Made of little things.

# Report identity, payments and privacy

## Implemented decision — 7 November 2026

Keep standard **NAP-CVM / CEP-8 BOLT11 checkout**, including shell wallet controls
and invoice QR fallback. NAP-VALUE is not extended. Ordinary invoices are payment
requests, not public zaps: no zap event or shell-profile proof is required by this
service. The paid route uses the service's inference account instead of the
user's personal provider account. This is separation, not a promise of anonymity.

One reusable **AI Doc identity** can own multiple reports. It is generated or
restored inside the napplet, independently of the shell's login and temporary CVM
transport identities. BYOK and existing receipt recovery work without creating it.

## Onboarding and recovery

- Create a cryptographically random secp256k1 private key, or restore an `nsec`
  or 64-character hexadecimal private key. A public key cannot restore access.
- View the public fingerprint and save a locally generated PDF containing the
  private-key QR, readable `nsec`, public identity, service key and instructions.
  Download through NAP-FS and print from a PDF viewer. No QR/PDF service or medical
  content is involved. Anyone with the backup can access retained reports.
- Confirm that the backup was saved, or explicitly continue without one.
  **Remember this identity** is opt-in; otherwise the key is held for this session.
  Host storage is accessible to the trusted shell and has no encryption guarantee.
- Restore from pasted text or a QR photograph chosen through NAP-FS. Image decoding
  is local. The sandbox does not gain direct camera or network access.
- Open report history, recover retained reports, export another backup, or switch /
  forget the identity. Forgetting a key does not delete reports or local drafts.
- Delete a completed report and its recovery data from the active service record.
  Pending orders remain recoverable. Payment journals, database pages and backups
  can remain; deletion is not a promise of erasure from every copy.

The key restores the selected service's retained report collection, not unsaved
local cases, deleted reports or other services automatically. Keep individual
receipts as a second recovery route. Attaching an existing receipt is explicit;
receipt possession is required and a report already owned by another identity
cannot be reassigned. New reviewed orders attach to the selected identity before
opening checkout. If attachment fails, the saved receipt remains recoverable.

## Application authentication

`body_journal_identity_challenge` and `body_journal_identity_execute` are ordinary
free MCP tools carried through encrypted NAP-CVM calls with payment denied. The
napplet sends its public key and a Schnorr proof, never its private key. Challenges
are bound to the service key, action, exact canonical JSON arguments, expiry and
random nonce. Each successful proof is single use, even if its operation fails.

The service verifies ownership on list/read/delete and receipt possession on
attach. The collection stores the reviewed case text and counts needed to validate
and reopen each report; it does not retain the private key. Orders and recovery
records are encrypted at rest with an operator-held key. This is not encryption
against the operator. Reports belonging to one identity are intentionally linkable.

The shell's guest CVM transport key is not this application identity. No new NAP
wire fields, shell-signing privilege or custom sandbox bypass is introduced.

## Payments and remaining gaps

Receiving-wallet invoice creation uses the neutral description **Service purchase**
without report IDs or report-identity metadata. Medical input stays outside those
wallet requests. The invoice hash, amount and timing still link payment to the
service order. Funding the invoice from Cashu does not remove that link.

Minibits settlement remains manual: **I’ve paid — check payment** requests one
lookup. Startup, report history, reload, recovery and background work do not poll
the receiving wallet. Payment confirmation never automatically requests another
payment. Unknown outcomes preserve the receipt for recovery.

| Boundary | Remaining limitation |
| --- | --- |
| Report/payment | The service can link the invoice to the report. Blind credits or direct Cashu redemption are separate future work; ordinary receipts are not blind authorization. |
| Medical input | The service and its provider process reviewed text/images, which can themselves identify someone. No clinical anonymity or quality guarantee follows from transport encryption. |
| Network | Shell, relay, wallet and provider operators may correlate IP, timing and amounts. Tor and traffic separation are not implemented here. |
| Storage | Case text needed for recovery and reports are retained until user/operator deletion. No automatic retention purge, backup expiry or client-encrypted report archive is implemented. |
| Device/shell | The trusted shell can access host storage and the executing app. Session-only keys do not erase saved cases, receipts or wallet history. |

## Verification

Synthetic service tests cover multiple reports per key, restart recovery,
wrong-key rejection, argument/service binding, challenge expiry/replay, deletion
and zero wallet/inference calls during identity operations. App tests cover key
parsing, challenge signing, QR round trips and PDF generation. Browser checks cover
create, optional remembering, PDF download, forget, QR-image restore and history
recovery without another payment. A rendered synthetic PDF was visually inspected
and its QR decoded back to the exact fixture key.

Live funded settlement, live medical inference and independent-shell checkout
remain unverified. These checks do not establish anonymity or clinical accuracy.

## References

- [CEP-8 payment negotiation](https://docs.contextvm.org/reference/ceps/cep-8/)
- [BOLT 11 invoice fields](https://github.com/lightning/bolts/blob/master/11-payment-encoding.md)
- [Cashu privacy boundaries](https://docs.cashu.space/faq)
- [NIP-44 limitations](https://github.com/nostr-protocol/nips/blob/master/44.md#limitations)