Skip to content
KN-86 Deckline

Worked multi-program mission: one live :world, one DOSSIER, several programs

Cross-program integration companion (GWP-630).

v1.1 | 2026-07-18

Single-tier companion (Tier-3 integration walkthrough). This is the “worked mission” deliverable of Phase 3: not a new program, but the canonical operator path through several programs that share one live :world and one accumulating DOSSIER. It documents how the three cross-program seams compose, what FFI each hop uses, and where the on-glass demo + the regression tests live. As of GWP-669 the chain is drivable entirely by keypress; see The key-driven chain. Cart authors building a multi-program contract follow this shape; the runtime guarantees the thread.

The thread (what makes it one mission, not five sessions)

Section titled “The thread (what makes it one mission, not five sessions)”

Two things are shared across every program the operator visits in a mission:

  1. The live :world — the opaque FE_TPTR handle into the single mission world-region (World Engine; ADR-0049 N1/N5). A program-initiated (launch-app …) re-mints the SAME region into the target program’s context (auto-carried from the caller’s *world* when no :world is passed), so a reveal/online/trace change one program makes is seen live by the next. The region is volatile run-state; it resets at the mission boundary.
  2. DOSSIER — the process-global fact store (ADR-0040; dossier-data-model), durable across missions and cart swaps within a powered session (cleared only at runtime init). A fact one program (dossier-commit …)s, the next program reads with (dossier-has? …). This is the durable thread; the live :world is the volatile one, reset at the mission boundary.

Both are wired into every program context by the GWP-630 dispatch bind (ADR-0049 N6); a program-initiated handoff is deferred + host-drained (N7) so switching programs never tears down the running context. None of this widens the durable-write boundary (N4): the only durable consequence is still dossier-commit.

The operator path

Section titled “The operator path”

A representative contract — trace a shell company’s beneficial owner, get into its finance relay, exfiltrate the ledger, and reconcile it. The operator walks five programs; the world and DOSSIER thread the whole way.

#ProgramWhat the operator doesThreads via
0kn9Reads the brief / a dead-drop that names the target org + a relay host.mail-arrived feed (World Engine §7); seeds the run.
1RIPSAWMaps the org graph; FOLLOWs a hidden ownership edge to the real beneficiary; promotes the beneficiary node of interest.world-reveal! on the shared region + dossier-commit acct:<id>:beneficial-owner / <type>:<id>:profile (Seam 3).
2KeyringCRACKs the relay’s lock. The captured key lands in the durable keystore; the cred commits to DOSSIER.keystore/commit! (durable, cross-mission) + dossier-commit host:<id>:cred (Seam 1, producer).
3CONDUITDIALs the relay. Opens pre-authenticated — off the DOSSIER cred or the owned keystore key.dossier-has? host:<id>:cred or keystore/has-held? (Seam 1, consumer).
4KommanderBrowses the relay’s mount; MARKs the ledger file; “open with” hands it to AmberCalc. Staging an exfil file commits the OBTAIN.launch-app :ambercalc :payload (:open <path>) carrying the live :world (Seam 2) + dossier-commit file:<path>:exfiltrated.
5AmberCalcAnalyzes the ledger over the same live region; reconcile-by-assertion surfaces the gap; commits the finding.the re-minted live :world handle + dossier-commit (ADR-0049 §4).

Each hop is enrich-never-gate (ADR-0042): bare-launch any program with no mission and it degrades to its own default world; the dispatch/DOSSIER calls soft-fail to nil rather than raising. The thread only “lights up” inside an accepted contract.

The three seams, composed

Section titled “The three seams, composed”
  • Seam 1 — CONDUIT ↔ Keyring (the cred pull, “Both” paths). Keyring’s crack captures the key to the durable keystore and commits host:<id>:cred to DOSSIER. CONDUIT’s dial-preauthenticated? opens the session without a challenge when either the DOSSIER cred fact is present (cracked this mission, learned earlier, or kn9 dead-drop) or the operator owns the host’s :method :key in the durable keystore (a key from a past mission — cross-mission de-risk). See conduit.md §“Reads”, keyring.md.
  • Seam 2 — Kommander “open with” (the handoff). Kommander’s LINK verb dispatches the focused target by type: a file → AmberCalc (launch-app :ambercalc :payload (:open <path>), carrying the live :world so the analyzer opens on the same world), a directory → the CONDUIT-into-dir terminal seam. Staging a tagged file still commits file:<path>:exfiltrated. See kommander.md.
  • Seam 3 — RIPSAW node-of-interest → DOSSIER (the promotion). RIPSAW’s CONS verb promotes the focused entity (a graph node, distinct from the FOLLOW→COMMIT edge path) into the run-state DOSSIER as a profile candidate (<type>:<id>:profile), so a surfaced node becomes a kept, cross-lens fact the later programs read. See ripsaw.md.

