Kinoshita Kommander: two-panel filesystem navigator

First-party on-device program #6 (ADR-0042).

v1.1 | 2026-07-18

Canonical per ADR-0042. A CONDUIT session exposes the remote mounts Kommander stages from; carts overlay staging / exfil-routing verbs. See the program roster.

Tier 1 — Treatment

Gate: draft (stub). Basics from the ADR-0042 charter and the Tier 2 spec; the treatment pass has not been written and this stub invents no design.

The hook

The deck’s two-panel filesystem navigator (Norton Commander / Dired lineage): where exfiltrated data lands and is staged. It works on the fictional remote mission targets reached via a live CONDUIT session; the operator never browses the deck’s actual OS filesystem. bzbx finds, CONDUIT rides, Kommander carries it home.

What the operator does

Navigate two panels of an in-world filesystem, MARK a tagged file, COPY it across to stage the exfil, HANGUP-safe before the mount drops. The repeating decision: which files are the loot and how to get them home before a trace kills the session.

Feel

Owed to the treatment pass.

Feasibility verdict

Reuses: the knEmacs application engine (tabulated-list panels, tree-cursor, minibuffer, dual-panel major-mode) and the World Engine’s filesystem model; the program-to-program handoff into CONDUIT.
New surface required: none; the dual-panel commander rides existing primitives.

Open questions

Deferred to the tiers below (see Open / deferred in Tier 3).

Tier 2 — Operator spec

Gate: approved (the v1 design; merged through PR review).

Identity

Kinoshita Kommander is the deck’s two-panel filesystem navigator (Norton Commander / Dired lineage): where exfiltrated data lands and is staged. It works primarily on the fictional remote mission targets (in-world filesystems reached via a live CONDUIT session); a cart may optionally expose a limited cart-supplied filesystem too. Like every program it does no real I/O: every mount is an in-world model (enrichment-contract.md §2); the operator never browses the deck’s actual OS filesystem.

Operator program #6 (ADR-0042). First-party, always-present, bare-launchable, never superseded. The filesystem / logistics layer of the recon cluster.
Generic verb floor (ships, bare-launchable): enter / parent / MARK, COPY/MOVE/RENAME/DELETE, MKDIR, clone-to-passive-pane (K), VIEW, find / filter, AVFS-into-archives, open-terminal-into-dir (→ launches a CONDUIT session into the current remote mount). Carts overlay staging / exfil-routing, UNPACK/DECRYPT.

Bare-launch default world

Per the global bare-launch default-world policy (enrich-never-gate, ADR-0042), but diegetic: bare Kommander shows a small authored, in-world “deck” filesystem to browse, the deck’s fictional local store. The operator is never browsing the actual OS filesystem (no program does real I/O, enrichment-contract.md §2). The local surface is simulated, like everything else the programs look at.

It teaches the whole grammar against the authored local fs: navigate, mark, copy-to-other-panel, view, make a directory. No remote mounts (none until a CONDUIT session is live), no mission keys.
Enrich-never-gate: insert a cart + open a CONDUIT session and a fictional remote mission mount appears in the other panel; the same COPY now exfiltrates.

What Kommander does NOT own

Kommander is file logistics: it moves / stages files between fictional mounts. It does not own:

Primary discovery. Finding the host, reading the banner, spotting the secret is bzbx (bzbx.md) and CONDUIT (conduit.md). Kommander moves what was already found.
The session / access. Riding one host (the command/response shell, the auth) is CONDUIT’s. Kommander only sees a remote mount once CONDUIT has made it reachable.
The org / relationship graph. Who connects to whom is RIPSAW’s layer (ripsaw.md). Kommander walks filesystems (concrete files you copy / move / delete), not entity graphs.
Missions / economy / the durable record. Contracts, the objective graph, credits / reputation, and the persistent intel store are mission-layer + DOSSIER (dossier.md). Durable consequence is the engine’s via the sanctioned outcome path (ADR-0040).

Tier 3 — Detailed design

Gate: approved (the v1 design; merged through PR review).

Implementation seam (GWP-629): file names, FFI signatures, node schemas, and ADR contracts appear from here down.

