kn9 (Kinoshita K9): encrypted operator comms

First-party on-device program #10 (ADR-0042).

v1.1 | 2026-07-18

Canonical per ADR-0042. kn9 is the diegetic back-channel where the job is briefed and intel is handed to you; carts overlay brief / dead-drop content + auto-DOSSIER-capture. See the program roster.

Tier 1 — Treatment

Gate: draft (stub). Basics from the ADR-0042 charter and the Tier 2 spec; the treatment pass has not been written and this stub invents no design.

The hook

The operator’s encrypted comms / relay: Mutt / Gnus-style threaded mail for handler briefings, dead drops, and cross-deck (LINK) intel. The diegetic back-channel where the job is briefed and where intel is handed to you, the give-side inverse of the recon you do yourself. Messages arrive over time on the World Clock, the same feed engine as the Mission Board.

What the operator does

READ a handler brief that defines the next objectives, process a dead-drop payload whose tagged leads auto-capture into DOSSIER, RELAY across the LINK channel. The repeating decision: which arriving lead to act on, and which program to hand it to.

Feel

Owed to the treatment pass.

Feasibility verdict

Reuses: the knEmacs application engine (tabulated-list group buffer, thread tree-cursor, minibuffer, nEmacs literal/multi-tap compose) and the same feed engine as the Mission Board; the sanctioned dossier-commit auto-capture path.
New surface required: none; kn9 is the clearest case of the shared feed engine.

Open questions

Deferred to the tiers below (see Open / deferred in Tier 3).

Tier 2 — Operator spec

Gate: approved (the v1 design; merged through PR review).

Identity

kn9 (Kinoshita K9) is the operator’s encrypted comms / relay: Mutt / Gnus-style threaded mail for handler briefings, dead drops, and cross-deck (LINK) intel. The diegetic back-channel: where the job is briefed and where intel is handed to you (the inverse of recon you do yourself).

Operator program #10 (ADR-0042). First-party, always-present, bare-launchable, never superseded.
Generic verb floor (ships, bare-launchable): enter-group / folder, thread-navigate, READ, REPLY/FORWARD, MARK (read / flag / kill), REFILE, SEARCH, RELAY (LINK). Carts overlay brief / dead-drop content + auto-DOSSIER-capture (BBDB).

Bare-launch default world

Per the global bare-launch default-world policy (enrich-never-gate, ADR-0042), genuinely useful here: bare kn9 shows the operator’s real inbox, handler messages that have actually arrived across the deck’s life (genuinely persistent comms on the deck).

A true utility (read your real messages, walk your threads), and it teaches the grammar: enter a folder, navigate a thread, read, mark, reply. No mission-specific dead-drops, no LINK traffic.
Enrich-never-gate: insert a cart and the mission’s briefs + dead-drops populate the feed (arriving on the World Clock).

What kn9 does NOT own

kn9 is the give-side comms channel: intel you’re handed, not intel you find. It does not own:

Recon / discovery. Finding hosts (bzbx, bzbx.md), riding hosts (CONDUIT, conduit.md), mapping orgs (RIPSAW, ripsaw.md) is the find-side. kn9 receives the brief and the dead-drop; the operator does the recon elsewhere.
The durable record. DOSSIER (dossier.md) is the persistent intel store; kn9 auto-captures into it (BBDB-style), it doesn’t keep the canonical record.
Mission timing / the phase chain. The mission owns when a feed item arrives and when a goal flips; kn9 surfaces arrivals and fires goal verbs, but the engine owns the clock.
Economy. Contracts, credits / reputation are mission-layer. Durable consequence is the engine’s via the sanctioned outcome path (ADR-0040).

Tier 3 — Detailed design

Gate: approved (the v1 design; merged through PR review).

Implementation seam (GWP-629): file names, FFI signatures, node schemas, and ADR contracts appear from here down.

