Corporate Espionage — Multi-Phase Campaign Spec

This document specifies the 2-phase Corporate Espionage campaign archetype (ICE Breaker → Black Ledger). It is the load-bearing demonstration of the multi-phase capability model: a single contract that cannot be completed by any one cartridge, requires a physical Hot Swap mid-mission, and pays out on completion of both phases. The campaign exists to prove the platform; the platform exists to host campaigns like this.

---

Related

• CLAUDE.md — Canonical Hardware Specification (cartridge interface, CIPHER-LINE OLED, 80×25 grid). Never restated below.
• docs/software/cartridges/authoring/campaign-economy.md — Campaign generation, phase-chain state machine, payout structure, archetype catalog. Corporate Espionage is Archetype 1 there. This doc is the canonical spec for that archetype; campaign-economy.md is the framework.
• docs/software/runtime/orchestration.md — Mission board, phase chain protocol, capability model.
• docs/software/runtime/cartridge-lifecycle.md — udev events, header validation, swap timeout, the cart-state machine.
• docs/software/runtime/cipher-voice.md — CIPHER-LINE engine, event stream, five utterance modes, voice heuristic. All Cipher fragments below conform to that engine; the voice heuristic in §1 of that doc is binding.
• docs/software/runtime/deck-state.md — Universal Deck State schema (phase_chain, cartridge_history, coherence_stack).
• docs/software/cartridges/modules/ice-breaker.md — Phase 1 cart spec.
• docs/software/cartridges/modules/black-ledger.md — Phase 2 cart spec.
• docs/marketing/pr-faq.md — L48: multi-phase campaign promise to operators.
• docs/marketing/product-evaluation.md — Sprint 4 platform-proof deliverable mandate.
• docs/adr/ADR-0007-scripted-mission-ffi.md — Mission FFI (Lisp scripted missions, phase advance primitive).
• docs/adr/ADR-0019-cartridge-storage-and-form-factor.md — SD-card cart, hot-swap physical contract.
• Companion combined-design artifact (design history, paired-module pattern reference): ../modules/neongrid-blackledger-campaign.md. The current launch-time pairing is ICE Breaker + Black Ledger (this doc); the older NeonGrid + Black Ledger pairing is retained for design-archaeology only.

---

1. Pitch — The Fiction Frame

A target — an Osaka-listed mid-cap with a defense subsidiary three holding companies deep — has been moving payments in patterns that don’t match its public ledgers. The client (Bureau 9 contact, no name on the contract) wants a complete trail: the raw transaction logs from the financial backend, and a proof-graded chain showing how the money walks through the shell network to its ultimate beneficiary.

Neither half is enough. Raw extraction without forensic reconstruction is just data; forensic analysis without source records is conjecture. The contract is paid only if both the extraction and the audit close.

This is two crafts in one mission — a tempo-driven intrusion under live ICE pressure, then a deliberate, patient audit of what was just torn out of the network. The same operator has to do both. The deck has to host both.

The Hot Swap between phases isn’t a menu transition. It’s the moment the operator pulls a cartridge out of a deck under power, with the run still ticking inside the firmware, and seats a new one. Hands move. The deck’s character changes. The voice in the operator’s peripheral vision (CIPHER-LINE) carries through.

---

2. Why This Campaign Is the Platform Proof

Per docs/marketing/product-evaluation.md Sprint 4: Corporate Espionage is the first end-to-end demonstration that a single contract spans two physical cartridges via the phase chain. It earns the marketing line in docs/marketing/pr-faq.md L48: “An ICE Breaker SABOTAGE of a financial target triggers a Black Ledger audit phase.”

It is the smallest possible campaign — 2 phases, 2 carts — that nonetheless requires every load-bearing platform mechanic:

• Universal Deck State persists handle, credits, reputation across the swap.
• Phase chain (PhaseChain struct, campaign-economy.md §Phase Chain State Machine) carries phase-specific payload (extracted ledger fragment, target identifiers, time-elapsed escalation).
• cartridge-lifecycle.md swap-timeout state machine governs the physical eject/insert.
• CIPHER-LINE coherence stack (5-slot FIFO in deck state, persists across cart swaps per ADR-0015) carries the cockpit voice through the swap dead-air.
• Mission board generates the campaign archetype only when cartridge_history shows both ICE Breaker and Black Ledger have been seen at least once.
• Multi-phase payout structure (~40% premium over the sum of equivalent single-phase contracts).

If this campaign works, every other archetype in campaign-economy.md (Maritime Intelligence, Signal Hunt, Supply Chain Sabotage, etc.) is implementation work, not new architecture.

