Authority and trust boundaries

A continuity system becomes unsafe when technical connectivity is mistaken for universal authority. The implementation distributes authority by concern.

5.1 The represented person

The person controls whether to begin the sign-in journey, whether to complete authentication, whether to grant an application-specific consent, and which available facets to publish through Word Wallet’s owner controls. These controls do not make every self-assertion externally validated. They establish authority over participation and disclosure.

5.2 The IoV Spec

The canonical Spec owns protocol paths, the eight-node ~WellbeingIdentity anatomy, the identity document anchor, comparability fields, and cross-protocol invariants. It does not operate a person’s live browser session and does not process the relying application’s private records. A Spec public-profile example is a conformance fixture, not runtime identity state.

5.3 Word Wallet Web

Word Wallet Web is the current identity authority and control plane. It operates identity-side authentication, maintains the binding between an authenticated user and the identity DID, hosts the private identity home, stores active private projections and owner disclosure choices, issues the current short-lived relying-application handoffs, and exposes minimized purpose-specific services. Calling it merely another relying application would invert the architecture.

Word Wallet is not the calculation authority for private Value Log events or issuer-specific wellbeing calculations. It may receive signed projections from an authorized source and gate their disclosure, but reception does not make Word Wallet the source of the calculation.

5.4 Value Log

Value Log owns private event records, append-only corrections and replay, issuer-specific calculations, and separate consented publication projections. It consumes the identity handoff to locate an existing private account. It may read an owner-private identity projection through a signed server route when authorized. It cannot change Word Wallet’s identity-facet publication controls and must not infer public state from private metadata.

5.5 ~Cortisol Checker~ and the Foundation

The Foundation hosts the current ~Cortisol Checker~ V2 participant interface. Word Wallet’s protected service creates the Checker session and stores only the strict structured observation allowlist after separate consent and confirmation. Free-text reflection remains in page memory and is not part of sign-in. The registered expression remains non-medical: it does not measure biological cortisol or diagnose a condition.

The Foundation also renders owner-approved public Wellbeing Identity projections. Presentation does not create authority to restore omitted fields, recalculate scores, ratify baselines, or override disclosure settings.

!Figure 3. Authority remains separated among the represented person, canonical Spec, Word Wallet Web, Value Log, ~Cortisol Checker~, and Foundation.

5.6 Trust is bounded, not absent

The system still depends on trusted components. Word Wallet must protect authentication and signing secrets. Each relying application must validate handoff properties and protect its local session. Database policies must enforce ownership. Operators must maintain allowlists and approved redirect locations. Users must understand that a viewing covenant cannot technically prevent screenshots. Purpose-bounded architecture reduces implicit trust; it does not eliminate operational trust or institutional responsibility.