Tenet — one deliberate moment
Guardrails a trader writes for herself: rules authored after the close become reversible friction at order-send, inside the fictional brokers Dart (mobile, 0DTE options) and Meridian (desktop, equities), backed by one shared Record.
The problemRetail apps can remove reflection through stimulation: streaks, confetti, one-tap re-entry. Workstations remove it through efficiency: hotkeys, dense ladders, sub-second tickets. After a losing sequence both arrive at an order sent before the trader has decided.
The boundaryFriction, never a block. Tenet never sends an order automatically and never locks a trader out; waiting, reducing, editing, overriding, and canceling stay available. Overrides are recorded as context, not moral failure.
StatusFunctional prototype · not shipped The rules, intervention state machines, cross-surface sync, and Record are fully functional. Brokers, quotes, fills, and history are simulated; no user study has been completed.
HOW TO READ THIS PAGE — FUNCTIONAL works in the linked prototypes · SIMULATED illustrative prototype data · PROPOSED a plan, never a result. Dart and Meridian are fictional brokers; quotes, fills, and trading history are simulated and labeled as such in the interface. The broker SDK and import/analysis pipeline are future work — described, not represented as complete. Every image below is captured directly from the working prototype; the prototypes themselves are linked from each section.
TRY THE PROTOTYPEREAL BUILD · SIMULATED MARKET
SANDBOXED EMBED · SEND AN ORDER AND YOUR RULE STEPS IN: NOTHING SENDS, EVERY PATH REVERSIBLE · SIMULATED DATA
Fully interactive version ships with the deployed site (v2/tenet-proto/).
Small screen: the workstation demo needs room. Use OPEN FULL PROTOTYPE ↗ above.
THE SHAPE OF THE PROJECTHONEST NUMBERS ONLY
3
WORKING SURFACES · TWO HOSTS + ONE COMPANION
4
STAGED SCENARIOS IN THE HOST DEMO, ALL INTERACTIVE
0
USER STUDIES COMPLETED · FIRST STUDY PLANNED BELOW
01 · THE
PROBLEM
Two interfaces, one failure mode: the next order becomes automatic. A hypothesis, not a research finding. How might a trader's own rule interrupt the momentum without becoming a lock, a punishment, or a trading signal?
02 · SCOPE &
ETHICAL BOUNDARY
What Tenet never does: send an order automatically, or lock a trader out.
- What is simulated: Dart and Meridian are fictional; quotes, fills, and history are simulated and labeled. Broker integration and the import/analysis pipeline remain future work
- What Tenet is not: a broker, a trading journal, a signal generator, financial advice, or a promise of profitability. One narrow job: restore a single reflective moment at send
03 · SYSTEM
MODEL
One loop, closed after the close: Companion → rules → host check at send → reversible intervention → result + reason → Record → reflection. The ethics live in three asymmetries.
Stricter → immediate.
Tightening syncs to both hosts right away; you can raise your bar mid-day.
Looser → next open.
Loosening arms at the next open, so a rule can't be talked down in the moment it exists to interrupt.
Failure → fail open.
If the connection drops, trading proceeds; the gap is recorded in plain view.
04 · ONE RULE SET,
TWO KINDS OF SPEED
The central call was that Dart and Meridian shouldn't be responsive versions of one interface. The same rule arrives in each broker wearing that broker's own language.
THE COOLDOWN,
HELD HONESTLY
The cooldown holds the order — held, not queued to fire. When it ends the trader reviews a refreshed quote and sends or cancels. Meridian holds a revenge-sized 1,000-share short the same way, every fill labeled SIMULATED FILL.
MERIDIAN —
THE QUIET HOST
Tenet answers Meridian in the workstation's own register: a quiet header chip (4 rules · 3 apply here) and an Ink Blue panel at transmit. Chart, ladder, order context, and positions are never touched. A chart annotation marks it: 9:53 — your rule stepped in.
05 · THREE KEY
DESIGN DECISIONS
A · “Stepped in,” not “blocked.”
Earlier explorations said “blocked,” which misdescribed a reversible system and shifted authorship from trader to tool. The final copy is “Your rule stepped in.” Softer language deters less; the point is only that the trader decides.
B · Nothing sends by itself.
A cooldown that ends by sending would make Tenet an execution actor. So it returns to review; reduce, wait, override, and cancel are parallel paths, none the default. The extra confirmation costs time in fast markets, the price of the pause.
C · Evidence without false certainty.
“Tenet saved you $X” is a causal claim the system cannot support. Counts of interventions and outcomes lead; financial figures are demoted: EST until settled, sample-size language, fee/slippage exclusions. Hedged evidence persuades less; I traded weaker marketing for stronger trust.
06 · THE COMPANION —
RULES / PATTERNS / RECORD
In the after-close app, “What your rules did” leads with counts: 7× stepped in · 6× waited or trimmed · 1× continued past. Below them, estimated loss avoided $1,240 EST sits beside realized on overrides −$310 ACTUAL. Neither is money earned; both are labeled.
Open the live Companion → · Host + Companion, synchronized side by side →
07 · TRUST, FAILURE &
ACCESSIBILITY
Built to expect doubt:
- Trust & data. Tenet reads order tickets at send and fills after close, conceptually via an embedded broker SDK, never your screen or other accounts. In the proposed model, disconnecting stops rules from arming and deleting the account removes rules and Record
- Failure behavior. Failed sync surfaces an explicit retry. Connection loss fails open: trading proceeds and the gap shows in the Record (“feed lost 17 min · trading unaffected · logged”). Events are immutable; notes and error annotations attach alongside
- Accessibility, as implemented in the prototypes: every intervention path is keyboard-complete; option groups use real radio semantics with arrow keys; status changes are announced live; charts carry text alternatives; reduced motion is respected. No WCAG certification is claimed
08 · ITERATION —
THREE HONEST CHANGES
All three earlier states are superseded:
- Everything, therefore nothing → one job. The first concept was a broad trading-journal product: import, session analysis, annotation, plus interventions. It narrowed to the intervention layer; the journal ambitions were deferred
- “Blocked” → a legible state machine. Early framing left unclear whether the order was stopped or the system could act alone. It became hold → choose (reduce / wait / override / cancel) → explicit re-confirmation. Nothing automatic
- Outcome-led evidence → behavior-led Record. A headline dollar figure implying Tenet made money became a synchronized Record computed live from prototype interactions: explicit estimates, settled-vs-EST, SIMULATED FILL labels throughout
09 · LIMITATIONS &
VALIDATION PLAN
PROPOSED What this work cannot claim yet:
- No moderated study yet; nothing here is validated with users
- The broker SDK and import pipeline are conceptual; feasibility is argued, not proven
- Market outcomes cannot validate behavioral effectiveness; a “saved” trade may have been a missed winner
- Free-text override reasons and deeper evidence-to-fill linkage remain deferred
Planned first study: moderated think-aloud sessions on the working prototypes with 6–8 active options/futures traders, including prop-evaluation users. It would test comprehension of why a rule fired, estimate versus actual, stricter-immediate versus looser-at-open, tone at the intervention moment, and whether the design could inadvertently encourage more trading. A sample this size supports comprehension and tone findings, not efficacy claims.
The strongest thing Tenet does is remain reversible. The intervention moment is the product: a pause that names its reason and leaves every exit open. The next step is moderated research and a feasibility conversation about the broker SDK.
Friction, never a blockreduce · wait · override · cancel
Failure modefails open · visible in the Record
Evidence runnone yet · 6–8-trader study planned