---

3. Eligibility and Generation

Eligibility

Gate	Value
cartridge_history bits required	CAPABILITY_ICE_BREAKER ∧ CAPABILITY_BLACK_LEDGER
Minimum reputation	0 (offered to fresh operators once both carts have been registered)
Threat range	2–6 (scaled by reputation; see campaign-economy.md §Reputation Modifier)
Generation frequency	Per campaign-economy.md §Campaign Frequency Table — eligible from the moment the second cart is registered

Generation

Generated by the standard mission board pipeline (orchestration.md §Mission Board, §Multi-Phase Missions). The archetype maps to CAMPAIGN_CORPORATE_ESPIONAGE (campaign-economy.md §Archetype 1). Contract parameters seeded from cipher_seed + reputation + credit balance + cartridge history bitfield, exactly as for any other multi-phase contract — no custom generation path. Mission board seeds determine target type, shell depth, threat level, and bonus condition; nothing in this archetype is hard-coded except the phase capability sequence and the narrative beats below.

Contract Variants

The mission board emits one of three Corporate Espionage variants on each generation, weighted by the seed:

Variant	Phase 1 emphasis	Phase 2 emphasis
EXTRACTION (default, ~60%)	Network intrusion; clean extraction with low trace	Forensic trace from raw transaction logs to beneficiary
SABOTAGE (~25%)	Network intrusion ending in record corruption (the operator must extract first, then corrupt before egress)	Reconstruction of corrupted records; identify the original payment chain
CONTROLLED BURN (~15%, rep ≥ 15 only)	Network intrusion + targeted insert (false transaction implant)	Audit that proves the implant chain (operator must verify their own forgery survived audit)

The variant is invisible to the operator at the contract-bid step (> CORPORATE TARGET — EXTRACT AND TRACE); it surfaces during Phase 1 mission brief on the main grid.

---

4. Phase 1 — ICE Breaker (Network Intrusion)

Mission Template Variant

Phase 1 is a standard ICE Breaker contract with two non-default knobs set:

• Target type is locked to FINANCIAL_BACKEND (this is what makes the data from Phase 1 readable as a ledger fragment in Phase 2).
• Egress requirement is locked to EXTRACT_AND_PRESERVE — the operator cannot trash the data on the way out (that’s a different contract type). The records have to come out clean enough for Phase 2 to read.

All other ICE Breaker mechanics — OODA loop, network topology, threat escalation, ICE classes, tool budget, tempo, Hot Swap to other capabilities mid-Phase-1 — are unchanged. See docs/software/cartridges/modules/ice-breaker.md.

What Is Stolen

The deliverable is a financial backend snapshot — encrypted transaction logs, account identifiers, subsidiary shell links. Concretely, this is bytecode written into phase_context in the phase chain (see §6 below): a target account hash, a shell-depth hint, and an encryption-scheme tag. The operator never sees the snapshot directly during Phase 1; it accumulates as “extraction progress” on the main grid HUD as nodes are cleared.

Why ICE Breaker Is the Entry Point

The data lives behind ICE. The fiction is consistent: there is no Black Ledger contract type that begins with “you are handed a clean copy of the records.” Every Black Ledger contract begins with someone having gotten the records out, somehow. In standalone Black Ledger play, that someone is offstage; in this campaign, that someone is the operator, on Phase 1, twenty minutes ago.

This also means the threat level the operator picks at the mission board is set by ICE Breaker’s threat scale (1–6 from campaign-economy.md), not Black Ledger’s. The audit difficulty in Phase 2 inherits from how Phase 1 went — see §6.

Phase 1 Completion Criteria

Phase 1 closes when the operator successfully exfiltrates from the target network with extraction_progress == 100 and egress_status == CLEAN (or CORRUPTED for the SABOTAGE variant, IMPLANTED for CONTROLLED BURN). On exfil:

1. nOSh writes the financial-backend snapshot into phase_context[0..4].
2. nOSh sets phase_flags = 0x22 (phase 0 complete, threat-escalation 2 baseline).
3. nOSh credits accumulated_payout += phase_1_payout (40% of total campaign payout).
4. CIPHER-LINE emits the :phase-advance event (see §7).
5. nOSh transitions to the swap-prompt screen (see §5).

Phase 1 abort/death/forced-egress without clean extraction is handled in §8.

Duration

15–30 minutes typical, threat-dependent. Matches campaign-economy.md §Archetype 1.

Payout (Phase 1 portion)

40% of the total campaign payout is credited at Phase 1 close — before the swap. The operator already has this credit if Phase 2 fails. This is intentional: it makes the swap a real choice (you can take the partial payment and abandon, see §8), and it makes Phase 2 a willing second job rather than a hostage situation.

---

5. The Hot Swap Moment

This is the load-bearing platform-proof. The operator has the deck under power, mid-contract, with mission state live in firmware. They eject a cartridge and insert another. The fiction continues across the gap.

