macinsight · anaremore · Mar 27, 2026
diff --git a/docs/deepai.md b/docs/deepai.md
@@ -1,17 +1,138 @@
 # DeepAI
 
-DeepAI is ...
+DeepAI is the AI forge system for crafting, upgrading, and managing exploit tools. It becomes available after completing **10 successful hacks**.
 
 ## Forge
 
-Something about the Forge.
+The forge creates AI implant files (`.ai`) from Intel Shards (`.rdat` files) collected during breaches. Implants dramatically improve hack success rates.
 
-## Firewall
+### Forging an Implant
+
+1. **Check available shards:** `deepai -stock all`
+2. **Get a recommendation:** `deepai -suggest <service>` (e.g., `deepai -suggest smtp`)
+3. **Start a forge job:** `deepai -start <service> injection_profile`
+4. **Check job status:** `deepai -jobs`
+5. **Collect results:** Jobs auto-collect to your `~/ai/` directory
+
+Each implant targets a specific service (SSH, FTP, SMTP, HTTP, HTTPS, DNS) and has four stats:
+
+| Stat | Description |
+|------|-------------|
+| **Power** | Breach strength — higher power = lower effective risk |
+| **Noise** | Detection footprint — higher noise = more trace per action |
+| **Stability** | Reliability during breach |
+| **Opsec** | Stealth rating — higher opsec = lower detection chance |
+
+### Forge Economy
+
+- Forging costs RCH (injection_profile ~120 RCH, often free with shards)
+- Queue limit: 2 concurrent jobs
+- Daily limit: 35 jobs
+- Higher-tier AI models produce better implants (when available)
+
+## Tuning and Upgrading
+
+Implants can be **tuned** up to 5 times to specialize their stats:
+
+```
+deepai -upgrade <file.ai> focus=<power|stability|noise|opsec> steps=1
+```
+
+Each tune improves the focused stat but may reduce others. Tuning also costs a small amount of **durability**.
 
-## Upgrading
+### Durability
+
+All AI tools have an integrity rating (durability_cur / durability_max). Integrity decreases on:
+
+- Failed hacks
+- Tuning operations
+
+At 0 integrity, the tool becomes **inoperable**. Use `deepai -recover <file.ai>` to restore it (costs RCH).
 
 ## Augmenting
 
+Augmentation adds special modifiers (affixes) to implants:
+
+```
+deepai -augment <file.ai> [mode=auto|add|replace] [slot=1..N]
+```
+
+## Firewall
+
+The firewall system uses `.df` (FORGE-MAT) capture files collected during breaches to build defensive appliances.
+
+### Compilation Flow
+
+1. Collect `.df` files from breaches (they appear in your `~/firewall/` directory)
+2. Compile: `deepai -firewall-compile <file1.df> <file2.df> output=rulepack appliance=relay_filter`
+3. Check job status: `deepai -firewall-jobs`
+4. Collect: `deepai -firewall-collect <job_id>`
+5. Deploy via the FIREWALL tab in the DeepAI GUI
+
+Firewall appliance types include ICE Nodes, Relay Filters, and Telemetry Sinks.
+
 ## Pathways
 
