{ "schema": "org-writing@v1", "slug": "disclosure-is-irrevocable", "kg": { "id": "org:writing:disclosure-is-irrevocable", "type": "brick", "graph": "/kg.json" }, "title": "Disclosure is irrevocable", "subtitle": "Deleting the copy does not undo the reading, so the record of a disclosure cannot offer to", "abstract": "Why moving material across a read boundary is typed as durable and non-revocable, and what a system gives up when it stops promising a takeback. The canonical treatment of irrevocable disclosure.", "kind": "brick", "topics": [ "Approval" ], "courseMemberships": [ { "course": "org:courses:approval", "topic": "Approval", "wall": "org:walls:ethics", "position": 4, "total": 5 } ], "publishedAt": "2026-08-03T00:00:00.000Z", "updatedAt": "2026-08-11T00:00:00.000Z", "version": 2, "guidelinesVersion": 15, "brief": { "problem": { "text": "Systems that move material across a read boundary want to describe the move as reversible, because deletion is the remedy everyone knows how to build and the one every person asks for.", "claims": [ "fails closed when private-domain material appears in shared work" ] }, "mechanism": { "text": "The event is typed as durable and non-revocable in the format itself, so a record describing a disclosure as undoable is not a rejected record, it is not a record of this kind at all.", "claims": [ "fixes the disclosure class to the single permitted value durable" ] }, "move": { "text": "Type disclosure as permanent and spend the recording budget on who, what, from where, and to where, because attribution is the only remedy that was ever actually available.", "claims": [] } }, "sources": [ { "repo": "mnstry-atelier", "path": "contracts/git-promote-event.v1.schema.json" }, { "repo": "mnstry-atelier", "path": "README.md" }, { "repo": "mnstry-atelier", "path": "docs/repo-boundary-guard.md" } ], "canonicalPath": "/writing/disclosure-is-irrevocable/", "body": "A document moves out of a private repository and into a shared one. Six people can now read it, and some number of them do. A week later somebody decides the move was a mistake, deletes the file, rewrites the history, and force-pushes. Ask what has been undone and the honest answer is narrow. The copy is gone. The reading is not.\n\nOur workspace tooling refuses to blur that. Moving source across a read boundary produces a promotion event, and the contract for it has two fields whose values are constants rather than choices. The disclosure class is fixed at durable. The revocable flag is fixed at false. Not defaults, not an enumeration with a recommended member, but single permitted values, which means a document describing a promotion as reversible fails validation on its shape and never reaches anyone with standing to disagree with it. The boundary policy fails closed in the other direction too, refusing private-domain material that turns up in shared work with no promotion record behind it.\n\nThe mechanism is that the event is typed as durable and non-revocable in the format itself, so a system holding these records cannot represent a disclosure as undoable, because what the record describes is a reading and a reading has no artifact left to destroy.\n\nThat last clause is the whole of the argument, and it is worth setting beside the strongest counter-technique this corpus has published. Cryptographic erasure lets an append-only ledger forget a person completely. The personal content sits encrypted under a key held somewhere else, and destroying the key leaves the sequence and the hashes intact while the content inside becomes unrecoverable. It is a real capability with a real guarantee, and the reason it works is that it has a target. There is a specific object whose destruction accomplishes the erasure. Disclosure has no such object. When material crosses a read boundary the thing that happened is that a person's attention, or a model's context window, took it in, and there is no key, no vault, and no jurisdiction on which any destruction could operate. Erasure can destroy a key. A reading has no key to destroy.\n\nLaw reached the same wall from the other side and stopped at the same place. In the 2014 Google Spain judgment, the Court of Justice of the European Union granted a form of the right to be forgotten and granted it in a very particular shape. The search engine was required to delist the results, and the newspaper page they pointed at stayed lawfully published exactly where it was. The most powerful data-protection court on the continent, ruling in the complainant's favor, could make the material harder to find and could not make it unread. Everything downstream of that judgment, including the erasure right written into European law four years later, inherits the same boundary.\n\nWhat a system gives up by admitting this is the undo button, and the undo button is what people want. The compensation is that the recording budget goes somewhere useful. Because it cannot promise a takeback, the promotion record spends its required fields on the questions that still have answers, naming the source repository and its read boundary, the target repository and its read boundary, the identity of the material at both ends, the actor who moved it, and the exact commit on either side. After the fact the question is never whether it can be recalled. The question is what went, from where to where, and who decided, and a record built on the truth can answer that one completely.\n\nThere is a kind of relief in a system that stops pretending here. A promise of revocation is a promise about other people's memories, which is not a thing anyone has ever been able to keep, and building on it quietly teaches everyone that disclosure is cheap and correctable. Building on the truth teaches the opposite, which is that the decision to let something be read is the decision, made once, at a specific moment, by a named person. Treat it that way and the moment gets the attention it always deserved.", "apparatus": { "note": "The human-facing essay is deliberately practical; this apparatus carries the full references, evidence-graded claims, article-local concepts, and research context behind it. Canonical concept definitions come from the concept registry.", "references": [ { "id": "org:references:disclosure-is-irrevocable:r01", "author": "MNSTRY Atelier", "work": "git-promote-event@v1, the local disclosure event contract", "year": 2026, "relevance": "The primary artifact. Its own description names it an append-only disclosure event, and two of its required event fields are JSON Schema constants, the disclosure class fixed at durable and the revocable flag fixed at false." }, { "id": "org:references:disclosure-is-irrevocable:r02", "author": "MNSTRY Atelier", "work": "Repo Boundary Guard