What the Operator Sees and Hears

Frame 0 (Phase 1 closes — main grid): The exfil sequence completes. The action bar (Row 24) flips from [A]ttack [E]gress to > PHASE 1 COMPLETE. Row 0 status bar changes the cart tag from IB-1.0 to [ — ]. The 80×23 content area fades to a calm centered panel:

                       ████████  ████████  ████████

                       PHASE 1 COMPLETE

                       FINANCIAL RECORDS EXTRACTED
                       SNAPSHOT WRITTEN TO PHASE CHAIN

                       PHASE 2 REQUIRES: FORENSIC ACCOUNTING
                       INSERT: BLACK LEDGER

                       PHASE CHAIN ACTIVE — DO NOT POWER DOWN

                       SWAP WINDOW: 90s

This is a diegetic instruction, not a menu. There is no [Cancel] button. The action bar offers only [ESC] Abandon (forfeit Phase 2 payout). Row 0 ticks the swap-window countdown.

Frame 0–90s (CIPHER-LINE): See §7 for the full fragment sequence. Aesthetically: the voice is in :cart-swap-lull beat (per cipher-voice.md §When the Cipher Voice Speaks) — drift-dominant, slow, observing the cart that just left while the next one comes online.

Eject (operator action, ~3–8s into the window): Operator opens the Pelican lid, palms the ICE Breaker cartridge sled, pulls. The deck’s udev layer sees the SD removal event (cartridge-lifecycle.md). Main grid swaps the centered panel to:

                       ████████  ░░░░░░░░  ████████

                       CARTRIDGE ABSENT

                       INSERT: BLACK LEDGER

                       SWAP WINDOW: 67s

Insert (operator action, ~10–60s into the window): Operator seats the Black Ledger sled. udev fires the insert event. nOSh validates the cart header (Black Ledger capability_bits must include FORENSIC_ACCOUNTING); if it doesn’t (operator inserted, say, NeonGrid), the deck rejects with > WRONG CAPABILITY — INSERT BLACK LEDGER and resumes the countdown without consuming swap time.

Bureau 9 publisher splash (~2.8s): The cartridge boots; Bureau 9 Technical Services renders its publisher splash (silent, mechanical typeout — see orchestration.md §Publishers). This is the phase boundary the operator feels — Zaibatsu’s harsh hex-dump-and-noise gives way to Bureau 9’s cold typewriter silence. The deck’s mood changes.

Frame N (Phase 2 begins): The Black Ledger main-grid mission brief renders. Row 0 cart tag now shows BL-2.1. Row 24 action bar flips to Black Ledger’s verbs ([CAR] drill [QUOTE] flag [EQ] match). CIPHER-LINE moves out of :cart-swap-lull and into :mission-brief mode.

What UDS State Carries Forward

Universal Deck State is unchanged across the swap (it lives on the Pi’s microSD, not on either cartridge). Specifically:

UDS field	Carries forward?	Source of truth at swap time
operator_handle	Yes	UDS, untouched
credits	Yes (Phase 1 payout already credited)	UDS, +40% of campaign payout
reputation	Yes (unchanged until campaign close)	UDS
cartridge_history	Yes; Black Ledger bit was already set (eligibility gate)	UDS
phase_chain (16 bytes)	Yes — this is the load-bearing state. Phase 2 reads it.	UDS
coherence_stack (5-slot CIPHER FIFO)	Yes — voice carries through	UDS
cipher_seed (LFSR)	Yes; advances normally during the swap idle	UDS

The ICE Breaker per-cartridge save file (/icebreaker_v1.3/save/icebreaker.sav on the ejected cart’s SD) was already flushed at Phase 1 close. The Black Ledger save file is read fresh on insert. Neither save file participates in the campaign chain.

What the Cart Eject Screen Says

Verbatim main-grid text on eject (after Phase 1 completion panel, before the operator pulls):

PHASE 1 COMPLETE
FINANCIAL RECORDS EXTRACTED

PHASE 2 REQUIRES: FORENSIC ACCOUNTING
INSERT: BLACK LEDGER

PHASE CHAIN ACTIVE — DO NOT POWER DOWN
SWAP WINDOW: 90s

[ESC] Abandon (forfeit Phase 2 payout)

After the operator pulls (cart absent state):

CARTRIDGE ABSENT

INSERT: BLACK LEDGER

SWAP WINDOW: <countdown>s

After the operator inserts the wrong cart:

CARTRIDGE: <inserted-cart-name>
WRONG CAPABILITY — INSERT BLACK LEDGER

SWAP WINDOW: <countdown>s

The wording is Bureau-9-flavored: declarative, no exclamation marks, no decorative typography. This matches the destination cart’s voice; the source cart’s voice (Zaibatsu) has already departed by the time these screens render.

