#142 F-Monitor — a warm ambient-monitoring daemon seam for the decision engine

[Anonymous]

Originally created by: fu351

Today each host hook pays engine import/startup cost per call. A warm, per-device background daemon that hosts the decision engine would remove that cost and unlock ambient monitoring — and it's the open foundation other collectors plug into.

What to build

• A local (never hosted) daemon that keeps the decision engine warm and answers decisions over a local IPC channel.
• A Collector / ActivitySource entry-point interface + a local ambient event bus (mirrors the existing Rule/Detector/AuthProvider/AuditSink plugin pattern).
• The basic built-in collectors: wire the existing MCP proxy + Claude Code hooks to feed the daemon.

Where to start: this needs a short design pass first (propose the IPC boundary, the daemon lifecycle, and the Collector interface) — it isn't slice-detailed yet, so comment with a design sketch before coding. Reuse the existing engine/registry; keep the daemon strictly off the hot decision path's correctness guarantees (it's a performance + observability layer).

Difficulty: hard / architectural — an epic; great for someone who wants ownership of a subsystem.

---

Building this? A few project invariants any change must respect:

• Fail closed — on any error or uncertainty, deny/BLOCK; never a silent pass.
• Raise-only — a guardrail may auto-tighten, never silently loosen; weakening goes through the human-approved, possession-factor-gated path.
• Never expose secrets — no raw secret, full file, or unredacted prompt in a log/store; fingerprints + reason codes only.
• Ships with tests and green CI; keep the policy core decoupled from the proxy adapter (import-linter enforced).

New here? See CONTRIBUTING.md (github.com), and come chat in the Discord — happy to help you scope any of this.

[Anonymous]

Originally posted by: fu351

Closing as decomposed. This level-10 umbrella was too big to hand anyone, so it was split into buildable slices: [#236] (the activity bus), [#237] (the warm observe-only daemon itself), and [#238] (basic collectors). The design detail lives with those issues. If you want in on F-Monitor, start with [#236]; the daemon in [#237] builds on it.

[Anonymous]

Ticket changed by: fu351

• status: open --> closed