{ "schema": "org-writing@v1", "slug": "which-way-failure-falls", "kg": { "id": "org:writing:which-way-failure-falls", "type": "brick", "graph": "/kg.json" }, "title": "Which way failure falls", "subtitle": "A system in trouble may take away what it is allowed to do and never take away that it is there", "abstract": "How deny-by-default and never-refuse turn out to be the same rule, and what a disclosure that names its own failure direction tells a reader. The canonical treatment of the direction of failure.", "kind": "brick", "topics": [ "Honest claims" ], "courseMemberships": [ { "course": "org:courses:honest-claims", "topic": "Honest claims", "wall": "org:walls:ethics", "position": 6, "total": 6 } ], "publishedAt": "2026-08-03T00:00:00.000Z", "version": 1, "guidelinesVersion": 15, "brief": { "problem": { "text": "Fail closed and fail open are argued as opposed doctrines, so a team that adopts either one wholesale gets a system that either leaks under partial failure or abandons a person mid-sentence.", "claims": [ "a capability referenced but not registered is a denial rather than a passthrough" ] }, "mechanism": { "text": "The two doctrines are one rule read on different axes, because failure has a direction, and an honest system spends its degradation on authority while spending none of it on presence.", "claims": [ "withdraw envelope protections while leaving the pilot in control" ] }, "move": { "text": "Put strictness at authoring time, where a builder can still fix what is wrong, and grace at the moment of contact, where a person is standing in front of the thing.", "claims": [] } }, "sources": [ { "repo": "mnstry-strategy", "path": "docs/20-business/40-content/drafts/2026-07-12/P3-missing-axis-not-missing-feature.md" }, { "repo": "mnstry-strategy", "path": "docs/20-business/40-content/drafts/2026-07-12/P5-prompts-as-state-machines.md" }, { "repo": "mnstry-org", "path": "src/content/writing/the-owed-disclosure.md" } ], "canonicalPath": "/writing/which-way-failure-falls/", "body": "Two of our own design documents appear to contradict each other, and the contradiction is worth walking into rather than around, because resolving it produces a rule better than either document had on its own.\n\nThe first describes a projection engine, the machinery that decides what one person is allowed to see of another person's material. It denies by default in the strongest available sense. A recipient matching no disclosure rule receives nothing rather than a fallback view. A capability referenced but not registered is a denial rather than a passthrough. Custody buys no visibility, so a custodian with no explicit rule is denied exactly like a stranger. The document goes further and reports that a synthesis capability was deliberately left unregistered, so that placeholder text standing in for a synthesizer nobody had built yet could not be served by accident. Refusing is the whole posture. Silence is the correct output when the specification is incomplete.\n\nThe second describes a prompt assembler, the machinery that composes what a conversational system is at the moment somebody speaks to it, and it states flatly that the assembler never refuses. A missing stage, an unknown label, an empty blueprint, and it renders what it can. The reasoning is that this machinery sits directly in the path of a live conversation with a real person, and a validation error that aborts a turn is not a safe failure. What survives every degradation path is exactly the part you least want to lose, the identity and the safety boundaries, so the system under partial failure gets simpler rather than broken.\n\nDeny everything, and never refuse. Read as doctrines they cancel. Read carefully they are one rule, because failure has a direction, and both documents are spending their degradation on authority while spending none of it on presence. The projection engine withdraws permission: to disclose, to act on someone's material, to speak in a voice nobody built. The assembler preserves the fact of being met: a person who reached out at two in the morning finds something simpler than they would have found an hour earlier, and not an error page. Nothing in either system trades one for the other, which is what makes them a pair rather than a conflict, and it is why the tempting synthesis, be strict everywhere, would break the second system while the other tempting synthesis, degrade gracefully everywhere, would quietly leak the first.\n\nThe direction is not ours and it is not new, which is the best evidence that it is right. Airbus fly-by-wire aircraft degrade through named control laws that withdraw envelope protections while leaving the pilot in control, so the loss lands on the automation's authority and never on the pilot's hands. Life safety codes require electrically locked doors on an egress path to release under power failure, so a building in trouble fails secured at the perimeter and open at the exit. In both cases the same event removes what the system is permitted to do and preserves the human being's ability to act, and in both cases the choice was made once, in advance, by people who knew the failure was coming and decided where to put it.\n\nThat decision is also the most revealing thing a system can disclose about itself. Every other claim can be softened later, hedged, restated at a more careful altitude when someone asks a hard question. The direction your failures fall cannot be added retroactively; it is already built, it has already been chosen, and the only question is whether you were the one who chose it. So put strictness where a builder can still fix what is wrong, and grace where a person is standing in front of the thing, and then say out loud which way yours falls. A system that can tell you what it does on its worst day has told you something no description of its best day can reach.", "apparatus": { "note": "The human-facing essay is deliberately practical; this apparatus carries the full references, evidence-graded claims, article-local concepts, and research context behind it. Canonical concept definitions come from the concept registry.", "references": [ { "id": "org:references:which-way-failure-falls:r01", "author": "MNSTRY", "work": "Internal essay draft on missing axes in the relationship and disclosure models (2026-07-12 drafts)", "year": 2026, "relevance": "The deny-by-default half. A per-recipient projection engine in which an unmatched audience receives nothing, an unregistered capability is a denial rather than a passthrough, and a synthesis capability