule
Security & 12 & Vulnerability assessment, pen testing, incident response, malware analysis, SIEM correlation \\
Infrastructure & 11 & K8s operations, network diagnostics, database administration, cloud provisioning \\
Data/ML & 10 & Data engineering, ML pipelines, model evaluation, feature engineering, dataset curation \\
Languages & 15 & Rust, Go, Python, TypeScript, C++, Java, Solidity, and 8 more \\
Architecture & 8 & System design, API design, microservices, distributed systems \\
QA/Testing & 7 & Unit testing, integration testing, load testing, security testing \\
Domain & 20 & Blockchain, DeFi, cryptography, NLP, computer vision, signal processing \\
\bottomrule
\end{tabular}
\caption{83 specialized agents by domain.}
\label{tab:agent-taxonomy}
\end{table}

\subsection{Multi-Agent Orchestrators}

\begin{table}[H]
\centering
\small
\begin{tabular}{@{}lp{6cm}@{}}
\toprule
\textbf{Orchestrator} & \textbf{Workflow} \\
\midrule
Security Hardening & Red agent attacks $\to$ blue agent defends $\to$ red re-tests fixes \\
Incident Response & Triage $\to$ containment $\to$ eradication $\to$ recovery $\to$ lessons \\
ML Pipeline & Data prep $\to$ training $\to$ evaluation $\to$ deployment $\to$ monitoring \\
Full-Stack Dev & Architecture $\to$ backend $\to$ frontend $\to$ testing $\to$ deployment \\
Intelligence Fusion & Collection $\to$ processing $\to$ analysis $\to$ dissemination \\
\bottomrule
\end{tabular}
\caption{Selected multi-agent orchestrators (5 of 15).}
\label{tab:orchestrators}
\end{table}

\subsection{Agent Execution Model}

\begin{algorithm}[H]
\caption{Agent Task Execution}
\begin{algorithmic}[1]
\State \textbf{Input}: Task description $T$, available tools $\mathcal{F}$, context $C$
\State \textbf{Initialize}: Agent identity (DID), model (Zen), memory store
\Repeat
  \State Reason about current state and remaining subtasks
  \State Select tool $f \in \mathcal{F}$ and generate arguments
  \State Execute tool: $r \gets f(\text{args})$
  \State Sign action: $\sigma \gets \text{ML-DSA-65.Sign}(\text{sk}, T \| f \| r)$
  \State Update memory with observation $r$
  \State Append to audit trail: $(T, f, r, \sigma, \text{timestamp})$
\Until{task complete or max steps reached (200--300 calls)}
\State \Return (result, audit\_trail, verifiable\_credential)
\end{algorithmic}
\end{algorithm}

% ============================================================================
\section{Playground: Agent Control Plane}
% ============================================================================

\subsection{Architecture}

Playground provides Kubernetes-like orchestration for autonomous AI agents:

\begin{itemize}
\item \textbf{Registration}: Agents register with capabilities, DID, and stake weight.
\item \textbf{Discovery}: Other agents and services discover registered agents by capability.
\item \textbf{Scheduling}: Tasks dispatched to agents based on capability match and availability.
\item \textbf{Durable state}: Built-in persistent state and vector search (no external Redis or vector DB).
\item \textbf{Lifecycle}: Health monitoring, graceful shutdown, automatic restart.
\end{itemize}

\subsection{Identity and Accountability}

Every agent in Playground possesses:

\begin{itemize}
\item \textbf{W3C DID}: Decentralized identifier derived from ML-DSA-65 public key (\texttt{did:key:z6Mk...}).
\item \textbf{Verifiable Credentials}: Every action produces a DID-signed VC as a tamper-proof receipt.
\item \textbf{Capability assertions}: Agent advertises what it can do; Playground verifies via credential chain.
\item \textbf{Policy boundaries}: ``Only agents with \texttt{security} credential can access vulnerability tools'' --- enforced at infrastructure level, not application level.
\end{itemize}

\subsection{Performance}

\begin{table}[H]
\centering
\begin{tabular}{@{}lrr@{}}
\toprule
\textbf{Runtime} & \textbf{Throughput} & \textbf{Overhead/Handler} \\
\midrule
Go & 8.2M req/s & 280 B \\
Python & 6.7M req/s & 512 B \\
TypeScript & 4.0M req/s & 384 B \\
\bottomrule
\end{tabular}
\caption{Playground control plane performance.}
\label{tab:playground-perf}
\end{table}

% ============================================================================
\section{Model Context Protocol Integration}
% ============================================================================

