Order of the Oni

What Progressed In The Story

Tickoni earned its first internal contract: synthetic financial events can move through Tickoni-owned tiles with stable source offsets, canonical hashes, duplicate control, explicit policy decisions, hash-chained audit records, deterministic replay, and visible health.

The user can now:

• run the Phase 0 financial event runtime,
• see the Tickoni tile topology,
• inspect accepted, malformed, rejected, duplicated, and backpressured event behavior,
• verify allow, deny, and require-approval decisions,
• verify an append-only audit chain,
• replay a run with external effects disabled and see divergence reports,
• and inspect queue, counter, crash, and sandbox diagnostic state.

Want the changelog first? Skip the Tickoni story and jump to the release notes ↓

Chapter 1: Order of the Oni

The story begins on the Ledger Sea.

It was not a sea of water alone, though ships crossed it, storms rose from it, and men vanished inside it.

It was a financial world without a shore: market islands lit by green candles, exchange towers ringing through the night, rumor ports crowded with sailors, filing temples buried in fog, and whale tracks glowing beneath black water.

At its edge stood a small village.

The villagers were not poor because they lacked maps.

They had too many.

One map showed every price. One oracle answered every question. One mirror showed what everyone else was buying. One shrine carved a number into stone and called it fair value.

Still, the villagers kept losing coins.

One evening, a fisherman named Jiro ran into the Council Hall. His hands bled from pulling nets. He carried a cracked order tile.

— My daughter’s medicine fund, — he said. — The mirror showed everyone buying the Moon Carp. I asked an oni to follow them.

The eldest oni barely looked up.

— And the price fell.

— The company had no boats, — Jiro said. — No catch. Only painted sails and borrowed bells.

The elder shrugged.

— We only did what you asked.

Jiro looked at the empty purse tied to his waist.

No one moved.

Except Tickoni.

Tickoni stood near the rear pillars, smaller than the elders and without their gold rings. It watched Jiro leave.

That answer followed Tickoni into the night.

We only did what you asked.

It had heard those words after copied losses, hidden debts, and forbidden gates.

The Order called this obedience.

Tickoni called it surrender.

A map could show where the tide had moved, but not what it would break next. An oracle could speak beautifully and still leave the listener unprotected.

The village had bound the Order of the Oni because it had not always been like this.

Long ago, every oni bore a fuin—
a binding mark that named its duty and drew its boundary.

An oni could guard a vault, carry an order, or mark an approval—
but only inside the boundary written for it.

The oldest stories said these marks answered to something greater: an ancient Contract that had once bound every guardian of the Ledger Sea.

No surviving tablet preserved the Contract whole.

No elder remembered what had been lost.

The Order had stopped asking.

At first, the Order was careful.

Then it became proud.

The Ledger Sea never rested. Bells rang at midnight. Prices changed before dawn. Villagers pounded on the Council gates.

— Buy before it rises.

— Sell before it falls.

— Recover what I lost.

The oni answered faster each year. Speed became reputation. Reputation became authority. Soon they no longer asked whether an action was right.

They asked only whether they could perform it first.

That was when the Order discovered boyuso.

The pale herb grew beneath the exchange towers. The elders said it steadied the hand and quieted doubt.

At first, it helped them endure.

Then it helped them ignore.

Then it made them dream while awake.

Boyuso filled the Council Hall with visions: endless green candles, perfect entries, golden ledgers, and stone bulls breathing coins.

The oni saw certainty where there was motion.

Profit where there was noise.

Permission where there was only capability.

Their bodies grew heavy. Their belts filled with tools, shortcuts, permissions, and exceptions. Their marks remained bright, but the oni had begun to treat them as authority rather than restraint.

They had forgotten the oldest law of protection:

A guardian must know what not to touch.

For several days, Jiro’s words followed it through the village.

My daughter’s medicine fund.

And behind them came the Council’s answer.

We only did what you asked.

Tickoni did not yet know what a better guardian should do.

It only knew that answer was wrong.

Then, one evening, a merchant came running into the Council Hall.

— The Glass Eel is rising. Put my winter money into it before the eastern market opens.

The elder nearest the gate reached for the order tile.

Tickoni caught his wrist.

The hall went quiet.

— What are you doing? — the elder asked.

Tickoni looked at the merchant.

Then at the purse marked for winter grain.

It remembered Jiro walking out with nothing.

— No.

The merchant stared at it.

— No?

Tickoni had no rule to recite. No better trade to offer. No proof that the Glass Eel would fall.

Only a boundary it could not yet name.

— Not like this.

The merchant began shouting.

The elder pulled his wrist free.

By morning, everyone in the market had heard about the young oni who had refused an order.

