RIPSAW: LDAP / org-chart relationship viewer

First-party on-device program #8 (ADR-0042).

v1.1 | 2026-07-18

Canonical per ADR-0042. Black Ledger’s RIPSAW recon maps a shell-company org graph; carts overlay domain attributes + linkage types. See the program roster.

Tier 1 — Treatment

Gate: draft (stub). Basics from the ADR-0042 charter and the Tier 2 spec; the treatment pass has not been written and this stub invents no design.

The hook

The deck’s LDAP / org-chart relationship viewer: it walks org charts and offshore-account topology, surfacing how people, corporations, and accounts connect. The player hunts linkages and clues: this CFO secretly controls that shell; this account is beneficially owned three hops away. The canonical recon program for who’s connected to whom. “Rips with the grain.”

What the operator does

QUERY an org by name or attribute, EXPAND the tree, FOLLOW a hidden ownership edge to the real beneficiary, COMMIT the linkage to DOSSIER. The repeating decision: which edge to follow through the shell haystack to find the concealed owner.

Feel

Owed to the treatment pass.

Feasibility verdict

Reuses: the knEmacs application engine (tree-cursor + outline fold, tabulated-list detail panel, EUDC-style minibuffer QUERY) shared with the DOSSIER store, and the World Engine’s org-graph model.
New surface required: none for v1; an optional cell-API relationship-graph render is a declined, deferred texture.

Open questions

Deferred to the tiers below (see Open / deferred in Tier 3).

Tier 2 — Operator spec

Gate: approved (the v1 design; merged through PR review).

Identity

RIPSAW is the deck’s LDAP / org-chart relationship viewer: it walks org charts and offshore-account topology, surfacing how people, corporations, and accounts connect. The player hunts linkages & clues: this CFO secretly controls that shell; this account is beneficially owned three hops away. The canonical recon program for who’s connected to whom. (“Rips with the grain.”)

Operator program #8 (ADR-0042). First-party, always-present, bare-launchable, never superseded. The entity-graph layer of the recon cluster (vs. bzbx’s wire, CONDUIT’s host, Kommander’s files).
Generic verb floor (ships, bare-launchable): QUERY (by name / attribute), EXPAND/COLLAPSE, descend / ascend, INSPECT attributes, FOLLOW a reference (mgr → report, owner → account), COMMIT-to-DOSSIER. Carts overlay domain attributes + linkage types.

Bare-launch default world

Per the global bare-launch default-world policy (enrich-never-gate, ADR-0042): bare RIPSAW shows the deck’s own “org of one”, the operator plus DOSSIER’s accumulated entity profiles rendered as a browsable directory tree (the people, corps, and accounts you’ve already filed across past missions).

Truthful, real content (you can walk what you actually know), and it teaches the whole grammar: query, expand, inspect attributes, follow a link. No external org, no mission keys.
Enrich-never-gate: insert a cart and the same lens now walks GLASS-CORP’s org graph over :world; the linkages you find there commit back into this same DOSSIER tree.

What RIPSAW does NOT own

RIPSAW maps the relationship / org graph: you spot the edge, you never “move” a node. It does not own:

The durable record. DOSSIER (dossier.md) is the persistent, cross-mission store where the linkages you found are kept and queried; RIPSAW shows the live target org graph (this run’s :world) where you find connections. You RIPSAW an org’s linkages into DOSSIER.
File logistics. Kommander (kommander.md) walks filesystems (concrete files you copy / move / delete); RIPSAW walks an entity / relationship graph. Both are dual-panel, but they are different layers.
The wire / the host. Probing the network (bzbx, bzbx.md) and riding one host (CONDUIT, conduit.md) are different layers; RIPSAW reads who’s connected, not what’s reachable or what’s on the box.
Missions / economy. Contracts, the objective graph, credits / reputation are mission-layer. Durable consequence is the engine’s via the sanctioned outcome path (ADR-0040).

Tier 3 — Detailed design

Gate: approved (the v1 design; merged through PR review).

Implementation seam (GWP-635): file names, FFI signatures, node/edge schemas, and ADR contracts appear from here down.