The world it reads (`:world`)

Kommander’s :world is its slice of the central World Engine’s generated world (see ../runtime/world-engine.md): fictional, in-world mountable filesystems, the FILESYSTEM layer (multi-mount). Every mount is a cart-installed in-world model, no real I/O, no real device filesystem (enrichment-contract.md §2). It is coherent with the rest: a remote mount is the filesystem of the host CONDUIT rides; a file here is the one bzbx’s host holds, owned by the entity RIPSAW maps. Types:

Node	Key fields	DOSSIER-discoverable key, or flavor?
`mount`	`:id` · `:kind`, `:remote` (the fictional mission-target fs, reached via CONDUIT, the primary case) or `:cart-fs` (an optional, limited cart-supplied filesystem) · `:host` (remote → the CONDUIT-accessed host) · `:root` · `:writable?`	a `:remote` mount appears only when a CONDUIT session is live; no `:device-sd` / real OS mount
`fs-node`	`:path` · `:kind` (`:file` / `:dir`) · `:size` · `:mtime` · `:tags` (`:exfil-target` / `:encrypted` / `:archive`) · `:located-at` (mount)	a tagged mission file = located-file flavor → key on staging (see Export to DOSSIER)
`archive` (AVFS)	a `.zip` / `.tgz`-like node navigable into transparently · `:entries`	unpacking is a verb; a tagged file inside = key on reveal

The world region is the single shared mission world-region (run-state): one region per mission (enrichment-contract.md §4). Kommander is logistics, not primary discovery: the finding happened in CONDUIT / bzbx; Kommander moves what was found, between fictional mounts. The cart’s world-archetype seeds which remote targets exist, their trees, and (optionally) a limited cart-fs.

Tick-aware: a remote mount drops if its CONDUIT session is traced / killed (a World Engine wall-clock heat event): a copy in flight can be cut off; the mission owns the :hold.

Scope-line: construction (knEmacs mode vs cell-API)

Verdict: knEmacs mode, the data / structured-navigation tier of the ADR-0046 scope line (ADR-0046), Dired × 2 / Sunrise lineage. No real-time, no split.

The two-panel commander is the canonical mark-and-act surface: each panel is a tabulated-list file listing (name · size · mtime · tags, the same shared table bzbx / RIPSAW want, another consumer), navigated with the engine tree-cursor; MARK then a verb (COPY/MOVE/DELETE) acts on the selection; clone-to-passive-pane (K) is the source ↔ dest core. AVFS-into-archives is just navigating a virtual subtree (tree-cursor over archive entries). open-terminal-into-dir is a program handoff: it (launch-app :conduit …) into the current remote mount (the Sunrise terminal-integration seam made diegetic). All pure data over the mounts, headlessly testable. find / filter / jump-to-path ride the minibuffer completing-read.

`:payload`

Small by-value params only, never the filesystems (those arrive via :world):

(launch-app :kommander
  :world   relay-7-mounts                      ; opaque live handle to the mount set
  :payload '(:left  :device-sd                  ; left panel mount
             :right "fin-relay-07:/var"         ; right panel (a remote mount, if a session is live)
             :focus :exfil))                     ; lens hint: foreground tagged exfil targets

:left / :right: which mount each panel opens on. :focus foregrounds tagged files.
Bare (no :world) ⇒ the fictional deck filesystem (see Bare-launch default world in Tier 2).

Export to DOSSIER

Kommander’s durable output is modest and outcome-shaped (it stages; it doesn’t discover), emitted only through the sanctioned (dossier-commit <key>) primitive, never a raw write (ADR-0049, ADR-0005). Fact-node fields per dossier-data-model.md §3:

Key	When	Carries
`file:<path>:exfiltrated`	a tagged mission file is staged to the deck’s local store	the OBTAIN outcome: this is where exfil completes
`file:<path>:located`	a tagged file is found in a mount (secondary to CONDUIT’s files-seen)	`:links (:located-at "<mount>")`

Staging is volatile run-state (moving a file between mounts mutates the shared region); the durable consequence (you got the loot, landed in the deck’s local store) is the dossier-commit / mission completion. No raw writes.
Reads ((dossier-has? <key>)): (dossier-has? host:<id>:cred) / host:<id>:reachable: a remote mount only exists if its CONDUIT session is reachable, so Kommander consumes the access bzbx / CONDUIT / Keyring earned. Kommander is the end of the thread: bzbx finds → CONDUIT rides → Kommander carries it home.

