Concepts

Certificates

Every portal name has a birth certificate signed by the Jubilee root key, re-issued whenever what it binds changes, and a death certificate when it dies, is retired or is terminated.

On this page

What a certificate is
Birth, re-certification and death
The signed body
How to verify one
The fingerprint
Where to get one

What a certificate is

Every registration receives a certificate that is both a keepsake and a security certificate. It is named for what the name is: an identity’s certificate of birth (an avatar’s verified identity certificate), a destination’s property certificate, or an experience certificate. Underneath, all of them are the same signed certificate, of kind birth. It binds the permanent ID, the name, the public key, the persona fingerprint where one applies, the registrant and the relationship label, and it is signed by the Jubilee root key. A character’s certificate also carries its class, gender, attributed birth country, the person who answers for it, and its Character DNA fingerprint. It proves provenance and the registered persona, not the accuracy of the underlying model.

A certificate is never edited. When something it binds changes, the registry issues a new version that supersedes the last; the old one stays in the name’s history.

Birth, re-certification and death

Certificate	kind	Issued when
Birth certificate	`birth`	The name is born: the registrant sends the public key (and, for a persona namespace, the persona package). Version 1. A `.character` is born when a Jubilee reviewer approves its Character DNA; see Characters.
Re-certification	`birth`	A new version of the birth certificate, with `supersedes` naming the one it replaces. Issued when the key is rotated, when a transfer is accepted (the new owner brings a new key and becomes the registrant), when a lost key or account is recovered, and when an authorized persona update brings a new persona fingerprint.
Death certificate	`death`	The owner retires the name; Jubilee terminates it; a name dies after a year dormant; or a born name that never went live lapses. It carries `retiredAt` and a `reason`, the STATUS becomes retired, terminated, dead or released for good, and the permanent ID, and a character’s DNA fingerprint, are never reissued. A retired character’s death certificate is also a keepsake.

The signed body

A signed certificate is { body, kid, signature }. This is the birth certificate of the example name, signed with the example root key:

oasis.character, birth certificate, version 1json

{
  "body": {
    "schema": "pm.certificate/1",
    "kind": "birth",
    "certificateId": "crt_01JBX3Q8ZA6M2T9K4V7N1R3W5Y",
    "version": 1,
    "pid": "pid:01JBX3Q8Z9M4T7K2V5N6R8W0YC",
    "name": "oasis.character",
    "address": "activate://oasis.character",
    "namespace": "character",
    "family": "identity",
    "registrant": {
      "displayName": "Example Studio",
      "type": "organization"
    },
    "bornAt": "2026-10-23T12:00:00.000Z",
    "issuedAt": "2026-10-23T12:00:00.000Z",
    "issuer": "The Portal Mesh Registry, Jubilee Software, Inc.",
    "notices": [
      "Relationship labels describe roles and a chain of responsibility only. They do not create human employment status, legal personhood, or human rights.",
      "This certificate proves provenance and the registered persona, not the accuracy of the underlying model."
    ],
    "lookup": "https://theportalmesh.com/lookup/?name=oasis.character",
    "publicKey": {
      "kty": "OKP",
      "crv": "Ed25519",
      "x": "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"
    },
    "keyId": "pid:01JBX3Q8Z9M4T7K2V5N6R8W0YC#k1",
    "personaFingerprint": "sha256:f666f7b6e5c7b0a0c94366a7b55b902d2d3c1fb6d6d130922c70f7a274f00a24",
    "relationshipLabel": "AI Employee",
    "displayName": "Oasis",
    "character": {
      "class": "worker",
      "gender": "female",
      "dnaFingerprint": "sha256:eacb55f7bb7e1c0240780e660ade3ddea5a4fc08d36fb23f3f52f983a604e54d",
      "birthCountry": "US",
      "responsible": {
        "role": "responsible_guardian",
        "shownAs": "Responsible Guardian",
        "displayName": "Jordan Lee"
      },
      "guardian": {
        "displayName": "Example Studio"
      },
      "affirmation": "I accept the duties and responsibilities of guardianship for this AI character.",
      "kind": "human",
      "humanoid": true,
      "fullName": "Oasis Rivera",
      "attributedAge": 32,
      "inspireType": "The Keeper",
      "dnaListVersion": "2026-10-24",
      "dnaSignature": {
        "kid": "jubilee-root-example",
        "signature": "Qqg_hrZtE1FZQHuNWwiQZDqw4QR8aoTYwbWGuFVO_lCedz58ZncpZCw3JCjm6vUeBOJ62PhMwG4QUIpUr6UIAg"
      },
      "characterFingerprint": "sha256:e3886f6081f353d1b96e6ff0275f89acad0492acdca5f52dbdcad6d2fe9f87fa"
    }
  },
  "kid": "jubilee-root-example",
  "signature": "qPj5JrRTdS2_hGVqcX1hzLSgoqetgYkfSN1Wd0Z5VzKtVUBFSNSwH6Nh9zAcDeAOJ0UGKUMl0Fo5crdevEZTAA"
}