-Pathways serve as the skill-tree of DeepNet. Each upgrade to a pathway requires Training Data acquired on rank-ups.
+Pathways are DeepAI's neural skill tree — a permanent progression system with 17 nodes across 4 layers. Each node requires `.ndf` (training data) fragments collected during breaches. Higher-tier targets drop more valuable fragments.
+
+### Layer Structure
+
+| Layer | Nodes | Fragments Each | Requirements |
+|-------|-------|---------------|--------------|
+| **Input** | 6 nodes | 2 frags | None (always available) |
+| **Hidden** | 5 nodes | 4 frags | Requires 2 trained Input nodes |
+| **Deep** | 3 nodes | 7 frags | Requires 2 trained Hidden nodes |
+| **Output** | 3 nodes | 10 frags | Requires 2 trained Deep nodes |
+
+### Input Layer (Reinforceable x5)
+
+Input pathways can be **reinforced** up to 5 times, stacking their effects:
+
+| Node | Effect (per level) |
+|------|-------------------|
+| **IDS** | Passive trace rate x0.85 in breach |
+| **OPSEC** | Heat gain x0.85 per hack |
+| **NET** | Netscan +2 hosts, scan shows IDS profile |
+| **EXPLOIT** | Tool match score +0.1 on all services |
+| **CRYPTO** | +1 exfil slot per breach |
+| **RECON** | Scan duration -20% |
+
+### Hidden Layer
+
+| Node | Effect | Prerequisites |
+|------|--------|--------------|
+| **PHANTOM** | Breach noise x0.7 on all commands | IDS + OPSEC |
+| **CLEANER** | Wipe removes 25% heat + reduces trace 5% | OPSEC + IDS |
+| **INFILTRATOR** | Hack duration reduced | EXPLOIT + NET |
+| **EXTRACTOR** | Exfil noise halved, ls shows value tags | CRYPTO + EXPLOIT |
+| **ANALYST** | Scan shows value estimate, cat shows RCH value | NET + RECON |
+
+### Deep Layer
+
+| Node | Effect | Prerequisites |
+|------|--------|--------------|
+| **SHADOW** | First hack per 24h = zero heat + zero trace | PHANTOM + CLEANER |
+| **PREDATOR** | Backdoor x2 duration, detection risk halved | INFILTRATOR + EXTRACTOR |
+| **ORACLE** | Netscan reveals all files, scan shows cycle days | ANALYST + any Hidden |
+
+### Output Layer (Permanent — Choose ONE)
+
+!!! warning "Output Choice is Permanent"
+    You can only activate ONE output pathway. Choose carefully — this defines your operator identity. Recalibration costs 10,000 RCH + 48h cooldown.
+
+| Node | Effect | Prerequisites | Playstyle |
+|------|--------|--------------|-----------|
+| **GHOST** | Zero trace when noise stays LOW, auto-wipe on disconnect | SHADOW + any Deep | Stealth operator |
+| **SURGEON** | Exfil slots x2, data values +25%, log files exfilable, splice command | PREDATOR + any Deep | Data extraction specialist |
+| **ARCHITECT** | Hacks count 3x for geo-escalation, trust gain x2, contacts post your name | ORACLE + any Deep | Political influence |
+
+### Placing Fragments
+
+Use the Pathways tab in the DeepAI GUI, or the CLI:
+
+```
+deepai -place <node_key> <file_id>
+```
+
+!!! tip "Pathway Strategy"
+    Prioritize CRYPTO (more exfil slots = more files per breach = more RCH) and CLEANER (wipe removes heat = more hacking uptime). These two nodes have the highest immediate impact on progression speed.
diff --git a/docs/gameplay/defense.md b/docs/gameplay/defense.md
@@ -0,0 +1,67 @@
+# Defense Systems
+
+Your node can be targeted by other operators. DeepNet provides several defensive tools to detect, deter, and counter intrusions.
+
+## Tripwires
+
+Tripwires are detection sensors placed on nodes you control.
+
+### Commands
+
+```
+tripwire list                              — list your active tripwires
+tripwire set <ip> [trigger] [action]       — plant a tripwire
+tripwire remove <id>                       — disarm a tripwire
+```
+
+### Triggers
+
+| Trigger | Description |
+|---------|-------------|
+| `file_access` | (default) Fires when an intruder accesses files |
+| `login_fail` | Fires on failed intrusion attempts before breach |
+| `port_scan` | Fires when someone scans the node |
+
+### Actions
+
+| Action | Description |
+|--------|-------------|
+| `alert` | (default) Notifies you of the intrusion |
+| `counter_exposure` | Increases the attacker's exposure |
+| `ddos_pulse` | Disrupts the attacker's connection |
+
+### Honeypot Combo
+
+Add `--honeypot` to arm bait files on the same node:
+
+```
+tripwire set 178.62.4.35 file_access counter_exposure --honeypot
+```
+
+Honeypot files look like real data. If an attacker exfiltrates them, the dealer integrity check refuses the sale and silently notifies the owner. Combined with `counter_exposure`, this creates a trap that both damages the attacker and provides intel.
+
+### Limits
+
+- Maximum 5 active tripwires at a time
+- Triggered tripwires become disarmed and must be re-set
+
+## Firewall
+
+The firewall system provides passive defense through deployed appliances. See the [DeepAI Firewall section](../deepai.md#firewall) for compilation details.
+
+Deployable appliance types include:
+
+- **ICE Node** — Intrusion Countermeasures Electronics
+- **Relay Filter** — Filters suspicious traffic
+- **Telemetry Sink** — Absorbs and logs probe attempts
+
+## Evidence Locker
+
+When the Agency seizes your tools during a raid, they're held in the evidence locker.
+
+```
+evidence-locker status     — check locker contents
+evidence-locker recover <tool_id>  — recover early (costs RCH)
+```
+
+Seized tools auto-release after **72 hours** if not recovered manually.
diff --git a/docs/gameplay/economy.md b/docs/gameplay/economy.md
@@ -0,0 +1,95 @@
+# Economy & Progression
+
+## RCH (Reputation Credits)
+
+RCH is The Net's shadow currency. It's earned by selling exfiltrated data or mining compute cycles, and spent on hardware, tools, and services.
+
+### Earning RCH
+
+| Source | Description |
+|--------|-------------|
+| **Selling data** | Sell exfiltrated files to the dealer with `sell <filename>` |
+| **Mining** | Passive income via `deepmine start` (~13 RCH/min at baseline) |
+| **Contracts** | Fulfill data contracts for premium payouts |
+| **Bounties** | Complete bounty objectives (requires reputation) |
+| **Jobs** | Quick-window objectives from the job board (`jobs -list`) |
+
+### Selling Files
+
+Sell prices are affected by:
+
+- **Heat level** — COLD gives the best prices. Selling at HOT or BURNING incurs a significant penalty.
+- **Dealer trust** — Higher trust = better prices. Build trust through consistent interaction.