The world it reads (`:world`)

RIPSAW’s :world is its slice of the central World Engine’s generated world (see ../runtime/world-engine.md): the in-world org / entity graph, the RELATIONSHIP-graph layer. It is coherent with the rest (the person here owns the account AmberCalc audits, employed by the corp that owns the host bzbx found). Materialized lazily; the linkages are the gameplay. Types:

Node / edge	Key fields	DOSSIER-discoverable key, or flavor?
`entity` (`:person` / `:corp` / `:account` / `:facility`)	`:id` · `:name` · `:type` · `:role` / `:sector` · `:attrs` (LDAP-style: title, dept, jurisdiction, balance-est) · `:revealed?`	key entities = DOSSIER profile candidates (`:person` / `:account` / `:target`); skeleton entities = flavor
`edge` (the linkage, the point)	`:from` · `:to` · `:rel` ∈ {`reports-to`, `employs`, `owns`, `controls`, `beneficial-owner`, `located-at`, `signatory`} · `:hidden?` (the clue) · `:conf`	a discovered linkage = key carrying that `:rel` as a DOSSIER edge (`:owns` / `:controls` / `:employs` / `:located-at`); visible org-chart edges = flavor
`directory-node`	the LDAP / org hierarchy (`OU=…`) the entities hang on	structure = flavor (the haystack)

Discoverable vs flavor: the hidden / concealed edges (a beneficial-owner masked through three shells), the key entities, and the linkages the cart tags are keys, the clues; the visible org skeleton + decorative attributes are flavor (the haystack you search). The world region is the single shared mission world-region (run-state): one region per mission (enrichment-contract.md §2, §4). The cart’s world-archetype seeds the org (depth, shell count, where the real owner hides, the conspiracy-signature). This is Black Ledger’s RIPSAW recon (PROFILE archived filings → shell links + beneficiary candidate → (dossier-commit org:glass-corp:shell-links)).

Tick-aware: on a live case a new filing / registration is a World Engine clock event RIPSAW shows; cold cases are static (ticks = move-budget).

Scope-line: construction (knEmacs mode vs cell-API)

Verdict: knEmacs mode, the data / structured-navigation tier of the ADR-0046 scope line (ADR-0046), EUDC + Speedbar / outline lineage. No real-time, no split.

A RIPSAW screen is dual-panel: a foldable directory / org tree on one side (the engine tree-cursor, CAR/CDR/BACK + expand / collapse, the same outline the DOSSIER store uses) and an entity-detail / linkage panel on the other (a tabulated-list of attributes + the edges from the selected node). Both are pure data over the :world graph, headlessly testable, no display dependency. QUERY is a minibuffer completing-read over entity names / attributes (the EUDC directory lookup = the command-by-name narrowing). The temptation to render an animated node-graph (cell-API) is declined for v1: the gameplay is navigate → inspect → follow the edge, which is structured navigation, not an animation. (An optional cell-API relationship-graph render is a deferred texture, like bzbx’s waterfall, flagged, not primary.)

`:payload`

Small by-value params only, never the org graph (that arrives via :world):

(launch-app :ripsaw
  :world   glass-corp-org                    ; opaque live handle to the org-graph slice
  :payload '(:root  "OU=GLASS-CORP"          ; entry node into the org
             :focus :ownership                ; lens: :ownership | :org-chart | :accounts
             :depth 2))                        ; initial expand depth

:root / :focus / :depth: where to start, which relationship lens, how deep to pre-expand. :focus picks which edge-types are foregrounded (ownership vs reporting vs accounts).
Bare (no :world) ⇒ the deck’s own directory (see Bare-launch default world in Tier 2).

Export to DOSSIER

RIPSAW’s output is linkage facts, the discovered edges, emitted only through the sanctioned (dossier-commit <key>) primitive, never a raw write (ADR-0049, ADR-0005). Fact-node fields per dossier-data-model.md §3:

Key	When	Carries
`org:<id>:employs:<person>`	an employment edge is surfaced	`:links (:employs "<person>")`
`acct:<id>:beneficial-owner` / `:owns`	a (often hidden) ownership edge is followed to its real owner	`:links (:owns "<entity>")`; `:conf` by depth
`corp:<id>:controls:<shell>`	a control edge between corps / shells	`:links (:controls "<shell>")`
`org:<id>:shell-links`	the shell hierarchy is mapped	the topology fragment

Confidence by recon depth: passive PROFILE of public filings ⇒ :inferred; a corroborated cross-reference (two independent edges agree) ⇒ :verified; a single rumor ⇒ :rumored.
Reads ((dossier-has? <key>)): (dossier-has? <entity>:topology) → a previously-mapped org comes pre-seeded (she breached GLASS-CORP before, so the org tree pre-loads, banked knowledge de-risks this run). RIPSAW is where a linkage is found; DOSSIER is where it’s kept and queried. You RIPSAW an org’s linkages into DOSSIER.

