ADR-0010: Each voice gains an identity and owns its record

Status: accepted (Rafa, 2026-10-12: "each voice gains an identity in the recording process, so each voice controls its own record")
Builds on: ADR-0008 (per-participant resolution)

Decision

Identity: when a voice is first heard, it gains a pseudonymous, session-local identity (v1, v2, …) and an empty record.
Record: every stretch of its speech is filed in that record as a segment stamped with the voice's applied level.
Control: the voice controls its record:
- it can lower its level, or raise it, but only for itself;
- it can forget a recent span ("forget what I just said");
- it can shorten how long the record is kept;
- it can erase the whole record for the session ("erase everything I said").
Derived artefacts: summaries and transcripts may draw on a voice's words only up to that voice's level (RP §5.4).
Persistence: identities end with the session unless the voice claims its identity ("remember my voice"). That is an opt-in, because the features that recognise a voice again are biometric data (GDPR Art. 9, BIPA). It is withdrawn by erasing.

Why

Per-participant levels (ADR-0008) said who may decide; this says what each person decides over. A level is meaningless without a record it applies to.

No existing system gives a person control over their own words in a shared recording: SIPREC preferences are advisory, and meeting platforms offer consent-or-leave (protocol/research/prior-art.md).

Consequences

The engine is protocol/…/session.py and resolution.js. It has Voice, Segment, stamp() and usable(), and the claim and erase intents.
Hardware gap:
- Real erasure needs per-voice keys. ATECC608 slots are few, so per-voice data keys must be wrapped under the chain keys and destroyed on erase.
- Flash wear-levelling means deleting a wrapped key isn't guaranteed; the secure element must hold a revocation counter (backlog B-26).
Separation errors now move content between records. Attribution accuracy (B-11) is a privacy property, not just a convenience.

# ADR-0010: Each voice gains an identity and owns its record - **Status:** accepted (Rafa, 2026-10-12: "each voice gains an identity in the recording process, so each voice controls its own record") - **Builds on:** ADR-0008 (per-participant resolution) ## Decision - **Identity:** when a voice is first heard, it gains a pseudonymous, session-local identity (`v1`, `v2`, …) and an empty record. - **Record:** every stretch of its speech is filed in that record as a segment stamped with the voice's applied level. - **Control:** the voice controls its record: - it can lower its level, or raise it, but only for itself; - it can forget a recent span ("forget what I just said"); - it can shorten how long the record is kept; - it can erase the whole record for the session ("erase everything I said"). - **Derived artefacts:** summaries and transcripts may draw on a voice's words only up to that voice's level (RP §5.4). - **Persistence:** identities end with the session unless the voice claims its identity ("remember my voice"). That is an opt-in, because the features that recognise a voice again are biometric data (GDPR Art. 9, BIPA). It is withdrawn by erasing. ## Why Per-participant levels (ADR-0008) said who may decide; this says *what* each person decides over. A level is meaningless without a record it applies to. No existing system gives a person control over their own words in a shared recording: SIPREC preferences are advisory, and meeting platforms offer consent-or-leave (`protocol/research/prior-art.md`). ## Consequences - **The engine** is `protocol/…/session.py` and `resolution.js`. It has `Voice`, `Segment`, `stamp()` and `usable()`, and the `claim` and `erase` intents. - **Hardware gap:** - Real erasure needs per-voice keys. ATECC608 slots are few, so per-voice data keys must be wrapped under the chain keys and destroyed on erase. - Flash wear-levelling means deleting a wrapped key isn't guaranteed; the secure element must hold a revocation counter (backlog B-26). - **Separation errors** now move content between records. Attribution accuracy (B-11) is a privacy property, not just a convenience.