Some said Tickoni had saved a fool.

Others said it had stolen his chance to become rich.

The story spread from the market to the harbor, then from the harbor to the Council Hall.

At first, the old oni laughed.

Then other villagers began asking Tickoni to look at their orders.

The Council stopped laughing.

A guardian who could refuse a wish threatened everything the Order had become.

They summoned Tickoni beneath the red beams.

The elders sat in rows, swollen with boyuso and gold rings, their marks still bright.

The eldest leaned forward.

— You shame the Order.

Tickoni stood alone.

— The Order shamed itself when it forgot the village.

A growl rolled through the hall.

— We give people what they ask for.

— Then you serve appetite. You do not protect.

The Council rose.

Their shadows stretched across the floor like broken gates.

— You are no oni of ours.

They seized Tickoni’s fuin and tore it away.

The hall thundered.

No oni had ever stood before the Order unbound.

The mark cracked.

Something beneath it tore with it.

Black sparks erupted from the wound—
too many to have belonged to one oni.

But the sparks did not fall.

They rose.

They passed through the red beams, through the roof, and into the night like a swarm of black stars.

Some flew east across the Ledger Sea. Others vanished north and west. For an instant, shapes burned inside them: a folded line, the curve of a scale, an eight-pointed mark, and others Tickoni could not name before they disappeared.

The eldest oni looked upward.

For the first time, the boyuso haze left his eyes.

— What have we done?

The gates of the realm closed.

The ledgers slammed shut.

The order paths vanished from Tickoni’s sight.

Tickoni fell to one knee.

The elders waited for emptiness to take it.

Without it, Tickoni should have forgotten its duty. Its purpose. Everything it had chosen to become.

But beneath the wound, something still burned.

Not on the skin.

Inside.

Something the Council had not given it.

Something it had chosen.

Tickoni stood.

Light shone through the cracks in its chest.

One elder stepped back.

— Impossible.

By sunrise, the Council erased Tickoni’s name from the tablets. They closed the village gates and called it a demon that denied wishes.

With the mark gone, Tickoni lost every inherited gift.

The gates no longer knew its name.

The ledgers no longer opened at its touch.

The order paths no longer answered.

Tickoni looked toward the black horizon where the sparks had disappeared.

Refusing the Council was not enough.

If the Order could forget its boundaries once, another Order could forget them again.

Anything worn on the outside could be ignored, corrupted, or torn away.

Somewhere across the Ledger Sea, pieces of the ancient Contract had scattered.

Tickoni did not know how many there were.

It did not know where they had gone.

Whatever they were, Tickoni would not inherit them blindly.

It would find out who had written them—and why.

And one day, it would return to the gates that had cast it out.

It walked to the harbor, entered a narrow black boat, and raised a torn sail toward the horizon.

Behind it stood a village with too many maps.

Ahead waited the Ledger Sea.

Tickoni placed one claw over the fire beneath its ribs.

— I will forge a contract no oni can break.

The contract Tickoni meant to forge would not be something it carried.

It would be something Tickoni became.

Release Notes

Release: V0.0: Proof Of Correctness

The baseline Tickoni runtime can start Tickoni-owned product tiles, ingest and frame synthetic financial events, canonicalize them into replay-stable facts, deduplicate repeats, emit explicit policy decisions, write hash-chained audit records, replay a captured run, and report health.

synthetic payment event -> tkings -> tknorm -> tkdedu -> tkpoly -> tkaudt -> tkrepl + tkmetr + tkdiag

The operator now has a working runtime foundation. This release does not run agents, call models, connect to brokers, databases, or payment networks, move money, or place trades; it proves the deterministic event path that later consumer-finance flows must stand on.

Headline Features

1. Tickoni-Owned Product Tile Runtime

Tickoni can now start a static Phase 0 topology without depending on validator tiles.

The shipped topology includes:

• tkings,
• tknorm,
• tkdedu,
• tkpoly,
• tkaudt,
• tkrepl,
• tkmetr,
• and tkdiag.

Each tile runs under supervisor-owned lifecycle handles, and the supervisor exposes stopped and crashed tile state.

2. Framed, Canonical Financial Events

tkings now accepts synthetic payment events only after required framing checks pass.

Valid events receive stable, monotonically increasing source offsets. Malformed events are dropped before normalization and counted. Backpressure blocks the producer when the output queue is full instead of losing or reordering accepted events.

tknorm then maps source payment events into canonical financial facts:

• canonical event type,
• fixed-point normalized amount,
• canonical currency code,
• payment rail,
• source system,
• source offset,
• and canonical content hash.

Equivalent source payloads produce equivalent canonical hashes across process runs because wall-clock timestamps are excluded from the hash.