Objective-graph ties

Which Kommander verbs fire goal verbs (ADR-0043):

COPY/MOVE a tagged exfil file to the deck → (goal-complete 'exfil-<file>): the OBTAIN payoff lands here (CONDUIT pulls into the session; Kommander carries to the deck = the completed exfil).
UNPACK an archive (AVFS) revealing a tagged file → (goal-reveal …).
Stage a required file set → (goal-complete 'stage-payload).
open-terminal-into-dir → (launch-app :conduit …): a program handoff, not a goal itself.
Tick-aware: a remote mount dropping mid-copy (World Engine heat event) can fail an in-flight transfer; the mission’s :hold (trace timer) is the pressure to grab the file and go.

Engine reuse

Kommander is a kommander-mode on the knEmacs application engine (built, kec-lisp ADR-0004; see ADR-0046). It consumes:

tabulated-list: each panel’s file listing (name / size / mtime / tags). Another consumer of the shared table (bzbx / RIPSAW / kn9 / Keyring), which strongly reinforces the rule-of-three extraction.
tree-cursor (CAR/CDR/BACK): descend / parent through directories + into AVFS archives (a virtual subtree).
minibuffer completing-read: find-file / filter / jump-to-path / pick-a-mount (the command-by-name narrowing).
define-major-mode: kommander-mode + the dual-panel (active / passive, Sunrise passive-navigation).

Program composition: open-terminal-into-dir (launch-app :conduit …), the cleanest program-to-program seam in the set (Sunrise’s eshell integration, made diegetic). CIPHER stays OLED-exclusive.

Interfaces

Launch: (launch-app :kommander :world <mount-set-handle> :payload '(:left … :right … :focus …)) — NoshAPI Tier 1 (ADR-0049, ADR-0005). :world is the live mount set; :payload is small params only.
Export: (dossier-commit <key>) — sanctioned fact-node deposit; read: (dossier-has? <key> &key min-conf) (ADR-0049, ADR-0005).
Program handoff: (launch-app :conduit …): open-terminal-into-dir opens a CONDUIT session on the current remote mount.
Display: draws on the cartridge / content rows (1–73) per the canonical grid (see the Canonical Hardware Specification); grid queried via the cell-API getters.
Authored in KEC Lisp. Program source lives at runtime/programs/kommander/ (ADR-0042).

Open / deferred

The opaque live :world handle. A remote mount that drops mid-copy when a CONDUIT session is killed (live tick reaction) needs the opaque live handle. (Update 2026-07-18: the ADR-0049 amendment landed, 2026-06-28; the live handle is built and tested. See worked-mission-walkthrough.md, Seam 2.) The shipped copy-by-value transport could not re-sync mid-mission while it was pending.
The shared tabulated-list library. Each panel’s file listing is the same table bzbx / RIPSAW / kn9 / Keyring want; the rule-of-three extraction of one shared library is engine work, not a Kommander blocker.
The World Engine spec. The generator + clock + typed-event bus the tick-awareness above depends on is specified in ../runtime/world-engine.md.
Recon heat / exposure is a mission-layer concern, deferred for v1 (../runtime/recon-mode.md).

Migration notes

2026-07-18 tier migration: content re-cut under tier headings from the v1 design; no mechanics changed. World schema, scope-line, and FFI moved behind the Tier 3 seam; identity and bare-launch behavior stayed at Tier 2. The “forthcoming ADR-0049 amendment” note was stale (the amendment landed 2026-06-28, Seam 2 built and tested); annotated in place.

References

enrichment-contract.md — lens / world / shared-region / dossier-commit contract (§1–§6).
dossier-data-model.md — the fact-node schema staging commits as (§3).
dossier.md — the durable intel store Kommander emits into.
conduit.md — the session program that exposes the remote mounts Kommander stages from.
bzbx.md · ripsaw.md — the wire-recon and org-graph layers of the recon cluster.
../runtime/world-engine.md — the central World Engine (generator + World Clock + typed-event bus) Kommander’s :world slice reads.
../gameplay-framework.md — the gameplay framework the World Engine serves as world model for.
ADR-0042 — first-party programs; carts enrich, never gate.
ADR-0046 — the knEmacs application engine (major modes + minibuffer command-by-name).
ADR-0049 · ADR-0005 — the NoshAPI FFI surface (launch-app / dossier-commit / dossier-has?).
ADR-0043 — the mission objective model Kommander’s verbs fire.
ADR-0040 — the UDS sanctioned-write boundary dossier-commit respects.

Inspirations

Assigned by Josh in the kn86-inspo workbench. Full map: cart-inspiration-map.md.

Source	Category
Midnight Commander (mc)	file browser
clipse	file browser
mcfly	file browser
mynav	file browser