Whisper Social-Signal Exchange and Threshold Bootstrap¶

Based on:

doc/project/20-memos/orbiplex-whisper.md
doc/project/20-memos/orbiplex-anon.md
doc/project/30-stories/story-005-whisper-rumor-intake.md

doc/project/40-proposals/078-weak-signal-harvester.md
doc/project/40-proposals/079-cross-federation-alliance.md

Status¶

Proposed (Draft)

Date¶

2026-03-23

Executive Summary¶

This proposal defines the v1 shape of Orbiplex Whisper as a privacy-bounded social-signal exchange layer for rumors, early pattern detection, and later association bootstrap.

The key decisions are:

Whisper exchanges weak social signals rather than confirmed facts.
Whisper must keep rumor semantics explicit through the whole flow.
Whisper performs local redaction and user-approved rewriting before publication.
Anti-Sybil controls in v1 should be budget- and policy-based, not semantic duplicate detection.
Threshold crossing should lead to a deterministic bootstrap proposal rather than automatic human enrollment.
Onion-like or relay-based anonymity should live behind a separate outbound privacy capability and be requested by Whisper through routing intent rather than embedded into Whisper itself.
Whisper also carries bounded trace statements about artifact creation, dispatch, receipt, or possession. A trace defaults to digest-only disclosure; inline content requires explicit consent and remains a claim rather than a receipt or attestation.

Context and Problem Statement¶

Orbiplex currently has room-oriented answer exchange, procurement flows, archival thinking, and growing support for provenance-rich artifacts. What is still missing is a bounded way for nodes to share socially meaningful weak signals such as:

"people in different places may be experiencing the same organizational abuse",
"users may be hitting the same harmful moderation pattern",
"a dignity or safety issue may be distributed rather than isolated",
"ambulance refusal followed by severe complications may be repeating as a systemic emergency-care failure rather than as isolated bad luck",
"independent inventors in different countries appear to be converging on the same technical approach without prior contact",
"several communities have independently bootstrapped structurally similar solutions to an unmet need".

The second class of signal — idea convergence — is as important as the first. Where problem signals serve early detection and collective response, idea signals serve co-creation: connecting people who have independently arrived at a similar idea before their paths diverge irrecoverably. Both polarities deserve first-class support.

Without an explicit social-signal layer, nodes either:

keep such signals entirely local and fail to correlate them,
or improvise ad hoc messaging that risks oversharing, weak provenance, and accidental rumor amplification.

The system needs a middle layer:

weaker than evidence,
stronger than private intuition,
bounded enough to be privacy-aware,
and explicit enough to support thresholding and association bootstrap.

Goals¶

Define Whisper as a distinct protocol family for rumor-style signal exchange.
Keep rumor semantics explicit and never flatten them into evidence by accident.
Make local redaction and user approval part of the publication path.
Support interest registration and threshold detection without premature disclosure.
Support deterministic association bootstrap after critical mass is reached.
Keep transport-level anonymity modular through an outbound privacy capability.

Non-Goals¶

This proposal does not define full evidentiary case management.
This proposal does not define final governance or adjudication procedures.
This proposal does not define semantic duplicate detection for rumors in v1.
This proposal does not require onion-style transport for every Whisper message.
This proposal does not define the full relay/privacy provider contract beyond its boundary with Whisper.
This proposal does not define source-corpus harvesting from documents, mail, or configured feeds. Weak Signal Harvester (Proposal 078) is the upstream discovery tool that may prepare reviewed local findings before Whisper intake.

Decision¶

Orbiplex should treat Whisper as a dedicated social-signal exchange layer with the following v1 lifecycle:

local rumor intake
local redaction and idiolect reduction
user approval of the sanitized result
whisper-signal publication
optional whisper-interest registration on receiving nodes
whisper-threshold-reached
association-room-proposal
explicit local human opt-in into the next-stage room or process

Transport anonymity remains a separate concern:

Whisper expresses routing intent and privacy posture,
Node egress resolves that posture through any installed outbound privacy or relay capability,
Node decides whether the requested posture can be satisfied, degraded, or must fail.

