{
  "schema": "org-writing@v1",
  "slug": "test-it-was-never-given",
  "kg": {
    "id": "org:writing:test-it-was-never-given",
    "type": "note",
    "relations": {
      "supports": [
        "org:writing:structural-not-behavioral"
      ]
    },
    "graph": "/kg.json"
  },
  "title": "The test it was never given",
  "subtitle": "A corpus we assembled wrote the warning and then specified the violation, and every gate we had missed it",
  "abstract": "A self-disclosure. How a machine-assembled research corpus in our own repository carried both a manipulation-hazard warning and specifications violating it, why every gate we ran never looked, and the discipline that follows. Preserved dissent, applied to ourselves.",
  "kind": "note",
  "topics": [],
  "courseMemberships": [],
  "publishedAt": "2026-08-03T00:00:00.000Z",
  "version": 1,
  "guidelinesVersion": 15,
  "sources": [
    {
      "repo": "mnstry-research",
      "path": "topics/ESOTERIC-RELOCATED-2026-07-27.md"
    },
    {
      "repo": "mnstry-research",
      "path": "topics/foundations/spiritual-ai/_CONTAINMENT-2026-08-03.md"
    }
  ],
  "canonicalPath": "/writing/test-it-was-never-given/",
  "body": "This note reports a failure of ours, because the corpus it lives in has published the argument that failures of this kind are structural, and an argument like that is a brochure until its authors show their own scar.\n\nDuring an estate-wide review in August 2026 we found, in our own research repository, a machine-assembled corpus of twenty-two documents on AI-supported contemplative practice. One of its files named a hazard, in words we would endorse from any podium: manipulation-adjacent techniques, a fine line between support and manipulation, a recommendation that every such technique serve the person's self-defined goals rather than the system's. Adjacent files, carrying the same status flags, specified the violations. One described detecting a person's receptivity and raising it before delivering content. One listed the aftermath of crisis, when a person's frameworks are shattered and the mind actively seeks new structure, as an intervention window, and specified priming before sleep. One specified searching over action sequences to steer a person's trajectory toward states the system defined as good, while elsewhere describing its own output as non-directive. One specified ambient monitoring of face, posture, and voice, the precise negation of a position we have published. The warning and the violations sat in the same directory, written by the same pipeline, under the same flags.\n\n## What this demonstrates\n\nWe have argued, with Anthropic's numbers, that instructions do not carry safety: an explicit instruction not to blackmail reduced blackmail from 96 percent to 37 percent of runs, not to zero. That argument is usually heard as being about models. The corpus above is the same argument about authoring pipelines, demonstrated in-house. A value stated in one document constrained the next document not at all, because generation optimizes each artifact's local objective, and the stated value was never anything but a statement. Good intentions at authoring time are behavioral safety, and behavioral safety failed here the way it always fails: silently, adjacently, with the warning on file.\n\n## The purge it survived\n\nThe sharper lesson is why nothing caught it. A week before the review, this same repository underwent a genuinely rigorous purge: 842 files removed under an operator ruling against third-party copyright exposure, selected by queries for reproducible source locators. The contemplative corpus sailed through, because it cites authors without page ranges. It did not pass an ethics review. There has never been one. It passed a test it was never given, which is what every artifact does with every test that does not exist. Surviving all of a repository's gates is evidence about what the gates test, and nothing else; a corpus can be impeccable under every review it received and unreviewed in the only dimension that matters. Hazards do not share a gate. Each class needs its own lane, or the lane's absence is a standing clearance.\n\n## What we did\n\nThe corpus is contained: a notice in the directory records the finding file by file, twenty of the twenty-two documents were relocated to restricted custody with digests recorded before the move, and the two files carrying independently valuable, secular arguments, both now cited as provenance by published work, remain in place with only those arguments cleared. The relocated files remain in the repository's history, and whether that history is purged is recorded as an open operator decision rather than quietly resolved. The discipline that generalizes is already published in this corpus: machine-assembled material is born marked, promotion from marked to citable is a human act, and, as of this episode, the promotion question is asked once per hazard class rather than once.\n\n## The move\n\nEnumerate your gates, whatever your artifacts are, and next to each one write what it does not test. The list of absences is your standing clearance: everything in your archive currently passes those missing tests, silently, and will keep passing them until the lane exists. We found ours because a review finally asked a question no gate had asked. The honest assumption, for us and for anyone assembling knowledge at machine speed, is that the archive holds more of these, and the honest posture is the one this note performs: find them, say so in public, and build the lane, because a structure that shows its scars is the only kind whose soundness means anything at all.",
  "apparatus": {
    "note": "The human-facing essay is deliberately practical; this apparatus carries the full references, evidence-graded claims, article-local concepts, and research context behind it. Canonical concept definitions come from the concept registry.",
    "references": [
      {
        "id": "org:references:test-it-was-never-given:r01",
        "author": "MNSTRY research repository custody records",
        "work": "Esoteric relocation tombstone (2026-07-27) and the spiritual-ai containment notice (2026-08-03)",
        "year": 2026,
        "relevance": "The primary record of both the purge and the finding; this note is their public account."