The world it reads (`:world`)

kn9’s :world is its slice of the central World Engine’s generated world (see ../runtime/world-engine.md): the message store, a feed whose items arrive over time on World Engine clock events. It is coherent with the rest: a dead-drop carries the cred for the host bzbx found; a brief names the entity RIPSAW maps. Types:

Node	Key fields	DOSSIER-discoverable key, or flavor?
`group` / `folder`	`:id` · `:kind` (`:handler` / `:dead-drop` / `:link` / `:archive`) · `:unread`	source of messages; flavor
`message`	`:id` · `:from` · `:subject` · `:thread` · `:body` · `:attachments` · `:flags` · `:reveals` (keys it carries) · `:arrives-at` (the tick it appears)	brief-borne leads + dead-drop payloads the cart tags = keys (see Export to DOSSIER)
`thread`	the conversation tree (Gnus threading)	structure; flavor

Discoverable vs flavor: dead-drop payloads (creds, coordinates, files) and brief-borne leads (a name, an account, a host) the cart tags are keys; chatter is flavor. The world region is the single shared mission world-region (run-state): one region per mission (enrichment-contract.md §2, §4). The cart’s world-archetype seeds the store and the arrival timeline (a brief at mission start; a dead-drop after phase 1).

Feed / tick: messages arrive on World Engine clock events. kn9 is the canonical feed consumer, and the Mission Board is the same engine (a feed of contracts).

Scope-line: construction (knEmacs mode vs cell-API)

Verdict: knEmacs mode, the data / structured-navigation tier of the ADR-0046 scope line (ADR-0046), Gnus / Mutt lineage. No real-time, no split.

Three engine surfaces: a group buffer (a tabulated-list of folders + unread counts, the shared table, identical in shape to the Mission Board’s feed), a thread tree (the engine tree-cursor over the conversation), and a message buffer (text). A feed arrival is a tick event, not an animation. Compose (REPLY / RELAY) is read-mostly in v1 and rides the nEmacs literal / Nokia multi-tap path (the same editing surface DOSSIER’s operator-notes lane uses): authoring is bounded, not a full mail client. SEARCH / jump-to-group ride the minibuffer completing-read.

`:payload`

Small by-value params only, never the message store (that arrives via :world):

(launch-app :kn9
  :world   mission-comms                       ; opaque live handle to the message store
  :payload '(:open  :handler                    ; folder to open
             :since <run-stamp>))                ; filter to recent arrivals

:open / :since: which folder, how far back. The store + the arrival timeline are in :world; arrivals fire as World Engine clock events.
Bare (no :world) ⇒ the operator’s real inbox (see Bare-launch default world in Tier 2).

Export to DOSSIER

kn9’s signature is auto-capture (BBDB): processing a message that carries a tagged lead emits it (the inverse of recon: intel you’re given, not intel you find). All emission is through the sanctioned (dossier-commit <key>) primitive, never a raw write (ADR-0049, ADR-0005). Fact-node fields per dossier-data-model.md §3:

Key	When	Carries
`host:<id>:cred`	a dead-drop delivers a credential	`:conf :verified`; enables CONDUIT pre-auth
`acct:<id>:lead` / `org:<id>:contact`	a brief names an account / person	`:links` to the named profile (auto-files into DOSSIER, BBDB-style)
`loc:<id>`	a dead-drop delivers coordinates	reveals a `:facility`

Reads ((dossier-has? <key>)): kn9 is mostly phase-gated (a dead-drop folder appears after a goal completes, feed timing), so it reads mission / phase state more than dossier-has?. A brief may reference a fact you must already hold (a soft gate). Net: kn9 is a source of keys (handler intel), the give-side counterpart to bzbx / RIPSAW’s find-side.

Objective-graph ties

Which kn9 verbs / feed events fire goal verbs (ADR-0043):

READ a handler brief → (goal-reveal …): a brief can define / reveal the next phase’s objectives (the job is briefed here).
Process a dead-drop payload → (goal-complete 'receive-<drop>) + auto-commits its keys (a cred enables CONDUIT; coordinates reveal a :facility).
RELAY to / from a linked deck (LINK) → a cooperative cross-deck goal (the LINK channel).
A message arriving (World Engine feed event) → can (goal-reveal) a new contract (the handler offering work, the Mission-Board-is-a-feed tie). The mission owns timing.

