The persona directory: durable principals for edge callers.

Implements the storage decision of docs/reference/personas.md §3(a): one commonware_storage::qmdb::any authenticated database holds the identity directory (external identity tuple → persona), the persona profiles, and the per-persona participation lists, under domain-separated digest keys. One instance — not three — so an identity mutation and its profile / participation mutations commit atomically in a single batch (one root transition).

Key derivation

Keys are SHA-256(domain || framed parts), where framing length-prefixes every part (u64 big-endian length, then the bytes) so identifiers containing separator characters cannot collide — the same policy as the edge SDK's framed_conversation_id.

Values

Values are buffa-encoded polychrome.persona.v1 records (proto/persona.proto) — the same persisted-proto discipline as the conversation event log's payloads.

Runtime genericity and single-writer ownership

Like polyc-eventlog, the store is generic over a [commonware_storage::Context]: production drives it on the Commonware tokio backend (hosted on a dedicated OS thread — see [host::PersonaHost]), tests on the deterministic backend. The control plane is the single writer; commits are explicit durability points and uncommitted batches are discarded on restart (clean recovery, no torn state).

Durability of the qmdb store

commonware_storage::qmdb::any is not an in-memory convenience, it is the durable identity/profile store (docs/reference/personas.md §3(a)) — chosen deliberately for its tamper-evidence and qmdb::sync replication properties (see the design doc for the alternatives considered).