# W/ML v0.1 — Wack Markup Language

Status: **Draft Language Specification**

Reference implementation: **The Cluster of Wack**

Authority: **PRACTITIONER_METHOD / AI_ASSISTED**

> W/ML describes the distance between how a system is believed to work and how it actually works.

A compact, human-readable notation for identifying, classifying, connecting, tracking, and resolving operational, architectural, security, compliance, evidence, and governance inconsistencies.

## Authority boundary

W/ML is practitioner-created working language. It is not PCI SSC terminology, an assessment result, a risk rating, or a statement of PCI DSS compliance. Material means practitioner-assigned consequence inside the named analysis; it does not automatically mean a PCI DSS finding, a compliance-accepting entity decision, or a formal risk classification. W/✓ and W/∅ apply only to the named condition and supporting record.

## Primitive

`W/` means **Wack exists**. A difference, inconsistency, uncertainty, or unexplained condition is present and ready to be described. Everything else adds context.

## Core grammar

```text
W/<state>[<object>]{<attributes>} <relationship> W/...
```

Every component after W/ is optional. A state refines disposition, an object names the affected thing, attributes carry metadata, and a relationship connects one Wack expression to another.

```text
W/
W/?
W/![SCOPE]
W/!![EVIDENCE]
W/![TPSP]{owner=UNKNOWN}
W/![TPSP] → W/?[SCOPE]
```

## State operators

Certainty and consequence are deliberately separate. `W/?` means uncertain. `W/!!` means material inside the named practitioner analysis.

| Syntax | State | Practitioner meaning |
| --- | --- | --- |
| `W/` | Observed | Something is Wack and is ready to be described. |
| `W/?` | Suspected | The proposition needs investigation; do not promote uncertainty into a conclusion. |
| `W/!` | Confirmed | Evidence supports the named Wack condition. |
| `W/!!` | Material | The confirmed condition has significant consequence inside the named analysis. This is not an automatic PCI finding or risk rating. |
| `W/???` | Unknown | Something is wrong, but the mechanism or causal structure remains unknown. |
| `W/+` | Accumulating | The condition is increasing as decisions, exceptions, dependencies, or periods accumulate. |
| `W/∞` | Systemic | The condition is recurring, structurally embedded, or reproduced by the operating model. |
| `W/…` | Developing | Investigation, change, or corrective work is underway; the final disposition is not yet established. |
| `W/✓` | Remediated | Correction has been implemented and validated for the named condition. |
| `W/∅` | Eliminated | The named Wack condition and its enabling path no longer exist. |

## Object vocabulary

`SCOPE` `ASSET` `DATA` `DATAFLOW` `SYSTEM` `NETWORK`
`CONTROL` `EVIDENCE` `OWNER` `PROCESS` `TPSP` `RESPONSIBILITY`
`DEPENDENCY` `CONFIG` `INVENTORY` `DOCUMENTATION` `ASSUMPTION`

The object vocabulary is extensible. W/[THING] remains valid when the core specification does not yet define THING, because Wack routinely arrives before taxonomy does.

## Relationships

| Syntax | Relationship |
| --- | --- |
| `→` | causes or propagates into |
| `↔` | is coupled with |
| `×` | interacts with |
| `+` | coexists with |
| `⊂` | is contained within |
| `∵` | is caused by |

Example: `W/![TPSP] → W/![RESPONSIBILITY] → W/?[CONTROL]`

## Attributes

Curly braces carry metadata. Human shorthand and machine-enriched W/ML use the same language at different fidelity.

| Attribute | Meaning |
| --- | --- |
| `owner=` | Accountable party or unresolved ownership state. |
| `requirement=` | Applicable requirement reference asserted by the writer. |
| `asset=` | Stable asset or component identifier. |
| `source=` | Source record or originating system. |
| `severity=` | Practitioner-assigned significance, kept separate from certainty. |
| `confidence=` | Confidence in the stated observation or relationship. |
| `age=` | Elapsed time associated with the condition or artifact. |
| `status=` | Workflow status external to the state operator. |
| `assignee=` | Person or role assigned the next action. |
| `detected=` | When the condition was first recorded. |
| `expires=` | When the observation, exception, or evidence must be revisited. |
| `evidence=` | Evidence identifier or explicit absence marker. |

Example: `W/![EVIDENCE]{owner=ENTITY, requirement=12.8.5, age=397d, source=TPSP_MATRIX}`

## Cluster operator

`W/{...}` — A Cluster of Wack is a set of related Wacks whose interaction creates a condition more significant than any individual Wack.

