Chapter 5 of 11 · 2 min read
Contracts Before Components
Why honest JSON-safe values and purpose-bound projections were established before interface reuse.
The ~WellbeingIdentity Rendering Architecture · v0.2 · edition history · Moses Sam Paul
Quick Answer
The shared contracts package @theinternetofvalue/wellbeing-identity-contracts@0.1.4 establishes JSON-safe facet values and distinct public, owner-private, replay, and replay-input projections. The renderer receives those projections; it does not make them.
One of the release’s smallest defects expressed its largest principle. Structured facet values were reaching an interface designed for strings, leading to raw-object rendering such as [object Object]. The defect was not solved by converting every record to an opaque sentence. The contract was corrected so arrays and structured records could be represented honestly, and the interface could present them as readable lists, summaries, and labelled disclosures.
Values are allowed to be structured
A facet can be a string, number, boolean, null, list, or a structured record with labelled fields. This is deliberately narrower than an arbitrary executable object and richer than a string-only schema. It lets a history remain a history rather than a misleading blob of text.
The private facet presenter follows the same principle. Lists become contained chips or readable items. Records become compact summaries with expandable labelled fields. Score History is described as recorded history with entries—not as an invented current score. Recognised service links use accessible external-link affordances; unfamiliar URLs retain a generic external-link indication. Long evidence remains inside compact disclosures so it cannot force a panel beyond its reading width.
Projection types express purpose
The contracts distinguish a public profile projection, an owner-private projection, a replay projection, and a replay input. The names are not cosmetic. A public profile has a public audience and a publication purpose; a replay carries settled-event context; an owner-private view supports a private identity reading. Consumer code can then be explicit about which shape it expects rather than using one permissive “identity” object everywhere.
A component that cannot reach behind its input
The renderer has no network role, no credential role, no score-calculation role, and no policy role. It takes a supplied projection and interaction callbacks. This makes one useful security property simple to state: a renderer cannot disclose data it was never given. That property does not remove the need for trustworthy projection construction, but it prevents the shared visual layer from becoming a hidden escalation path.