Building a Privacy-First Biography and Evidence System

A personal biography can be more than a collection of memories. When it is supported by documents, archived conversations, photographs, technical artifacts, and dated records, it can become a structured historical account.

But evidence and publication are not the same thing.

This distinction is the foundation of a project we are currently developing: a privacy-first system for organizing the historical record of Daniel Ioni while keeping sensitive and personal material out of public repositories.

Two Separate Layers

The system is divided into two clearly separated layers.

1. The private evidence archive

The private archive is used for verification and preservation. It may contain sensitive source material such as:

• Personal photographs
• Private conversations
• Historical account records
• Technical artifacts
• Documents containing personal information
• Materials involving third parties
• Records that help establish a date or sequence of events

These materials are evidence, but they are not automatically suitable for publication.

The private archive must never expose:

• Passwords
• Seed phrases
• Private cryptographic keys
• Card numbers or CVVs
• Bank account information
• Home addresses or telephone numbers
• Personal information belonging to third parties
• Private photographs or conversations

Public access must never be inferred merely because a file supports a historical claim.

2. The public biography

The public layer contains only information that has been deliberately reviewed and approved for publication.

Its purpose is to present a careful historical narrative without reproducing the underlying private evidence.

For example, the public biography may state that a dated technical artifact exists and supports part of the timeline. It does not need to publish the artifact itself, reveal its secrets, or identify unrelated people appearing in it.

An Evidence Classification Model

Every historical statement should be assigned an evidence status.

Documented

The statement is directly supported by an identifiable source with a verifiable date or provenance.

Supported by multiple artifacts

Two or more independent records support the same event, relationship, or period.

Autobiographical

The statement comes from Daniel’s own recollection but does not yet have sufficient independent documentation.

Not yet verified

The statement remains a hypothesis, an unresolved memory, or a claim requiring additional evidence.

This classification prevents personal recollections from being presented as independently verified facts.

It also makes uncertainty explicit instead of hiding it.

What an Evidence Register Should Record

The private register should describe each artifact without unnecessarily reproducing its sensitive contents.

A useful entry includes:

• A unique evidence identifier
• The source filename or archival reference
• The approximate or exact date
• The type of artifact
• Its provenance
• What it directly supports
• What it does not prove
• Its verification status
• Its privacy classification
• Whether a redacted public summary is permitted
• The integrity hash of the original file

This approach allows the historical argument to be audited while preserving the confidentiality of the source material.

Reviewing the Persona Builder Pull Request

An initial pull request introduced a Persona Lore Builder containing:

• Structured biographies and origin stories
• Declared skills and personality traits
• Revision metadata
• A basic moderation filter
• A public dossier representation
• A visual biography preview
• Automated tests

The first test suite passed, and the submitted diff did not contain real personal records, credentials, banking information, private keys, or photographs.

However, passing tests did not mean the implementation was ready for publication.

Our security and privacy review found several important problems:

1. Dynamic biography fields were inserted into HTML without comprehensive escaping, creating a stored cross-site scripting risk.
2. The moderation filter detected only a few exact strings and could be bypassed using common HTML or case variations.
3. Several secondary fields were not filtered at all.
4. Biographical information was included in the public representation by default.
5. “Verified capabilities” could be supplied directly by the caller instead of coming from an authoritative verification source.
6. The claimed immutable revision history was only a mutable in-memory structure containing hashes and timestamps.
7. The tests did not cover privacy defaults, adversarial HTML, unauthorized publication, or revision tampering.

For these reasons, the pull request received a formal Changes Requested review and has not been merged.

That is an important outcome: security review is not an obstacle to the project. It is part of the evidence system itself.

Private by Default

The corrected architecture should follow a simple rule:

Every personal field is private unless an explicit and recorded decision makes that specific field public.

A public biography should be constructed from an allowlist, not by removing selected sensitive fields from a complete private record.

This means the system should require:

• Explicit field-level visibility
• Recorded consent or publication authorization
• HTML escaping at the rendering boundary
• Strong schema validation
• Redaction before export
• Separate private and public data models
• Provenance for verified claims
• Tamper-evident revision records
• Security and privacy regression tests

Declared Skills Are Not Verified Capabilities

A biography may describe interests, experience, or skills claimed by its subject. These are narrative attributes.

They must remain separate from authenticated technical permissions or independently verified capabilities.

For example, writing that a person has experience in system administration must not grant that person administrative access. Likewise, a field called verifiedCapabilities is not trustworthy simply because a caller supplies values to it.

Verification requires an authoritative source, a defined process, and traceable provenance.

Evidence Is Not an Accusation

A responsible historical dossier must also define the limits of every artifact.

A document may prove that a record existed on a particular date. It may not prove who created it, who controlled an account, or whether every statement inside it was accurate.

A photograph may support presence at an event. It does not automatically establish the purpose of the event or the relationships between everyone shown.

A cryptographic artifact may support a technical timeline. It does not automatically prove ownership or every activity associated with an identity.

Recording these limitations is essential, especially when the material could affect the reputation or privacy of real people.

The Publication Workflow

Our intended workflow is:

1. Preserve the original artifact privately.
2. Calculate and record its integrity hash.
3. Classify its sensitivity.
4. Record what it supports and what it cannot establish.
5. Seek corroborating evidence where appropriate.
6. Produce a redacted factual summary.
7. Review the summary for privacy, security, and legal risk.
8. Publish only the approved summary.
9. Maintain a revision trail for subsequent corrections.

Private evidence never moves automatically into the public biography.

What Comes Next

The next version of the Persona Lore Builder must implement:

• Private-by-default fields
• Explicit public-field allowlists
• Robust output encoding
• Stronger validation
• Provenance-aware capability verification
• Complete revision snapshots
• Tamper detection
• Privacy-focused automated tests
• Redacted public exports

Only after these requirements are implemented and independently reviewed should the pull request be reconsidered for approval.

Conclusion

Historical preservation and personal privacy do not have to conflict.

A credible biography does not become stronger by publishing every private artifact. It becomes stronger by maintaining a disciplined boundary between evidence, interpretation, recollection, and public fact.

The private archive preserves the record.

The evidence register explains what that record supports.

The public biography communicates only what can be shared responsibly.

That separation is not merely a privacy feature. It is the core of a trustworthy historical system.