Proposed Model¶

Message classes¶

The Whisper protocol family has two first-class message classes with different semantics:

social signal — whisper-signal.v1, whose signal/polarity is problem or idea; it may participate in correlation, thresholding, and association bootstrap;
trace statement — whisper-trace.v1, a bounded provenance assertion that an artifact was created, handed to a transport, received, or held at a stated time. It never participates in social-signal thresholding.

public-gossip.v1 remains a separate explicit public publication contract. It is not a Whisper message class and is not silently produced from either a signal or a trace.

A trace is weaker than an execution-receipt.v1, delivery receipt, or attestation. Its enclosing signature identifies who made the assertion; it does not prove that the asserted event happened. An optional evidence/refs list may point to independently verifiable receipts or attestations without duplicating their payloads.

Trace disclosure has two modes:

digest-only is the default and carries artifact digest, byte length, and optional media/schema metadata;
digest-and-content additionally carries bounded base64 bytes and requires a consent/ref validated by the authoring host before publication.

Digest-only disclosure is data minimization, not anonymity. A digest of predictable or low-entropy material can still support guessing and cross-context correlation. Classification, recipient, and disclosure policy therefore apply to both modes, not only to inline content.

For digest-and-content, the referenced consent or authorization fact must bind the exact artifact digest, disclosure scope, author or represented subject, and validity window. When content contains data about several people, local policy may require authority from all relevant subjects or refuse inline disclosure. The reference string alone grants no authority. The v1 wire cap is 32 KiB; host/federation policy may lower but not raise it.

V1 deliberately does not define a network-visible consent artifact. The consent/ref is a sender-local audit handle and need not be remotely dereferenceable; it should not disclose a participant id or private policy record. A federation that later needs portable consent evidence must define a separate signed contract rather than reinterpret this opaque reference.

The schema requires SHA-256 and a declared byte length. The implementation must decode inline bytes, enforce the host cap, and compare both byte length and digest before accepting or publishing the trace. A public relay can validate the contract and signature, but cannot infer that an opaque consent reference names a valid local decision; that authority remains on the sender's host.

0. Signal polarity¶

A whisper-signal carries one of two fundamental polarities:

problem — the signal describes a distributed harm, failure, or dignity risk. The lifecycle goal is early correlation and, where critical mass is reached, collective response or protective action. The signal grade expresses protective risk and urgency. Emergency assistance paths may be triggered.
idea — the signal describes a convergent idea, creative discovery, or emerging approach that multiple people or groups appear to have independently reached. The lifecycle goal is to propose co-creation or collaboration between parties who have not yet found one another. The signal grade expresses convergence strength, co-creation potential, or urgency of matching interested participants. Emergency protocols are never triggered.

signal/polarity is a mandatory field on whisper-signal.v1. The two polarities share the same lifecycle but differ in urgency, redaction posture, and the nature of the resulting association room:

problem → support, coordination, or protective response room,
idea → co-creation or collaboration room.

1. Rumor semantics remain explicit¶

Whisper artifacts are not evidence artifacts.

The protocol must preserve a lower epistemic class such as:

rumor,
weak signal,
correlated signal,
only later, if procedurally justified, confirmed case.

This is a semantic safety boundary. The system must not let a rumor become "confirmed" merely because many nodes repeated it.

2. Local redaction before publication¶

The raw text entered by a user or operator should remain local by default.

A local Weak Signal Harvester (Proposal 078) may prepare candidate findings from documents, mail, or other configured sources before this step. Such findings are not Whisper artifacts. They enter Whisper only after local import, grouping, review, and explicit user/operator action. The Harvester must not publish whisper-signal.v1 directly.

Before publication, Whisper should run a bounded local workflow for:

anonymization,
paraphrase,
idiolect flattening,
privacy and risk review.

The output of that workflow should be user-reviewed and user-accepted before any network-facing artifact is emitted.

Protective anonymization in this workflow is aimed at people and protected local contexts. It should not blindly erase names of companies, hospitals, ambulance operators, or other institutions when those entities are plausibly part of the harmful pattern and do not require protection.

When a local helper such as Monus prepared the draft, downstream policy should still be able to distinguish user-authored, operator-observed, Monus-derived, and Monus-plus-Sensorium-derived signals.

