DOSSIER Data Model — the intel store: profiles, fact-nodes, links

• dossier.md — the program charter (this resolves its record-schema / write-path / storage open questions)
• enrichment-contract.md — gap D: the sanctioned dossier-commit that deposits a fact
• ../runtime/recon-mode.md — gap C: where keys are earned
• ../runtime/currency-and-economy.md — knowledge as typed DOSSIER keys + the gating it drives
• nemacs.md — the tree-cursor + keymap + CIPHER-LINE substrate reused as a library
• ADR-0040 — the UDS write boundary (canonical facts are sanctioned-write-only); ADR-0042 — DOSSIER charter

Conceptual lineage: a dossier is an Org tree — profiles are headlines, fields are property drawers, cross-refs are links, the overview is an agenda/column view. We borrow those primitives and drop the rest (§7). The interaction is Xiki-style expand-in-place.

---

1. Substrate (settled)

• A windowed view over an indexed backing store — not an nEmacs buffer. nEmacs’s buffer caps at a 4 KB serialize / 32 KB arena (nemacs.md); a cross-mission store that outlives carts blows past that. DOSSIER reuses nEmacs’s tree-cursor (CAR/CDR/BACK), mode-scoped keymap, and CIPHER-LINE compositor as a library, and materializes only a windowed slice of the store on demand (Xiki fetch-on-expand). The whole tree is never resident.
• Browse = a single foldable outline. Expand-in-place: root → profiles → facts → links → source mission.
• Two lanes (forced by ADR-0040):
  • Canonical intel — sanctioned-write-only, read-only in the view. Written only through the engine (§4).
  • Operator notes — a free-text field per profile, freely editable (device SD). The editing surface (nEmacs literal/multi-tap) is active only here.

2. The tree

DOSSIER                                              ; root (the indexed store)
├── (profile :id "tanaka-h" :type :person           ; headline
│     :props (:handle "HOSHIKO-T" :role "CFO"        ; identity drawer (property-drawer)
│             :affiliation "Zaibatsu-Fin")
│     :facts (                                       ; ← the atomic discovered units
│        (fact :key  acct:fin-relay-07:routing       ; typed, addressable (for gating)
│              :value "RT-88241-X"
│              :prov  (:mission 0x1023 :via :bzbx :phase 2)
│              :conf  :verified
│              :found <run-stamp> :stale? nil
│              :links ((:routes-to "acct-shell-3") (:owned-by "tanaka-h"))))
│     :notes "operator free-text lane")              ; the only editable field
├── (profile :id "acct-shell-3" :type :account …)
└── inbox  ; captured-but-unrefiled facts awaiting sanctioned refile (§4)

3. The two record types

Profile (headline)

The aggregation unit. A small identity property-drawer plus its facts and a notes field.

Profile :type	Is	Identity drawer (examples)
:target	a system/org you operate against	name, sector, posture-known?
:person	an individual	handle, role, affiliation
:account	a financial/credential account	routing, owner→link, balance-est
:network	a node/host/topology	entry-point, ice-class, map-known?
:facility	a physical location	site, access, schedule

The set is extensible — a cart domain may register a profile type. (Identity-drawer fields per type are per-domain authoring, not fixed here.)

Fact-node (the atom — the unit a recon key deposits as)

Each discovered key is its own node under a profile:

Field	Meaning
:key	the typed, addressable key id (e.g. acct:fin-relay-07:routing) — what gating queries
:value	the datum
:prov	provenance — (:mission … :via <program> :phase …); ties to the run that found it
:conf	confidence — :verified / :inferred / :rumored (recon depth → confidence: passive lower, active or corroborated higher)
:found	run/timestamp
:stale?	staleness flag (time-gated keys decay — recon-mode §8)
:links	typed edges to other profiles/facts (§5)

A fact is immutable once committed (it’s a record of a discovery); new information arrives as a new fact (which may corroborate or contradict an older one — :conf and :links carry that). Provenance + confidence are why this is a fact-node, not a bare property: a value alone can’t say where it came from or how sure you are.

4. The write path — capture → sanctioned refile

Canonical facts are never raw-written (ADR-0040). The path:

1. Capture. A program’s discovery calls dossier-commit (enrichment-contract §5); the fact lands in the inbox (a holding node).
2. Refile (the sanctioned write). The engine hangs the fact under the matching profile — auto when the :key’s type names a known profile (acct:fin-relay-07:* → the acct-shell-… profile, creating it if new), otherwise it waits in the inbox for the operator to refile (a sanctioned action, not a free edit).
3. Operator notes are the one exception — written directly to the SD-backed notes lane, never sanctioned, never gating.

This is org-capture adapted to the write boundary: capture is cheap; the durable attach is sanctioned.

5. Links — the cross-reference graph

Typed edges turn the outline into a graph (the “web”). Canonical edge verbs: :owns · :controls · :routes-to · :employs · :located-at · :corroborates · :contradicts. A fact links to the profile it implicates (a :person fact “owns account X” carries (:owns "acct-x")), so expand-in-place can walk person → fact → the account it names → that account's facts. Links are how a scattered set of discoveries becomes a picture.

6. Gating — the recon → mission bridge

A mission/objective declares a key requirement; the engine queries DOSSIER:

(dossier-has? acct:fin-relay-07:routing :min-conf :inferred)   ; → bool

• Hard-gate — key absent ⇒ the objective/path is blocked (you must recon or buy it).
• De-risk — key present ⇒ the soft-bias from currency-and-economy.md (pre-revealed topology, fewer nodes, lower start difficulty).

:min-conf lets a gate demand verified intel (not a rumor). This is the single query that makes recon load-bearing.

7. Borrowed from Org (named narrowly)

Take	As
outline fold / expand	the Xiki expansion tree (§1)
property drawers	the profile identity drawer (§3)
inter-node links	the cross-reference graph (§5)
agenda / column view	the generated “all targets” overview (§8 — open)
capture + refile	the sanctioned write path (§4)

Dropped: TODO state machines, scheduling/clocking, babel, export. None serve intel aggregation.

8. Open / deferred

• Storage home — bulk store on device SD (cross-cart, indexed) with the gating-critical key index in the sanctioned/durable tier; vs. all-UDS. Embedded decision (the dossier.md “storage” question) — size budget TBD.
• Confidence model tuning — exactly how recon depth / corroboration sets :verified/:inferred/:rumored, and whether contradiction downgrades.
• Profile-type registration — the mechanism for a cart to add a :type + its identity-drawer schema.
• The overview view — the agenda/column “all targets / all open gates” generated render.
• Stale-intel decay — how :stale? is set over time and whether re-casing refreshes a fact (ties to recon-mode §8).
• FFI — dossier-commit + dossier-has? landed in the ADR-0005 Amendment Log (2026-06-21); exact signatures + the refile primitive finalize with the engineering spike.