Requirements 013: Monus as Host-Granted Local Observation Middleware¶

Based on:

doc/project/20-memos/orbiplex-monus.md
doc/project/20-memos/orbiplex-whisper.md
doc/project/30-stories/story-005-whisper-rumor-intake.md
doc/project/40-proposals/013-whisper-social-signal-exchange.md
doc/project/40-proposals/019-supervised-local-http-json-middleware-executor.md
doc/project/40-proposals/022-monus-as-host-granted-local-observation-middleware.md
doc/project/50-requirements/requirements-010-middleware-executor.md

Date: 2026-03-30 Status: Draft

Executive Summary¶

Orbiplex Monus is defined as a local Node-attached middleware module that may observe admitted local signals and prepare candidate social-signal drafts, but only through host-granted capability contracts.

The key boundary is:

Monus may observe and prepare,
Node grants bounded access and enforces policy,
Whisper remains the bounded publication layer.

Functional Requirements¶

ID	Requirement	Type	Source	Status
FR-001	The system MAY support `Orbiplex Monus` as a supervised Node-attached middleware module.	Fact	Proposal 022	todo
FR-002	A Node claiming Monus support MUST expose Monus only through explicit host-granted capability contracts rather than through ambient unrestricted access to local state.	Fact	Proposal 022	todo
FR-003	Host-granted Monus capability contracts MUST remain separately grantable for memory/read-model access, local signal intake, Inquirium/model-assisted draft shaping, audit emission, and publication requests.	Fact	Proposal 022 + Proposal 063	todo
FR-004	`Monus` MUST be able to operate with only a subset of those host-granted capabilities when deployment policy does not grant the full set.	Fact	Proposal 022	todo
FR-005	`Monus` MUST NOT directly publish outbound `whisper-signal.v1` artifacts onto the network without Node-owned validation and egress.	Fact	Proposal 022 + Proposal 013	todo
FR-006	`Monus` MAY prepare local concern drafts, candidate Whisper drafts, or explicit do-not-publish recommendations.	Fact	Proposal 022	todo
FR-007	When an outgoing `whisper-signal.v1` was materially prepared by Monus, the publication path MUST preserve `source/class = monus-derived` or `monus-sensorium-derived` as appropriate.	Fact	Proposal 013 + Proposal 022	todo
FR-008	`Monus` MUST preserve the distinction between purely user-authored rumor input and middleware-derived rumor preparation.	Fact	Memo + Proposal 022	todo
FR-009	A Monus-capable Node SHOULD retain local audit trace indicating which host-granted capabilities were used in preparing a candidate concern or publication request.	Inference	Proposal 022	todo
FR-010	If a deployment grants Monus memory/query access, that access MUST remain bounded by admitted local scopes rather than unrestricted access to all local storage.	Fact	Proposal 022	todo
FR-011	If a deployment grants Monus Inquirium/model-assisted draft shaping, the draft-shaping path MUST remain host-owned and policy-visible rather than allowing direct vendor side channels from Monus.	Fact	Proposal 022 + Proposal 063 + Requirements 010	todo
FR-012	If a deployment grants Monus publication-request capability, the request path MUST target a Node-owned or Whisper-owned review/publication contract rather than direct transport egress.	Fact	Proposal 022	todo
FR-013	If a deployment grants Monus communication-signal ingestion, the grant MUST be explicit, user-approved, bounded by local policy, and separately revocable from general memory/query access.	Fact	Proposal 022	todo
FR-014	Communication-signal ingestion MUST distinguish source classes such as outgoing message, incoming message, conversation summary, and metadata-only observation.	Fact	Proposal 022	todo
FR-015	A communication-derived Monus draft MUST NOT publish or expose the original message content as a network-facing rumor unless a later Whisper or Node policy explicitly authorizes that disclosure path.	Fact	Proposal 022 + Story 005	todo
FR-016	When an outgoing message contributes to a Monus-prepared candidate rumor, the local audit trace MUST record the observation grant, source class, source reference, exposed content mode, transform path, and basis for any Whisper handoff.	Fact	Proposal 022	todo

Non-Functional Requirements¶

ID	Requirement	Type	Source	Status
NFR-001	The Monus integration surface SHOULD preserve stratyfikacja between local observation, host capability grants, and bounded social-signal publication.	Fact	Project values + Proposal 022	todo
NFR-002	Monus support MUST remain optional at deployment level and MUST NOT be assumed by the core Node transport or procurement baseline.	Fact	Proposal 022	todo
NFR-003	Host-granted Monus capabilities SHOULD be inspectable by operators as explicit configuration or capability-report state rather than hidden middleware assumptions.	Inference	Operability	todo
NFR-004	A future Monus implementation MAY be written in Python or another language as long as it attaches through the supervised middleware surface and honors the host capability contracts.	Fact	Proposal 022 + Proposal 019	todo
NFR-005	Communication-derived observation SHOULD default to least disclosure: summaries or redacted projections should be preferred over raw message content when they are sufficient for the Monus task.	Inference	Privacy and auditability	todo

Failure Modes and Mitigations¶

| Failure Mode | Impact | Mitigation | |---|---|---|---|---| | Monus silently reads more local state than intended | Hidden privacy violation and broken trust boundary | Require explicit host-granted capability contracts and bounded local scope for memory/query access. | | Monus treats ordinary messages as ambient observation data | Private communication becomes hidden monitoring input | Require explicit communication-signal grants, source-class filtering, least-disclosure projections, and local audit records. | | Monus publishes directly through transport without host validation | Unbounded rumor publication and broken accountability | Keep transport egress Node-owned and Whisper-mediated. | | Monus calls external model vendors directly | Hidden side channel and audit gap | Require host-owned Inquirium/model-assisted draft-shaping path. | | Deployment grants only partial capability set | Feature brittleness | Require Monus to degrade gracefully under partial host grants. |