---
type: overview
summary: How a person gets from holding nothing to acting as an identity — the barrier, the broker hand-over, and the split between settling and connecting
triggers:
  keywords: [sign-in, signin, identity, ensureIdentity, settleIdentity, barrier, gate, wallet, broker, redirect, ng-id, currentUser, session]
  paths:
    - "packages/polyfill/src/shared-wallet/**"
    - "packages/polyfill/src/surface/lifecycle.ts"
    - "packages/polyfill/src/emulated-verifier/connect.ts"
vocabulary:
  - term: settle
    gloss: decide which identity is acting, from the URL, storage, or the barrier — needs no session
    not: [resolve identity, determine user, login]
    see: knowledge_settling-is-not-connecting
  - term: barrier
    gloss: the full-screen overlay this package mounts to hand out the wallet and take an identifier
    not: [modal, popup, login screen]
---

# sign-in — getting a person from nothing to acting

This concept covers everything between "someone opens the application" and "an identity is acting with a live session": the `barrier` this package mounts, the wallet a newcomer must obtain, the broker redirect, and the two distinct acts — `settle` and connect — that were once conflated and must stay apart.

None of it is app-facing. An application awaits one call and renders; it must never learn that a broker, an iframe or a redirect exist. What it may rely on lives in `app-contract`; what follows is how that promise is kept.

The whole thing is scaffolding: upstream, a person opens **their** wallet, it contains **their** site, and `session_start` takes an id that came from the wallet. There is nothing to name and nothing to choose. This concept exists because one shared wallet hosts several identities.

## Read first

- `knowledge_how-a-user-gets-in` — the flow end to end, and which layer owns each step.
- `knowledge_settling-is-not-connecting` — the split, and the cycle that forces it.
- `caveat_connect-memoizes-an-abandoned-run` — a live trap, unfixed.