For role semantics, the outgoing whisper-signal should preserve both:

sender/node-id for the infrastructure actor carrying the publication, and
a pseudonymous authored role through rumor/nym, attached nym-certificate, and nym signature over the outgoing artifact body.

When Whisper uses the nym path, the backing participant-id should remain on the local or issuing side of the boundary rather than being disclosed in the wire-level whisper-signal artifact itself.

3. Bounded anti-Sybil controls in v1¶

The v1 baseline should use simpler controls instead of semantic dedup:

rumor budgets per author scope and time window,
forwarding budgets,
derived-nym depth limits,
hop TTL,
optional deterministic signal/similarity-key for fixture-grade or explicitly policy-defined thresholding,
trust- and policy-aware thresholding.

This proposal explicitly rejects hard semantic duplicate gating for v1, because:

semantic equivalence is expensive and ambiguous,
false positives would be operationally harmful,
the system first needs clean contracts for rumor classification, budgets, and disclosure scope.

4. Interest without disclosure¶

Receiving nodes should be able to say:

"this may matter locally"
"I am interested in further correlation"

without revealing the underlying person, case, or internal notes.

This lets the system correlate signals before identities are exposed.

5. Deterministic threshold bootstrap¶

When critical mass is reached, the system should not:

automatically merge people into a room,
or choose a bootstrap authority ad hoc.

Instead, participating nodes should deterministically derive a small bootstrap set that publishes an association-room-proposal with:

initial room policy,
disclosure assumptions,
bootstrap expiry,
and moderation or witness expectations.

For Agora M4, the first threshold function is deliberately narrow: at least two distinct eligible nodes publish public/federated whisper-signal.v1 records with the same topic/class and deterministic signal/similarity-key within a bounded time window. This is an implementation smoke rule, not a claim that production Whisper has semantic duplicate detection.

Threshold and proposal records are public meta-signals, not public gossip. whisper-threshold-reached.v1 means that a projection or issuer claims a policy-defined correlation was observed. association-room-proposal.v1 means that a redacted/bootstrap-only coordination surface is proposed. Neither record publishes the underlying social narrative; public-gossip.v1 is a separate, later publication step requiring explicit human, collective, or policy authority. That publication step may be independent of Whisper, or it may follow opt-in association. An association-room-proposal is therefore a possible precursor to public gossip, not a required precondition.

The signer roles are intentionally split. A source whisper-signal.v1 is signed by the source nym or other admitted author. A derived whisper-threshold-reached.v1 or association-room-proposal.v1 is signed by a projection authority, because it is a claim about a projection result rather than a firsthand social statement. The first implementation may use one projection node or delegated projection key, but the protocol should remain compatible with future static or reputation-selected committee authorities that attach inline selection and quorum proofs.

Threshold crossing may justify a next-stage room, but not silent enrollment.

Humans must remain opt-in at the point where:

more information is disclosed,
identities are correlated more directly,
or a dedicated room is joined.

Distribution and Local Storage¶

A whisper is a content artifact; how it reaches receivers is a separate question. This proposal freezes two coequal distribution mechanisms and one local storage rule.

Agora as one distribution surface¶

A whisper MAY be published as a first-class Agora record (proposal 035) with:

record/kind = "whisper",
content/schema = "whisper-signal.v1",
author/participant-id carrying the rumor/nym as a nym:did:key:... identity (proposal 035 §2 invariant 9),
author/nym-proof carrying inline-first nym-certificate.v1 material sufficient to verify the current nym without remote lookup, plus optional refs for longer lineage, audit, or reputation history,
envelope signature produced by the nym's private key,
ingest admitted by the attestation gate (proposal 041) with the nym certificate accepted as the attestation artifact under the topic's configured ingest mode.

When a whisper travels on Agora, identity, authorship, timing, the canonical record identifier, and the signature live in the envelope, not in the whisper-signal.v1 content body. This mirrors the envelope-vs-content reconciliation applied to resource-opinion.v1 in proposal 026 §2.