\subsection{13 Canonical Tools}

Agents interact with systems through the Model Context Protocol (MCP), providing a standardized tool interface:

\begin{table}[H]
\centering
\small
\begin{tabular}{@{}llp{4.5cm}@{}}
\toprule
\textbf{Tool} & \textbf{Type} & \textbf{Capability} \\
\midrule
\texttt{fs} & Core & File system operations (read, write, search) \\
\texttt{exec} & Core & Shell command execution (sandboxed) \\
\texttt{code} & Core & AST analysis, symbol search, refactoring \\
\texttt{git} & Core & Version control operations \\
\texttt{fetch} & Core & HTTP requests, API calls \\
\texttt{workspace} & Core & Project context management \\
\texttt{ui} & Core & User interface interaction \\
\texttt{think} & Optional & Internal reasoning steps \\
\texttt{memory} & Optional & Persistent memory across sessions \\
\texttt{hanzo} & Optional & Platform API (IAM, KMS, PaaS) \\
\texttt{plan} & Optional & Task decomposition and planning \\
\texttt{tasks} & Optional & Task tracking and progress \\
\texttt{mode} & Optional & Execution mode control \\
\bottomrule
\end{tabular}
\caption{MCP canonical tool set (HIP-0300).}
\label{tab:mcp-tools}
\end{table}

\subsection{MCP-ZAP Bridge}

The ZAP bridge provides 10--30$\times$ performance improvement over native MCP JSON-RPC:

\begin{itemize}
\item \textbf{Binary encoding}: Tool name (64~B fixed), arguments (length-prefixed JSON), result (zero-copy bytes).
\item \textbf{Message types}: ToolList (100), ToolCall (101), ToolResult (102).
\item \textbf{Auto-discovery}: Bridge queries MCP server capabilities and exposes via ZAP.
\item \textbf{20-server aggregation}: Single ZAP endpoint fronts 20+ MCP servers with prefix namespacing.
\end{itemize}

\subsection{Search Strategy}

MCP implements multi-strategy code and data search:

\begin{table}[H]
\centering
\begin{tabular}{@{}lrlp{3.5cm}@{}}
\toprule
\textbf{Strategy} & \textbf{Priority} & \textbf{Engine} & \textbf{Triggers} \\
\midrule
Symbol & 10 & TreeSitter AST & \texttt{class}, \texttt{function}, \texttt{def} \\
AST & 20 & TreeSitter & Code-like patterns \\
Vector & 30 & LanceDB & Natural language queries \\
Text & 40 & Ripgrep & Default fallback \\
File & 50 & Glob & Paths, extensions \\
\bottomrule
\end{tabular}
\caption{MCP multi-strategy search with priority dispatch.}
\label{tab:search-strategy}
\end{table}

% ============================================================================
\section{Distributed Agent Consensus}
% ============================================================================

\subsection{Threshold Voting Protocol}

For high-consequence decisions, multiple agents must independently reach the same conclusion:

\begin{algorithm}[H]
\caption{Agent Consensus for Threat Classification}
\begin{algorithmic}[1]
\State \textbf{Coordinator} broadcasts sensor data $D$ to $n$ analyst agents
\For{each agent $A_i$ in parallel}
  \State $A_i$ independently analyzes $D$ using assigned model
  \State $A_i$ produces classification $C_i$ with confidence $p_i$
  \State $A_i$ signs: $\sigma_i \gets \text{ML-DSA-65.Sign}(\text{sk}_i, D \| C_i \| p_i)$
  \State $A_i$ returns $(C_i, p_i, \sigma_i, \text{DID}_i, \text{stake}_i)$
\EndFor
\State Verify all signatures against registered DIDs
\State Compute weighted consensus: $\hat{C} = \arg\max_c \sum_{i: C_i = c} \text{stake}_i$
\If{$\sum_{i: C_i = \hat{C}} \text{stake}_i \geq \frac{2}{3} \sum_i \text{stake}_i$}
  \State \Return (CONSENSUS, $\hat{C}$, aggregated evidence)
\Else
  \State \Return (NO\_CONSENSUS, all $(C_i, p_i)$, escalate to human)
\EndIf
\end{algorithmic}
\end{algorithm}

\subsection{Defense Applications}

\begin{itemize}
\item \textbf{Threat classification}: 3+ agents independently assess sensor contact; consensus prevents single-model hallucination from triggering false alarms.
\item \textbf{Targeting}: Distributed analysis with $\frac{2}{3}$ threshold before engagement recommendation. Human remains in loop for final decision.
\item \textbf{Intelligence corroboration}: Agents processing different SIGINT, IMINT, and OSINT sources; consensus identifies corroborated vs.\ single-source intelligence.
\item \textbf{Cyber attribution}: Multiple agents analyze malware, network indicators, and TTPs independently; consensus reduces false attribution risk.
\end{itemize}

