Qafiya: A Provenance-First Data Model for Trustworthy AI-Generated Views over Personal Data

AI assistants can now build a report or a dashboard from your files in seconds. But three practical problems follow. You cannot tell where a number came from. Fixing a number on screen does not fix it in the data. And a sentence can misrepresent the data even when every digit is correct. This paper presents Qafiya, a data layer designed to solve all three at once. In Qafiya, every number and every claim on screen is tied to its source by a small record we call a binding. The binding tells the system how to recompute the number, where an edit should be written back, and what evidence a claim rests on. Checking is built in, not bolted on: one layer proves that numbers match the data; a second layer flags sentences that misread correct numbers. We built a working prototype and tested it on frozen, reproducible experiments. In a defect-injection study, the full system caught every catchable defect --- 100\% --- with no false alarms, while checking numbers alone missed every misinterpretation. In a cost study with exact token accounting, structuring data did not make single-document tasks cheaper --- but when questions span many documents, reading only the relevant slice cut input tokens by about 69\%, a saving we confirmed on live commercial APIs with two different models. The live runs also exposed a simple truth: current models cannot reliably add up a few hundred rows, in any format. Computed values must come from code, not from the model --- which is exactly what the binding provides. Qafiya does not claim to certify truth. It certifies that a claim and its evidence agree, and it says so openly when checking is impossible. We see it as an early answer to a larger question: what a file system should look like in the era of AI agents.