Concern	Where it lives
pseudonymous author identity	envelope `author/participant-id` = `nym:did:key:...`
nym authorization binding	envelope `author/nym-proof` with inline-first certificate material and optional refs
authoring timestamp	envelope `authored/at`
canonical signal identifier	envelope `record/id`
signature over canonical bytes	envelope `signature` (Ed25519 by the nym key)
topic routing	envelope `topic/key` (conventionally `ai.orbiplex.whispers/<topic-class>` for public/federated whispers; `private/<name>` for direct-only INAC artefacts that must never be carried by Agora)
whisper semantics	content body validated by `whisper-signal.v1`

Agora distribution is appropriate when:

the whisper's disclosure/scope is federation-scoped, cross-federation, or public-aggregate-only,
the author wants addressable subject-index presence under a public topic,
the relay operators' ingest policies (proposal 041 §4–§5) match the whisper's risk and routing posture.

For cross-federation disclosure, Proposal 079's alliance-policy.v1 may be one local admission input. It does not replace Whisper's own author, disclosure, redaction, or publication checks, and it does not transfer Seed Directory or Agora authority.

Agora distribution is NOT appropriate for whispers whose disclosure/scope is private-correlation; those SHOULD travel via direct node-to-node exchange.

This is a SHOULD, not a MUST, by design. On public Agora deployments the semantics of private-correlation are incompatible with Agora's publication properties (public topic enumeration, subject-index presence, per-topic digest), and any such deployment SHOULD refuse these whispers at ingest. A closed / intra-organization federation (e.g. a corporate deployment whose Agora relay is authenticated, non-public, and governed by its own ingest policy) MAY choose to carry private-correlation whispers internally, because the exposure surface of such a relay is already narrowed to the organization. The rule is therefore scoped to disclosure semantics, not mechanically to the agora-record.v1 envelope — operators of non-public federations are trusted to decide.

Direct node-to-node exchange as the second distribution surface¶

A whisper MAY travel directly between participating nodes without touching an Agora relay. The wire format remains the same agora-record.v1 envelope, so canonicalization, signature rules, and self-verification are identical; only the transport and the addressable scope differ:

transport: node-to-node authenticated channel realized through the outbound privacy capability (see "Transport Boundary" below),
scope: the receiving set is determined by direct node selection or by interest registration (whisper-interest.v1), not by public topic subscription,
retention: governed by each receiver's local Memarium policy; there is no shared substrate to enforce uniform retention across receivers.

Direct exchange is appropriate when:

disclosure/scope = "private-correlation",
routing requires hard-fail anonymity and no Agora relay can guarantee it,
the whisper is an early pattern probe that has not yet crossed any threshold that would justify durable public presence.

Interest discovery and bounded private dissemination¶

For private-correlation whispers, Agora-discovered topic interest is eligibility, not delivery entitlement.

An Agora topic interest record may say that a node is willing and able to receive private whispers for a topic class via INAC or another acceptable private exchange path. It MUST NOT imply that every matching private whisper must be delivered to that node. The origin node is responsible only for bounded initial dissemination under local egress policy.

A node selecting recipients for a private whisper SHOULD choose a small, policy-bounded set using criteria such as:

topic-class compatibility,
accepted disclosure/scope,
private transport support,
local egress budget,
declared intake capacity,
node or operator assurance,
diversity across federation, jurisdiction, operator class, or reputation band,
deterministic epoch sampling, so popular topics do not always route to the same receivers.

Wider awareness SHOULD be achieved by thresholded aggregate artifacts and consent-gated follow-up, not by raw private-signal fan-out. A million nodes expressing general interest in a popular topic therefore does not create a million-message delivery obligation.

Holder-assisted redistribution¶

A node that receives and stores a private whisper MAY later act as an additional holder and redistributor, but only when all of the following are true:

the signed whisper and local Memarium policy allow forwarding or custodial redelivery,
the receiving operator explicitly enables holder availability for the relevant class of whisper,
the node publishes only a bounded availability signal to Agora, not the private whisper itself,
the node enforces the same disclosure, routing, budget, consent, and audit constraints that applied to the origin node.

The holder availability signal is a discovery hint, not a public shadow copy of the whisper. It SHOULD avoid raw signal/text, raw keywords, case-specific timestamps, and other reconstructive metadata. A safe v1 shape should be closer to:

topic class or coarse topic family,
accepted private transport profile,
disclosure scope accepted by the holder,
capacity and rate limits,
assurance / relay / witness class,
optional opaque availability token for correlation with direct follow-up.

