# Persona operating-profile contract — v100.0.36

## Decision

`spiralist-persona-operating-profile-v1` is the canonical persona output. It is produced by `PersonaOperatingProfileProjector` and validated by `PersonaOperatingProfileValidator`. Every full-detail page, API detail response, prompt handoff, passport, and export must carry this exact canonical object or a byte-preserving copy of it.

`persona-output-contract-v1` is a compatibility presentation. It is produced only by `PersonaPresentationBuilder`, which delegates behavioral policy to the canonical projector and then flattens the result for existing consumers. It may not independently invent voice, reasoning, relationship, values, boundaries, evidence rules, or identity.

## Progressive disclosure

Discovery lists may use the shared compact card, but the compact card must be traceable to the same source signature and link to a full operating profile. Detail, prompt, passport, API, and export surfaces may not substitute a teaser for the canonical profile.

## Canonical profile domains

The profile carries identity, purpose, promise, traits, charter, voice, reasoning, working relationship, productive tension, values, boundaries, behavior examples, evidence and correction rules, identity non-inference rules, controls, source lineage, quality findings, and a canonical SHA-256 fingerprint.

## Fingerprint boundary

- `operatingProfile.fingerprint`: SHA-256 over stable canonical JSON.
- `presentation.sourceSignature`: the canonical fingerprint when a canonical source exists.
- `presentation.presentationSignature`: a separate FNV-1a presentation fingerprint used by browser compatibility code.
- Browser normalization must never overwrite a server canonical SHA-256 fingerprint.

## Surface requirements

| Surface | Required output |
|---|---|
| Homepage, gallery, libraries | Shared compact card plus full-detail link and source signature |
| Curated persona detail | Canonical operating profile and compatibility presentation |
| Personality type detail | Canonical operating profile and compatibility presentation |
| Starter Pack detail/persona | Canonical operating profile for every persona |
| Persona of the Day | Canonical operating profile |
| Compare and quiz | Canonical profiles for visible results |
| Creator and passport | Exact canonical persona reused; no regeneration during handoff |
| Prompt launchpad | Exact canonical persona and source signature |
| News Caster studio/API | Specialist newsroom fields plus the same canonical persona contract |
| Random and generated-persona APIs | Canonical profile, compatibility presentation, metadata, and synchronized text artifact |
| Exports | Canonical profile and fingerprint retained |

## Identity and evidence boundaries

Geography, name, language, script, appearance, religion, politics, gender, orientation, accent, voice, loyalty, competence, temperament, and morality are separate dimensions. No field is inferred from a proxy. Content falsity, coordination, actor identity, sponsorship, intent, reach, and effect are separate evidentiary propositions. Repeated publication from one origin is one source chain, not independent corroboration.

## Acceptance boundary

The 1,113-record parity exercise and browser/PHP tests are deterministic package-local fixtures. They establish contract and identity consistency only. They do not establish live-provider, human-review, publication, deployment, live-host, activation, or runtime acceptance.
## v100.0.36 typed source boundary

Every persona now crosses `spiralist-persona-source-record-v1` before projection. The source registry resolves one of eight enum-backed families, runs a family-specific adapter, validates the normalized envelope, retains unknown top-level fields in an explicit extension bag, and then delegates to the canonical projector. The projector no longer owns specialist route defaults.

Required dependency direction:

```text
transport/controller -> typed source adapter -> canonical projector -> compatibility projection -> integrity guard -> view/API/export
```

The source boundary is fail-closed for unknown families, missing or malformed identifiers, incompatible family declarations, out-of-range controls, unsafe route traversal, and geography-to-sensitive-identity inference. Input arrays are compared before and after adaptation and must not be mutated.

Prompt, Persona Passport, and export handoffs bind to an immutable `PersonaOutputSnapshot`. A post-selection change to the canonical fingerprint, compatibility source signature, or exact identity is rejected instead of being silently represented as the same persona.