{
  "notation_id": "WACK-NOTATION-0001",
  "name": "Wack Markup Language",
  "short_name": "W/ML",
  "version": "0.1",
  "status": "draft-language-specification",
  "reference_implementation": "The Cluster of Wack",
  "authority": ["PRACTITIONER_METHOD", "AI_ASSISTED"],
  "design_principle": "W/ML describes the distance between how a system is believed to work and how it actually works.",
  "purpose": "A compact, human-readable notation for identifying, classifying, connecting, tracking, and resolving operational, architectural, security, compliance, evidence, and governance inconsistencies.",
  "thesis": "Find the Wack. Describe the Wack. Follow the Wack. Cluster the Wack. Fix the cause—not merely the artifact where the Wack appeared.",
  "boundary": "W/ML is practitioner-created working language. It is not PCI SSC terminology, an assessment result, a risk rating, or a statement of PCI DSS compliance. Material means practitioner-assigned consequence inside the named analysis; it does not automatically mean a PCI DSS finding, a compliance-accepting entity decision, or a formal risk classification. W/✓ and W/∅ apply only to the named condition and supporting record.",
  "primitive": {
    "expression": "W/",
    "name": "Wack exists",
    "meaning": "A difference, inconsistency, uncertainty, or unexplained condition is present and ready to be described. Everything else adds context."
  },
  "grammar": {
    "expression": "W/<state>[<object>]{<attributes>} <relationship> W/...",
    "rule": "Every component after W/ is optional. A state refines disposition, an object names the affected thing, attributes carry metadata, and a relationship connects one Wack expression to another.",
    "valid_examples": [
      "W/",
      "W/?",
      "W/![SCOPE]",
      "W/!![EVIDENCE]",
      "W/![TPSP]{owner=UNKNOWN}",
      "W/![TPSP] → W/?[SCOPE]"
    ]
  },
  "state_operators": [
    {"symbol": "W/", "name": "Observed", "meaning": "Something is Wack and is ready to be described.", "color": "teal"},
    {"symbol": "W/?", "name": "Suspected", "meaning": "The proposition needs investigation; do not promote uncertainty into a conclusion.", "color": "amber"},
    {"symbol": "W/!", "name": "Confirmed", "meaning": "Evidence supports the named Wack condition.", "color": "orange"},
    {"symbol": "W/!!", "name": "Material", "meaning": "The confirmed condition has significant consequence inside the named analysis. This is not an automatic PCI finding or risk rating.", "color": "red"},
    {"symbol": "W/???", "name": "Unknown", "meaning": "Something is wrong, but the mechanism or causal structure remains unknown.", "color": "red"},
    {"symbol": "W/+", "name": "Accumulating", "meaning": "The condition is increasing as decisions, exceptions, dependencies, or periods accumulate.", "color": "purple"},
    {"symbol": "W/∞", "name": "Systemic", "meaning": "The condition is recurring, structurally embedded, or reproduced by the operating model.", "color": "purple"},
    {"symbol": "W/…", "name": "Developing", "meaning": "Investigation, change, or corrective work is underway; the final disposition is not yet established.", "color": "amber"},
    {"symbol": "W/✓", "name": "Remediated", "meaning": "Correction has been implemented and validated for the named condition.", "color": "lime"},
    {"symbol": "W/∅", "name": "Eliminated", "meaning": "The named Wack condition and its enabling path no longer exist.", "color": "slate"}
  ],
  "symbols": [
    {"symbol": "W/", "name": "Wack", "meaning": "A known condition is ready to be mapped and explained.", "color": "teal"},
    {"symbol": "W/?", "name": "Suspected Wack", "meaning": "The proposition is unresolved and needs evidence.", "color": "amber"},
    {"symbol": "W/!", "name": "Confirmed Wack", "meaning": "Evidence supports the named condition.", "color": "orange"},
    {"symbol": "W/!!", "name": "Material Wack", "meaning": "The confirmed condition has significant consequence inside the named analysis.", "color": "red"},
    {"symbol": "W/⚠", "name": "Wack requiring attention", "meaning": "Presentation shorthand for assigning an owner and bounded next action.", "color": "orange"},
    {"symbol": "W/+", "name": "Wack accumulating", "meaning": "New decisions, exceptions, or dependencies are increasing the condition.", "color": "purple"},
