Skip to main content
InternalMarkdown

ADR 0019. Scoped Bootstrap Proofs and Controlled Merge

Status​

Accepted.

Closes the "sign in as existing PlayerPal account" mechanics left open under ADR 0010.

Context​

Without email, name or government ID, PlayerPal cannot guarantee one natural person equals one account. Silent merge on IP, device or timing would be both a privacy violation and an account-takeover path. Retrying registration must not create duplicate players for the same trusted proof.

Decision​

Prevent accidental duplicates and same-proof double registration. Raise the cost of abuse. Provide an audited correction path. This is Sybil-resistance, not civil-identity deduplication.

  • Repeatable proofs (social iss + sub, operator assertion subject, integration-scoped provider subject) map through a non-reversible issuer-scoped lookup key. An active proof cannot map to two players.
  • Account discovery offers passkey, approved social, PlayerPal ID + password, existing-device QR, or recovery code. Never email/phone lookup. Uniform errors; do not reveal whether a PlayerPal ID exists.
  • IP, device fingerprint, timing, gameplay or profile similarity must never become durable linking keys or automatic merge criteria.
  • Merge requires recent independent proof of both accounts, a preview, programme reconciliation, immutable ledger with compensating entries, and session invalidation. Unresolved value or compliance conflicts block merge.

Fragmented independent accounts (player does not sign in at a later audience) remain an expected outcome of ADR 0010.

Consequences​

  • Registration is an idempotent state machine (spec §46.3).
  • Password-only accounts are too weak to treat as unique persons (ADR 0020).
  • See docs/linking-and-bootstrap.md and spec §46.