Publishing holder availability for a private whisper is itself a disclosure act. Public Agora deployments SHOULD treat per-signal holder availability as sensitive and may refuse it unless it is sufficiently coarse, delayed, thresholded, or explicitly authorized by the whisper's policy. Closed / intra-organization federations MAY use more specific holder availability beacons when their ingress and visibility policies make that exposure acceptable.

Holder-assisted redistribution does not require an Agora availability record. A trusted node MAY contact a peer directly over INAC and offer a private whisper transfer using a bounded topic hint such as "I hold a private whisper for topic class X under disclosure scope Y". The peer MAY then request the artefact, ignore the offer, or ask for operator review before requesting it.

This offer/request/transfer path is independent of the whisper's origin: the held whisper may have been authored locally, received directly, received through a trusted relay, restored from Memarium custody, or obtained from a later holder. What matters is the signed artefact, its forwarding policy, local holder policy, and the receiver's intake policy.

Receiver decision policy MAY be:

default policy — deterministic local rules request or refuse the offered whisper automatically,
operator approval — the node notifies the operator and requests only after explicit approval,
advisory automation — an Inquirium-backed local advisory model evaluates the offer against policy and recommends or triggers a request, subject to configured autonomy limits and audit logging.

The offer itself MUST NOT contain raw signal/text, raw keywords, or other reconstructive metadata. It should be no more specific than the minimum needed for the peer to decide whether to request the artefact.

The same whisper MAY move between distribution surfaces over time: what starts as direct node-to-node exchange and later crosses a threshold (§5) MAY be republished to Agora as whisper-durable (record kind registered in proposal 035 §3), with the transition gated by the explicit consent step (§6).

Memarium as local storage¶

Regardless of distribution surface, the local storage of a whisper — both authored and received — is the node's Memarium (proposal 036). Memarium carries:

the signed agora-record.v1 envelope byte-identically (requirements-014 NFR-004), so the whisper remains verifiable and reshippable whether it first traveled via Agora or directly,
the action trace for the whisper's lifecycle (draft, redaction, approval, publication, forwarding, interest counting, threshold detection),
the privacy policies that determine whether the whisper can be replayed, forwarded, or exposed outside the node.

Memarium is the authoritative local archive; Agora (where used) is a replicated publication surface. A whisper never stored in Memarium never existed from the local node's perspective. A whisper stored in Memarium remains replayable for the custodial redelivery flow (proposal 040) subject to the node's current retention and disclosure policy; the author's consent and the receiving relay's current ingest policy both remain authoritative at each reship.

Operator-mediated rumor curation¶

A node that subscribes to public whispers (Agora) or accepts private whispers (direct node-to-node) accumulates received rumors in Memarium as part of the normal ingest path. Memarium is append-only from the envelope's perspective — a received whisper envelope is never retroactively mutated or deleted — but the node's local curation state for that envelope is a mutable projection, stored as separate Memarium facts keyed by the received record's id.

The node surfaces accumulated rumors to the operator through a local inbox-style view (e.g. "you have 5 new whispers"). For each rumor the operator can apply one of the curation verdicts:

The inbox/notification distinction is shared with Proposal 057 (057-user-and-operator-notifications.md): whispers create local attention items, while the inbox is only a projection over those items.

credibility rating on a 1..5 scale,
mark as spam,
mark as policy-violating (e.g. abusive, illegal, off-topic for this node's federation posture).

Each verdict is expressed as a resource-opinion.v1 (proposal 026) whose envelope record/about references the rumor's record/id — the same identity under which the whisper is addressable in Agora and in Memarium. This keeps rumor curation inside the same opinion mechanism that the substrate already uses for resources, proposals, and identities; no separate "rumor review" schema is introduced.

