DOSSIER — cross-mission intel aggregation

v2.0 | 2026-07-18

First-party on-device program #11 (ADR-0042): the intel store and its rolodex. Missions and recon programs file discovered facts; DOSSIER is where the operator reads them back. The record schema (profiles, fact-nodes, links, capture→refile) lives in the companion dossier-data-model.md; this chain references it and never duplicates it.

Tier 1 — Treatment

The hook

Every job leaves a residue of facts: a routing number surfaced mid-audit, a beneficial owner traced through three shells, a credential cracked at 3 a.m. DOSSIER is the case file that outlives the case. It aggregates that residue across missions, sessions, and cartridge swaps into profiles of the targets, persons, and accounts the operator has worked, and the work itself reads the file back: missions resolve as small mysteries, success locks facts in, and generation draws on those facts when it shapes what comes next (economy model, fixed rule 4).

The operator fantasy is the investigator’s wall of string. The genre it plays in is the intelligence dossier. The genre it refuses is the inventory: facts are investigation output, earned through play, and they are never bought, never spent, and never consumed (economy model, element classes). A veteran’s standing shows up here twice over: late-game work is gated on facts only a veteran’s file contains, and the file itself is the visible shape of a career.

What the operator does

Opens the file and flips through what they know, almost like a rolodex: entities on the left, the selected entity’s facts and their confidence on the right. The repeating decision is made before the risky move, and DOSSIER is where it gets made: is what I know about this target sufficient, is it confident enough to trust, and if not, do I go case it first or jack in cold?

Feel

Quiet and at-leisure. DOSSIER carries no clock, no defender, and no heat; it is the reference surface between pressures. The long-arc satisfaction is accumulation: an early file is a few thin cards, a veteran’s file is thick with cross-referenced entities, and flipping through it is a replay of the career that filled it.

Feasibility verdict

Reuses: the knEmacs major-mode shape shared with RIPSAW and Kommander (ADR-0046); the two-pane index+card layout family; the sanctioned-write boundary (ADR-0040) with dossier-commit / dossier-has? already ratified on NoshAPI; typed colon-path fact keys; the board’s list key grammar.
New surface required: none for the browse surface (built). The refile inbox and link-walking wait on the record schema growing into the store (engineering follow-ons, Tier 3).
Escalations considered and declined: free editing of canonical intel (the ADR-0040 write boundary stays; the view is read-only); a search field (deferred to v2; arrow navigation covers the fact counts the store holds today).
Red flags respected: the one durable write path stays sanctioned; the viewer adds no new write.

Open questions

Storage home / power-cycle persistence. The file survives cart swaps within a powered session today; surviving power-off is the open storage decision (data model §8).
Operator notes lane. The free-text notes field per profile (data model §1): when it arrives and on what editing surface.
The overview view. The generated “all targets / all open gates” render (data model §8).
Profile-type registration. The mechanism for a cart to add a profile type (data model §8).
Stale-intel decay. How time-gated facts go stale and whether re-casing refreshes them (recon mode §8).

Tier 2 — Operator spec

The core loop

Work files facts; DOSSIER reads them back; what it shows steers the next commitment.

Work. Recon surfaces an authored fact, a mission phase resolves, a program flags a finding. The discovery is filed at that moment. The operator never writes the file.
Read. Open DOSSIER (anytime, including mid-mission), flip to the entity in question, read its facts and their confidence marks.
Decide. Accept the contract or pass. Case the target first or rip-and-run. Trust the rumored routing number or go corroborate it.

The loop closes outside the program: the fact that de-risked tonight’s job was filed by last week’s, and tonight’s job files the facts the next one reads.

The systems

Filed facts and the confidence ladder. Every fact carries a confidence: rumored, inferred, or verified. Shallow, passive casing files rumors; deep or corroborated work files certainty. Corroboration only raises confidence; a fact, once filed, is a record of a discovery and does not degrade into a different claim (data model §3).

The rolodex. The file presents as an index of entities grouped by kind (accounts, hosts, files, persons, and so on), each entity carrying a density cluster: one mark per fact, drawn heavier the more confident the fact. The selected entity’s card lists its facts with their confidence words. An inspect toggle swaps the card to each fact’s full formal designation (the exact form a gate names).

Gating: the file read back. Contracts and objectives query the file. A hard gate blocks a path until the named fact is present (the door needs the credentials). A de-risk softens the job when the fact is known: pre-revealed topology, fewer nodes, a lower starting alert (recon mode §5). A gate can demand a confidence floor, so a rumor may not open what verified intel opens. Beyond gates, generation reads the file when it builds the world: the missions offered to a thick file differ from those offered to a thin one (fixed rule 4).

Arrival and refile. Facts arrive attributed: which mission, which tool, which phase found them. A find that names a known entity is filed under that entity. A find that fits nowhere waits in an inbox until the operator refiles it under the right profile, a deliberate filing action, distinct from editing the fact itself (designed; data model §4).