Demo + verification

Section titled “Demo + verification”
  • On-glass demo (real-screen GIF). runtime/tools/kn86rec/demos/xprogram-handoff.gif — Kommander launched over a live world; the operator hits open with on a deck file and the screen hands off to AmberCalc over the same re-minted live region. Re-record with:
    Terminal window
    tools/record-demo.sh --screen kommander --world network \
        --script runtime/tools/kn86rec/demos/xprogram-handoff.rec \
        --out runtime/tools/kn86rec/demos/xprogram-handoff.gif --lib runtime/system-image/lib
  • On-glass demo — the key-driven chain (real-screen GIF). runtime/tools/kn86rec/demos/open-in-chain.gif — bzbx over a live network world; one OPEN> (QUOTE) keypress rides the host into CONDUIT, a second hands the session to Kommander — three programs on two keypresses, the live :world threaded the whole way (the same host:0 that came online in bzbx materializes as the loot-bearing remote mount in Kommander). Re-record with:
    Terminal window
    tools/record-demo.sh --screen bzbx --world network \
        --script runtime/tools/kn86rec/demos/open-in-chain.rec \
        --out runtime/tools/kn86rec/demos/open-in-chain.gif --lib runtime/system-image/lib
  • Regression tests.
    • runtime/tests/test_screen_router.c — live_world_threads_across_program_handoff (a reveal in program A is seen live in program B after the handoff + context switch) and program_bind_hook_runs_for_system_and_program_contexts.
    • runtime/tests/test_ffi_launch_dossier.c — the deferred-launch staging, explicit + auto-carried live world, soft DOSSIER in/out of mission, and the world verbs.
    • runtime/tests/test_conduit.c — conduit_keystore_preauth_cross_mission (Seam 1 durable path); conduit_open_in_kommander_when_session_open + conduit_focus_payload_autodials_endpoint (OPEN> producer + the :focus auto-dial consumer, GWP-669).
    • runtime/tests/test_kommander.c — kommander_open_with_dispatches_by_target_type (Seam 2).
    • runtime/tests/test_ripsaw.c — ripsaw_promote_node_of_interest_to_dossier (Seam 3); ripsaw_open_in_conduit_on_host_entity (OPEN>, GWP-669).
    • runtime/tests/test_keyring.c · test_kn9.c · test_bzbx.c — keyring_open_in_conduit_after_crack, kn9_open_brief_target_launches_named_program, bzbx_open_in_conduit_on_cursor_host (the OPEN> handoff per program, GWP-669).

The key-driven chain — OPEN> (QUOTE) per program (GWP-669)

Section titled “The key-driven chain — OPEN> (QUOTE) per program (GWP-669)”

The chain above is now drivable entirely by keypress. Every recon program carries a context-sensitive OPEN> handoff bound to the shared QUOTE function key (Kommander keeps its own LINK open-with). Each verb reads the program’s existing focus/cursor and fires a guarded program-tier (launch-app …) that auto-carries the live :world + threads DOSSIER — the same Seam-2 shape as Kommander’s open-with, generalized:

ProgramOPEN> (QUOTE)Fires
kn9open the brief’s named target(launch-app <:open-target> :payload (:focus …)) — the mission start
RIPSAWdial a focused entity’s relay host (:host)(launch-app :conduit :payload (:focus <host>))
Keyringdial a cracked host(launch-app :conduit :payload (:focus <host>)) — opens pre-authenticated off the just-committed cred (Seam 1)
CONDUIThand an open session’s host to the commander(launch-app :kommander :payload (:focus <endpoint>))
bzbxride the cursor host(launch-app :conduit :payload (:focus <addr>))

CONDUIT’s enter consumes the (:focus <endpoint>) payload and auto-DIALs that endpoint (guarded to dialable endpoints), so a recon→CONDUIT handoff lands the operator on the box, not the dialer. Each verb is (bound? 'launch-app)-guarded — bare-launch a program with no mission and OPEN> soft-fails to a no-op echo (enrich-never-gate). So a cart no longer has to script the operator’s path from its mission handlers; the operator walks it from the keyboard.

Known edges / deferred

Section titled “Known edges / deferred”
  • RIPSAW “open in DOSSIER” on a promoted node is still deferred. The DOSSIER rolodex viewer is built (GWP-668: dossier registers a screen, and the operator can browse filed facts anytime); the remaining piece is the RIPSAW-side OPEN> verb that launches the viewer focused on the promoted node.
  • AmberCalc reads the live :world for its grid only for a ledger-shaped world; a non-ledger live world renders EMPTY (as in the demo GIF). Mapping a richer live region into the AmberCalc grid is World-Engine + AmberCalc follow-on work.

References

Section titled “References”