# Student identity and research-manifest separation

Source record:
`docs/backlog/tasks/task-hule-08-02-17-add-governed-vt26-manifests-with-restorable-private-student-identity-map.md`
at HuleEdu revision `c9d8b6ef60c19bbbdb17b9b46243ab4abfce35bb`.

## Retained Contract

The Swedish research data uses two separate manifest layers:

- The tracked structural manifest contains assignment and prompt identity,
  pseudonymous essay IDs, source checksums, provenance, and aggregate cohort
  counts. It contains no raw essay text or direct student-name mapping.
- The private identity manifest contains the teacher-owned mapping between
  pseudonymous IDs and names, classes, local source files, and result records.
  That manifest and the identity-bearing runtime catalog remain outside Git.

## Validation Results

The completed task recorded:

- 61 student records and 9 anchors in the VT26 manifest;
- successful full verification of the structural manifest, private manifest,
  and local catalog;
- successful structural-only verification without the private identity file;
- a failed identity-bearing verification when the private identity file was
  deliberately absent; and
- a structural privacy scan with no direct-name, local-path, class, source-role,
  or source-filename fields in the tracked manifest.

These results substantiate the separation between public research identity and
the private restoration map. They do not claim that essay text itself is absent
from a comparative-judgment provider request; that request shape is recorded
separately.