A source is a plugin — a tap — pinned at an immutable commit and built in a sandbox on first use. It fetches raw material into the append-only evidence ledger; nothing it returns becomes truth until you accept a proposal built from it.
Glob a local directory tree into hashed, versioned evidence.
Any git repository's tree, local or remote, at a ref — swept as versioned evidence. System git carries the credentials.
Microsoft 365 mail with attachments; narrow with mail_filter.
Microsoft 365 calendar events, over the same sign-in.
Teams meetings that carry transcripts or attendance reports.
Teams chats and their messages — the slow crawl, on its own cadence.
A tracked SharePoint / OneDrive file or folder, by sharing link, snapshot-fetched.
The four windowed Graph plugins share one config — owner_addresses, plus optional client_id / tenant. Leave the app id empty to use the shared multi-tenant kyyn app. mail_filter is graph-mail only; sharepoint-file takes a sharing-link url instead.
A SOQL query's records as evidence, via a Connected App device-flow sign-in.
Ingest another kyyn KB as evidence — federation via curation, no shared ontology.
A KB pins its tap repo at an immutable (repo, rev) in sources.ron. A fresh kyyn init pins the first-party tap.
Kyyn clones and builds the tap on first use inside a bubblewrap jail — read-only checkout, private /proc & /dev, network denied for the build. Its manifest declares the hosts its fetches need.
One RON request per invocation returns evidence into the append-only ledger under the plugin's namespace. The agent curates from there.
Write your own. First-party plugins aren't special — a tap is a repo with a kyyn-tap.ron manifest and a binary calling tap_main with a plugin table. Pin yours in sources.ron the same way.