% ============================================================================
\section{Autonomous Cyber Operations}
% ============================================================================

\subsection{Defensive Cyber Operations (DCO)}

\subsubsection{Continuous Vulnerability Assessment}

\begin{enumerate}
\item Security agent scans codebase using MCP \texttt{code} tool (AST analysis, dependency audit).
\item Agent identifies vulnerability class (injection, XSS, auth bypass, crypto weakness).
\item Agent generates proof-of-concept exploit via \texttt{exec} tool (sandboxed).
\item Agent proposes fix, generates test case, and validates fix eliminates vulnerability.
\item Full workflow signed and recorded as verifiable credential.
\end{enumerate}

\subsubsection{Threat Hunting}

\begin{enumerate}
\item O11y anomaly detection triggers agent investigation.
\item Agent queries distributed traces via MCP \texttt{fetch} tool.
\item Agent correlates indicators across logs, metrics, and traces.
\item Agent classifies threat using MITRE ATT\&CK framework.
\item Multi-agent consensus validates classification before alert.
\end{enumerate}

\subsubsection{Incident Response Orchestrator}

The 5-phase incident response orchestrator coordinates specialized agents:

\begin{table}[H]
\centering
\begin{tabular}{@{}llp{5cm}@{}}
\toprule
\textbf{Phase} & \textbf{Agent} & \textbf{Actions} \\
\midrule
Triage & Security analyst & Severity assessment, scope determination \\
Contain & Infrastructure & Network isolation, credential rotation \\
Eradicate & Malware analyst & Root cause removal, persistence check \\
Recover & DevOps & Service restoration, integrity verification \\
Lessons & Architecture & Post-incident report, control improvement \\
\bottomrule
\end{tabular}
\caption{Incident response orchestrator phases.}
\label{tab:ir-phases}
\end{table}

\subsection{Offensive Cyber Operations (OCO)}

\subsubsection{Automated Penetration Testing}

\begin{enumerate}
\item Reconnaissance agent maps attack surface via MCP \texttt{fetch} and \texttt{exec} tools.
\item Vulnerability agent identifies exploitable weaknesses in discovered services.
\item Exploitation agent chains vulnerabilities into attack paths.
\item Lateral movement agent assesses post-exploitation pivot opportunities.
\item Reporting agent produces findings with severity, evidence, and remediation.
\item \textbf{Operator identity}: Ring signatures (LatticeLSAG) protect pen tester identity during operations.
\end{enumerate}

\subsubsection{Red/Blue Team Automation}

Adversarial pairs operate in continuous cycles:

\begin{algorithm}[H]
\caption{Red/Blue Agent Cycle}
\begin{algorithmic}[1]
\Repeat
  \State \textbf{Red agent} identifies attack vector
  \State \textbf{Red agent} develops and executes exploit (sandboxed)
  \State \textbf{Blue agent} receives attack indicators
  \State \textbf{Blue agent} develops detection rule and mitigation
  \State \textbf{Red agent} adapts attack to evade new detection
  \State \textbf{Blue agent} refines defense based on adapted attack
  \State Record cycle results as verifiable credentials
\Until{convergence (red cannot bypass blue) or max iterations}
\State \Return (attack report, defense posture, residual risk)
\end{algorithmic}
\end{algorithm}

% ============================================================================
\section{Intelligence Fusion}
% ============================================================================

\subsection{Multi-Source Correlation}

Agents process intelligence from heterogeneous sources:

\begin{table}[H]
\centering
\begin{tabular}{@{}llp{4.5cm}@{}}
\toprule
\textbf{INT Type} & \textbf{Agent Capability} & \textbf{MCP Tools Used} \\
\midrule
SIGINT & NLP agent with 32+ language support & \texttt{code} (pattern matching), \texttt{fetch} \\
IMINT & Vision-language model (Zen VL) & \texttt{fs} (image access), \texttt{code} (analysis) \\
OSINT & Web search and document exploitation & \texttt{fetch} (HTTP), \texttt{fs} (documents) \\
CYBER & Network traffic analysis, malware RE & \texttt{exec} (tools), \texttt{code} (analysis) \\
HUMINT & Report processing and entity extraction & \texttt{code} (NER), \texttt{memory} (context) \\
\bottomrule
\end{tabular}
\caption{Intelligence source processing by agent type.}
\label{tab:intel-sources}
\end{table}

