knSALK: deck defense bundle (firewall / antivirus / internal ICE)
First-party on-device program #13 (ADR-0042).
v1.1 | 2026-07-18
The deck’s self-defense program: the inverse of the offensive toolkit. Fills gap F (the last) of the gameplay framework. Where this and an ADR disagree, the ADR wins. Design drafted 2026-06-21 (Gameplay Design); promoted from the charter stub. See the program roster.
Tier 1 — Treatment
Section titled “Tier 1 — Treatment”Gate: draft. The treatment content below is design-drafted, not yet merged as an approved tier.
The hook
Section titled “The hook”Every offensive program points outward: you scan, breach, and exfil someone else’s system. knSALK is the one that points inward, because while you’re hacking them, they can hack back. A defender who notices you (your heat) can trace back along your connection and counter-intrude on your own deck. knSALK stands between that intrusion and your stuff: the shield that keeps an enemy’s trace programs and counter-intrusion off the operator’s deck while they work.
This makes the device’s central tension symmetric: the same skills, the same ICE model (ice-breaker.md: JUNK / BLACK / RED / HUNTER), the same trace-out failure, but now you’re the system being attacked, and knSALK is your perimeter.
What the operator does
Section titled “What the operator does”Mostly nothing, most of the time: a passive shield silently absorbs low-grade counter-intrusion and modifies the threat math. When pressure exceeds the shield (a serious intrusion, a HUNTER against you), the offensive op interrupts and the operator defends in real time, using DEFENDER verbs turned on their own deck. The repeating decision: how much heat headroom to buy (harden the shield) versus staying cold enough that defense never becomes active work.
Rare, tense, symmetric. Rip-and-run stays cold and rarely sees knSALK fire; a long, loud, measured op invites a counter-stand. When the active stand fires, it is the offensive tension inverted: your own trace-out clock, your own perimeter to hold.
Feasibility verdict
Section titled “Feasibility verdict”- Reuses: the ICE classes / trace / HUNTER model (
ice-breaker.md) pointed at the operator, the DEFENDER Tier-2 verb spine (verb-taxonomy-map.md§DEFENDER), the heat economy (recon-mode.md) as the trigger, the existing trace/threat + event-bus plumbing, and the CIPHER OLED event handoff (ADR-0015). Hardening rides the economy model’s upgrade catalog. - New surface required: none anticipated. The active stand is a grammar capability (
capability-shapes.md), scriptable via Lambda Slots; no new NoshAPI primitive is anticipated beyondlaunch-app(already amended). Flag for an ADR-0005 amendment only if a defense-event primitive proves necessary at the engineering spike. - Scope fork: whether knSALK is formally the DEFENDER baseline that Sysop Mode deepens, or just shares its vocabulary, is a design call carried to Tier 2 (see §“knSALK vs Sysop Mode”).
Open questions
Section titled “Open questions”- Stakes / heat tuning, the defender-floor relationship, PvP counter-intrusion, and the FFI confirmation are carried to the tiers below (see Open / deferred in Tier 3).
Tier 2 — Operator spec
Section titled “Tier 2 — Operator spec”Gate: draft. The operator-experience content is design-drafted, not yet merged as an approved tier.
Identity
Section titled “Identity”The deck’s own defense bundle: firewall, antivirus, and internal ICE. The defensive counterpart to the offensive toolkit (CONDUIT / RIPSAW / Keyring / bzbx / ICE BREAKER): the shield that keeps an enemy’s trace programs and counter-intrusion off the operator’s deck while they work. Name: Salk → vaccine → immunization (the house-brand kn prefix family, cf. kn9).
The frame: your deck is also a target
Section titled “The frame: your deck is also a target”Every offensive program points outward; knSALK points inward, because while you’re hacking them, they can hack back. A defender who notices you (your heat) can trace back along your connection and counter-intrude on your own deck. knSALK stands between that intrusion and your stuff.
