Short answer: the door
Janus is the Roman god of doors, gates, beginnings, endings, and transitions. He is usually shown with two faces: one looking backward, one looking forward. Orbit’s Janus owns identity and the account lifecycle, so the name was sitting there begging to be used.
Janus decides whether a person may enter Orbit before a model sees their message. It remembers how they arrived, what they agreed to, whether they are still allowed through, and what must happen when they leave.
The model is not first in line
An incoming text reaches Gateway with transport-authenticated sender information. Before Pluto can infer intent, retrieve memory, or call a tool, Gateway asks Janus to resolve the event. Janus deduplicates the provider event, evaluates messaging controls, applies admission policy, and either returns an opaque subject identity or shuts the interaction down.
Unknown, suspended, deleted, and opted-out identities do not reach inference. The assistant cannot charm its way past a suspended account because there is no assistant in the loop yet.
verified message
→ deduplicate event
→ STOP / START / HELP
→ resolve identity
→ apply admission
→ opaque subject_id or no entryA phone number is evidence, not an identity
Phone numbers change, transports multiply, and formatting them is a small international nightmare. Orbit therefore does not use a phone number as a tenant key. Janus binds a verified transport identity to a random subject ID, encrypts the normalized handle, and keeps a keyed hash for lookup.
Every other service scopes its state to that subject. Pluto’s turns and memory, Argus’s reminders and delivery routes, and Vulcan’s proposals and receipts all agree on the same opaque identity without passing a phone number around as database architecture.
transport evidence → Janus → subject_6ab36e…
subject_id ≠ phone number
subject_id ≠ email addressSTOP should not need artificial intelligence
Program-level messaging controls are deterministic and run before inference. A standalone STOP, START, or HELP receives a defined response even if Pluto is unavailable. STOP creates a subject-scoped opt-out, pauses proactive delivery, and blocks ordinary inbound processing while leaving portal privacy controls available.
The word standalone matters. “Cancel my 9 p.m. report” is a task request. A message containing only CANCEL is a program opt-out. I would rather maintain an explicit command grammar than ask a probabilistic model to freestyle telecom compliance.
The browser does not get to pick who you are
The website holds an opaque Janus session in a Secure, HttpOnly cookie. Browser requests never submit a subject ID, receive an internal service credential, or choose which account to inspect. The website asks Janus who the session belongs to, and Janus derives the subject server-side.
Janus looks both ways
The forward-looking face handles admission, setup, consent, sessions, and activation. The backward-looking face handles revocation, export, suspension, and deletion. Leaving Orbit is a real distributed workflow, not a row disappearing from one convenient table.
When an authenticated owner types DELETE, Janus disables the subject in the same transaction that creates a durable deletion job. It then retries authenticated, idempotent deletion across Pluto, Argus, and Vulcan. A separate one-time receipt tracks progress after the normal account session is gone. Janus only reports completion after every service acknowledges, then removes its own identity state and leaves opaque tombstones to prevent accidental resurrection.
disable subject + create deletion job
→ Pluto deletes context
→ Argus deletes durable work
→ Vulcan deletes actions
→ Janus anonymizes identity
→ completion receiptThe most important thing Janus does not do
Janus does not run model inference. It does not remember your preferences, hold Google credentials, schedule reminders, or execute actions. It answers a narrower set of questions: Who is this? Are they allowed here? What state is their account in? What consent and authority exist right now?
Keeping those answers outside the model is the point. A capable assistant can be creative about dinner and research. It should be painfully boring about identity, consent, access, and deletion.
Why Janus matters
Most of Orbit’s magic begins after Janus says yes. That makes Janus easy to overlook and impossible to replace. It is the boundary that lets every downstream system assume the person is real, admitted, active, correctly scoped, and still consenting to be reached.