Swap Window Timeout

The swap window is 90 seconds (per cartridge-lifecycle.md). At 0s, if no Black Ledger cart is seated:

• The phase chain enters SUSPENDED state (phase_flags |= 0x80).
• The campaign is held open in UDS for up to 7 days; on next boot with Black Ledger inserted, the operator is offered > RESUME CORPORATE ESPIONAGE CAMPAIGN [Y/N].
• After 7 days or explicit decline, the campaign is closed with the partial Phase 1 payout retained and a small reputation penalty (−1) for the abandonment.

This isn’t a soft fail — the operator who walked away with 40% of the payout in their pocket and never came back is making a real choice, and the deck honors it.

---

6. Phase 2 — Black Ledger (Forensic Accounting)

Mission Template Variant

Phase 2 is a Black Ledger contract initialized with a non-empty seed — the Phase 1 snapshot — instead of the procedurally generated seed a standalone Black Ledger contract would draw. Concretely, the case generator reads phase_context[0..4] from the phase chain and constructs the case parameters from it:

• phase_context[0] (target_account_hash) — root account of the case tree.
• phase_context[1] (shell_depth_hint) — number of shell-corp levels (3–7); sets the case’s drilling depth.
• phase_context[2] (time_elapsed_phase1) — escalates Black Ledger’s move-budget pressure if Phase 1 took longer than expected.
• phase_context[3] (egress_status) — CLEAN / CORRUPTED / IMPLANTED. Selects the Phase 2 case type:
  • CLEAN → FORENSIC_TRACE case
  • CORRUPTED → RECONSTRUCTION case (operator must reconstruct the corrupted records before tracing)
  • IMPLANTED → AUDIT case (operator must verify their own implant survives audit, identify the false leg)
• phase_context[4] (encryption_scheme_tag) — tags the encryption Black Ledger has to walk through; affects the difficulty of the first 1–2 drill levels.

All other Black Ledger mechanics are unchanged. See docs/software/cartridges/modules/black-ledger.md for case mechanics, drilling, flagging, evidence-chain scoring, the four case types, and the move/QUOTE/EQ budgets.

What Is Processed

The encrypted database from Phase 1 is auto-decrypted at the phase boundary by nOSh — the operator does not solve a Black Ledger encryption mini-game on top of the audit. (This is a deliberate scope cut: the encryption was part of the ICE Breaker problem, not the Black Ledger problem.) On Phase 2 start, the operator sees the case board with the target case pre-selected and the root account exposed. They drill from there.

The campaign succeeds when the operator identifies the ultimate beneficiary — the natural-person account at the leaves of the shell tree, with a complete proof chain back to the target — and submits the audit (EVAL on SUBMIT FINDINGS from the case board).

Why Black Ledger Is the Natural Successor

Two reasons.

Mechanical: Phase 1 produces a decrypted-but-uninterpreted ledger fragment. Black Ledger is the only launch-library cartridge whose capability is forensic interpretation of that fragment. ICE Breaker can extract data; it can’t read it. SynthFence (Commerce/market ops) reads market patterns, not internal corporate ledgers. The Vault (passive index) doesn’t operate on extraction outputs. Black Ledger is structurally the next move.

Tonal: The two carts are deliberately opposite — Zaibatsu’s ICE Breaker is tempo (OODA loop, sub-second decisions, harsh PSG noise on boot), Bureau 9’s Black Ledger is patience (turn-based, move budgets, silent typewriter boot). The campaign teaches the operator that the same deck — their deck — hosts both moods. This is the platform claim the campaign exists to make.

Phase 2 Completion Criteria

Phase 2 closes when the operator either:

• Succeeds: Submits a complete, correct audit. Beneficiary identified, evidence chain proof-graded ≥ threshold (case-type-dependent; see black-ledger.md).
• Partial-succeeds: Submits an audit that names the beneficiary but with an incomplete chain (some shells unflagged). Reduced Phase 2 payout (50% of Phase 2 portion).
• Fails: Submits a wrong beneficiary, exhausts the move budget, or aborts. Phase 2 portion forfeit; Phase 1 portion retained.

On any of the above:

1. nOSh updates phase_chain: phase_index = 1, phase_flags |= 0x40 (campaign close), accumulated_payout += phase_2_payout.
2. nOSh applies the multi-phase bonus (40% premium on the combined base payout) if both phases hit success.
3. nOSh clears the campaign from active state in UDS; reputation adjusts (see §9).
4. CIPHER-LINE moves into :debrief mode; main grid renders the campaign close panel.

Duration

10–25 minutes typical, scaled by shell_depth_hint and time_elapsed_phase1 pressure. Matches campaign-economy.md §Archetype 1.