Heat is the trigger (the double-edged meter)
Section titled “Heat is the trigger (the double-edged meter)”The coupling that ties offense and defense into one system: the heat you accrue on offense is what brings the counter-intrusion. Recon casing (recon-mode.md) and in-op trace (ice-breaker.md) feed one heat timeline; knSALK reads the other end of it:
counter-intrusion pressure = f(operator heat) breakthrough fires when pressure > knSALK passive-shield strengthSo the offensive heat meter is no longer just “a harder op”: at high heat, they come for your deck. Rip-and-run stays cold and rarely sees knSALK fire; a long, loud, measured op invites a counter-stand. Hardening knSALK raises the breakthrough threshold, buying more heat headroom before defense becomes active work.
The hybrid model: passive shield + active stand
Section titled “The hybrid model: passive shield + active stand”knSALK runs in two layers (mirroring the offensive side’s passive trace-decay + active HUNTER moments):
- Passive shield (always-on). A background posture (firewall rules + AV signatures + base internal-ICE strength) that silently absorbs low-grade counter-intrusion and modifies the threat math. Set-and-forget for the common case; its strength is a build you buy and tune. This is what keeps defense from being constant busywork.
- Active stand (breakthrough). When pressure exceeds the passive shield (a serious intrusion, a HUNTER-against-you), the offensive op interrupts and the operator must defend in real time. Rare, tense, and the moment knSALK becomes gameplay rather than a stat.
The three facets: one program, the threat lifecycle
Section titled “The three facets: one program, the threat lifecycle”Firewall / antivirus / internal-ICE are three modes of one program, mapped to the three moments of a threat:
| Facet | When | Does | Layer |
|---|---|---|---|
| Firewall | before, prevention | inbound blocking rules + posture; the passive perimeter that sets the breakthrough threshold | passive |
| Antivirus | after, remediation | scan & neutralize hostile payloads picked up from the wire / a target / a cart; the between-ops hygiene loop + the cleanup that recovers a debuff | passive + on-demand |
| Internal ICE | during, response | the active stand: defensive ICE you raise and fight with when an intrusion is underway | active |
The active stand is a DEFENDER-verb grammar engagement (capability-shapes: grammar, not a bespoke mini-game). It reuses the DEFENDER Tier-2 spine from verb-taxonomy-map.md: QUARANTINE the payload, BANISH the intruder, PLACE-ICE / REROUTE / COUNTER-INTRUDE, turned defensively on your own deck. Because it’s grammar, it’s scriptable: an operator can author an auto-defense lambda (Lambda Slots) that fires a stock response so a breakthrough mid-op doesn’t always demand hands-on attention. (Sysop Mode deepens the same spine offensively-against-attackers; see §“knSALK vs Sysop Mode”.)
Hardening: the defensive build (credit sink)
Section titled “Hardening: the defensive build (credit sink)”Per economy-model.md, hardening knSALK is a permanent program-tier purchase in the upgrade catalog. Upgrades raise the passive-shield strength (a higher breakthrough threshold), add firewall rule capacity, improve AV neutralize speed, and strengthen internal-ICE for the active stand. So defense is a build choice: a stealth-rig operator who buys trace-decay leans on staying cold; a loud-but-armored operator buys knSALK and tanks the counter-stand. Both viable, the same generalist-vs-specialist axis as the rest of the economy.
Stakes: what a breach costs (the tuning knob)
Section titled “Stakes: what a breach costs (the tuning knob)”Escalating, and deliberately recoverable: defense failure should sting, not brick a save.
| Outcome | Cost |
|---|---|
| Absorbed (passive shield holds) | nothing (maybe a small heat bump) |
| Breakthrough, defended (active stand wins) | you keep going; some time/heat spent |
| Breakthrough, not defended → trace-out | forced disconnect of the current op = run fail / abandon (mirrors the offensive trace-out penalty) |
| Deep intrusion (worst) | a temporary, recoverable deck debuff: a locked DOSSIER slice, a credit skim, a rep ding, cleaned up with a knSALK AV scan (a short self-directed remediation loop) |
Never permanent UDS destruction. Durable consequences are sanctioned outcomes (ADR-0040 §6) routed through the guarded cores, always with a recovery path (the AV scan). The exact numbers (pressure curve, threshold per hardening tier, debuff severity/duration) are the key tuning knob, deferred to balance.