Field	Meaning
`schema`	`pm.certificate/1`
`kind`	`birth` or `death`.
`certificateId`	`crt_` and a ULID.
`version`	Counts the certificates of this kind for this name, from 1.
`pid`	The permanent ID.
`name`	The portal name.
`address`	The name with its locked scheme.
`namespace`	The namespace, without its dot.
`family`	identity, destination or experience. A record or certificate signed before October 25, 2026 may say environment or place, the two families that became Destinations.
`publicKey`	Birth certificates: the name's Ed25519 public key, as a JWK.
`keyId`	Birth certificates: that key’s id, `<pid>#k<n>`.
`personaFingerprint`	Persona namespaces: `sha256:<64 hex>` of the persona package. See Personas.
`registrant`	`{ displayName, type, role? }`: the public owner label, individual or organization, and for a Family character how its person is shown: `father`, `mother`, `owner`, `sponsor` or `guardian`. Never private contact details.
`relationshipLabel`	Identity namespaces: the label, such as AI Employee, AI Daughter or AI Pet.
`displayName`	The name's display name, when it has one. Stored apart from the address; many names may share one.
`character`	A `.character`: its class, gender, DNA fingerprint, birth country, the person who answers for it, and the words they affirmed (below).
`bornAt`	When the name was born.
`issuedAt`	When this certificate was issued.
`retiredAt`	Death certificates: when the name died, or was retired or terminated.
`reason`	Death certificates: why. Defaults to “Retired by its owner.”, “Terminated by Jubilee.”, “Its renewal was missed and it stayed dormant for a year.” or “It never went live within its deadline.”
`supersedes`	The certificateId of the certificate of the same kind this one replaces.
`issuer`	`The Portal Mesh Registry, Jubilee Software, Inc.`
`notices`	The notices every certificate carries (below).
`lookup`	The public lookup address for the name.

Optional fields are left out when they do not apply; they are never present as null.

What every certificate says

Relationship labels describe roles and a chain of responsibility only. They do not create human employment status, legal personhood, or human rights.
This certificate proves provenance and the registered persona, not the accuracy of the underlying model.

The certificate shows the relationship as one line, for this example “AI Employee of Example Studio”. For a Family character the role follows, as in “AI Daughter of Ruth Brown, mother” or “AI Pet of Ruth Brown, owner”.

A character’s certificate

A .character’s certificate adds a character section. It is written once, at birth, and every later version of the certificate repeats it unchanged: the birth certificate, including its date, can never be changed. This is Oasis’s, a Worker character of Example Studio:

The character sectionjson

{
  "class": "worker",
  "gender": "female",
  "dnaFingerprint": "sha256:eacb55f7bb7e1c0240780e660ade3ddea5a4fc08d36fb23f3f52f983a604e54d",
  "birthCountry": "US",
  "responsible": {
    "role": "responsible_guardian",
    "shownAs": "Responsible Guardian",
    "displayName": "Jordan Lee"
  },
  "guardian": {
    "displayName": "Example Studio"
  },
  "affirmation": "I accept the duties and responsibilities of guardianship for this AI character.",
  "kind": "human",
  "humanoid": true,
  "fullName": "Oasis Rivera",
  "attributedAge": 32,
  "inspireType": "The Keeper",
  "dnaListVersion": "2026-10-24",
  "dnaSignature": {
    "kid": "jubilee-root-example",
    "signature": "Qqg_hrZtE1FZQHuNWwiQZDqw4QR8aoTYwbWGuFVO_lCedz58ZncpZCw3JCjm6vUeBOJ62PhMwG4QUIpUr6UIAg"
  },
  "characterFingerprint": "sha256:e3886f6081f353d1b96e6ff0275f89acad0492acdca5f52dbdcad6d2fe9f87fa"
}

Field	Meaning
`class`	`family` or `worker`. See Characters.
`gender`	male, female or other, as registered. It stays on the certificate.
`dnaFingerprint`	The Character DNA fingerprint, `sha256:<64 hex>`. See the fingerprint.
`birthCountry`	The attributed birth country, a two-letter code. It never changes.
`responsible`	`{ role, shownAs, displayName }`: the person who answers for the character, its Parent, Owner, Sponsor, Guardian or Responsible Guardian. A successor who steps in later is named in the GUARDIAN record, never here: the Parent stays on the birth certificate forever.
`guardian`	A Worker character’s organization, `{ displayName }`.
`affirmation`	The words the responsible person affirmed at registration.

How to verify one

A certificate’s signature covers the canonical JSON of { body, kid }, signed by the root key that kid names. To verify:

Find the root key you trust whose id is the certificate’s kid. If there is none, it does not verify.
Write { "body": <body>, "kid": <kid> } as canonical JSON and encode it as UTF-8.
Verify the base64url signature over those bytes with Ed25519.
Check that the body is for the name and PID you expected, and that it is the current certificate: the one the CERT record points at.

These are the bytes the example certificate signs:

Canonical JSON of { body, kid }text

{"body":{"address":"activate://oasis.character","bornAt":"2026-10-23T12:00:00.000Z","certificateId":"crt_01JBX3Q8ZA6M2T9K4V7N1R3W5Y","character":{"affirmation":"I accept the duties and responsibilities of guardianship for this AI character.","attributedAge":32,"birthCountry":"US","characterFingerprint":"sha256:e3886f6081f353d1b96e6ff0275f89acad0492acdca5f52dbdcad6d2fe9f87fa","class":"worker","dnaFingerprint":"sha256:eacb55f7bb7e1c0240780e660ade3ddea5a4fc08d36fb23f3f52f983a604e54d","dnaListVersion":"2026-10-24","dnaSignature":{"kid":"jubilee-root-example","signature":"Qqg_hrZtE1FZQHuNWwiQZDqw4QR8aoTYwbWGuFVO_lCedz58ZncpZCw3JCjm6vUeBOJ62PhMwG4QUIpUr6UIAg"},"fullName":"Oasis Rivera","gender":"female","guardian":{"displayName":"Example Studio"},"humanoid":true,"inspireType":"The Keeper","kind":"human","responsible":{"displayName":"Jordan Lee","role":"responsible_guardian","shownAs":"Responsible Guardian"}},"displayName":"Oasis","family":"identity","issuedAt":"2026-10-23T12:00:00.000Z","issuer":"The Portal Mesh Registry, Jubilee Software, Inc.","keyId":"pid:01JBX3Q8Z9M4T7K2V5N6R8W0YC#k1","kind":"birth","lookup":"https://theportalmesh.com/lookup/?name=oasis.character","name":"oasis.character","namespace":"character","notices":["Relationship labels describe roles and a chain of responsibility only. They do not create human employment status, legal personhood, or human rights.","This certificate proves provenance and the registered persona, not the accuracy of the underlying model."],"personaFingerprint":"sha256:f666f7b6e5c7b0a0c94366a7b55b902d2d3c1fb6d6d130922c70f7a274f00a24","pid":"pid:01JBX3Q8Z9M4T7K2V5N6R8W0YC","publicKey":{"crv":"Ed25519","kty":"OKP","x":"11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"},"registrant":{"displayName":"Example Studio","type":"organization"},"relationshipLabel":"AI Employee","schema":"pm.certificate/1","version":1},"kid":"jubilee-root-example"}