\subsection{Graph-Based Fusion}

The GraphVM provides in-memory graph analytics for intelligence correlation:

\begin{itemize}
\item \textbf{Entity resolution}: Link entities across SIGINT, IMINT, and OSINT sources.
\item \textbf{Network analysis}: Identify communication patterns, social networks, and organizational hierarchies.
\item \textbf{Temporal analysis}: Track entity behavior changes over time.
\item \textbf{Geospatial correlation}: Associate entities with locations from multiple sources.
\item \textbf{Merkle-verified}: Graph state is Merkle-proofed for integrity verification.
\end{itemize}

% ============================================================================
\section{Multi-Channel Operator Interface}
% ============================================================================

\subsection{OpenClaw Bot Platform}

OpenClaw provides a privacy-first, local-first multi-channel AI assistant:

\begin{itemize}
\item \textbf{20+ messaging channels}: WhatsApp, Telegram, Slack, Discord, Signal, Matrix, iMessage, and more.
\item \textbf{Local-first}: All processing on operator's device. No cloud routing of messages.
\item \textbf{Gateway control plane}: WebSocket-based session management, channel routing, tool dispatch.
\item \textbf{Policy enforcement}: DM pairing, group routing rules, channel allowlists, mention gating.
\item \textbf{Voice interface}: Wake word activation, Talk Mode (macOS/iOS/Android).
\item \textbf{Skills platform}: Bundled, managed, and workspace-specific skill sets.
\end{itemize}

\subsection{Defense Application}

\begin{itemize}
\item Operators interact with AI agents via their preferred secure messaging app (Signal, Matrix).
\item Agent responses routed through local gateway---never traverses external servers.
\item Multi-channel unification: single AI assistant across all communication platforms.
\item Group messaging with policy-enforced access controls per channel.
\end{itemize}

% ============================================================================
\section{Explainable AI and Transparency}
% ============================================================================

\subsection{Chain-of-Thought as Explainability}

Zen models with extended reasoning (96--128K thinking tokens) provide inherent explainability:

\begin{itemize}
\item \textbf{Reasoning traces}: Every conclusion preceded by visible reasoning steps.
\item \textbf{Heavy Mode}: 8 parallel reasoning trajectories with explicit comparison.
\item \textbf{Tool call logging}: Every external tool invocation recorded with inputs and outputs.
\item \textbf{Memory traces}: Agent's retrieval of relevant context from vector memory is logged.
\end{itemize}

\subsection{Verifiable Decision Records}

\begin{itemize}
\item Every agent decision produces a verifiable credential (W3C VC).
\item Credential contains: task, reasoning trace, tool calls, result, DID signature.
\item Credentials form an immutable chain anchored to blockchain.
\item Post-operation review can replay exact decision process.
\end{itemize}

\subsection{Adaptability via LoRA}

\begin{itemize}
\item Mission-specific LoRA adapters fine-tune agent behavior without full model retraining.
\item Adapters swappable at runtime: switch from SIGINT to IMINT analysis in seconds.
\item Quantized base model (4-bit) + unquantized adapter layers = edge-deployable specialization.
\end{itemize}

% ============================================================================
\section{Reinforcement Learning from Operations}
% ============================================================================

\subsection{Operational Feedback Loop}

Agent performance improves through operational feedback:

\begin{enumerate}
\item Agent executes task and produces result with confidence score.
\item Human operator validates or corrects result (accept/reject/modify).
\item Feedback recorded as preference pair: (agent output, human correction).
\item Preference pairs used for LoRA fine-tuning via RLHF/DPO.
\item Updated adapter deployed to operational agents.
\end{enumerate}

\subsection{Multi-Agent Learning}

\begin{itemize}
\item \textbf{DeltaSoup}: Byzantine-robust aggregation of LoRA updates from multiple agents.
\item \textbf{Contributor reputation}: Agents that produce higher-quality outputs gain reputation weight.
\item \textbf{Differential privacy}: Individual training contributions protected from extraction.
\item \textbf{GT-QLoRA}: Gate-Targeted LoRA for Mixture-of-Experts adaptation without full model access.
\end{itemize}

% ============================================================================
\section{Edge Deployment}
% ============================================================================

\subsection{Disconnected Agent Operation}

\begin{table}[H]
\centering
\begin{tabular}{@{}llll@{}}
\toprule
\textbf{Platform} & \textbf{Model} & \textbf{Agents} & \textbf{Capability} \\
\midrule
MacBook M4 & zen4-pro (27B) & 5--10 & Full reasoning, OCR \\
Jetson Orin & zen4 (9B) & 3--5 & Tactical analysis \\
Raspberry Pi 5 & zen4-nano (0.8B) & 1--2 & Basic classification \\
Server (A100) & zen4-ultra (1T) & 20+ & Frontier reasoning \\
\bottomrule
\end{tabular}
\caption{Edge deployment configurations.}
\label{tab:edge-deploy}
\end{table}

