23 Aug 2026
Identity learning foundation and safer matching controls
This update records the current implementation pass in the working tree. Identity learning remains opt-in and shadow-only by default: staff-confirmed evidence can prepare a profile, but it does not replace the existing matching workflow or bypass human review.
Identity learning
Added bounded identity-profile storage and evidence rules
The system can keep a versioned identity profile per student and select a limited, diverse set of approved evidence.
What changed
New identity profile, evidence, learning request, and audit structures connect official references with staff-confirmed review outcomes. Evidence limits, provider ownership, quality checks, and rebuild versions are enforced before a profile can be prepared.
Why
Long-term identity learning needs explicit data boundaries and traceable rebuilds before it can be considered for a controlled pilot.
Review decisions can feed learning requests safely
A confirmed, good-quality staff decision can create bounded learning evidence without changing the original review decision.
What changed
Review evidence is synchronised append-only, stale evidence is revoked when decisions change, and affected profiles are queued for rebuild. The learning path is separated from publication, export, and Journey decisions.
Why
Learning should follow an explicit human-confirmed decision and remain reversible when that decision is corrected.
Matching controls
Face scanning now adapts to group-photo coverage
Scan profiles can choose deeper coverage for demanding archive photos while retaining bounded face-count and budget limits.
What changed
Adaptive scan policy, provider-side timeouts, pre-scan handling, and cost-guard integration make the scan mode explicit and keep broader detection work within controlled limits.
Why
Different photo types need different coverage, but a more thorough scan must not become an unbounded provider operation.
Near-tie results can use school context without overriding similarity
A same-class or same-year signal can reorder only close face-search candidates; it cannot create a candidate or overrule a materially stronger match.
What changed
Context ranking loads the photo’s academic metadata and candidate enrolments, applies small policy-versioned bonuses, preserves raw similarity and rank, and records the reason for any near-tie reorder.
Why
School context can help staff review close candidates, but it must never become identity proof.
Operations & privacy
Profile builds, shadow comparison, and deletion use guarded queues
Profile work can run in bounded, retryable jobs, compare against the legacy path without changing live suggestions, and remove provider-side identity data when a profile is deleted.
What changed
The new queue route uses idempotent messages, leases, retries, retention, and explicit feature flags. Shadow sampling is disabled by default and records only comparison metrics; deletion checks provider ownership and reports failed cleanup for follow-up.
Why
The rollout needs a reversible operational path and must not affect production matching until evidence supports a future decision.