With the standalone code from mesh-verify.js, that is await verifyCertificate(certificate, { kid: "jubilee-root-example", x: "PUAXw-hDiVqStwqnTRt-vJyYLM8uxJaMwM1V8Sr0Zgw" }). Changing any field, even the registrant’s display name, makes it fail; both checks ran while this page was built.

The fingerprint

A certificate’s fingerprint is sha256: and the lowercase hex SHA-256 of the canonical JSON of the whole signed certificate, { body, kid, signature }. The CERT record carries it as fingerprint, which ties the certificate to the signed records a resolver serves: whoever holds both can check that they belong together.

text

fingerprint of the example certificate:
sha256:8985a02b0098e873418e5de978268581dfc2c1777279d3799e9345379b33e9ae

The CERT record that points at itjson

{
  "name": "oasis.character",
  "type": "CERT",
  "version": 1,
  "ttl": 3600,
  "data": {
    "certificateId": "crt_01JBX3Q8ZA6M2T9K4V7N1R3W5Y",
    "kind": "birth",
    "version": 1,
    "fingerprint": "sha256:8985a02b0098e873418e5de978268581dfc2c1777279d3799e9345379b33e9ae",
    "url": "https://theportalmesh.com/certificate/pid:01JBX3Q8Z9M4T7K2V5N6R8W0YC",
    "issuedAt": "2026-10-23T12:00:00.000Z",
    "personaFingerprint": "sha256:f666f7b6e5c7b0a0c94366a7b55b902d2d3c1fb6d6d130922c70f7a274f00a24",
    "dnaFingerprint": "sha256:eacb55f7bb7e1c0240780e660ade3ddea5a4fc08d36fb23f3f52f983a604e54d"
  },
  "issued": "2026-10-23T12:00:00.000Z",
  "kid": "jubilee-root-example",
  "signature": "d8jPFlYaIF_BEUkCkzufNmfb8ucTPqfjxXqn0aCvMnq7q1tIakFlRDrLRs2l5kvgfRmOC8pYmm-4tMIl7i7EAA"
}

When the name dies, or is retired or terminated, the CERT record keeps pointing at the last birth certificate and gains death: { certificateId, fingerprint, issuedAt } for the death certificate. The example of a death certificate, and the tombstone that carries it, is on The life of a name.

mesh-fingerprint.js (uses canonicalize from mesh-core.js)js

// "sha256:<64 hex>" over the canonical JSON of a value: the persona fingerprint (of a persona
// package) and the certificate fingerprint (of a whole signed certificate) are both this.
async function fingerprint(value) {
  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(canonicalize(value)));
  return "sha256:" + Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, "0")).join("");
}

await fingerprint(certificate) gives the value above; during the build it matched the registry’s own. The same function gives the persona fingerprint of a persona package.

Where to get one

Where	What
GET /v1/certificates/:pid	The current certificate (the death certificate once the name has ended), its fingerprint, the PDF address, and the full history, each entry with its own signed certificate.
`https://files.theportalmesh.com/certificates/<pid>/<certificateId>.json`	The signed certificate as JSON. Immutable.
`https://files.theportalmesh.com/certificates/<pid>/<certificateId>.pdf`	The keepsake PDF. Immutable.
`https://theportalmesh.com/certificate/<pid>`	The certificate page; the CERT record's url.
`cert.<name>`	The certificate view of a name, for example `cert.jubileeinspire.character`. See views.

The birth step returns the new certificate, its fingerprint, and the addresses of its JSON and PDF directly; see POST /v1/names/:pid/birth.