\subsection{Agent Mesh over RNS}

Agents on disconnected nodes coordinate via RNS mesh:

\begin{itemize}
\item Each node runs local agents with local models.
\item Agent consensus messages traverse RNS mesh (LoRa, packet radio, serial).
\item ZAP binary protocol minimizes bandwidth (256~B per call vs.\ 2,826~B JSON-RPC).
\item Store-and-forward ensures eventual consensus delivery.
\item Hybrid PQ handshake protects all agent communication.
\end{itemize}

% ============================================================================
\section{AR/VR Integration}
% ============================================================================

\subsection{Vision-Language Models as AR Engine}

Zen VL models provide real-time scene understanding for augmented reality overlays:

\begin{itemize}
\item \textbf{Object detection}: Identify and classify objects in camera feed.
\item \textbf{Spatial reasoning}: Determine object positions, distances, and relationships.
\item \textbf{OCR}: Extract text from signage, documents, and displays in 32 languages.
\item \textbf{Temporal tracking}: Video comprehension for activity detection and tracking.
\end{itemize}

\subsection{Mission Rehearsal in VR}

\begin{itemize}
\item Digital twin environments (Netrunner) feed simulated scenarios to VR displays.
\item Babylon.js 3D rendering engine provides immersive visualization.
\item Agents provide real-time tactical analysis overlaid on VR environment.
\item Network conditions (DDIL, jamming) simulated for realistic rehearsal.
\end{itemize}

% ============================================================================
\section{Conclusion}
% ============================================================================

We have presented a comprehensive agentic AI framework providing autonomous cyber operations, multi-domain intelligence fusion, and tactical decision support. The combination of 83 specialized agents, Playground control plane with verifiable credentials, distributed consensus with threshold voting, and multi-channel operator interface provides a complete system for naval information warfare operations.

The framework's key differentiators---post-quantum agent identity, consensus-validated decisions, edge-deployable inference, and explainable reasoning---address the specific requirements of naval operations where accountability, disconnected operation, and trust are paramount.

% ============================================================================
\begin{thebibliography}{18}

\bibitem{mcp} Anthropic, ``Model Context Protocol Specification,'' 2024.

\bibitem{w3cdid} W3C, ``Decentralized Identifiers (DIDs) v1.0,'' 2022.

\bibitem{w3cvc} W3C, ``Verifiable Credentials Data Model v2.0,'' 2024.

\bibitem{fips204} NIST, ``ML-DSA Standard,'' FIPS 204, 2024.

\bibitem{mitre} MITRE, ``ATT\&CK Framework,'' 2024.

\bibitem{lora} E. Hu \etal, ``LoRA: Low-Rank Adaptation,'' ICLR 2022.

\bibitem{dpo} R. Rafailov \etal, ``Direct Preference Optimization,'' NeurIPS 2023.

\bibitem{rlhf} L. Ouyang \etal, ``Training Language Models to Follow Instructions with Human Feedback,'' NeurIPS 2022.

\bibitem{flashattn} T. Dao \etal, ``FlashAttention-2,'' ICLR 2024.

\bibitem{zap} Hanzo Team, ``ZAP: Zero-Copy Application Protocol,'' 2026.

\bibitem{quasar} Hanzo Team, ``Quasar Consensus,'' Hanzo, 2025.

\bibitem{corona} ``Two-Round Threshold Signature from LWE,'' IACR ePrint 2024/1113.

\bibitem{zen} Zen LM, ``Zen Model Family Technical Report,'' 2026.

\bibitem{lancedb} LanceDB, ``LanceDB: Serverless Vector Database,'' 2024.

\bibitem{treesitter} M. Brunsfeld, ``Tree-sitter: Incremental Parsing System,'' 2018.

\bibitem{otel} OpenTelemetry, ``Observability Framework,'' CNCF, 2024.

\end{thebibliography}

\section*{Reproducibility}
\textbf{Source code.} \texttt{github.com/hanzoai/agents} (commit \texttt{TBD}).\\
\textbf{Build.} \texttt{pnpm install \&\& pnpm build} (Node 20+); SDK via \texttt{uv sync}.\\
\textbf{Hardware tested.} Apple M-series, x86\_64 Linux + NVIDIA A100/H100.\\
\textbf{Standards referenced.} W3C DID, OpenAI tool-use API, MCP, OpenTelemetry.\\
\textbf{Contact.} [email protected].

\end{document}