Engine reuse

kn9 is a kn9-mode on the knEmacs application engine (built, kec-lisp ADR-0004; see ADR-0046), and the clearest case of the feed engine. It consumes:

tabulated-list: the group buffer (folders + unread). Identical in shape to the Mission Board’s feed: kn9 + Mission Board are the pair that proves a shared feed-reader library (rule-of-three with bzbx / RIPSAW / Kommander’s tables → extract one tabulated-list / feed lib).
tree-cursor: the thread tree (Gnus threading).
nEmacs literal / multi-tap: REPLY / RELAY compose (the DOSSIER-notes editing surface; read-mostly v1).
minibuffer completing-read: SEARCH / jump-to-group.
define-major-mode: kn9-mode.

The kn9 → DOSSIER bridge is BBDB auto-capture (see Export to DOSSIER). CIPHER stays OLED-exclusive (a message’s crypto flavor narrates on OLED, never the main grid).

Interfaces

Launch: (launch-app :kn9 :world <message-store-handle> :payload '(:open … :since …)) — NoshAPI Tier 1 (ADR-0049, ADR-0005). :world is the live message store; :payload is small params only.
Export: (dossier-commit <key>) — sanctioned auto-capture deposit; read: (dossier-has? <key> &key min-conf) (ADR-0049, ADR-0005).
Display: draws on the cartridge / content rows (1–73) per the canonical grid (see the Canonical Hardware Specification); grid queried via the cell-API getters.
Authored in KEC Lisp. Program source lives at runtime/programs/kn9/ (ADR-0042).

Open / deferred

The opaque live :world handle. Feed items arriving mid-mission on World-Clock ticks need the opaque live handle to be seen live. (Update 2026-07-18: the ADR-0049 amendment landed, 2026-06-28; the live handle is built and tested, and kn9’s MAIL_ARRIVED polling rides it. See worked-mission-walkthrough.md.) kn9’s phase-gated folders could also be re-snapshotted per launch in the v1 transport while it was pending.
The shared tabulated-list / feed library. kn9’s group buffer + the Mission Board’s contract feed are the pair that proves a shared feed-reader library; the rule-of-three extraction is engine work, not a kn9 blocker.
The World Engine spec. The generator + the feed event stream the arrival timeline depends on is specified in ../runtime/world-engine.md (kn9 + the Mission Board are the shared feed-engine pair, §7).
Compose scope. REPLY / RELAY is read-mostly in v1 (bounded multi-tap authoring); a fuller compose surface is deferred.
Recon heat / exposure is a mission-layer concern, deferred for v1 (../runtime/recon-mode.md).

Migration notes

2026-07-18 tier migration: content re-cut under tier headings from the v1 design; no mechanics changed. World schema, scope-line, and FFI moved behind the Tier 3 seam; identity and bare-launch behavior stayed at Tier 2. The “forthcoming ADR-0049 amendment” note was stale (the amendment landed 2026-06-28; MAIL_ARRIVED polling is built and tested); annotated in place.

References

enrichment-contract.md — lens / world / shared-region / dossier-commit contract (§1–§6).
dossier-data-model.md — the fact-node schema an auto-captured lead commits as (§3).
dossier.md — the durable intel store kn9 auto-captures into.
conduit.md · bzbx.md · ripsaw.md — the find-side recon programs kn9’s give-side complements.
../runtime/world-engine.md — the central World Engine (generator + World Clock + typed-event bus); kn9’s feed shares the Mission-Board feed engine (§7).
../gameplay-framework.md — the gameplay framework the World Engine serves as world model for.
ADR-0042 — first-party programs; carts enrich, never gate.
ADR-0046 — the knEmacs application engine (major modes + minibuffer command-by-name).
ADR-0049 · ADR-0005 — the NoshAPI FFI surface (launch-app / dossier-commit / dossier-has?).
ADR-0043 — the mission objective model kn9’s verbs / feed events fire.
ADR-0040 — the UDS sanctioned-write boundary dossier-commit respects.

Inspirations

Assigned by Josh in the kn86-inspo workbench. Full map: cart-inspiration-map.md.

Source	Category
hackernews-TUI	reader
newsboat	reader