Private identity design
CovCare ID is intended to support pseudonymous accounts without requiring a legal name. Email-free design uses a strong password and one-time private recovery code. A short ID and PIN alone are not remote authentication.
What is available now
Sign In and account-help pages exist. Create My CovCare ID shows an unavailable state. Do not create synthetic accounts in the shared backend to test this design.
Safe current steps
- Read the prototype account warning.
- If registration is unavailable, continue with anonymous resources or temporary practice.
- Use /sign-in-help for recovery information, not the support-demo conversation.
- Do not paste passwords, recovery codes or real private information into documentation or demo forms.
Proposed recovery behavior
Email-free recovery is distinct from email reset. Codes are designed to be hashed, one-time and replaceable after successful recovery. Losing both password and recovery code can mean the account cannot be restored. Current delivery and recovery success are unverified; source implementation is not fresh end-to-end evidence.
Expected versus proven result
A future approved test would create an isolated authorized identity, save a goal, sign out/in and verify readback and owner isolation. A simulated return in /demo does not perform that test.
Blocks and future review
Data classification, actual backup/recovery evidence, CHI reviewers and separately scoped changes/tests remain required. No operational activation is authorized by a tour or manual.