    {"symbol": "W/×", "name": "Interacting Wack", "meaning": "Presentation shorthand for Wack expressions that require joint analysis.", "color": "red"},
    {"symbol": "W/∞", "name": "Systemic Wack", "meaning": "The condition continues across periods, occurrences, or operating cycles.", "color": "purple"},
    {"symbol": "W/→", "name": "Propagating Wack", "meaning": "Presentation shorthand for a condition changing dependent systems, evidence, controls, or claims.", "color": "teal"},
    {"symbol": "W/↔", "name": "Coupled Wack", "meaning": "Presentation shorthand for two or more conditions that reinforce one another.", "color": "purple"},
    {"symbol": "W/✓", "name": "Wack remediated", "meaning": "Corrective work and supporting validation are recorded.", "color": "lime"},
    {"symbol": "W/∅", "name": "Wack eliminated", "meaning": "The condition and its enabling path have been removed and verified.", "color": "slate"},
    {"symbol": "W/…", "name": "Wack developing", "meaning": "Investigation or change is underway and the final disposition remains open.", "color": "amber"},
    {"symbol": "W/???", "name": "Mechanism unknown", "meaning": "Preserve the uncertainty and investigate before relying on the behavior.", "color": "red"}
  ],
  "objects": [
    "SCOPE", "ASSET", "DATA", "DATAFLOW", "SYSTEM", "NETWORK", "CONTROL", "EVIDENCE", "OWNER", "PROCESS", "TPSP", "RESPONSIBILITY", "DEPENDENCY", "CONFIG", "INVENTORY", "DOCUMENTATION", "ASSUMPTION"
  ],
  "object_rule": "The object vocabulary is extensible. W/[THING] remains valid when the core specification does not yet define THING, because Wack routinely arrives before taxonomy does.",
  "relationships": [
    {"symbol": "→", "name": "causes or propagates into"},
    {"symbol": "↔", "name": "is coupled with"},
    {"symbol": "×", "name": "interacts with"},
    {"symbol": "+", "name": "coexists with"},
    {"symbol": "⊂", "name": "is contained within"},
    {"symbol": "∵", "name": "is caused by"}
  ],
  "attributes": [
    {"name": "owner", "meaning": "Accountable party or unresolved ownership state."},
    {"name": "requirement", "meaning": "Applicable requirement reference asserted by the writer."},
    {"name": "asset", "meaning": "Stable asset or component identifier."},
    {"name": "source", "meaning": "Source record or originating system."},
    {"name": "severity", "meaning": "Practitioner-assigned significance, kept separate from certainty."},
    {"name": "confidence", "meaning": "Confidence in the stated observation or relationship."},
    {"name": "age", "meaning": "Elapsed time associated with the condition or artifact."},
    {"name": "status", "meaning": "Workflow status external to the state operator."},
    {"name": "assignee", "meaning": "Person or role assigned the next action."},
    {"name": "detected", "meaning": "When the condition was first recorded."},
    {"name": "expires", "meaning": "When the observation, exception, or evidence must be revisited."},
    {"name": "evidence", "meaning": "Evidence identifier or explicit absence marker."}
  ],
  "attribute_example": "W/![EVIDENCE]{owner=ENTITY, requirement=12.8.5, age=397d, source=TPSP_MATRIX}",
  "cluster_operator": {
    "syntax": "W/{...}",
    "definition": "A Cluster of Wack is a set of related Wacks whose interaction creates a condition more significant than any individual Wack.",
    "examples": [
      {"expression": "W/{TPSP × RESPONSIBILITY × SCOPE × CONTROL × EVIDENCE}", "meaning": "An unstated cluster whose constituents interact."},
      {"expression": "W/{TPSP × SCOPE × EVIDENCE}?", "meaning": "A suspected cluster."},
      {"expression": "W/{TPSP × SCOPE × EVIDENCE}!", "meaning": "A confirmed cluster."},
      {"expression": "W/{TPSP × SCOPE × EVIDENCE}!!", "meaning": "A cluster with material consequence inside the named analysis."},
      {"expression": "W/{???}", "meaning": "A cluster is detected, but its constituents or causal structure remain unknown."}
    ]
  },
  "composition": {
    "expression": "{ W/ × W/ × W/ } = CLUSTER OF WACK",
    "meaning": "A Cluster of Wack emerges when multiple individually identifiable conditions interact and the combined effect becomes more consequential than any single condition."