The verbs

Verb	What it does	Key	Cost
Cycle	Step the index to the next / previous entity; the card follows.	CDR / CAR	free
Inspect	Toggle the card between plain facts and their full formal designations.	INFO	free
Exit	Leave the rolodex, back to wherever the operator came from.	TERM	free
Refile (designed)	File an inbox fact under the profile it belongs to.	EVAL	free

Filing is automatic: discoveries land in the file from the programs that made them, so DOSSIER itself has no filing verb. Browsing is free by design; reading what you know never costs heat, credits, or time pressure.

Emergent collisions

The verified wall. A gate demands verified intel; the file holds the fact only as rumored. The operator chooses: go corroborate (active recon, heat) or route around the gate entirely. The file made the gap visible before the job punished it.
The thin file. A rip-and-run career banks credits fast and files little. Late-game offers gated on deep facts stop appearing, and the thin rolodex is where the operator discovers why.
The old credential. A cred filed two contracts ago opens tonight’s relay pre-authenticated (worked mission, seam 1). Cross-mission reads like this are the payoff for measured play, and DOSSIER is where the operator confirms the cred is there before committing.

Session shape

The ten-second check (mid-op). Between phases: open, arrow to the target host, confirm the cred is filed and verified, exit, dial. DOSSIER’s job here is to answer one question fast.
The between-contracts review (minutes). Board open in one hand, file in the other: flip through candidate targets, weigh thin cards against posted gates, pick the contract the file already de-risks, or pick the recon job that thickens the right card.
Failure still files. A failed or abandoned mission keeps its discoveries: the payout is lost while the facts remain. The file advances even when the wallet doesn’t, so a failed run still pays into the record.

Onboarding

First launch shows the empty state: NO INTEL FILED. Run recon to file facts. That line is the whole tutorial: the program is inert until play fills it, and the empty state names the activity that fills it. The first recon action files the first fact; the masthead count ticks up from zero; the first card appears with a single rumored mark. No dedicated onboarding flow exists and none is planned: the file grows by playing, and its growth is self-evident.

Tier 3 — Detailed design

The record schema (companion)

dossier-data-model.md is the schema authority: profiles, fact-nodes (key / value / provenance / confidence / links), typed edges, and the capture→refile write path. This chain does not restate it.

Implementation seam (GWP-609): the built store (dossier.c / dossier.h) implements the key + confidence subset of that schema: DossierStore, a fixed inbox of 64 facts, each a 64-byte colon-path key plus a DossierConfidence (rumored < inferred < verified). Values, provenance, links, and first-class profiles are design-only. The store is embedded by value on RuntimeState and cleared only at runtime init (types.h), so facts persist across missions and cart swaps within a powered session; power-cycle persistence is the open storage-home decision.

Screen: the rolodex (built)

One screen, an index + card two-pane over the full content area, per the Row 0 / Rows 1–73 / Row 74 contract (screen design rules §1):

Row 0     [firmware status bar: OPERATOR · DOSSIER]
Row 2     ┌──────────────────────────────────────────────────────────────┐
          │  DOSSIER (4× headline)          14 FACTS  6 NODES            │
          │                                                              │
          │  ACCOUNTS                                 CARD               │
          │  ▶ fin-relay-07        #=.       fin-relay-07  [acct]        │
          │    shell-caribbean     =         routing  verified           │
          │  HOSTS                           owner  inferred             │
          │    gateway-2           ##        balance-est  rumored        │
          │  FILES                           3 facts                     │
          │    /ops/plan.txt       #                                     │
Row 72    └──────────────────────────────────────────────────────────────┘
Row 74    [ CAR/CDR browse · INFO inspect · TERM exit ]

Masthead: program name at 4× scale, then the live fact and entity counts.
Index (left): entities grouped under a header per kind, in the canonical section order (accounts, hosts, files, persons, corps, orgs, networks, facilities; unknown kinds follow in first-seen order). Each entity row ends in its confidence cluster: one glyph per fact, capped at 8 so it never collides with the card. The cursor row renders inverted (marked ▶ in the sketch above).
Card (right): the selected entity’s title (entity [kind]), one line per fact (attribute confidence-word), then the fact count. With inspect on, each fact line is instead its full raw colon-path key, alone (key plus confidence word would overflow the card).
Confidence glyphs: # verified · = inferred · . rumored. An ASCII density ramp by deliberate choice: the text primitive emits bytes without decoding multibyte shade glyphs, so CP437 shades would render as mojibake.
Empty state: NO INTEL FILED in the index; the card reads Nothing in DOSSIER yet. Run recon to file facts. Bare launch with no mission opens this state and runs normally (enrich-never-gate, ADR-0042).

Implementation seam (GWP-668): the viewer is dossier.lsp, a pure-Lisp knEmacs major-mode (dossier-mode, ADR-0046) registered via deck/register-screen and reachable by launch-app under the dossier program id (screen_router.c). It reads the store through the read-only enumeration seam dossier/count / dossier/key-at / dossier/conf-at (dossier_screen.c), bound router-side into the program context. It never writes; the sanctioned deposit stays dossier-commit. Coverage: 8 ctests in test_dossier.c (registration, chrome-row respect, grouping, cursor, card, inspect, bare-launch, key routing); on-glass recording at demos/dossier.gif.

