OtterMon modern surfaces — architecture lock¶

Short ownership lock for the Drupal sensor package and its modern operator/agent surfaces. Not a roadmap and not a check catalog.

Ownership map¶

ottermon                    = sensor kernel (system-only; no hard dashboard/tool/orchestration deps)
ottermon_dashboard          = Blocks only (no dashboard.dashboard.* config in the module)
ottermon_tool               = Plugin/tool/Tool/ (Tool API plugins wrapping kernel services)
recipe_ottermon_baseline    = composition (first-10 checks + dashboard.dashboard.ottermon_ops)
OtterMon SaaS               = fleet / policy / AI correlation

Layer	Package / owner	Owns	Must not own
Sensor kernel	`drupal/ottermon`	Checks, findings, evidence, queue, PushFinding, Drush, minimal settings	Hard requires on `dashboard` / `tool` / `orchestration`; new bespoke admin SPAs
Dashboard surface	`ottermon_dashboard` submodule	Placeable Block plugins over kernel services	`dashboard.dashboard.*` config entities (recipe owns layout)
Tool surface	`ottermon_tool` submodule	`#[Tool]` plugins under `Plugin/tool/Tool/`	OtterMon-specific Orchestration code
Composition	`recipe_ottermon_baseline`	First-10 check set + `dashboard.dashboard.ottermon_ops` layout	Expanding the check catalog; SaaS policy
Fleet / SaaS	OtterMon platform (external)	Fleet views, severity policy, AI correlation	Site-local sensor kernel behavior

Same-service rule¶

Block plugins, Tool plugins, Drush commands, and any retained legacy admin routes call the same kernel services. No parallel business logic in controllers, forms, or UI wrappers.

Orchestration¶

Orchestration is external. drupal/orchestration / orchestration_tool publishes Tool API plugins; OtterMon does not ship Orchestration-specific adapters. Once ottermon_tool is enabled, remote iPaaS sees OtterMon ops automatically.

Behaviors (frozen)¶

Keep: PushFinding (bridge to OtterMon ingest).
Phase 2 (later): Log / Webhook Behavior actions → ECA on CheckChangedEvent. Do not grow Behavior product surface in the meantime.

Lab boundary¶

Prove modern surfaces on OttermonPOC only (POCs/OttermonPOC via Composer registry). Do not install OtterMon packages, config, or beads into DEMOs/bluefly.io or other consumer demos.

Check catalog¶

Do not expand the first-10 check set. No check #11 in this package or recipe.

Fleet-level product framing (ingest, fleet dashboard, rule packs) remains in Products/Drupal-Fleet-Observability.md. This file locks site-local Drupal package surfaces only.