  },
  "propagation": {
    "expression": "W/![INVENTORY] → W/?[SCOPE] → W/?[CONTROL] → W/?[EVIDENCE]",
    "cluster": "W/{INVENTORY → SCOPE → CONTROL → EVIDENCE}!",
    "meaning": "One confirmed inventory defect propagates uncertainty through scope, control applicability, and evidence completeness."
  },
  "lifecycle": [
    {"step": "detect", "symbol": "W/", "meaning": "Record the observed difference without pretending the cause is known."},
    {"step": "investigate", "symbol": "W/?", "meaning": "Gather facts, define the object, and test the proposition."},
    {"step": "dismiss", "symbol": "W/∅", "meaning": "Close the suspected condition when testing shows it does not exist."},
    {"step": "confirm", "symbol": "W/!", "meaning": "Bind the confirmed condition to supporting evidence."},
    {"step": "assess consequence", "symbol": "W/!!", "meaning": "State significance within the analysis without manufacturing a PCI result."},
    {"step": "remediate", "symbol": "W/…", "meaning": "Track corrective work while the condition remains open."},
    {"step": "validate", "symbol": "W/✓", "meaning": "Record that the correction was tested successfully."},
    {"step": "eliminate", "symbol": "W/∅", "meaning": "Record that the condition and enabling path no longer exist."}
  ],
  "laws": [
    {"name": "First Law of Wack", "statement": "Wack that is undocumented does not cease to exist. It merely becomes undiscoverable."},
    {"name": "Second Law of Wack", "statement": "Local remediation does not guarantee global de-Wackification."},
    {"name": "Third Law of Wack", "statement": "Wack propagates across undocumented dependencies faster than documented ones."},
    {"name": "Cluster Principle", "statement": "When independently manageable Wacks become mutually dependent, a Cluster of Wack exists."},
    {"name": "Practitioner Rule", "statement": "Never normalize the Wack."}
  ],
  "comments": {
    "syntax": "W// commentary about the Wack",
    "example": "W// TPSP says they own this control. Responsibility evidence says otherwise."
  },
  "reference_case": {
    "title": "Responsibility → control → evidence",
    "facts": "The assessed entity attributes a control to a TPSP, current service-specific responsibility evidence indicates shared responsibility, no internal owner is identified, and implementation evidence is absent.",
    "expression": "W/{RESPONSIBILITY → CONTROL → EVIDENCE}!!",
    "lesson": "The useful observation is the causal cluster, not three disconnected missing fields. The notation still requires the underlying facts, sources, tests, owner, and assessment judgment."
  },
  "architecture": [
    {"layer": "The Cluster of Wack", "role": "Brand, practitioner philosophy, publication platform, community language, and method."},
    {"layer": "W/ML", "role": "Human-readable notation for observations, relationships, lifecycle, and clusters."},
    {"layer": "Wack Engine", "role": "Bounded reference implementation for parsing, linting, explaining, and identifying explicit clusters without scoring or compliance conclusions."},
    {"layer": "Wack Graph", "role": "Structured objects and relationships across PCI DSS, evidence, and operations."}
  ],
  "examples": [
    {
      "context": "Architecture",
      "expression": "W/![TPSP] → W/![RESPONSIBILITY] → W/?[CONTROL]",
      "explanation": "A confirmed provider-boundary condition propagates into a responsibility problem and uncertainty about control ownership."
    },
    {
      "context": "Assessment note",
      "expression": "W/![RESPONSIBILITY]{requirement=8.3.1, owner=UNKNOWN}",
      "explanation": "The notation identifies the working condition; the supporting record must carry the facts, source, test, and professional conclusion."
    },
    {
      "context": "Structured interchange",
      "expression": "{\"wml\":\"W/![EVIDENCE]{requirement=12.8.5}\",\"object\":\"EVIDENCE\",\"state\":\"CONFIRMED\"}",
      "explanation": "W/ML can serve as a human-readable serialization of a structured graph observation without becoming the evidence itself."
    }
  ],
  "reference_commands": ["wack lint assessment.wml", "wack explain assessment.wml", "wack cluster assessment.wml"],
  "downloads": {
    "specification": "/downloads/brand/wml-v0.1-specification.md",
    "example": "/tools/wml-v0.1-pci-scope-propagation.wml",
    "schema": "/tools/wml-v0.1-structured-record.schema.json",
    "canonical_json": "/downloads/brand/wml-v0.1.json",
    "practice_lab": "/wml/lab"
  }
}