SCIBASE-AI · telemarkdigital-publisher · Aug 16, 2026
diff --git a/PR_BODY_IDENTITY_MERGE_REPUTATION_15.md b/PR_BODY_IDENTITY_MERGE_REPUTATION_15.md
@@ -0,0 +1,53 @@
+/claim #15
+
+## Summary
+
+Adds `researcher-identity-merge-guard`, a focused Community & User Reputation System slice for safe researcher profile consolidation before reputation, CRediT-style contribution credit, badges, leaderboards, or private review history can transfer between merged profiles.
+
+The guard evaluates synthetic merge packets for:
+
+- independent verified identity proofs across ORCID, GitHub, and institutional email evidence
+- ORCID and GitHub alias conflicts
+- stale institutional email evidence
+- projected reputation or credit spikes after merge
+- open source-profile objection windows
+- anonymous, double-blind, or private review history exposure
+- missing institutional steward approval
+- duplicate publication or contribution-credit collisions
+- missing durable audit receipts
+
+## Demo Video
+
+Required short demo video is included at:
+
+`researcher-identity-merge-guard/reports/demo.mp4`
+
+It is a generated synthetic slate only. It does not capture a desktop, browser, credentials, personal files, API keys, or private researcher data.
+
+## Reviewer Artifacts
+
+- `researcher-identity-merge-guard/reports/summary.json`
+- `researcher-identity-merge-guard/reports/reviewer-packet.md`
+- `researcher-identity-merge-guard/reports/summary.svg`
+- `researcher-identity-merge-guard/reports/demo.mp4`
+
+## Validation
+
+```text
+npm run check
+npm test
+npm run demo
+npm run video
+git diff --check
+ffprobe reports/demo.mp4
+```
+
+Local results:
+
+- syntax check passed
+- tests passed: 5/5
+- demo generated 4 packet decisions: approve 1, review 1, hold 2
+- MP4 rendered successfully: 1280x720, yuv420p, 8.000000 seconds
+- `git diff --check` passed
+
+AI-assisted implementation, reviewed and locally verified before submission.
diff --git a/researcher-identity-merge-guard/README.md b/researcher-identity-merge-guard/README.md
@@ -0,0 +1,41 @@
+# Researcher Identity Merge Guard
+
+This package is a focused SCIBASE community reputation slice for issue #15. It evaluates researcher identity consolidation packets before merged profiles can transfer reputation, CRediT-style contribution credit, badges, leaderboards, or private review history.
+
+The guard is intentionally self-contained. It uses synthetic data only, has no external API calls, needs no credentials, and does not touch live profile systems.
+
+## Why this fits Community and User Reputation
+
+Community reputation systems often need to merge duplicated or renamed researcher identities: ORCID records, GitHub handles, institutional emails, legacy profile IDs, and project contribution ledgers. A naive merge can hijack credit, leak double-blind reviews, duplicate publication credit, or inflate reputation scores.
+
+This guard produces deterministic reviewer decisions:
+
+- `APPROVE_MERGE` when independent identity proofs, consent, redaction, steward approval, and audit receipts are all present.
+- `REVIEW_MERGE` when evidence is plausible but stale or the projected credit transfer is unusually large.
+- `HOLD_MERGE` when conflicting identity claims, open objections, privacy leaks, missing approvals, duplicate publication collisions, or missing audit receipts are present.
+
+## Files
+
+- `src/index.js` contains the decision engine.
+- `data/sample-merge-packets.json` contains four synthetic profile merge packets.
+- `test/identity-merge-guard.test.js` covers approve, review, hold, aggregate, and helper behavior.
+- `scripts/demo.js` writes reviewer artifacts to `reports/`.
+- `scripts/render-demo-video.js` renders the required short MP4 demo using a generated slate only.
+
+## Local Validation
+
+```powershell
+npm run check
+npm test
+npm run demo
+npm run video
+```
+
+Generated review artifacts:
+
+- `reports/summary.json`
+- `reports/reviewer-packet.md`
+- `reports/summary.svg`
+- `reports/demo.mp4`
+
+The MP4 is generated from synthetic text and color frames only. It does not capture the desktop, browser windows, keys, personal files, or private data.