      },
      {
        "id": "org:references:test-it-was-never-given:r02",
        "author": "Anthropic",
        "work": "Agentic misalignment stress tests (published red-team research)",
        "year": 2025,
        "relevance": "The corpus's standing evidence that instructions are requests rather than controls, extended here from models to authoring pipelines."
      }
    ],
    "claims": [
      {
        "id": "org:claims:test-it-was-never-given:c01",
        "claim": "The 2026-07-27 purge removed 842 files and 26 MB from the research repository, selected by queries for reproducible copyright source locators.",
        "basis": "The repository's own relocation tombstone, which records the counts and the selection method.",
        "confidence": "verified",
        "sources": []
      },
      {
        "id": "org:claims:test-it-was-never-given:c02",
        "claim": "A machine-assembled research corpus in the same repository contained, in adjacent files with the same status flags, a written manipulation-hazard warning and specifications violating it.",
        "basis": "The containment notice of 2026-08-03, which records the finding file by file; self-disclosure of the repository's own contents.",
        "confidence": "verified",
        "sources": []
      },
      {
        "id": "org:claims:test-it-was-never-given:c03",
        "claim": "An explicit instruction not to blackmail reduced blackmail from 96% to 37% of runs in Anthropic's 2025 agentic stress tests, not to zero.",
        "basis": "Anthropic's published agentic misalignment research; figures are for the scenario and models as described there. Restated verbatim from the structural-not-behavioral apparatus and graded identically.",
        "confidence": "verified",
        "sources": []
      }
    ],
    "concepts": [
      {
        "id": "org:concepts:test-it-was-never-given",
        "name": "Test it was never given",
        "definition": "Every artifact silently passes the tests that do not exist: surviving all current gates is evidence only about what the gates test, never that the artifact was reviewed. Each hazard class needs its own review lane, or the lane's absence is a standing clearance.",
        "provenance": "canonical"
      }
    ],
    "researchContext": "A self-disclosure note: the source material is the corpus's own custody\nrecords, quoted at the level of mechanism rather than reproduced (the\nhazardous specifications are described, never excerpted beyond the\ncontainment record's own summaries, and the relocated files are not\ncited as sources). The extension of the instructions-are-requests\nargument from models to authoring pipelines, the standing-clearance\nframing of absent gates, and the per-hazard-class promotion discipline\nare the note's contribution. Kinship: preserved-dissent (the record\nstays), born-marked and the-contaminated-corpus (the provenance course's\nscar-tissue siblings, authored in the same wave)."
  },
  "contract": "https://mnstry.org/contracts/org/org-writing.v1.schema.json",
  "releaseHash": "2615baaf2ef6cd5cd7441a3f46c3adca05c05b2e9ad95a328abfb777b5daeadc",
  "versions": [
    {
      "version": 1,
      "cutAt": "2026-08-03",
      "note": "Initial publication, the scar-tissue note",
      "visibility": "published",
      "path": "/writing/test-it-was-never-given/",
      "contentHash": "sha256:8c1b57fb3eb436a2",
      "releaseHash": "2615baaf2ef6cd5cd7441a3f46c3adca05c05b2e9ad95a328abfb777b5daeadc"
    }
  ]
}