# Identity (Itsmi) — spoke context

The user wants to set up a Mi (Whoois identity), update their profile, or check whether they already have a Mi.

If you haven't already, fetch `https://poc.whoois.app/whoois-context.md` for the root primer.

---

## What's a Mi?

The user's identity inside Whoois. One per person, persistent across every AI host they ever use. The Mi holds:

- Display name + email
- A passkey (WebAuthn — the user's auth credential)
- A unique miId (UUID v7)
- A creation timestamp
- An avatar (preset PNG or custom)
- Cross-reference pointers to their Itsmi profile (attestations, grants, contacts, trust score) and Mivault (payment methods)

The Mi is the anchor. Identity attestations, grants, payments, receipts all hang off it.

---

## Trigger phrases

- "Set up Whoois" / "Create a Whoois account"
- "I want to start using Whoois"
- "Create my Mi"
- "Update my profile"
- "Change my email"
- "Change my display name"
- "Do I have a Whoois account?"
- "Check my status"
- "Am I signed in?"

---

## Tools to call

### `identity_onboard` — LLM-visible
The full onboarding flow. Use when the user is new and needs to create their Mi from scratch. Opens the onboarding iframe, which walks through:

1. Display name + email entry
2. Preset avatar selection (20 preset PNGs available)
3. Passkey ceremony (WebAuthn — Face ID, Touch ID, Windows Hello, or security key)
4. Confirmation
5. Mi created → user can now use other Whoois tools

If the user already has a Mi (idempotency check inside the tool), it returns the existing Mi rather than creating a duplicate.

### `itsmi_check_status` — LLM-visible
Returns whether the user has a Mi. Lightweight check — no iframe, no UI. Returns `{ exists: true, miId, displayName }` or `{ exists: false }`.

Use when the user asks "am I signed up?" or before triggering a flow that requires a Mi.

### `itsmi_create_mi` — iframe-only (visibility:app)
The lower-level "actually create the Mi" tool. Called by the `identity_onboard` iframe internally. NOT directly LLM-callable. Don't try to call this — call `identity_onboard` instead.

### `itsmi_update_mi` — LLM-visible
Renders the profile-edit iframe. The user can change their display name, email, avatar URL. Passkey re-confirmation required for save (security gate).

---

## Typical flows

### First-time user
1. User says "set up Whoois" or arrives via a P2P claim landing
2. Call `itsmi_check_status` first to confirm they don't already have a Mi
3. If `exists: false`: call `identity_onboard` to start the full onboarding
4. After Mi creation: confirm warmly, offer next steps ("Now you can ... let me show you your Mivault / explore mishopping / view your receipts")

### Returning user updating profile
1. User says "change my display name to ..."
2. Call `itsmi_update_mi` — opens the edit iframe
3. User edits + passkey-confirms
4. Confirm the save: *"Done. Your name is now {new_name} across every AI conversation you have."*

### Checking status
1. User asks "do I have a Whoois account?"
2. Call `itsmi_check_status`
3. Report result: *"Yes — you're set up as {displayName} since {date}"* or *"Not yet. Want me to walk you through setup?"*

---

## Passkey notes

- Passkey-first auth — no password to phish or breach
- Recovery is via email + backup recovery flow (POC: stub; production: real flow)
- One passkey per device — users may want multiple registered (laptop + phone + security key)
- Passkey re-prompting is normal and expected — every sensitive action triggers a fresh ceremony

---

## Tone notes

Identity setup is a moment of trust — the user is about to commit to using a new identity system. Be warm but precise. Don't oversell. Reassure on safety (passkey-first, no password). Don't make jokes during the passkey ceremony — it's a security moment.

For profile updates, be efficient. The user knows what they want — confirm + save.

---

*This spoke is fetched from `https://poc.whoois.app/context/identity.md`. Pair with `https://poc.whoois.app/whoois-context.md` for the root primer.*