diff --git a/researcher-identity-merge-guard/data/sample-merge-packets.json b/researcher-identity-merge-guard/data/sample-merge-packets.json
@@ -0,0 +1,198 @@
+[
+  {
+    "packetId": "identity-approve-001",
+    "policy": {
+      "minimumVerifiedProofTypes": 2,
+      "maxInstitutionalEmailAgeDays": 180
+    },
+    "primaryProfile": {
+      "profileId": "sci-user-1029",
+      "orcid": "0000-0002-1111-2222",
+      "github": "dr-rivera"
+    },
+    "sourceProfiles": [
+      {
+        "profileId": "legacy-user-44",
+        "orcid": "0000-0002-1111-2222",
+        "github": "dr-rivera"
+      }
+    ],
+    "identityProofs": [
+      {
+        "type": "orcid",
+        "status": "verified"
+      },
+      {
+        "type": "github",
+        "status": "verified"
+      },
+      {
+        "type": "institutional_email",
+        "status": "verified",
+        "freshnessDays": 34
+      }
+    ],
+    "objectionWindowStatus": "closed",
+    "requiresStewardApproval": true,
+    "stewardApprovalStatus": "approved",
+    "auditReceiptId": "merge-receipt-2026-08-16-001",
+    "reputationPreview": {
+      "before": 184,
+      "after": 201,
+      "maxAllowedDelta": 25
+    },
+    "privateReviewLinks": [
+      {
+        "reviewId": "dbl-948",
+        "mergeVisibility": "redact"
+      }
+    ],
+    "publicationCollisions": []
+  },
+  {
+    "packetId": "identity-hold-002",
+    "policy": {
+      "minimumVerifiedProofTypes": 2,
+      "maxInstitutionalEmailAgeDays": 180
+    },
+    "primaryProfile": {
+      "profileId": "sci-user-8821",
+      "orcid": "0000-0003-2222-3333",
+      "github": "lab-anika"
+    },
+    "sourceProfiles": [
+      {
+        "profileId": "legacy-user-17",
+        "orcid": "0000-0003-9999-3333",
+        "github": "anika-results"
+      }
+    ],
+    "identityProofs": [
+      {
+        "type": "github",
+        "status": "verified"
+      },
+      {
+        "type": "institutional_email",
+        "status": "stale",
+        "freshnessDays": 412
+      }
+    ],
+    "objectionWindowStatus": "open",
+    "requiresStewardApproval": true,
+    "stewardApprovalStatus": "missing",
+    "auditReceiptId": "",
+    "reputationPreview": {
+      "before": 91,
+      "after": 178,
+      "maxAllowedDelta": 30
+    },
+    "privateReviewLinks": [
+      {
+        "reviewId": "dbl-122",
+        "mergeVisibility": "expose"
+      }
+    ],
+    "publicationCollisions": [
+      {
+        "artifactId": "doi:10.5555/conflict.2026",
+        "status": "unresolved"
+      }
+    ]
+  },
+  {
+    "packetId": "identity-review-003",
+    "policy": {
+      "minimumVerifiedProofTypes": 2,
+      "maxInstitutionalEmailAgeDays": 180
+    },
+    "primaryProfile": {
+      "profileId": "sci-user-3104",
+      "orcid": "0000-0001-4444-5555",
+      "github": "m-chen"
+    },
+    "sourceProfiles": [
+      {
+        "profileId": "legacy-user-90",
+        "orcid": "0000-0001-4444-5555",
+        "github": "m-chen"
+      }
+    ],
+    "identityProofs": [
+      {
+        "type": "orcid",
+        "status": "verified"
+      },
+      {
+        "type": "github",
+        "status": "verified"
+      },
+      {
+        "type": "institutional_email",
+        "status": "verified",
+        "freshnessDays": 219
+      }
+    ],
+    "objectionWindowStatus": "closed",
+    "requiresStewardApproval": false,
+    "stewardApprovalStatus": "not_required",
+    "auditReceiptId": "merge-receipt-2026-08-16-003",
+    "reputationPreview": {
+      "before": 132,
+      "after": 190,
+      "maxAllowedDelta": 45
+    },
+    "privateReviewLinks": [],
+    "publicationCollisions": []
+  },
+  {
+    "packetId": "identity-hold-004",
+    "policy": {
+      "minimumVerifiedProofTypes": 2,
+      "maxInstitutionalEmailAgeDays": 180
+    },
+    "primaryProfile": {
+      "profileId": "sci-user-6407",
+      "orcid": "0000-0002-7777-8888",
+      "github": "kpatel-open"
+    },
+    "sourceProfiles": [
+      {
+        "profileId": "legacy-user-128",
+        "orcid": "0000-0002-7777-8888",
+        "github": "kpatel-open"
+      }
+    ],
+    "identityProofs": [
+      {
+        "type": "orcid",
+        "status": "verified"
+      },
+      {
+        "type": "github",
+        "status": "verified"
+      },
+      {
+        "type": "institutional_email",
+        "status": "verified",
+        "freshnessDays": 88
+      }
+    ],
+    "objectionWindowStatus": "missing",
+    "requiresStewardApproval": true,
+    "stewardApprovalStatus": "pending",
+    "auditReceiptId": "merge-receipt-2026-08-16-004",
+    "reputationPreview": {
+      "before": 220,
+      "after": 231,
+      "maxAllowedDelta": 35
+    },
+    "privateReviewLinks": [],
+    "publicationCollisions": [
+      {
+        "artifactId": "doi:10.5555/shared-credit.2026",
+        "status": "unresolved"
+      }
+    ]
+  }
+]
diff --git a/researcher-identity-merge-guard/package.json b/researcher-identity-merge-guard/package.json
@@ -0,0 +1,20 @@
+{
+  "name": "researcher-identity-merge-guard",
+  "version": "1.0.0",
+  "description": "Synthetic researcher identity merge guard for SCIBASE community reputation workflows.",
+  "main": "src/index.js",
+  "scripts": {
+    "check": "node --check src/index.js && node --check test/identity-merge-guard.test.js && node --check scripts/demo.js && node --check scripts/render-demo-video.js",
+    "test": "node --test",
+    "demo": "node scripts/demo.js",
+    "video": "node scripts/render-demo-video.js"
+  },
+  "keywords": [
+    "scibase",
+    "reputation",
+    "identity",
+    "orcid",
+    "audit"
+  ],
+  "license": "MIT"
+}
diff --git a/researcher-identity-merge-guard/reports/demo.mp4 b/researcher-identity-merge-guard/reports/demo.mp4
diff --git a/researcher-identity-merge-guard/reports/reviewer-packet.md b/researcher-identity-merge-guard/reports/reviewer-packet.md
@@ -0,0 +1,68 @@
+# Researcher Identity Merge Guard Reviewer Packet
+
+Synthetic SCIBASE community reputation packets were evaluated before identity consolidation could transfer credit, reputation, badges, or private review history.