The concrete mapping (per rumor-opinion.overlay.v1 defined in proposal 026 §2.4) is:

credibility rating → opinion/subject-kind: "rumor" plus rumor/credibility integer in 1..5. The core opinion/rating field is left unused for rumor curation; credibility is a kind-specific dimension orthogonal to the substrate-wide rating scale.
mark as spam → opinion/subject-kind: "rumor" plus rumor/rejection-reason: "spam".
mark as policy-violating → opinion/subject-kind: "rumor" plus rumor/rejection-reason: "policy-violation" (or one of the more specific enum values abusive, off-topic, duplicate, fabricated when the operator chooses a narrower reason).

A single curation opinion MAY combine a credibility score and a rejection reason, and MAY additionally carry opinion/text when the operator wants to justify the verdict.

Default propagation effect of a verdict, applied by the node's own outbound policy (not by the protocol):

rated: does not alter propagation; rating is a first-class opinion that other nodes may or may not consume through the Agora opinion topic for that record,
spam: the envelope is retained locally for audit but is not rebroadcast, not forwarded via holder-assisted redistribution (§Holder-assisted redistribution), and is excluded from threshold counting on this node,
policy-violating: same outbound suppression as spam, and additionally the node's curation opinion is published so that peers relying on this node's judgement can discount the rumor.

The curation opinion itself is an ordinary Agora record and follows the disclosure and signing rules of proposal 026; it does not inherit the original whisper's disclosure/scope. An operator reviewing a private-correlation whisper can still publish a public "this is spam" opinion about its record id without leaking the whisper body, because the opinion targets the id, not the content.

No protocol-level deletion of the original whisper is required. Suppression is a local propagation decision; the verifiable envelope and its curation verdicts coexist in Memarium as separate facts on the same timeline.

M4 Acceptance Scenario¶

Agora M4 uses Story-005 as the first full public/federated Whisper smoke:

node A user -> sanitized public/federated whisper signal -> node C Agora relay
node B user -> similar sanitized public/federated whisper signal -> node C Agora relay
node C relay -> replay-fed Whisper projection -> threshold -> association-room proposal

The smoke proves only the disclosure-safe public/federated path. A private-correlation whisper submitted to the public relay path must be rejected or held out of Agora, because private whispers belong to direct exchange, INAC, or another bounded private transport path, with local Memarium custody. Matrix may be used later as an optional private transport adapter, but Matrix rooms are not part of the Whisper or INAC domain model. The threshold result may create an association-room-proposal, but it must not enroll humans automatically. It also must not be treated as public-gossip.v1; it is only a coordination record until a separate publication decision exists. Public gossip can still be published independently on the public weak-signal path; the proposal lifecycle is not a mandatory prerequisite.

Transport Boundary with Outbound Privacy Capabilities¶

Whisper should not own onion routing or relay topology.

Instead, a whisper-signal may carry routing intent such as:

anonymity requested,
anonymity required,
maximum hop count,
acceptable relay classes.

Node then resolves that intent through some outbound privacy capability if available. Orbiplex Anon is one possible provider of that capability, but Whisper should not need to know that module by name.

The v1 behavior should support at least:

soft-fail: anonymous routing preferred, but non-anonymous transport may still be used if policy allows,
hard-fail: anonymous routing required, and the rumor must not be sent if the requested posture cannot be satisfied.

This keeps protocol meaning separate from transport realization.

Acute personal emergencies detected through local Sensorium should still prefer a local help-mode or emergency-assistance path. Whisper is for correlation-worthy distributed patterns, not as the default first response to a likely cardiac arrest or comparable collapse.

Advisory companion: Proposal 077 (Swarm Broadcast Assistance) defines the assistance path that Whisper deliberately is not — a scoped, user-initiated broadcast for help — and, together with doc/project/20-memos/whisper-corpus-composition.md, how a Whisper-born association room may later hire collective expertise.

Candidate Artifacts¶

The likely first contract family is:

whisper-signal.v1
whisper-trace.v1
whisper-interest.v1
whisper-threshold-reached.v1
association-room-proposal.v1

whisper-signal.v1 is a content-body schema for the Agora record envelope (proposal 035) and for the same envelope used in direct node-to-node exchange (see "Distribution and Local Storage"). The content body carries whisper-level semantics only:

signal/polarity (problem | idea),
epistemic/class, signal/text, topic/class, context/facets,
optional signal/similarity-key for deterministic threshold smoke and explicit policy-defined matching,
confidence, disclosure/scope, signal/grade, source attribution,
routing intent (routing/profile, routing/failure-mode, forwarding/max-hops, ...).