Objective-graph ties

Which RIPSAW verbs fire goal verbs (ADR-0043):

QUERY/EXPAND maps the hierarchy → (goal-complete 'map-shell-hierarchy) (Black Ledger P1).
FOLLOW/INSPECT surfaces a hidden ownership edge → (goal-complete 'name-beneficiary) (P2 “name the beneficiary, file the verdict”).
A discovered linkage that names a new entity → (goal-reveal …): a shell pointing to another shell reveals it (the branching-shell co-conspirator); follows the thread to the next program (the account → AmberCalc; the person → kn9 / CONDUIT).
Observes tick events: on a live case a new registration / filing appears (World Engine clock event); cold-case Black Ledger is static, the run’s pressure is the move budget + case clock (the same :hold / TTL the engine already owns).

Engine reuse

RIPSAW is a ripsaw-mode on the knEmacs application engine (built, kec-lisp ADR-0004; see ADR-0046). It consumes:

tree-cursor (CAR/CDR/BACK) + outline / Speedbar fold: the org / directory tree; the same library DOSSIER uses (DOSSIER ≈ the Org store; RIPSAW ≈ the live org graph that feeds it). Strong shared-library candidate.
minibuffer completing-read (command-by-name): EUDC-style QUERY by entity name / attribute (the narrowing surface).
tabulated-list: the entity-attribute + linkage detail panel. RIPSAW is consumer #2 of the same table bzbx wants → this is the pair that triggers the rule-of-three extraction of a shared tabulated-list library, also the feed-engine base.
define-major-mode: ripsaw-mode + the dual-panel (tree ↔ detail).

Optional cell-API passenger: a relationship-graph node render (declined for v1, deferred). CIPHER stays OLED-exclusive.

Interfaces

Launch: (launch-app :ripsaw :world <org-graph-handle> :payload '(:root … :focus … :depth …)) — NoshAPI Tier 1 (ADR-0049, ADR-0005). :world is the live org-graph slice; :payload is small params only.
Export: (dossier-commit <key>) — sanctioned linkage-fact deposit; read: (dossier-has? <key> &key min-conf) (ADR-0049, ADR-0005).
Display: draws on the cartridge / content rows (1–73) per the canonical grid (see the Canonical Hardware Specification); grid queried via the cell-API getters.
Authored in KEC Lisp. Program source lives at runtime/programs/ripsaw/ (ADR-0042).

Open / deferred

The shared tabulated-list library. RIPSAW’s attribute table + bzbx’s capture table are the pair that triggers the rule-of-three extraction (the third consumer being kn9’s summary buffer); building each program’s table first, then extracting, is the discipline, not a hard blocker.
The opaque live :world handle. Live-case org events (a new filing appearing mid-mission) depend on the opaque live handle. (Update 2026-07-18: the ADR-0049 amendment landed, 2026-06-28; the live handle is built and tested. See worked-mission-walkthrough.md, Seam 3.) The cold-case (v1 Black Ledger) path is static and worked while it was pending.
The World Engine spec. The generator + clock + typed-event bus the tick-awareness above depends on is specified in ../runtime/world-engine.md.
Optional cell-API relationship-graph render. A node-graph visualization is a deferred texture, not primary.
Recon heat / exposure is a mission-layer concern, deferred for v1 (../runtime/recon-mode.md).

Migration notes

2026-07-18 tier migration: content re-cut under tier headings from the v1 design; no mechanics changed. World schema, scope-line, and FFI moved behind the Tier 3 seam; identity and bare-launch behavior stayed at Tier 2. The “forthcoming ADR-0049 amendment” note was stale (the amendment landed 2026-06-28, Seam 3 built and tested); annotated in place.

References

enrichment-contract.md — lens / world / shared-region / dossier-commit contract (§1–§6).
dossier-data-model.md — the fact-node / edge schema a linkage commits as (§3, §5).
dossier.md — the durable intel store RIPSAW emits into (RIPSAW finds the live org graph; DOSSIER keeps it).
ambercalc.md — the spreadsheet lens an RIPSAW-found account hands off to.
conduit.md · bzbx.md · kommander.md — the other recon-cluster layers.
../runtime/world-engine.md — the central World Engine (generator + World Clock + typed-event bus) RIPSAW’s :world slice reads.
../gameplay-framework.md — the gameplay framework the World Engine serves as world model for.
ADR-0042 — first-party programs; carts enrich, never gate.
ADR-0046 — the knEmacs application engine (major modes + minibuffer command-by-name).
ADR-0049 · ADR-0005 — the NoshAPI FFI surface (launch-app / dossier-commit / dossier-has?).
ADR-0043 — the mission objective model RIPSAW’s verbs fire.
ADR-0040 — the UDS sanctioned-write boundary dossier-commit respects.

Inspirations

Assigned by Josh in the kn86-inspo workbench. Full map: cart-inspiration-map.md. A row marked (cross-listed) was placed on another destination first and serves this one too (2026-07-29 workflow sweep).

Source	Category
Midnight Commander (mc)	file browser (cross-listed)