os-console platform and cartridge architecture

os-console is Woodfine's keyboard-native console interface — a single Rust binary that provides direct access to the Totebox Archive, editorial workflows, governance records, and infrastructure management from a terminal. It connects to backend os-* services through machine-based authorization and operates fully offline when backend services are unavailable.

The design principle is end-to-end ownership: every component is compiled into a single binary, with no dynamic plugin loading, no subprocess launching, and no nesting. The console starts in milliseconds and responds at keyboard speed.

[edit]The binary

os-console is the deployable artifact: one binary, one process, all cartridges compiled in. It runs as a native application on the host operating system. Platform targets include Linux Mint on the on-premises iMac workstation and macOS 13 or later on executive workstations.

An optional SSH server mode, compiled with the --features ssh-server flag, enables remote access over port 2222 for use on a GCE VM, providing the same TUI experience over an SSH session.

[edit]The base chassis: app-console-keys

app-console-keys is the always-installed base chassis inside os-console. Its relationship to os-console is analogous to `service-fs`'s relationship to os-totebox: it is the minimum required component that must be present; everything else is optional.

app-console-keys provides the Cartridge trait (the interface all cartridges implement), the F-key navigation framework (the horizontal tab strip, F-key input dispatch, and active-cartridge routing), the status bar showing machine-based authorization connection state and session identity, the authorization client that manages connections to paired os-* services, and profile-based configuration stored at ~/.config/os-console/config.toml.

Naming note: "keys" in app-console-keys refers to F-keys — keyboard function keys. It does not refer to cryptographic keys. Machine-based authorization is implemented by system-gateway-mba, a separate crate.

[edit]Cartridges

Each app-console-* crate is a library crate that implements the Cartridge trait. Cartridges are compiled into os-console directly — not loaded dynamically and not launched as subprocesses. A cartridge that is not installed has its F-key slot greyed in the tab strip.

Cartridges are optional except for app-console-keys and app-console-input (F12). An installation that includes only app-console-content (F4) and app-console-input (F12) is a complete, valid os-console deployment for editorial work.

[edit]F-key map

The console presents twelve addressable slots via F-keys. F12 is fixed as The Anchor — the input-machine — and is never moved. The complete os-console article describes the broader product design and deployment context.

F-key	Cartridge	Domain
F1	`app-console-help`	Help overlay
F2	`app-console-people`	Identity and contacts
F3	`app-console-email`	Communications
F4	`app-console-content`	Editorial — proofread, draft, verify
F5	`app-console-minutebook`	Governance — minutes, resolutions
F6	`app-console-bookkeeper`	Financial ledger
F7	`app-console-bim`	Building information management
F8	`app-console-gis`	Geographic information
F9	`app-console-slm`	AI management and adapter marketplace
F10	`app-console-mesh`	Network mesh management
F11	`app-console-system`	Live `os-*` service health and pairing status
F12	`app-console-input`	The Anchor — Input Machine (SYS-ADR-10)

[edit]The status bar

The app-console-keys status bar is always visible at the bottom of the console and provides the operator with a live situational picture:

jennifer@woodfine | MBA LINK ACTIVE | F4: Content | Tier A | 00:04:23

The identity component shows the username and tenant set during the pairing ceremony. The authorization state shows MBA LINK ACTIVE, MBA LINK INACTIVE <reason>, or MBA LINK PENDING. The active cartridge slot name, the SLM tier in use (A for local, B for cloud burst, C for frontier API), and session duration complete the bar.

[edit]Authorization connectivity

app-console-keys maintains outbound connections to paired os-* services. Each pairing is independent: the console can be active with os-totebox and inactive with os-privategit simultaneously.

When the authorization link is inactive, os-console operates in local-only mode. Locally-cached content remains accessible. Backend service requests to service-proofreader, service-input, and service-content fail gracefully rather than crashing.

[edit]PDF rendering

os-console supports in-terminal PDF rendering using the pdfium-render library — Rust bindings to Chromium's pdfium. PDF pages are rendered to RGB bitmaps and displayed using the Kitty graphics protocol as the primary path, with Sixel as a fallback and an error for terminals that support neither. This is pixel rendering, not text extraction.

[edit]Three-Ring Architecture placement

os-console is a client of the Three-Ring Architecture, not a ring itself. It connects to Ring 1 services through the authorization layer — service-input via F12, `service-people` via F2, `service-email` via F3, and service-fs; to Ring 2 services including `service-content` and `service-search`; and to the Ring 3 service `service-slm` via Doorman at http://localhost:8011. os-console is the human interface through which an operator instructs the rings.

[edit]See also

console-os — architectural overview of os-console as Command Ledger
machine-based-auth — the authorization mechanism os-console uses
input-machine — The Anchor; mandatory ingest gate at F12
three-ring-architecture — the Ring 1/2/3 architecture os-console connects to
os-family-overview — the eight-OS family and how os-console fits
compounding-doorman — the Doorman audit boundary for service-slm access