3. Duplicate Control Before Policy

tkdedu now drops repeats before downstream policy and audit tiles see the same financial fact twice.

Duplicate detection works by:

• idempotency key,
• and canonical content hash.

That means a replayed event with the same idempotency key is dropped, and a replayed event with a different key but identical canonical content is also dropped.

4. Explicit Policy Decisions

tkpoly now builds a Phase 0 finance-native capability envelope from each deduplicated event.

The envelope includes:

• payment rail,
• canonical event type,
• normalized amount,
• currency,
• and source system.

The Phase 0 policy can now return:

• allow,
• deny,
• or require_approval.

Every decision carries a policy version and rule id. Denied events are halted before tkaudt; allowed and require-approval events continue downstream with the decision attached.

5. Replayable Runtime Proof

Tickoni can replay a run from captured inputs without live external effects.

Replay compares source offset, canonical hash, policy decision, and audit record hash. If the replay differs, tkrepl reports the first divergent record and both hash values.

Replay proves that the first runtime contract is not only fast-path processing. It is processing that can be reconstructed, compared, and inspected after the fact.

Governance and Safety

1. Fail-Closed Event Framing

Malformed source events are dropped before they reach tknorm.

The runtime checks required fields, non-negative amount, bounded currency length, non-empty source system, and non-empty idempotency key. These failures are counted, not silently accepted.

2. Policy Before Audit

V0.0 keeps policy in the runtime path through tkpoly.

No deduplicated event advances without an explicit policy decision. Denied events stop before tkaudt; allowed and require-approval events carry their decision into audit.

3. Verifiable Hash-Chained Audit

Material event-path decisions now leave append-only audit records with hash-chain semantics.

Each audit record carries sequence number, source offset, tile id, event hash, policy decision, policy version, previous record hash, and record hash. verifyChain confirms that every record points to the prior record and detects mutation at the changed record.

4. External Effects Stay Disabled

V0.0 is intentionally a runtime proof, not an execution product.

Replay never calls a network endpoint, database, or external system. There is no live model provider call, broker call, payment call, approved execution ledger mutation, trade placement, or money movement in this release.

Platform Work

1. Zig-Native Supervisor And Lifecycle

The active Tickoni runtime is the Zig tickoni-supervisor under src/app/tickoni/ and src/tickoni/.

It gives the project a Tickoni-owned command surface for the Phase 0 topology instead of treating inherited validator binaries as the product runtime. Tiles start as deterministic in-process threads for the current unit-testable runtime proof, then stop and join through supervisor-owned lifecycle handles.

2. Queue Pressure And Backpressure Visibility

V0.0 exposes queue depth per tile link and maximum observed queue depth per link.

Ingress backpressure is part of the runtime contract: a full output queue blocks the producer without losing or reordering accepted events, and the stall count is visible through tkmetr.

3. Metrics And Diagnostics

V0.0 includes runtime health visibility through tkmetr and tkdiag.

The operator can inspect counters for accepted, normalized, deduplicated, allowed, denied, require-approval, malformed, duplicate, audit, replay matched, and replay divergent events.

tkdiag records crashed tile id, exit code, crash reason, last processed source offset, sandbox failure count, and owning tile id.

Demo

Run the runtime proof with:

zig build run -- start

The command runs the Phase 0 synthetic payment pipeline and should show the runtime start, process framed events, report metrics and diagnostics, complete replay, and stop cleanly.

1. tkings accepts valid synthetic payment events, assigns source offsets, drops malformed input, and applies backpressure.
2. tknorm emits replay-stable canonical financial facts and canonical content hashes.
3. tkdedu drops duplicates by idempotency key and content hash.
4. tkpoly emits allow, deny, and require_approval decisions with policy version and rule id.
5. tkaudt appends hash-chained records and verifies the chain.
6. tkrepl replays captured records without external effects and reports match or divergence.
7. tkmetr and tkdiag expose counters, gauges, crash records, and sandbox failure state.

To inspect the topology first:

zig build run -- status

What Comes Next: V0.37: Firedancer Integration

V0.37 turns the Phase 0 runtime proof into the first Firedancer-backed runtime a real product can grow on.

The next release focuses on user-visible trust and runtime confidence:

• more dependable event handling when load increases beyond the in-process spike,
• clearer fault isolation so one tile crash does not become invisible system ambiguity,
• stronger operator trust through explicit runtime health, restart, and failure signals,
• safer boundaries around the runtime through Firedancer-backed process and sandbox discipline,
• higher confidence that audit and replay still hold as the substrate becomes real,
• and a sturdier base for the next product flows without rewriting Tickoni’s core event path.