01 · Consent model
Identity and capability never sit in the same place.
Two stores, two keys. The matching service can read a candidate's shape and evidence but has no path to their name. A reveal requires a consent record written by the candidate, and every reveal is logged with time and requester.
Try it: step through what an employer can see →