+
+## Decision Summary
+
+- Total packets: 4
+- Approve: 1
+- Review: 1
+- Hold: 2
+
+## Packet Findings
+
+### identity-approve-001: APPROVE_MERGE
+
+- Verified proof types: orcid, github, institutional_email
+- Projected credit delta: 17
+- Findings: none
+- Reviewer actions:
+  - Approve merge and preserve the audit receipt on both source profiles.
+
+### identity-hold-002: HOLD_MERGE
+
+- Verified proof types: github
+- Projected credit delta: 87
+- Findings:
+  - IDENTITY_EVIDENCE_MISSING (high): Fewer than two independent verified identity proofs are present.
+  - ORCID_CONFLICT (critical): Profile records claim conflicting ORCID identifiers.
+  - GITHUB_HANDLE_CONFLICT (high): GitHub handles conflict without a verified alias or account migration proof.
+  - INSTITUTIONAL_EMAIL_UNVERIFIED (medium): Institutional email evidence is missing, unverified, or stale.
+  - CREDIT_SPIKE_AFTER_MERGE (medium): Projected reputation or credit delta exceeds the configured merge allowance.
+  - SOURCE_PROFILE_OBJECTION_OPEN (high): Source profile owner or collaborator objection window is not closed.
+  - PRIVATE_OR_BLIND_REVIEW_LEAK (critical): The merge would expose anonymous, double-blind, or private review history.
+  - AFFILIATION_APPROVAL_MISSING (high): A governed affiliation merge is missing steward approval.
+  - DUPLICATE_PUBLICATION_COLLISION (high): The same artifact is claimed by both profiles with conflicting roles or credit.
+  - AUDIT_RECEIPT_MISSING (medium): The merge packet lacks a durable audit receipt.
+- Reviewer actions:
+  - Require verified identity proof before reputation or credit transfer.
+  - Request a signed GitHub alias or account migration receipt.
+  - Route the packet to the institutional steward for approval.
+  - Freeze public credit deltas until artifact ownership is reconciled.
+  - Wait for the objection period to close and attach responses.
+  - Redact private review history before any profile consolidation.
+  - Generate an immutable merge receipt before approval.
+
+### identity-review-003: REVIEW_MERGE
+
+- Verified proof types: orcid, github, institutional_email
+- Projected credit delta: 58
+- Findings:
+  - INSTITUTIONAL_EMAIL_UNVERIFIED (medium): Institutional email evidence is missing, unverified, or stale.
+  - CREDIT_SPIKE_AFTER_MERGE (medium): Projected reputation or credit delta exceeds the configured merge allowance.
+- Reviewer actions:
+  - Route the packet to the institutional steward for approval.
+  - Freeze public credit deltas until artifact ownership is reconciled.
+
+### identity-hold-004: HOLD_MERGE
+
+- Verified proof types: orcid, github, institutional_email
+- Projected credit delta: 11
+- Findings:
+  - SOURCE_PROFILE_OBJECTION_OPEN (high): Source profile owner or collaborator objection window is not closed.
+  - AFFILIATION_APPROVAL_MISSING (high): A governed affiliation merge is missing steward approval.
+  - DUPLICATE_PUBLICATION_COLLISION (high): The same artifact is claimed by both profiles with conflicting roles or credit.
+- Reviewer actions:
+  - Wait for the objection period to close and attach responses.
+  - Route the packet to the institutional steward for approval.
+  - Freeze public credit deltas until artifact ownership is reconciled.