Part IV · Attribution and Reporting · Chapter 13

Persona Linkage

Commands only. What each step does, why it is built this way, and the judgment behind it are in the book.

LAB 13.1

The linkage problem and the identifier ledger

Meet the persona lab

Ubuntu 
$ ls labs/artifacts/persona-extract/corpus/
$ ./lab link selftest     # the whole linkage engine self-tests offline — no Docker, no Tor
Expected
selftest: personas parse to records; a signed key or wallet links, a displayed-only
          key is flagged as framing not a link, and naive merges on any identifier  -> PASS
selftest: leet handle variants match and look-alikes do not; shared rhythm and a
          repeated tactic sequence link only within an operator  -> PASS
selftest: full recovers 4 operators (Alpha high, Bravo medium) and flags the borrowed
          key; naive over-merges the frame and the look-alike and splits Bravo  -> PASS
selftest: full recall 1.00/precision 1.00/false-merges 0; naive precision 0.40/false-merges 9  -> PASS
  link self-tests passed (identifiers, stylometry, behavior, fuse, pipeline+scorer)

The identifier ledger

Ubuntu 
$ ./lab link ledger
Expected
  the identifier ledger (what each persona signs, shows, and transacts with):
    BlackVault   leak    signs:F19B7A0C4E82D5613FA0   shows:F19B7A0C4E82D5613FA0   wallet:bc1qsynth0la
    IronVault    leak    signs:0F1E2D3C4B5A69788796   shows:0F1E2D3C4B5A69788796   wallet:bc1qsynth0br
    Mimic        market  signs:CC11DD22EE33FF445566   shows:F19B7A0C4E82D5613FA0   wallet:bc1qsynth0ch
    n1ghthawk    forum   signs:F19B7A0C4E82D5613FA0   shows:F19B7A0C4E82D5613FA0   wallet:bc1qsynth0la
    NightHawk    market  signs:F19B7A0C4E82D5613FA0   shows:F19B7A0C4E82D5613FA0   wallet:bc1qsynth0la
    Nighthawke   forum   signs:DD44EE55FF6600112233   shows:DD44EE55FF6600112233   wallet:bc1qsynth0de
    RedLattice   leak    signs:F19B7A0C4E82D5613FA0   shows:F19B7A0C4E82D5613FA0   wallet:bc1qsynth0la
    SaltMine     market  signs:A1B2C3D4E5F60718293A   shows:A1B2C3D4E5F60718293A   wallet:bc1qsynth0br
Verify in the Docker host
Ubuntu 
$ ./lab check 13.1
  • The persona-lab corpus is present, eight profiles across markets, leak sites, and forums, and every file carries the synthetic watermark
  • ./lab link selftest passes offline across all five modules and the scorer
  • ./lab link ledger shows one persona whose signed key differs from its displayed key, the borrowed key 13.2 must refuse to merge on
LAB 13.2

Hard identifiers and the provenance trap

The links a key earns

Ubuntu 
$ ./lab link hard
Expected
  hard-identifier links (shared signed key / wallet) + framing flags:
    (framing) BlackVault   Mimic        possible framing — key displayed, not controlled
    shared_signed_key  BlackVault   NightHawk
    shared_wallet      BlackVault   NightHawk
    shared_signed_key  BlackVault   RedLattice
    shared_wallet      BlackVault   RedLattice
    shared_signed_key  BlackVault   n1ghthawk
    shared_wallet      BlackVault   n1ghthawk
    (framing) Mimic        NightHawk    possible framing — key displayed, not controlled
    (framing) Mimic        RedLattice   possible framing — key displayed, not controlled
    (framing) Mimic        n1ghthawk    possible framing — key displayed, not controlled
    shared_signed_key  NightHawk    RedLattice
    shared_wallet      NightHawk    RedLattice
    shared_signed_key  NightHawk    n1ghthawk
    shared_wallet      NightHawk    n1ghthawk
    shared_signed_key  RedLattice   n1ghthawk
    shared_wallet      RedLattice   n1ghthawk
Verify in the Docker host
Ubuntu 
$ ./lab check 13.2
  • The hard pass links the four operator personas by both a shared signed key and a shared wallet, six pairwise links
  • Mimic's displayed-only key is reported as possible framing and is not merged
  • The naive pass, on the same pair, instead reports a shared identifier, the merge the full linker refuses
LAB 13.3

Stylometry, a soft signal

Fingerprinting a voice

Ubuntu 
$ ./lab link style     # sorted high to low; the top of the matrix shown
Expected
  stylometric similarity (writing voice; higher = closer):
    0.775  NightHawk    n1ghthawk
    0.717  NightHawk    RedLattice
    0.716  BlackVault   RedLattice
    0.672  BlackVault   NightHawk
    0.662  RedLattice   n1ghthawk
    0.646  BlackVault   n1ghthawk
    0.617  IronVault    SaltMine
    0.353  BlackVault   Nighthawke
    0.340  Mimic        NightHawk
    0.331  IronVault    NightHawk
    ...    (cross-operator pairs continue down to 0.067)
Verify in the Docker host
Ubuntu 
$ ./lab check 13.3
  • Within-operator pairs (e.g. NightHawk/n1ghthawk ≈ 0.78) score well above every cross-operator pair (e.g. Mimic/NightHawk ≈ 0.34)
  • A clear gap separates the two bands, placing the threshold at 0.45 from the measured data
  • The key-rotating operator's two personas are linked by voice where no hard identifier connects them
LAB 13.4