Payout (Phase 2 portion + bonus)

60% of the campaign payout is gated behind Phase 2 success. The 40% multi-phase bonus is gated behind both phases succeeding. So:

• Phase 1 only (abandon at swap): 40% of campaign payout.
• Phase 1 + Phase 2 partial: 40% + 30% = 70%.
• Phase 1 + Phase 2 full: 40% + 60% + 40% bonus on the (40+60) base = 140% of base (i.e., the campaign pays 1.4× the sum of its phases).

See §9 for absolute numbers by threat level.

---

7. CIPHER-LINE Voice Arc

All Cipher fragments below conform to docs/software/runtime/cipher-voice.md. The voice heuristic (§1 of that doc) is binding: clipped, observational, fragments under eight words, dropped articles/connectives where natural. No full sentences, no exclamation marks, no narration of plot.

The fragments below are examples drawn from the productions a real grammar would emit. They are not a script — at runtime, the engine samples from the productions weighted by mode, affect, memory store, and coherence stack. Rendering them verbatim every time would be wrong. They are listed here to specify the voice’s behavior across the campaign arc, not its lines.

Beat: Mission Brief (campaign offered on the board)

Mode: observe + occasional annotate. Affect: :routine. Beat: :mission-brief.

threat three.
clean work, maybe.
two carts. patience after.

The third fragment is the campaign tell — the voice flagging that this contract has a swap in it without saying so directly. Fires only on Corporate Espionage offers, not on single-phase ICE Breaker contracts.

Beat: Phase 1 Active

Standard ICE Breaker :active-hack beat. CIPHER-LINE behaves as it would on any ICE Breaker run. Coherence stack accumulates events normally; the campaign context is invisible to the operator at this point.

Beat: Phase 1 Close → Pre-Swap (final 2–3 ticks of Phase 1)

Mode: :reflect. Affect: :significant.

records out.
clean enough.
ledger now.

The pivot fragment (ledger now.) is the voice handing off — recognizing that the work is changing shape.

Beat: Cart Swap Lull (90-second window)

Mode: :drift-dominant, with :silent long pauses (per ADR-0015, the OLED ticker on cart-swap pauses are first-class — silence is voice). Affect: :significant, :anomalous (cart absent is anomalous).

Tick 1 (post-Phase-1 panel up, cart still seated):

zaibatsu loader. last time today.

Tick 2 (~5s later):

hands moving.

Tick 3 (cart pulled, absent state):

slot empty.

Tick 4 (~10s of silence on row 2, drift on row 3):

                              (silence)
osaka, again.

Tick 5 (cart inserted):

b9 boot.

Tick 6 (Bureau 9 splash playing):

typewriter mood.

The coherence stack carries the Phase 1 fragments (records out., clean enough.) into Phase 2 — when the Bureau 9 splash clears and Phase 2’s first observe fragment fires, the previous-fragment row 3 may echo a Phase 1 fragment. This is the cockpit-voice-recorder effect across the swap. It is not optional; it is the load-bearing demonstration that voice survives the cart change.

Beat: Phase 2 Active

Standard Black Ledger active beat. observe-heavy, reflect-on-significant. Bureau-9-flavored vocabulary (subsidiary, shell, audit, paper trail).

shell depth four.
seen this before. similar.
beneficiary close.

The middle fragment is the coherence stack pulling a memory-store hit across the cart swap — recall is unlocked by :significant weight on the Phase 1 extraction events. This is the cross-cartridge recall the platform claims.

Beat: Campaign Close (Phase 2 success → :debrief)

Mode: :reflect + :annotate. Affect: :significant.

named.
both halves.
clean run.

If Phase 2 partial-succeeds:

named, mostly.
some shells dark.

If Phase 2 fails:

wrong leaf.
records held. not enough.

Beat: Campaign Abandonment (swap window timeout)

Mode: :drift. Affect: :anomalous.

no cart inserted.
deck remembers.
seven days.

The third fragment is the suspended-campaign hint — voice acknowledging that the run isn’t dead, just paused.

Cart Vocabulary Contributions

Per orchestration.md §Vocabulary Registration, both carts contribute their cipher-grammar blocks. During Phase 1, ICE Breaker’s pools dominate; during Phase 2, Black Ledger’s. The cart-swap-lull beat uses the transition pool — fragments that name the carts directly (zaibatsu loader., b9 boot.) — registered by nOSh as runtime-owned vocabulary, not by either cart. This is the only beat in normal play where the voice references the publisher names.