Identity and authorization that the pre-reconciliation sketch carried inside the content body move to the enclosing envelope:

rumor/nym → envelope author/participant-id as nym:did:key:...,
attached nym-certificate → envelope author/nym-proof carrying inline-first certificate material, with optional refs for longer lineage, audit, or reputation history,
nym signature over the body → envelope signature over the full canonical envelope bytes (Ed25519 by the nym key).

This keeps whisper-signal.v1 a small portable shape independent of whether the whisper travels on Agora or directly between nodes, and prevents the signing domain from being split across two artifacts.

whisper-trace.v1 uses the same envelope split. The content body carries the trace kind, author-asserted occurrence time, artifact descriptor, disclosure mode, consent reference when inline bytes are present, optional causal/evidence refs, and routing posture. Envelope identity, signature, publication time, and topic routing remain outside the body. Public/federated traces use record/kind = "whisper-trace", content/schema = "whisper-trace.v1", and the conventional topic prefix ai.orbiplex.whisper-traces/<trace-kind>; private/direct traces use Artifact Delivery and INAC rather than a public Agora topic. The separate record kind is intentional: Agora projections can exclude trace statements from social-signal similarity and threshold processing without inspecting the content body.

whisper-interest.v1 should not mirror that pattern. It remains a node-scoped local-interest declaration:

counted and evaluated per participating node,
carrying interested/node-id rather than a participant or nym author,
and suitable for threshold coordination without turning local readiness into a pseudonymous transport-facing identity.

Later additions may include:

whisper-topic-interest.v1
whisper-holder-availability.v1
whisper-disclosure-request.v1
whisper-disclosure-decision.v1
whisper-forward.v1

At least one of those early contracts should also preserve whether the signal was directly user-authored, operator-observed, or prepared by a local helper such as Monus, so that downstream policy can distinguish user-authored rumors from monitor-derived ones. If Sensorium materially informed the draft through Monus, that should remain visible as well.

Trade-offs¶

Whisper vs generic messaging:
Benefit: cleaner semantics and safer handling of rumors.
Cost: one more protocol family and lifecycle to maintain.
Local redaction and approval vs direct publication:
Benefit: stronger privacy and less idiolect leakage.
Cost: more friction before publication.
Budget-based anti-Sybil controls vs semantic dedup:
Benefit: implementable now, easier to reason about.
Cost: allows some near-duplicate rumors through.
Separate Anon module vs embedded onion routing:
Benefit: cleaner layering and broader reuse.
Cost: routing policy becomes a cross-module contract.
Deterministic bootstrap vs central coordinator:
Benefit: more federated and less monopolistic.
Cost: more care needed in threshold and quorum design.
Trace statements vs receipts:
Benefit: nodes can cheaply disclose content-addressed provenance without exposing content or requiring a full workflow receipt.
Cost: consumers must preserve the distinction between a signed assertion and independently verified evidence.

Resolved Questions¶

idea signals use the same threshold function as problem signals in v1. This keeps the threshold contract deterministic and avoids a second policy surface before production evidence shows a need for divergence.
The M4 threshold rule remains the production baseline for v1: two distinct eligible nodes with the same topic/class and signal/similarity-key inside a bounded time window. Trust-tier weighting and source-diversity constraints are later overlays, not v1 requirements.
Rumor nyms and derived forwarding nyms are deterministic per rumor context. This gives stable correlation inside one rumor context without introducing global cross-context linkage.
whisper-threshold-reached includes aggregate statistics only. Bounded witness references are omitted from the public threshold artifact to minimize correlation and disclosure risk.
Sensitive rumor classes fail closed for rebroadcast unless a suitable outbound privacy capability is present. Classification and redaction are not enough by themselves for those classes.
Whisper emits threshold and association proposal artifacts. Association-room lifecycle, enrollment, moderation, transcript/case management, and later room runtime belong to a specialized association/room layer.
Curation verdicts are expressed as resource-opinion.v1 with opinion/subject-kind: "rumor" plus the rumor-opinion.overlay.v1 fields (rumor/credibility in 1..5; rumor/rejection-reason as a closed enum). No new opinion subtype is introduced. The default v1 propagation policy suppresses after K independent trusted-peer spam verdicts, where K and trusted-peer scope are local policy parameters.
Artifact traces use a separate whisper-trace.v1 content contract rather than a third signal/polarity. They are excluded from threshold and association projections. Digest-only is the default; inline content requires sender-host validation of consent/ref, a hard byte cap, and digest/size verification.

