Phase J2: Identity, Sessions, and Consent¶

This phase introduced Keycloak-backed accounts, visitor-to-account linking, the append-only consent ledger, consent-gated health profiles, and the first authenticated consumer session.

Boundaries established¶

• Keycloak owns credentials and token issuance.
• Identity owns account, Visitor, Brand, Brand User, and consent records.
• Personalization owns health profiles and erases a profile after ConsentRevoked.
• Declining initial health consent stores no health profile. Revoking previously granted consent appends a denial record and triggers profile erasure.

Known limitations¶

The implemented browser flow uses Resource Owner Password Credentials through Identity and stores tokens in browser local storage. This is a demonstration compromise, not a production-safe OIDC flow. Authorization Code + PKCE and a reviewed token/session design are required before production-user deployment.

Account creation spans Keycloak and Identity storage without a distributed transaction. Operations must be idempotent and need compensation/reconciliation for partial failure. Consent-revocation publication and consumption remain best-effort; QAS-3 is not met until durable publication, retry, dead-letter handling, and completion monitoring exist.