---

8. Branching Outcomes

A campaign run is one of nine end states, governed by Phase 1 outcome × Phase 2 outcome:

Phase 1	Phase 2	End state	Payout	Reputation
Clean exfil	Full audit	Golden Path	140% base	+12
Clean exfil	Partial audit	Successful, lossy	110% base	+7
Clean exfil	Wrong beneficiary	Phase 2 fail	40% base	+1 (Phase 1 cred)
Clean exfil	Operator aborted Phase 2	Phase 2 abandon	40% base	0
Clean exfil	Swap window timeout	Suspended (resumable 7d)	40% retained, rest pending	0 (until close)
Sabotage exfil (variant)	Reconstruction success	Variant golden	145% base	+13
Controlled burn (variant)	Audit confirms implant	Variant golden	150% base	+14
Phase 1 forced egress (incomplete)	n/a (campaign aborts)	Phase 1 fail	0	−2
Operator abandoned Phase 1	n/a	Pre-swap abandon	0	−1

Variant Phase 2 Setups

The Phase 1 outcome routes to a different Phase 2 case type, so the operator’s Phase 1 craft (clean vs. messy vs. surgical) literally selects the Phase 2 craft:

• Clean exfil → FORENSIC_TRACE. Trace forward from a clean root to a clean leaf. The “default” audit shape.
• Corrupted egress → RECONSTRUCTION. Black Ledger reconstructs corrupted records from partial signal before tracing. Harder; ~15% more move-budget pressure.
• Implanted egress → AUDIT. Black Ledger audits the (operator-altered) records, looking for the false leg. The campaign succeeds when the operator’s own implant passes audit (proves the forgery survived); fails if the auditor’s tooling catches the implant. Highest variance, highest payout.

This means a Phase 1 failure mode (corrupted egress under threat) is promoted to a Phase 2 affordance — the operator who got messy in Phase 1 plays a different but legitimate Phase 2, not a degraded one. Sabotage and Controlled Burn variants are not punishments; they are the campaign branching to fit the run’s actual shape.

---

9. Economy

Base Payout (per campaign-economy.md §Archetype 1)

Base campaign payout is 1,800 ¤ at threat 2. Threat-multiplier applies (campaign-economy.md §Reputation Modifier):

Threat	Base × multiplier	Phase 1 (40%)	Phase 2 (60%)	Multi-phase bonus (40% on base)	Golden total
2	1,800 × 1.0 = 1,800	720	1,080	720	2,520
3	1,800 × 1.3 = 2,340	936	1,404	936	3,276
4	1,800 × 1.6 = 2,880	1,152	1,728	1,152	4,032
5	1,800 × 2.0 = 3,600	1,440	2,160	1,440	5,040
6	1,800 × 2.5 = 4,500	1,800	2,700	1,800	6,300

Economy modifier (economy_modifier() in campaign-economy.md) further compresses or amplifies the payout based on credit_balance. Numbers above are pre-modifier.

Reputation

Reputation impact is multi-track — Corporate Espionage touches both the intrusion track (ICE Breaker rep) and the financial track (Black Ledger rep), but it also touches a cross-track campaign rep that only multi-phase contracts feed:

Outcome	Intrusion rep	Forensic rep	Campaign rep
Golden Path	+4	+4	+4
Successful (lossy)	+3	+1	+3
Phase 2 fail	+1	0	0
Phase 1 fail	0	0	−2
Pre-swap abandon	0	0	−1
Variant golden	+4	+5	+5

Campaign rep is the gate to higher-archetype contracts (Maritime Intelligence, Strategic Takeover, Full Operation per campaign-economy.md). It cannot be earned from single-phase contracts. Corporate Espionage is the only way to seed campaign rep until the operator owns a third capability cart.

Provenance

Both cartridges’ provenance chains (orchestration.md §Cartridge Provenance) record the campaign as MISSION events with a campaign-link tag in the payload. The chain on each cart shows the same campaign_id, allowing a future deck to reconstruct that these two carts were paired on a real run. This is load-bearing for community / linked-play provenance.

---

10. Replayability

What Reseeds

Per generation:

• Target identity (which Osaka mid-cap, which subsidiary). Names drawn from a fictional company table.
• Shell topology (3–7 levels, branching factor 1–4). Generates a different audit tree every time.
• Beneficiary leaf identity.
• ICE network topology, ICE classes, encryption scheme tag.
• Variant (EXTRACTION / SABOTAGE / CONTROLLED BURN), per the weights in §3.
• Bonus condition (e.g., “complete in under 35 minutes”, “complete with no Hot Swap during Phase 1”) — selected from a small pool.

What Locks

Locked structurally (campaign is the same archetype every time):

• 2-phase chain.
• ICE Breaker → Black Ledger order. (Black Ledger first would be a different archetype; not in launch.)
• Capability sequence: NETWORK_INTRUSION → FORENSIC_ACCOUNTING.
• The Hot Swap window length (90s).
• Multi-phase bonus structure.

