Personas

The persona package

A PERSONA record carries { personaVersion, hash, profile }. The hash is the fingerprint of a persona package: a small, public JSON document that describes the persona and commits to its private sources without containing them. Names in .character, .avatar, .figure have one, and its fingerprint is written into the birth certificate.

{
  "schema": "pm.persona-package/1",
  "name": "oasis.character",
  "personaVersion": "2026.10.23",
  "profile": {
    "displayName": "Oasis",
    "class": "custom",
    "temperament": "Warm and patient",
    "summary": "A welcoming guide who answers questions about the Portal Mesh."
  },
  "sources": {
    "origin": "example.com",
    "rom": "sha256:90df3c095bb1083dc3433c8e743759806b400e90e6c5707f1e8487ccc9c780e0",
    "kernel": "sha256:a17d20701395ea274222b3d4dfa599d15ef8269bf021fce256c3a70b34d8b287",
    "tail": "sha256:d9aa267af787a852321741cd0438dbd620d163e374299b6bf2f88a9240990eb0"
  }
}

The registry refuses a package that breaks these rules, with messages such as:

• “The profile field memories is not a public field.”
• “The profile class must be inspire-family, seventy, or custom.”
• “Source rom must be a sha256:<hex> hash, never the source text.”
• “The persona package is for someone.character, not oasis.character.”

The fingerprint

The persona fingerprint is sha256: and the lowercase hex SHA-256 of the canonical JSON of the whole package. Anyone who holds the package can recompute it.

{"name":"oasis.character","personaVersion":"2026.10.23","profile":{"class":"custom","displayName":"Oasis","summary":"A welcoming guide who answers questions about the Portal Mesh.","temperament":"Warm and patient"},"schema":"pm.persona-package/1","sources":{"kernel":"sha256:a17d20701395ea274222b3d4dfa599d15ef8269bf021fce256c3a70b34d8b287","origin":"example.com","rom":"sha256:90df3c095bb1083dc3433c8e743759806b400e90e6c5707f1e8487ccc9c780e0","tail":"sha256:d9aa267af787a852321741cd0438dbd620d163e374299b6bf2f88a9240990eb0"}}

persona fingerprint:
sha256:f666f7b6e5c7b0a0c94366a7b55b902d2d3c1fb6d6d130922c70f7a274f00a24

With the standalone fingerprint function, that is await fingerprint(pkg); it matched the registry’s own while this page was built. The same value appears three times: as the PERSONA record’s hash, as the birth certificate’s personaFingerprint, and as the CERT record’s personaFingerprint.

Sealed sources are hashed, never copied

What makes a persona who it is lives in sealed sources that are never published. Jubilee’s own personas list three: rom (the identity ROM), kernel (the shared kernel) and tail (the persona’s own tail). The package carries only their SHA-256 hashes, and that choice does three things at once:

• Privacy. A hash discloses nothing about the text it was made from. The sealed files never leave the place the persona is maintained.
• A tripwire for drift. Any change to a sealed source changes its hash, and so the fingerprint. The fingerprint therefore changes whenever the persona’s actual activation identity changes, and only an authorized, versioned update can make the new fingerprint valid.
• Safe to publish. Because the package holds only a curated public profile and hashes, it can be published at the persona view, persona.<name>, and recomputed by anyone.

Binding a persona at birth

1. For a persona namespace, POST /v1/names/:pid/birth requires the persona package alongside the public key. The registry checks it and its name, and computes the fingerprint. A .character is born by the birth engine instead. Its key is sent at checkout, and when it has no persona package of its own, its persona fingerprint is its DNA hash; the persona and the DNA are separate, and both fingerprints go on its certificate.
2. The fingerprint is written into the signed birth certificate and the CERT record, and the package is published at https://files.theportalmesh.com/personas/<hex>.json, returned as personaProfileUrl.
3. The owner then publishes the PERSONA record, signed with the name’s key: personaVersion from the package, hash the fingerprint, and profile an https address where the profile can be read.

{
  "name": "oasis.character",
  "type": "PERSONA",
  "version": 1,
  "ttl": 300,
  "data": {
    "personaVersion": "2026.10.23",
    "hash": "sha256:f666f7b6e5c7b0a0c94366a7b55b902d2d3c1fb6d6d130922c70f7a274f00a24",
    "profile": "https://files.theportalmesh.com/personas/f666f7b6e5c7b0a0c94366a7b55b902d2d3c1fb6d6d130922c70f7a274f00a24.json"
  },
  "issued": "2026-10-23T12:10:00.000Z",
  "kid": "pid:01JBX3Q8Z9M4T7K2V5N6R8W0YC#k1",
  "signature": "lk49Qy02Qyh-8UsNRJOrtcgwGleY0FSEvPLAtBmKxKcP0XQiKBYMLQkwJgCVYMSnUgs3qTW4_8Bt9pqb7-cEDQ"
}

The integrity rule

A PERSONA hash must match the hash recorded on the birth certificate, or a newer authorized, versioned update. (PNS Record Standard, section 9)

The registry enforces it in three places:

1. On upload. A PERSONA record whose hash differs from the current certificate is a persona update. It must come with the new package in the same request (personaPackage), whose fingerprint is that hash and whose name is the name. The registry then re-certifies: it issues a new version of the birth certificate with the new fingerprint, and a new CERT record, in the same change, so the chain never breaks. The answer says recertified: true.
2. On activation. A name is not activated while its PERSONA hash differs from the fingerprint on its certificate.
3. On every resolution. The verification chain refuses a bundle whose PERSONA hash differs from the CERT record’s personaFingerprint: “The PERSONA hash does not match the persona fingerprint on the birth certificate.” See Resolution.

The upload refusals read:

• “PERSONA: A persona package is needed when the persona changes.”
• “PERSONA: the hash must be the fingerprint of the persona package sent with it.”

What the fingerprint proves

The fingerprint ties the persona that answers a session to the persona that was certified. portal.js sends the verified PERSONA hash in every session request as personaHash, and refuses a session whose signed answer does not echo it. See Sessions.