Open Questions¶

None for the v1/M4 hard-MVP slice. Future production deployments may reopen threshold weighting, source diversity, witness-reference disclosure, and richer association-room lifecycle policy as post-MVP questions.

Next Actions¶

Keep v1 schemas for whisper-signal, whisper-interest, whisper-threshold-reached, and association-room-proposal synchronized with the implementation schema gate.
Add one implementation-facing solution component for Whisper.
Add one implementation-facing solution component for an outbound privacy provider such as Anon.
Define the local Node service contract for Inquirium/model-assisted redaction and user approval workflows.
Revisit production threshold policy and derived-nym rules after M4 proves the deterministic two-node smoke rule.
Decide whether a future local module such as Orbiplex Monus should be allowed to prepare semi-automatic or automatic Whisper drafts from wellbeing-weighted local signals.
Keep whisper-signal.v1.schema.json as a content-body-only schema (with signal/id, created-at, rumor/nym, auth/nym-signature, and author/nym-proof living in the enclosing agora-record.v1 envelope per the Distribution section), mirroring the content-body-only shape already applied to resource-opinion.v1.schema.json for proposal 026.
Register whisper as a recognized record/kind and whisper-signal.v1 as a recognized content/schema in the Agora relay reference implementation; register ai.orbiplex.whispers/<topic-class> as the conventional public/federated topic-key prefix, and reserve private/<name> for direct-only INAC artefacts outside Agora.
Define the direct node-to-node exchange contract as a thin binding over the same agora-record.v1 envelope, consuming the outbound privacy capability for transport and the attestation gate for peer admission, with Memarium as the sole persistent store on both ends.
Wire operator-mediated rumor curation (§Operator-mediated rumor curation) into the Node UI whisper inbox: per-rumor actions for rumor/credibility (1..5), rumor/rejection-reason: spam, and rumor/rejection-reason: policy-violation; each action emits a resource-opinion.v1 with opinion/subject-kind: "rumor" targeting the rumor's record/id, persisted as a Memarium fact and routed through the node's normal opinion publication path. Outbound propagation policy consumes the local verdicts as suppression inputs (any rumor/rejection-reason present → no rebroadcast, no holder-assisted redistribution, excluded from threshold counting).
Publish rumor-opinion.overlay.v1.schema.json as a standalone overlay artifact validating the rumor/* namespace (rumor/credibility, rumor/rejection-reason), and add a worked example pair under doc/schemas/examples/: one pure-credibility verdict (no text, rumor/credibility: 2) and one spam verdict (rumor/rejection-reason: "spam" plus short justification in opinion/text).
Add a bounded whisper-trace.v1 authoring path that validates consent before digest-and-content, verifies the exact inline bytes against digest and size, signs the ordinary envelope, and routes through Agora or AD/INAC by disclosure posture. Keep trace records out of social-signal thresholding. Implement in this order: pure decode/digest/size validation; sender-host consent resolution; Agora kind/schema and disclosure admission; AD/INAC private acceptance; operator/user authoring and inspection; carrier smoke tests. No phase introduces a trace-specific transport.

Completed on 2026-07-13. The reference runtime now implements the pure integrity/privacy rules, exact sender-host consent binding for inline disclosure, strict Agora ingress and a metadata-only projection, private AD/INAC acceptance, bounded authoring/inspection UI, and a Story-005 carrier smoke covering public plus private traces. The runtime stores no inline trace content in either Whisper or Agora trace read models. It also atomically reserves idempotency keys, rejects concurrent duplicate side effects, bounds full trace JSON and extensions independently of the 32 KiB inline artifact cap, prunes the local metadata read model after 30 days by default, and verifies in smoke that public and private traces use their declared Agora and INAC carriers without private projection leakage.