- `W/{TPSP × RESPONSIBILITY × SCOPE × CONTROL × EVIDENCE}` — An unstated cluster whose constituents interact.
- `W/{TPSP × SCOPE × EVIDENCE}?` — A suspected cluster.
- `W/{TPSP × SCOPE × EVIDENCE}!` — A confirmed cluster.
- `W/{TPSP × SCOPE × EVIDENCE}!!` — A cluster with material consequence inside the named analysis.
- `W/{???}` — A cluster is detected, but its constituents or causal structure remain unknown.

Composition law: **`{ W/ × W/ × W/ } = CLUSTER OF WACK`**

## Propagation

```text
W/![INVENTORY] → W/?[SCOPE] → W/?[CONTROL] → W/?[EVIDENCE]
```

One confirmed inventory defect propagates uncertainty through scope, control applicability, and evidence completeness.

```text
W/{INVENTORY → SCOPE → CONTROL → EVIDENCE}!
```

## Lifecycle

1. **Detect — `W/`.** Record the observed difference without pretending the cause is known.
2. **Investigate — `W/?`.** Gather facts, define the object, and test the proposition.
3. **Dismiss — `W/∅`.** Close the suspected condition when testing shows it does not exist.
4. **Confirm — `W/!`.** Bind the confirmed condition to supporting evidence.
5. **Assess Consequence — `W/!!`.** State significance within the analysis without manufacturing a PCI result.
6. **Remediate — `W/…`.** Track corrective work while the condition remains open.
7. **Validate — `W/✓`.** Record that the correction was tested successfully.
8. **Eliminate — `W/∅`.** Record that the condition and enabling path no longer exist.

`W/✓` is not the same as `W/∅`. Remediation records a validated correction; elimination records that the condition and its enabling path are gone.

## Laws of Wack

- **First Law of Wack:** Wack that is undocumented does not cease to exist. It merely becomes undiscoverable.
- **Second Law of Wack:** Local remediation does not guarantee global de-Wackification.
- **Third Law of Wack:** Wack propagates across undocumented dependencies faster than documented ones.
- **Cluster Principle:** When independently manageable Wacks become mutually dependent, a Cluster of Wack exists.
- **Practitioner Rule:** Never normalize the Wack.

## Comments

`W// commentary about the Wack`

Example: `W// TPSP says they own this control. Responsibility evidence says otherwise.`

## PCI DSS reference implementation

**Responsibility → control → evidence**

The assessed entity attributes a control to a TPSP, current service-specific responsibility evidence indicates shared responsibility, no internal owner is identified, and implementation evidence is absent.

`W/{RESPONSIBILITY → CONTROL → EVIDENCE}!!`

The useful observation is the causal cluster, not three disconnected missing fields. The notation still requires the underlying facts, sources, tests, owner, and assessment judgment.

## Deeper architecture

- **The Cluster of Wack:** Brand, practitioner philosophy, publication platform, community language, and method.
- **W/ML:** Human-readable notation for observations, relationships, lifecycle, and clusters.
- **Wack Engine:** Bounded reference implementation for parsing, linting, explaining, and identifying explicit clusters without scoring or compliance conclusions.
- **Wack Graph:** Structured objects and relationships across PCI DSS, evidence, and operations.

## Practice lab

Exercise W/ML in three bounded working contexts before the draft language is treated as stable.

- **Architecture annotation:** Reconcile one service that appears in runtime evidence but not in the maintained inventory or diagram. Download: `/tools/wml-v0.1-architecture-annotation.wml`
- **Owner Desk review:** Use an exact source record to separate a narrative mismatch from the later practitioner disposition. Download: `/tools/wml-v0.1-owner-desk-review.wml`
- **Facilitated workshop:** Give a cross-functional group one provider claim and ask them to expose the responsibility and evidence seams. Download: `/tools/wml-v0.1-facilitated-workshop.wml`

### Reference commands

- `wack lint FILE.wml` — Validate grammar and report bounded notices without judging PCI DSS compliance.
- `wack explain FILE.wml` — Translate each parsed expression into plain practitioner language.
- `wack cluster FILE.wml` — Report explicit clusters and connected object sets without producing a score or finding.

The lab describes observations and relationships. It does not determine PCI DSS applicability, produce an assessment result, assign risk, or decide compliance acceptance.

## Thesis

> Find the Wack. Describe the Wack. Follow the Wack. Cluster the Wack. Fix the cause—not merely the artifact where the Wack appeared.

`W/ → W/? → W/! → W/{...} → W/✓ → W/∅`