Vision. An artist's body of work outlives the infrastructure that hosts it. The site is mortal; the work is not. Persistence is not the immortality of any single platform — it is coordinated survivability across many mortal ones.
A working artist's website depends on a stack of payment-dependent services — domain, hosting, managed databases, CDNs. When the artist stops paying, the work disappears. The legacy is bottlenecked on a credit card. This is a design failure for anyone whose body of work matters more than their billing cycle.
Decouple the artifact from any single host. The canonical thing is not the gist or the database row — it is the artifact itself: content plus a manifest of where it lives, checksums to verify integrity, and a schema to interpret it. Each backend stores a copy. The site renders whichever copy resolves first.
Every published object — exercise, comm, song, thought — is an artifact with three parts. The content is the text, audio, image, or structured data itself. The schema is the interpretation rules, embedded so the artifact decodes without the codebase. The manifest is a small root file holding the object ID, version, checksums, list of mirror URLs/CIDs/txids, timestamps, public/private flags, and renderer compatibility version. The manifest is replicated everywhere the content goes; it binds the otherwise-interchangeable backends together. It is the root truth.
Tier 1 — warm, mortal. DigitalOcean App Platform, MongoDB, custom server. Dies with billing. Acts as authoring surface and cache, not source of truth.
Tier 2 — warm, long-lived. GitHub. Gists for atomic records (single thoughts, snippets, manifests), repos for collections (song catalog, exercise library, comms archive). Survives as long as the GitHub account does. Software Heritage and the GitHub Archive Program mirror public repos automatically — no extra action required.
Tier 3 — cold, permanent. IPFS for content-addressed replicas (with explicit pinning — addressing is not permanence), Arweave for canonical immutable releases that should outlive the app, Internet Archive's Save Page Now for rendered public snapshots. Each plays a different role; together they form independent custody.
Every artifact ships with SHA-256 checksums in its manifest. Verification is baseline, not optional. A corrupted mirror is detectable on read; a missing mirror triggers fallback to the next URL in the array.
Authored content (exercises, comms, songs, thoughts) becomes artifacts in Tier 2/3. Interactive infrastructure (relay, live admin, real-time) stays on Tier 1 and dies with it — those aren't legacy, they're presence. The cut is mortality-tier, not feature-importance.
Text and metadata go in Git-compatible storage (gists, repos). Large binary assets (audio, video, high-res images) go in object storage and content-addressed networks; gists carry only the manifest entry pointing to them. Gists are bad at archival binary burden — don't make them carry it.
Each data artifact is paired with a logic gist holding the adapter — the parser, transformer, and renderer hints. The site loads both at runtime; data shape and content can change without redeploying. The site is a thin loader over remote modules.
Assets live across multiple custody models. Each asset record in the manifest carries an array of fallback URLs — personal CDN, long-lived CDN, IPFS gateway, Arweave gateway. The downloader walks the array until something resolves and verifies against the checksum. The downloader logic itself lives in a gist for hot-swap.
The server uses a GitHub token to persist mutable state back to private gists and repos. Every write maintains ordering, updates the manifest, and verifies version compliance against the embedded schema. Mongo becomes a cache, not a source of truth.
- Exercises — first migration, simplest schema
- Comms — next
- Songs — with tiered asset URLs and Arweave canonical releases
- Thoughts — moves from DB to private gist; server becomes write-through proxy
Schema-embedded-with-data plus checksum-verified manifests mean a future reader can interpret and verify the artifact without the codebase, and a future custodian can move the artifact between backends without losing fidelity. That is the actual death-resilience property. The site rendering it is incidental.
The active counterpart to passive tiering — instead of waiting for the warm tier to die, the system migrates itself to the cold tier before the lights go out. On prolonged absence, a cascade fires: snapshot Mongo to private gist, pin all content and assets to IPFS/Arweave, submit rendered pages to Save Page Now, flip the site into read-only memorial mode, notify designated humans.
The recursive problem: the switch can't live on the infrastructure it's protecting, or it dies before it fires. GitHub Actions is the natural host — same persistence tier as the gists, scheduled cron in GitHub's infra, alive as long as the account is. The artist confirms aliveness by editing a heartbeat field in a known gist or hitting a webhook on a schedule.
Escalation is graduated to absorb false positives — vacation, hospitalization, lockout that resolves. Typical staircase: 30 days lapsed → ping artist via email/SMS; 60 days → snapshot warm-tier state to cold tier and trigger Wayback snapshots; 90 days → flip site to memorial mode and flip flagged private content to public; 180 days → publish formal notice and revoke write access. Each phase is reversible by a heartbeat update until the final irreversible step.
Privacy is a function of aliveness. While the artist is editing, half-thoughts need protection because they're drafts in motion — embarrassing only because they're unfinished. After death, the work becomes archive rather than draft, and the protection is no longer for the artist. Literary estates have always operated this way; the dead man's cascade automates it.
Mechanism: gh gist edit --public on flagged private gists during the cascade. URL stays stable, content becomes world-readable, the artifact remains self-decoding without any site rendering it.
Granularity matters. Not all private content is publication-eligible after death — correspondence with living people who didn't consent, financial records, credentials, things written about others still around. Two private categories tagged in the data itself: private:until-death (made public on cascade) and private:living-only (sealed or destroyed, key thrown away). Default to living-only; posthumous publication is an explicit opt-in per piece, never a blanket flip.
Five copies inside one vendor is not redundancy. Real redundancy is copies across different custody models — GitHub, Internet Archive, Arweave, IPFS, personal cold storage, an optional friend or institution mirror. Each custodian has different failure modes; together they cover each other. This is the LOCKSS logic ("lots of copies keeps stuff safe") in artist-native form.
BagIt packaging, OCFL object layout, Filecoin storage deals, and periodic offline .tar.zst exports are preservation-grade additions worth adopting later when the corpus stabilizes. They are noted here so the architecture stays compatible with them, but they are not MVP. The MVP is: artifact + manifest + checksum + GitHub mirror + IPFS pin + Arweave for canonical releases + Wayback for rendered pages.
This document is itself part of the legacy. The planning is public. Updated as the architecture matures, always re-aligned to the vision at the top.