Chapter 1 of 11 · 3 min read
One Person, Four Legitimate Views
Why consistency of meaning must coexist with strict differences in purpose and visibility.
The ~WellbeingIdentity Rendering Architecture · v0.2 · edition history · Moses Sam Paul
Quick Answer
One canonical identity reference can appear across private, public, replay, and teaching surfaces without becoming one universal profile. In this paper, “canonical identity” means a stable identity anchor plus a shared semantic grammar. It does not mean one master profile object, one shared database, or a document that every product may read.
A person may need to inspect an owner-private identity portrait, revisit a settled sequence in Replay, publish a deliberately small public profile, or learn the model in an interactive teaching environment. Those situations ask different questions. They require different permissions, different time horizons, and different presentation choices. Treating them as four cloned profiles produces semantic drift; treating them as one universally available record produces a disclosure hazard.
The architectural answer is purpose-bound projection. An authority establishes whether a view may exist for a stated purpose. A product receives only that view. A renderer gives the view a consistent interaction grammar. It does not infer missing fields, fetch richer records, calculate a score, or grant access.
One anchor; no universal profile object.
Each receives a different, explicitly bounded projection or native explanation.
Four questions, not four copies
The owner-private profile asks: <em>what may the identity holder inspect and manage?</em> It can render private facets only after the owner-authorised projection has been assembled. Replay asks: <em>what did a completed transition mean when it settled?</em> It reads a bounded replay input rather than rewriting the event it explains. A public profile asks: <em>what has this person consented to communicate?</em> It receives public labels and summaries, never a cosmetically hidden private record. Explorer asks: <em>how can a reader learn the system before disclosing anything?</em> It is an educational scene, not a profile viewer.
For a CEO, this is the trust proposition: one recognisable language without making every audience equal. For a CTO, it is a narrower dependency graph: the shared package holds types and interaction geometry, while identity authority, disclosure policy, canonical records, and calculation remain elsewhere.
What v0.2 changes—and what it does not
v0.2 changes the argument, visual system, and responsive presentation of this public paper. It replaces fixed-text diagrams with semantic, responsive figures; makes ownership and projection paths concrete; and records both threat boundaries and decision gates. It does not change protocol semantics, renderer behaviour, contracts, consent boundaries, or product runtime.
The operational release documented here remains contracts 0.1.4 and renderer 0.2.2. The latter is a narrowly scoped interaction component shared by Value Log and Foundation. Explorer remains intentionally native.
The optional Cortisol Checker sign-in route is a fifth, deliberately narrow connection: it establishes a private Checker session for an existing identity holder, but does not export an identity record or change the expression's independent content reading.
The practical promise
The promise is modest: a person can recognise a coherent identity language across contexts while each context reveals only what it is entitled to reveal. The following chapters make the conditions of that promise explicit.