USER-ID-1: user identity resolution specification

CHANGELOG.md

@@ -79,6 +79,23 @@ tool does not recognize the token and cannot expand the template.
   guarantees, session lifecycle, and the internal shape of `session`
   beyond `session_id` and `lang` are explicitly out of scope.
 
+## OVOS-USER-ID-1 — User Identity Resolution
+
+### 1
+
+- User identity resolution at the bus layer. The §2 identity fields,
+  claimed under OVOS-SESSION-1 §2.1: the consolidated `user_id`, the four
+  enrolled-signal ids `voice_id` / `face_id` / `name_id` / `passphrase_id`,
+  the configured `default_user_id`, and the integer `auth_level`. §3 — the
+  six `auth_level` strengths (`0` anonymous, `1` configured default, `2`
+  self-declared, `3` single passive biometric, `4` multiple passive
+  biometrics, `5` explicit credential). §4 — the four enrolled signal
+  types and the transformer / out-of-band paths that populate them. §5 —
+  the recognition plugin's ordering relative to the pipeline. §6 — Layer-2
+  injection: a bridge MAY set the identity fields directly and preserves
+  `user_id` across relay hops. Conformance roles: Recognition Plugin,
+  Skill, Bridge.
+
 ## OVOS-INTENT-4 — Intent and Entity Registration Bus Contract
 
 ### 1

README.md

@@ -108,6 +108,7 @@ pre-spec status quo, `2` for one that is not backwards compatible.
 | OVOS-SESSION-1 | [Session Carrier Wire Shape](session-1.md) | 1 | Draft |
 | OVOS-SESSION-2 | [Session Lifecycle and State Ownership](session-2.md) | 1 | Draft |
 | OVOS-BRIDGE-1 | [Bus Bridge and Opaque Relay](bridge-1.md) | 2 | Draft |
+| OVOS-USER-ID-1 | [User Identity Resolution](user-id-1.md) | 1 | Draft |
 
 ### Orchestrator stack — what processes utterances