+- **World state** — CRISIS provides a loot yield bonus (+12%) and a loot multiplier (x1.20)
+- **File quality** — Files have quality tiers (grey, green, blue, etc.) affecting base value
+
+!!! tip "Maximize Sell Value"
+    Wait until your heat is COLD (0-49) before selling files. During CRISIS, the loot bonuses stack with COLD prices for maximum profit.
+
+### File Types
+
+Not all files are sellable. Know what to keep and what to sell:
+
+| Extension | Type | Action |
+|-----------|------|--------|
+| `.ndf` | Training fragments | **KEEP** — pathway progression |
+| `.ds` | DeepScript files | **KEEP** — tool compilation |
+| `.ai` | AI implant files | **KEEP** — hack tools |
+| `.rdat` | Intel Shards | **KEEP** — forge research data |
+| `.df` | FORGE-MAT | **KEEP** — firewall compilation |
+| `.log`, `.txt` | Log files | **SKIP** — worthless (0 RCH) |
+| `.pdf`, `.json`, `.db`, `.csv`, `.tar.gz`, `.sql.gz`, `.zip`, `.kdbx`, `.pem`, `.key` | Data files | **SELL** — valuable |
+
+### Contracts
+
+Contracts are data requests from NPCs offering premium payouts above dealer rates.
+
+- View contracts: `contracts list`
+- Fulfill: `contracts fulfill <contract-id> <file-id>`
+- Post your own: `contracts post`
+- Files must match the contract category (e.g., finance files for a finance contract)
+
+### Bounties
+
+Bounties are objectives available from the bounty board. Access requires building trust with specific NPCs (e.g., Kira). During CRISIS, higher-level bounties become available with larger RCH pools.
+
+- View: `bounties list`
+- Claim: `bounties claim`
+
+## Hardware
+
+Your rig affects mining speed, hack capability, and system load. Components include:
+
+| Component | Function |
+|-----------|----------|
+| **CPU** | Processing power for hacking |
+| **GPU** | Compute for mining and AI operations |
+| **RAM** | Memory for concurrent operations |
+| **HDD** | Storage for files and tools |
+| **Mainboard** | Base platform affecting all components |
+| **Cooling** | Reduces power draw (negative wattage) |
+| **PSU** | Power supply — must support total load |
+
+Check your hardware with `hw` or `rig`. Upgrade components through the `broker` or `deepshop` commands.
+
+!!! warning "Power Grid"
+    If your system load exceeds PSU capacity, hacks will fail with "power grid unstable." Monitor load % and upgrade your PSU if needed.
+
+## Groups
+
+At grade 10+, you can join one of three hacker collectives:
+
+| Group | Focus | Perks |
+|-------|-------|-------|
+| **SIGNAL** | Intelligence | Intel gathering, NPC contacts |
+| **BLACKOUT** | Heat management | Cooling perks, stealth operations |
+| **ARCHIVE** | Economics | Trading, market intel, RCH generation |
+
+## Crews
+
+Crews are player-formed groups with shared resources:
+
+- Create or join a crew with the `crew` commands
+- Shared RCH pool (deposit/withdraw)
+- Weekly crew challenges for bonus rewards
+- Crew reputation and rankings
diff --git a/docs/glossary.md b/docs/glossary.md
@@ -0,0 +1,33 @@
+# Glossary
+
+Key terms from the DeepNet universe. In-game, use `glossary <term>` for official definitions.
+
+| Term | Definition |
+|------|-----------|
+| **Agency** | The Net's surveillance and enforcement arm. Monitors heat, conducts sweeps, assigns codenames. Officer Vance is their operative. |
+| **Architect** | Output pathway specialization. Hacks count 3x for geo-escalation, trust gain doubled. The political influence identity. |
+| **Breach** | Post-exploitation phase after a successful hack. Navigate the filesystem, exfiltrate files, harvest data, cover tracks. |
+| **Burned** | Detected by target IDS during a hack or breach. Causes forced disconnect, heat spike, and potential tool damage. |
+| **COLD** | Heat level 0–49. Best dealer prices, lowest Agency risk. |
+| **COVENANT** | Faction bloc. Government-aligned, corporate-aligned, agency-aligned. Easier institutional targets, harder underground. |
+| **CRISIS** | World state with active conflict. Higher loot yield, higher defense, target stress +3/hack. |
+| **DeepAI** | The AI forge system for crafting and upgrading exploit tools. Start jobs, augment tools, recover fragments. |
+| **DeepScan** | Network reconnaissance. Discovers hackable targets in a subnet. Usage: `deepscan 178.62.4.*` |
+| **Deploy** | ARCHITECT-exclusive command. Consumes intelligence files, translates into geopolitical influence. |
+| **Dumps** | Training data fragments (.ndf) collected from hacks. Used to activate pathway nodes. |
+| **Durability** | Tool integrity rating. Decreases on failed hacks and tuning. At 0: tool becomes inoperable. |
+| **Exfil** | Exfiltration — stealing data files from a breached target. Limited by exfil slots (default 3). |
+| **Exposure** | Your trace signature during active operations. At 100%: forced disconnect. |
+| **Ghost** | Output pathway specialization. Zero trace when noise stays LOW, auto-wipe on disconnect. The stealth identity. |
+| **Group** | Hacker collective (grade 10+). SIGNAL (intel), BLACKOUT (heat mgmt), ARCHIVE (economics). |
+| **Hack** | Exploit a target. Select service vulnerability and matching tool. Success triggers breach phase. |
+| **Heat** | Operational visibility to the Agency. Rises with hacks, decays at 5/hour. High heat = worse deals, harder targets. |
+| **MERIDIAN** | Faction bloc. Underground-aligned, infrastructure-aligned. Easier chaotic targets, harder institutional. |
+| **Notoriety** | Permanent stat. Increases when heat reaches BURNING. Never decays. Worse loot, slower scans. |
+| **Pathway** | Neural development grid. 17 nodes across 4 layers. Activated by placing .ndf training fragments. |
+| **RCH** | Reputation Credits — The Net's shadow currency. Earned by selling data or mining. |
+| **Recognition** | Player visibility. NOBODY → HANDLE → NAME → REPUTATION → LEGEND. |
+| **Sanctuary** | VPN route. Protected charter lane. Offensive traffic blocked. Used for cooling exposure. |
+| **Splice** | SURGEON-exclusive breach command. Extracts 40% value fragment that persists immediately. Survives forced disconnect. |
+| **Surgeon** | Output pathway specialization. Double exfil slots, +25% file values, log files exfilable. The data extraction identity. |
+| **Trust** | NPC relationship level. UNKNOWN → NOTICED → KNOWN → TRUSTED → INNER. Affects prices and access. |
diff --git a/docs/index.md b/docs/index.md
@@ -1,3 +1,34 @@
 # DeepNet Wiki
 