This is intentional. The campaign archetype is the shape; the seed varies the content. After 50 Corporate Espionage runs the operator knows the shape cold and hunts the variants and bonus conditions for variety. Procedural in the content; ritual in the form.

---

11. Sample Playthroughs

11.1 Golden Path — Threat 3, EXTRACTION variant

Operator handle: kinoshita. Reputation: intrusion 12, forensic 4, campaign 0. Both carts loaded at least once.

Mission board, 19:42: A Threat 3 Corporate Espionage offer surfaces between a single-phase ICE Breaker SABOTAGE and a Black Ledger AUDIT. Cipher fragment on the highlighted contract: threat three. / two carts. patience after. Operator EVALs.

Phase 1, 19:43–20:08 (25 min): Standard ICE Breaker run against MITSUWA HOLDINGS BACKEND. Operator clears 11 nodes, uses CRACK + MIRROR + SPIKE, takes one Hot Swap to NeonGrid (yes, mid-Phase-1 Hot Swap to a third cart for spatial scope — fully legal, doesn’t affect the campaign chain) to map a maze-like sub-net. Trace = 38 at exfil. Clean egress. CIPHER: records out. / clean enough. / ledger now.

Payout: 936 ¤ (Phase 1 portion of threat 3). UDS credits update; phase chain populated; main grid renders the swap-prompt panel.

Swap, 20:08–20:08:42 (42s): Operator pulls ICE Breaker, swap window counts down. CIPHER: zaibatsu loader. last time today. / slot empty. / (silence) / osaka, again. Operator seats Black Ledger. Bureau 9 splash plays; CIPHER: b9 boot. / typewriter mood. Phase 2 mission brief renders.

Phase 2, 20:09–20:23 (14 min): FORENSIC_TRACE case, shell depth 4, root account MITSUWA HOLDINGS LTD. Operator drills CAR-CAR-CAR through NEXUS PACIFIC TRUST → IRYO INVESTMENTS K.K. → HARADA CONSULTING → natural-person beneficiary HARADA, K. QUOTEs each shell, EQ-matches the transaction patterns, submits audit at move 31 of 40. CIPHER: shell depth four. / seen this before. similar. / beneficiary close.

Audit accepted clean. CIPHER :debrief: named. / both halves. / clean run.

Close: Total payout 3,276 ¤ (phase 1 936 + phase 2 1,404 + bonus 936). Reputation: intrusion +4, forensic +4, campaign +4. Provenance blocks recorded on both carts with shared campaign_id 0x8A21.

Total session: 41 minutes, deck-down to deck-down.

11.2 Partial-Fail Recovery — Threat 4, SABOTAGE variant

Operator: same. Reputation post-prior: intrusion 16, forensic 8, campaign 4.

Phase 1, 18:11–18:39 (28 min): SABOTAGE variant against KAIBARA TECHNICAL. Operator extracts records, but during the corruption pass a HUNTER ICE spawns; operator panics, slams CRACK on three nodes, exfils with egress_status = CORRUPTED. Trace = 71 at exfil. Survived but messy. CIPHER: records out. / not clean. / audit will see.

Swap, 18:39–18:39:35.

Phase 2, 18:40–19:02 (22 min): Phase chain routes to RECONSTRUCTION case (because corrupted egress). Black Ledger has to reconstruct ~30% of the records before tracing. Operator burns most of the move budget on reconstruction; tracing is rushed. Identifies beneficiary correctly but leaves two intermediate shells unflagged. Submits as partial audit. CIPHER: named, mostly. / some shells dark.

Close: Total payout 70% of threat-4 base = 2,016 ¤. Reputation: intrusion +3, forensic +1, campaign +3. The operator learns that messy Phase 1 egress promotes Phase 2 to a harder variant — and decides next time to take the trace hit on Phase 1 to keep the egress clean.

11.3 Phase-2-Fail — Threat 5, CONTROLLED BURN variant

Operator: same. Reputation post-prior: intrusion 19, forensic 9, campaign 7.

Phase 1, 14:22–15:01 (39 min): CONTROLLED BURN variant — operator has to extract, then implant a forged transaction, then exfil before the alarm trips. Surgical run; trace = 22 at exfil. egress_status = IMPLANTED.

Swap, 15:01–15:01:18.

Phase 2, 15:02–15:24 (22 min): AUDIT case — operator must verify their forged transaction passes audit. They drill, they QUOTE, they EQ-match. The audit tooling flags the forged leg on move 28; operator misjudges and submits naming the forged leaf as the beneficiary. Wrong leaf — the audit’s job was to confirm the implant survived, not to name the implant as the beneficiary. CIPHER: wrong leaf. / records held. not enough.

