Chapter 8 of 12 · 2 min read
Case study: ~Cortisol Checker~
A separate identity handoff followed by action-specific observation and storage consent.
Sign in with Wellbeing Identity · v0.1 · edition history · Moses Sam Paul
The private ~Cortisol Checker~ V2 journey uses a separate audience, continuation, exchange endpoint, redemption store, and local service session. It demonstrates why continuity must not be confused with data reuse.
8.1 Sign in before writing
The interface asks the participant to connect Wellbeing Identity before beginning a personal observation. It creates the verifier and state before any reflection is written. The handoff stores only short-lived transaction material. After successful exchange, the interface reports: “Wellbeing Identity connected. No reflection text was carried through the sign-in.”
This ordering is a privacy control. The participant does not type a narrative and then discover that authentication will redirect it elsewhere. Free-text reflection fields remain only in page memory and are cleared by reload. The structured observation is assembled separately.
8.2 Authentication is not observation consent
An authenticated Checker member still lacks authority to save a personal observation until active action-specific consent exists. The current flow distinguishes observation consent from storage consent. Before persistence, the application prepares a structured preview, displays what will be saved, requires submit-time confirmation, and uses a save token and idempotency key. The service accepts only an explicit structured-event allowlist and recursively rejects forbidden narrative-like keys.
The default stored-observation retention is ninety days. An owner can extend retention through a separate explicit action, append a correction revision, delete an observation group and its revisions, or revoke storage consent, which deletes the owner’s V2 ledger under the current contract. Minimal content-free audit material can have a separate security basis; the distinction must remain explicit.
8.3 Identity does not change the result
The legacy public language analysis and the V2 private observer have different contracts. In the published Phase 1 implementation, identical text receives the same deterministic content score regardless of identity. A verified participant can add a separate self-reported response under consent. In V2, the interface states that the current structured observation creates no identity update. No private identity value is an input to a medical or diagnostic claim.
8.4 Evidence status
On 10 August 2026, an authenticated production canary completed preview, save, read, retention extension, and deletion through the Foundation UI. Database checks verified the structured allowlist, absence of narrative echo, lack of direct authenticated table privileges, owner-scoped policy, zero remaining observations after deletion, and content-free deletion audit. Revision creation, consent-revocation deletion, scheduled purge, recurrence thresholds, and second-owner denial remain separately gated canaries. The result is implementation evidence, not clinical, scientific, or independent security validation.