-Welcome to the DeepNet wiki, a collaborative resource to pool knowledge about the game "[DeepNet](https://deepnet.us)"
+Welcome to the DeepNet Wiki — a collaborative resource for the hacking simulation game [DeepNet](https://deepnet.us).
+
+## Quick Links
+
+- **[Hacking Guide](gameplay/HACKING.md)** — Full walkthrough of the hack flow from scanning to breach
+- **[Economy & Progression](gameplay/economy.md)** — RCH, selling, hardware, crews, and groups
+- **[Game Mechanics](mechanics/index.md)** — Heat, exposure, notoriety, VPN routes, trust, and recognition
+- **[DeepAI System](deepai.md)** — AI forge, implants, firewall, and the pathway skill tree
+- **[Lore & World](lore/index.md)** — Factions, world states, NPCs, and the K-Mystery
+- **[Command Reference](commands/index.md)** — Complete list of terminal commands
+- **[Glossary](glossary.md)** — Key terms and definitions
+
+## What is DeepNet?
+
+DeepNet is a browser-based hacking simulation where you operate as a threat actor in a reactive underground network. Scan targets, exploit vulnerabilities, breach systems, exfiltrate data, and sell it on the black market — all while managing heat, exposure, and Agency attention.
+
+The game features:
+
+- **Deep hacking simulation** — service selection, tool matching, breach navigation
+- **AI forge system** — craft and upgrade exploit tools from collected intel
+- **17-node skill tree** — permanent progression with three specialization paths
+- **Reactive world** — CRISIS states, faction conflicts, and NPC interactions
+- **Multiplayer** — crews, contracts, bounties, PvP defense systems, and leaderboards
+- **Hardware management** — upgrade your rig to mine faster and hack harder
+
+## Getting Started
+
+1. Visit [deepnet.us](https://deepnet.us) and create an account
+2. Choose Deep-CLI interface
+3. Run `tutorial` for an interactive introduction
+4. Run `next` for suggested next steps
+5. Start scanning and hacking!