knSALK vs Sysop Mode (don’t confuse them)
Section titled “knSALK vs Sysop Mode (don’t confuse them)”Both speak DEFENDER (verb-taxonomy-map.md) and both end in trace-out, but they’re different seats:
| knSALK | Sysop Mode | |
|---|---|---|
| What | the deck’s own self-defense | a cart: you defend a network for pay |
| Category | first-party program (always present) | removable capability cartridge (sysop-mode.md) |
| When | during your offensive ops (reactive) | a chosen contract (you are the defender; PvP/asymmetric) |
| Seat | protecting your stuff | hunting an intruder for a bounty |
They share the DEFENDER verb vocabulary; plausibly knSALK is the shallow defender floor (the always-there baseline) that Sysop Mode deepens into full asymmetric defender gameplay (the baseline-vs-cart-deepened pattern, DeckRunner §11). Whether that relationship is formal is an open question (Tier 3).
Tier 3 — Detailed design
Section titled “Tier 3 — Detailed design”Gate: draft. State/surface and the FFI position are design-drafted; the behavior tables (the active-stand verb map, the pressure/threshold curves) are owed the design + balance pass.
Implementation seam: file names, FFI, and ADR contracts appear from here down.
State & surface
Section titled “State & surface”- Hardening / posture (the build): durable, set via sanctioned purchase (the credit-sink build) + Config toggles for firewall posture. Persists like any rig upgrade.
- Live threat (incoming intrusion, the active stand): run-state (volatile; resets at the run boundary).
- Breach consequences (debuffs): sanctioned outcomes (the guarded UDS path), recoverable.
- Surface: the threat surface renders on the main grid (Keyring-style); knSALK alerts route to the CIPHER-LINE OLED via event hand-off (no main-grid CIPHER glyphs, ADR-0015). One program, the three facets as modes/tabs.
The active stand uses DEFENDER verb-tools (program-internal, surfaced via the DeckRunner interface) and rides the existing trace/threat + event-bus plumbing; no new NoshAPI primitive is anticipated beyond launch-app (already amended). Confirm at the engineering spike; flag for an ADR-0005 amendment only if a defense-event primitive proves necessary.
Open / deferred
Section titled “Open / deferred”- Stakes / heat tuning. The pressure curve, breakthrough threshold per hardening tier, debuff severity + duration. The balance pass (best against a running build).
- Defender-floor relationship. Is knSALK formally the DEFENDER baseline that Sysop Mode deepens, or just shares its vocabulary? (Cart-vs-program categories differ; the verb spine is shared either way.)
- PvP counter-intrusion. When the attacker is another operator over the link cable (Sysop Mode’s domain), does knSALK mediate the defended deck? Ties to the link-cable layer (GWP-330).
- The active-stand behavior tables. The DEFENDER verb → effect map, the facet mode/tab layout, and the pressure/threshold data shapes are the design work this Tier-3 pass owes once the balance knobs are set.
References
Section titled “References”../runtime/recon-mode.md— the heat economy that triggers counter-intrusion (this is its defensive inverse).../cartridges/modules/ice-breaker.md— the ICE classes / trace / HUNTER model, now pointed at the operator.../cartridges/design-bibles/verb-taxonomy-map.md§DEFENDER — the verb spine the active stand reuses.../cartridges/modules/sysop-mode.md— the DEFENDER cart (defend-a-network-for-pay); shares vocabulary, different seat.../runtime/economy-model.md— hardening knSALK is a program-tier purchase in the upgrade catalog.../cartridges/authoring/capability-shapes.md— the active stand is a grammar capability.- ADR-0040 (sanctioned-write boundary), ADR-0015 (CIPHER hand-off), ADR-0042 (charter).
../gameplay-framework.md— knSALK fills gap F.