V1 and the strict boundary policies", "year": 2026, "relevance": "The enforcement half. Git repository access is the source read boundary, and private-domain material appearing in shared work without a promotion record fails closed." }, { "id": "org:references:disclosure-is-irrevocable:r03", "author": "Court of Justice of the European Union", "work": "Google Spain SL and Google Inc. v AEPD and Mario Costeja González", "year": 2014, "relevance": "The external anchor and the limit case in law. The remedy granted was delisting from search results while the underlying publication remained lawfully in place, which is the strongest available demonstration that a completed publication cannot be unmade." }, { "id": "org:references:disclosure-is-irrevocable:r04", "author": "MNSTRY (this corpus)", "work": "'Destroy the key' (the contrasting brick)", "year": 2026, "relevance": "The deliberate contrast. Cryptographic erasure is real and works because it has a destroyable target; this brick's argument is that a reading has none, so the two pieces are complements rather than rivals." }, { "id": "org:references:disclosure-is-irrevocable:r05", "author": "MNSTRY (this corpus)", "work": "'Sacred artifacts' (the parent essay)", "year": 2026, "relevance": "The frame. The parent argues that fixing knowledge matters more than generating it; this brick takes one thing that is fixed whether anyone wanted it fixed or not." } ], "claims": [ { "id": "org:claims:disclosure-is-irrevocable:c01", "claim": "The Atelier git-promote-event contract fixes the disclosure class to the single permitted value durable and the revocable flag to the single permitted value false, so no valid promotion record can describe a disclosure as reversible.", "basis": "The schema read directly on 2026-08-03; both fields are JSON Schema const declarations inside the required event object.", "confidence": "verified", "sources": [] }, { "id": "org:claims:disclosure-is-irrevocable:c02", "claim": "The same contract requires repository, read boundary, knowledge-graph id, audience, and commit at both the source and target endpoints, together with the acting identity, so a promotion record states exactly what moved and between which boundaries.", "basis": "The schema's endpoint definition and the event's required-field list, read directly on 2026-08-03; commits are constrained to full forty-character hexadecimal identifiers.", "confidence": "verified", "sources": [] }, { "id": "org:claims:disclosure-is-irrevocable:c03", "claim": "Atelier's strict boundary policy fails closed when private-domain material appears in shared work without a git.promote disclosure record.", "basis": "The kit's own statement of its strict policies, read directly on 2026-08-03, alongside the boundary guard document.", "confidence": "verified", "sources": [] }, { "id": "org:claims:disclosure-is-irrevocable:c04", "claim": "In Google Spain v AEPD, decided by the Court of Justice of the European Union in 2014, the search engine was required to delist results about the complainant while the underlying newspaper publication remained lawfully in place.", "basis": "The judgment and the settled commentary on it. The delisting-not-deletion shape of the remedy is the point the brick uses and is uncontroversial.", "confidence": "verified", "sources": [] }, { "id": "org:claims:disclosure-is-irrevocable:c05", "claim": "Cryptographic erasure operates on a key held apart from the record, which gives it a destroyable target that a completed reading does not have.", "basis": "The first half restates the technique as treated in 'Destroy the key'. The second half is this brick's argument rather than a separate finding, offered as reasoning about what erasure can operate on.", "confidence": "directional", "sources": [] } ], "concepts": [ { "id": "org:concepts:irrevocable-disclosure", "name": "Irrevocable disclosure", "definition": "Moving material across a read boundary is a durable, non-revocable event. Deleting the copy removes an artifact and does not undo the reading, which is why the technique that lets a permanent record forget a person does not apply here: erasure operates on a key, and a completed reading leaves no key to destroy. A format that records disclosure therefore types it as permanent and spends its required fields on attribution, naming what moved, from which boundary to which, at which commit, and on whose decision. The question after the fact is never whether it can be recalled, only exactly what went and who decided.", "provenance": "canonical" } ], "researchContext": "Sourced from the Atelier disclosure contract and its surrounding boundary\ndocuments, with one external judgment for the limit case. No client or tenant\nmaterial is involved and no repository path or commit identifier appears in\nthe prose.\n\nThe brick's contribution is reading two schema constants as a statement about\ntime rather than about validation, and setting the result against this\ncorpus's own strongest erasure technique to mark exactly where erasure stops.\nThe unrepresentability move itself, the observation that a sentence which\ncannot be written needs no rule against writing it, belongs to \"Consent that\nfails CI\" for permission and to \"The proposer cannot ratify\" for authority.\nThis brick does not re-argue it and applies it to a third dimension, which is\nwhether a recorded event can claim to be undoable.\n\nGrading note: the final claim is directional because only its first half is a\nfinding. That cryptographic erasure has a destroyable target is a restatement\nof published work; that a reading has none is the brick's own reasoning, and\ngrading the pair as verified would launder an argument into an observation.\n\nBoundary with \"Destroy the key\": the two pieces are complements and the\ncontrast is load-bearing. Destroy the key establishes that a permanent record\ncan be made to forget a person; this brick establishes the class of event\nwhere that instrument has nothing to act on. If either is revised, the\ncontrast is the thing to preserve." }, "contract": "https://mnstry.org/contracts/org/org-writing.v1.schema.json", "releaseHash": "62690af1141b42c31055a6fc922631c36b3a8ee6221019d18193481d9e5b2c42", "versions": [ { "version": 2, "cutAt": "2026-08-11", "note": "Re-parented to The owed disclosure after the founder-approved article fission.", "visibility": "published", "path": "/writing/disclosure-is-irrevocable/", "contentHash": "sha256:e957fd9e0747c46b", "releaseHash": "62690af1141b42c31055a6fc922631c36b3a8ee6221019d18193481d9e5b2c42" }, { "version": 1, "cutAt": "2026-08-03", "note": "Initial publication, boundary wave", "visibility": "published", "path": "/writing/disclosure-is-irrevocable/v/1/", "contentHash": "sha256:e957fd9e0747c46b" } ] }