Key map

The rolodex follows the board’s list grammar (CDR cycles forward, CAR back, INFO peeks, exit backs out), so an operator who can drive the mission board can drive the file:

Key	Rolodex (built)	Inbox / drill (designed)
CAR	cursor up (previous entity)	drill into the focused fact (provenance, links)
CDR	cursor down (next entity)	cycle the inbox
INFO	toggle inspect (raw keys on the card)	toggle inspect
EVAL	—	refile the focused inbox fact under the selected profile
NIL	—	back out of a drill
TERM	exit (router-owned)	exit (router-owned)

Designed-column bindings follow the same grammar (CAR inspect/drill, CDR cycle, NIL back) and land with the surfaces they belong to; they are not bound today.

Behavior tables

Index derivation. The built store holds flat colon-path keys, so the rolodex derives its structure by parsing them:

Aspect	Specification
Key parse	a key `type:entity:attr…` splits into the kind (first segment), the entity (second), and the re-joined attribute (the rest); a 2-segment key gets the entity-level marker `·`
Grouping	one entity record per distinct `(type, entity)` pair; facts in store order within it
Section order	canonical kinds first (`acct host file person corp org net facility`), then unknown kinds in first-seen order
Cursor	clamped to the entity list ends; reset to 0 on each enter/rebuild
Rebuild	the store is re-read and the grouping rebuilt on every enter (the store may have changed since the last visit)

Commit semantics (the store side the screen renders).

Aspect	Specification
Deposit	sanctioned only: the engine commits; no raw write path exists (ADR-0040)
Re-commit of a known key	keeps the higher confidence; corroboration only raises certainty
Default confidence	a bare commit files at verified; recon depth may supply a lower explicit confidence
Capacity	fixed inbox of 64 facts; a new key past capacity is rejected (no growth, no malloc)
Gating read	present-at-confidence-floor query; a floor of “any” accepts a rumor

The inbox / refile surface (designed, unbuilt)

Manual refile is a DOSSIER operator action on the inbox: a sanctioned UI action, deliberately not cart-callable Lisp (the ADR-0005 Amendment Log closed gap D’s refile primitive by absence-by-design; auto-refile happens inside the commit path). In the built flat store every key parses to a (type, entity) home, so auto-grouping always succeeds and the inbox has nothing to hold; the surface becomes real when profiles become first-class in the store. Its interaction contract is fixed now (key map above, data model §4); its screen layout is deferred until then.

CIPHER-LINE contributions

None specified. A filed-fact acknowledgment line is the natural candidate; it is deferred to the inbox design pass. CIPHER voice stays OLED-exclusive per ADR-0015 regardless.

FFI usage

Implementation seam (GWP-609 / GWP-668): the NoshAPI surface is ratified and bound: (dossier-commit key) (Tier 2, sanctioned capture) and (dossier-has? key &key min-conf) (Tier 2, read-only gate, :min-conf in :rumored/:inferred/:verified) per the ADR-0005 Amendment Log (2026-06-21 entry, ratified 2026-06-25 per ADR-0049). Program contexts get the soft pair (nil outside a mission); mission contexts get the raising pair (nosh_lisp_bridge.c). No refile primitive exists by decision. Engineering follow-ons, in dependency order: grow the store toward the full record schema (values, provenance, links, first-class profiles; store-internal, no enumeration change), then the inbox/refile surface, then the storage home (power-cycle persistence). Each rides the ratified surface; none reopens the ADR-0005 enumeration.

Migration notes

Charter stub → chain (this pass). The stub’s four open questions were already resolved by the companion docs; their dispositions now live in the chain (write path and program-to-program flow in Tier 2 “Arrival” and the FFI seam; record schema in the companion; storage stays open in Tier 1).
Rich model vs. built store. The companion’s fact-nodes carry values, provenance, and links; the built store holds key + confidence only. The Tier 3 seams document the built subset and keep the companion as the target. No redesign either way.
Durability drift, resolved toward the code. The store’s own header comment and the worked mission walkthrough described the store as mission-instance run-state; the code keeps it across missions and cart swaps within a powered session (cleared only at runtime init). Working code wins; this chain and the walkthrough now state the session-durable reading, and power-cycle persistence remains the open storage-home question.
Stale viewer note. The walkthrough’s “a DOSSIER viewer does not exist yet” predated GWP-668 landing; corrected in this PR.

Inspirations

Assigned by Josh in the kn86-inspo workbench. Full map: cart-inspiration-map.md. A row marked (cross-listed) was placed on another destination first and serves this one too (2026-07-29 workflow sweep).

Source	Category
bookokrat	reader
browsh	reader
w3m	reader
System 15000 (1984)	hacking sim (cross-listed)
loglens-core	terminal library (cross-listed)
logradar	dashboard (cross-listed)