was left unregistered on purpose so a placeholder could not be served." }, { "id": "org:references:which-way-failure-falls:r02", "author": "MNSTRY", "work": "Internal essay draft on prompt assembly as a state machine (2026-07-12 drafts)", "year": 2026, "relevance": "The never-refuse half, and the source of the authoring-time-strictness formulation: the assembler degrades rather than aborting, and the identity and safety boundaries survive every degradation path." }, { "id": "org:references:which-way-failure-falls:r03", "author": "Airbus", "work": "Fly-by-wire flight control laws (normal, alternate, direct) as documented in flight crew operating manuals and accident investigation literature", "relevance": "The external case in aviation: degradation withdraws envelope protection while leaving the pilot flying the aircraft." }, { "id": "org:references:which-way-failure-falls:r04", "author": "National Fire Protection Association and the International Code Council", "work": "NFPA 101 Life Safety Code and the International Building Code, means-of-egress provisions for electrically locked doors", "relevance": "The external case in the built environment, and the plainest statement of the rule: the perimeter fails secured and the exit fails open." } ], "claims": [ { "id": "org:claims:which-way-failure-falls:c01", "claim": "Our projection engine denies by default, so an unmatched recipient receives nothing and a capability referenced but not registered is a denial rather than a passthrough, which is why a placeholder synthesis capability was deliberately left unregistered.", "basis": "Internal: the 2026-07-12 draft describing the per-recipient disclosure engine, its audience rules, its fail-closed posture, and the unregistered synthesis capability.", "confidence": "verified", "sources": [] }, { "id": "org:claims:which-way-failure-falls:c02", "claim": "Our prompt assembler never aborts a live turn, rendering what it can when configuration is missing or unknown, with the persona and the safety boundaries surviving every degradation path.", "basis": "Internal: the 2026-07-12 draft on prompt assembly, which enumerates the degradation cases and states the reasoning that a validation error mid-conversation is not a safe failure.", "confidence": "verified", "sources": [] }, { "id": "org:claims:which-way-failure-falls:c03", "claim": "Airbus fly-by-wire aircraft degrade through named control laws that withdraw envelope protections while leaving the pilot in control.", "basis": "Airbus flight control law documentation and the accident-investigation literature that describes reversion to alternate and direct law.", "confidence": "verified", "sources": [] }, { "id": "org:claims:which-way-failure-falls:c04", "claim": "Life safety codes require electrically locked doors on an egress path to release under power failure, so the perimeter fails secured and the exit fails open.", "basis": "NFPA 101 and International Building Code means-of-egress provisions governing electrically locked egress doors; the fail-safe versus fail-secure distinction is standard practice in access control.", "confidence": "verified", "sources": [] } ], "concepts": [ { "id": "org:concepts:direction-of-failure", "name": "Direction of failure", "definition": "The axis along which a system degrades. An honest system spends its failure on authority and none of it on presence: deny the permission, keep the person in front of something that still works. The rule dissolves the apparent conflict between failing closed and failing open, and it is the one claim a system cannot make retroactively, because it is already built.", "provenance": "canonical" } ], "researchContext": "Extracted from the honest-claims parent essay, taking the failure-direction\nhalf of its claim set. The Airbus and egress-code claims are restated\nverbatim from the parent's apparatus and graded identically; the two internal\nclaims are stated at greater length here because the brick's argument is the\nrelation between them.\n\nThe resolution is the brick's contribution and appears in neither source. The\ntwo drafts were written weeks apart about unrelated subsystems, one arguing a\nfail-closed disclosure engine and one arguing an assembler that never\nrefuses, and read as doctrines they cancel. Reading them as a single rule with\na direction, degradation spent on authority and never on presence, is our\nsynthesis, and the brick says so rather than presenting the coherence as\nsomething the source documents already knew. The two external cases were\nselected to test the synthesis against domains where the cost of getting it\nwrong is counted in lives rather than in trust, and both fall the same way.\n\nA second source is recorded here as of the spiritual-harvest wave\n(2026-08-03), contributing convergence rather than evidence. The cleared\nsystem integration blueprint in the contemplative research estate,\n`research/topics/foundations/spiritual-ai/spiritual-04-system-integration-blueprint.md`,\nframes resilience as an ethical commitment and arrives at the same rule from\nan unrelated domain, naming graceful degradation as compassion, offline\nfunctionality as steadfastness, and proactive monitoring as stewardship. That\nan argument about disclosure engines and prompt assemblers is reached\nindependently by a document about distributed system resilience is worth\nrecording, and it is worth no more than recording, because the brick's own\nmechanism is stronger than the resilience table's and nothing in the file\nchanges a claim or a grade above. The file's clearance is argument-scoped and\nstays that way; only the reliability-as-compassion material is in view.\n\nThe observation that the direction of failure is the one claim that cannot be\nmade retroactively is the brick's own, and is the sentence connecting it back\nto the parent essay's argument about what a disclosure owes. The subsystem\narchitecture surrounding both drafts, including the relationship anchor model,\nthe capability registry, the phase registry, and the evaluation material, is\ninternal and none of it is used here." }, "contract": "https://mnstry.org/contracts/org/org-writing.v1.schema.json", "releaseHash": "cfe22dcbf63eff00d104fd3742f3a77935c43d2e2f5896554e8ffb807f8b4cb1", "versions": [ { "version": 1, "cutAt": "2026-08-03", "note": "Initial publication, honest-claims wave", "visibility": "published", "path": "/writing/which-way-failure-falls/", "contentHash": "sha256:5c8e9c8316be464d", "releaseHash": "cfe22dcbf63eff00d104fd3742f3a77935c43d2e2f5896554e8ffb807f8b4cb1" } ] }