Close: Phase 2 forfeit. Total payout 1,440 ¤ (Phase 1 portion of threat 5 only). Reputation: intrusion +1, forensic 0, campaign 0. Operator stews. Notes that CONTROLLED BURN variant’s Phase 2 has different success criteria than EXTRACTION’s — files this for the next attempt.

11.4 Suspended (Swap Window Timeout) — Threat 3, EXTRACTION

Operator: same. Reputation: intrusion 19, forensic 9, campaign 7.

Phase 1, 22:04–22:31 (27 min): Clean run. Phase 1 closes. Payout 936 ¤ credited.

Swap, 22:31–22:32:30: Operator pulls ICE Breaker, sets the deck down to take a phone call. Looks back 90 seconds later — swap window has expired. Main grid: > CAMPAIGN SUSPENDED. RESUMABLE FOR 7 DAYS. CIPHER: no cart inserted. / deck remembers. / seven days.

Boot, 23:14 next day: Operator powers on with Black Ledger inserted. nOSh detects the suspended campaign in UDS, prompts: > RESUME CORPORATE ESPIONAGE CAMPAIGN [Y/N]. Operator hits Y. Phase 2 begins with the Phase 1 snapshot intact in phase_context. Cipher carries — seen this before. similar. echoes from the coherence stack.

Phase 2 plays out as a normal FORENSIC_TRACE; operator nails it. Close: Full golden payout (the suspension didn’t cost anything except the wait). Reputation: intrusion +4, forensic +4, campaign +4.

Total session: 42 minutes of Phase 1 + 16 minutes of Phase 2 = 58 minutes spread across 25 hours of wall-clock time. The campaign held.

11.5 All-Fail — Threat 6, EXTRACTION variant (over-reach)

Operator: same. Reputation: intrusion 22, forensic 11, campaign 12. They take a Threat 6 because they can.

Phase 1, 09:14–09:51 (37 min): Threat 6 ICE Breaker against NIPPON STRATEGIC SOLUTIONS. Three Hot Swaps mid-Phase-1 (Depthcharge for sonar, NeonGrid for routing, back to ICE Breaker). At node 14, a BLACK-class ICE chain converges before the operator can reach the financial backend. Forced egress at trace = 84, extraction_progress = 67. Phase 1 fails. Campaign aborts.

Close: 0 payout. Reputation: intrusion 0, forensic 0, campaign −2. Cipher fragment after fade-to-black: not today.

Operator drops to 10 campaign rep. Decides Threat 6 was the wrong call and queues a Threat 4 EXTRACTION next session to rebuild. The campaign system did its job: the over-reach cost something real, but not catastrophic.

---

12. Implementation Notes for Engineering

This is a campaign spec, not a cart implementation plan. But the spec implies the following pre-existing platform mechanics must be in place — which is why this campaign is the Sprint-4 platform proof:

• Phase chain state machine (PhaseChain struct, write/read across cart swaps) — campaign-economy.md §Phase Chain State Machine.
• Hot-swap lifecycle (udev events, header validation, swap timeout, suspend/resume) — cartridge-lifecycle.md.
• Mission board archetype generation with cartridge-history gating — orchestration.md §Mission Board.
• CIPHER coherence stack persistence across cart swap — ADR-0015 + cipher-voice.md.
• Multi-phase payout computation + variant routing — campaign-economy.md §Multi-Phase Payout Structure.
• Per-cart provenance chain campaign tagging — orchestration.md §Cartridge Provenance.

The mission template variants (EXTRACTION / SABOTAGE / CONTROLLED BURN) are implemented as parameter sets on the existing ICE Breaker mission template; the Phase 2 case routing (FORENSIC_TRACE / RECONSTRUCTION / AUDIT) is implemented as parameter sets on the existing Black Ledger case generator. No new gameplay verbs. No new FFI surface. The campaign is composed entirely from existing primitives.

---

13. Open Questions

1. Variant weighting. The 60/25/15 split for EXTRACTION / SABOTAGE / CONTROLLED BURN is initial design intent. Playtest may shift weights — particularly whether CONTROLLED BURN should be rep-gated higher than 15.
2. Multi-phase bonus tuning. 40% premium is the campaign-economy.md baseline. May want to bump to 50% for the launch-window 2-phase archetypes specifically, to make sure the platform-proof feels worth the swap overhead. Defer to first wave of player data.
3. Suspend window length. 7 days is generous. Likely correct for a $499 deck where sessions are intentional, but watch for abuse (parking high-value Phase 1 outcomes indefinitely).
4. Cipher transition vocabulary. The publisher-name fragments (zaibatsu loader., b9 boot.) live in nOSh-runtime-owned vocabulary, not in either cart’s cipher-grammar. Confirm registration path with the CIPHER engine team.

---

End of spec.