Rhythm, handles, and tactic signatures

The weak signals, weighted

Ubuntu 
$ ./lab link behavior
Expected
  behavioural links (rhythm, handle transform, tactic sequence):
    rhythm           BlackVault   NightHawk (0.955)
    rhythm           BlackVault   RedLattice (0.957)
    tactic_sequence  BlackVault   RedLattice
    rhythm           BlackVault   n1ghthawk (0.955)
    rhythm           IronVault    SaltMine (0.962)
    rhythm           NightHawk    RedLattice (0.957)
    rhythm           NightHawk    n1ghthawk (1.0)
    handle_transform NightHawk    n1ghthawk
    rhythm           RedLattice   n1ghthawk (0.957)
Verify in the Docker host
Ubuntu 
$ ./lab check 13.4
  • The handle transform matches NightHawk/n1ghthawk and does not match the one-edit look-alike
  • Rhythm overlap links only within an activity band, never across the disjoint bands
  • The two leak brands' shared tactic sequence is reported as corroboration
LAB 13.5

Fusing the signals into an operator

One rule, four operators

Ubuntu 
$ ./lab link fuse
Expected
  fusing signals into operators (full linkage):
    [HIGH  ] op-1: BlackVault, NightHawk, RedLattice, n1ghthawk
             via handle_transform, rhythm, shared_signed_key, shared_wallet, stylometry, tactic_sequence
    [medium] op-2: IronVault, SaltMine
             via rhythm, stylometry
    [single] op-3: Mimic
    [single] op-4: Nighthawke
    (framing) BlackVault vs Mimic: key displayed, not controlled — possible framing
    (framing) Mimic vs NightHawk: key displayed, not controlled — possible framing
    (framing) Mimic vs RedLattice: key displayed, not controlled — possible framing
    (framing) Mimic vs n1ghthawk: key displayed, not controlled — possible framing

Confidence is calibration

Verify in the Docker host
Ubuntu 
$ ./lab check 13.5
  • Fusion recovers four operators from the eight personas
  • The hard-linked operator is labelled HIGH and the key-rotating operator is labelled medium
  • The borrowed-key persona stays a singleton with a framing flag, not merged into the operator
LAB 13.6

The adversarial identity

The frame and the rotation

Ubuntu 
$ ./lab link fuse            # full: four operators, borrowed key held apart
$ ./lab link fuse --naive    # naive: merges on any shared string or look-alike handle
Expected, naive
  fusing signals into operators (naive linker):
    [medium] op-1: BlackVault, Mimic, NightHawk, Nighthawke, RedLattice, n1ghthawk
             via handle_lookalike, shared_identifier
    [single] op-2: IronVault
    [single] op-3: SaltMine

A link is a claim with a provenance

Verify in the Docker host
Ubuntu 
$ ./lab check 13.6
  • The naive linker over-merges the frame and the look-alike into the operator and splits the key-rotating operator into singletons
  • The full linker does neither, four operators, the borrowed key flagged not merged
  • Every full-linker cluster carries the evidence trail that holds it together
LAB 13.7

Scoring, calibration, and where linkage stops

The scorecard

Ubuntu 
$ ./lab link score
$ ./lab link score --naive
Expected, full
  linked the persona corpus (full linkage); grading against ground truth:
scored persona linkage against persona-lab ground truth
  link recall            7 / 7      1.00
  link precision         7 / 7     1.00
  false merges           0          (cross-operator links — the dangerous error)
  operators recovered    4 / 4
  confidence calibration 2 / 2      (high for hard, medium for soft-only)
  framing flagged        4 / 4      (borrowed key held apart, not merged)
Expected, naive
  linked the persona corpus (naive linker); grading against ground truth:
scored persona linkage against persona-lab ground truth
  link recall            6 / 7      0.86
  link precision         6 / 15     0.40
  false merges           9          (cross-operator links — the dangerous error)
  operators recovered    3 / 4
  confidence calibration 0 / 2      (high for hard, medium for soft-only)
  framing flagged        0 / 4      (borrowed key held apart, not merged)

Where linkage stops

Reflection

Verify in the Docker host
Ubuntu 
$ ./lab check 13.7
  • The full linker scores 7/7 recall, 7/7 precision, 0 false merges, 4/4 operators, 2/2 calibration, 4/4 framing
  • The naive linker's precision collapses to 0.40 with 9 false merges and 0/4 framing on the same corpus
  • The false-merge count, the number of wrong accusations, is the metric the chapter foregrounds