{
  "schema_version": "1.0",
  "lab_id": "WACK-DIAMOND-LAB-0001",
  "package_id": "WACK-DERIVATIVES-0001",
  "canonical_content_id": "WACK-CONTENT-0165",
  "reviewed_content_sha256": "afd7ad277bc7044e41333601f0377105268a9739a615357f2edc69ed23232e6f",
  "title": "Diamond Fulcrum Formation Break Lab",
  "subtitle": "The webhook that moved only one document",
  "status": "public-pilot-derived-from-reviewed-source",
  "duration_minutes": 45,
  "purpose": "Test whether one changed payment fact causes Scope, Applicability, Implementation and Responsibility, Evidence, and their downstream consumers to move together.",
  "boundary": "This fictional practitioner exercise exposes dependencies, contradictions, and unsupported claims. It does not decide PCI DSS scope, requirement applicability, compliance, validation eligibility, provider responsibility, or acceptance. Use fictional or sanitized information only. Working notes remain on the device unless the participant downloads them.",
  "opening_rule": "Do not repair the scenario while reading it. Record the first dependency the room misses and the first explanation the facilitator has to supply.",
  "baseline_facts": [
    "Northwind Market uses a hosted checkout supplied by a payment service provider.",
    "A production payment-status webhook is exposed through the entity's cloud edge service.",
    "The application inventory and architecture diagram name the new endpoint.",
    "External vulnerability and ASV scan target records still list the prior public addresses.",
    "The penetration-testing methodology does not describe webhook behavior or its trust boundaries.",
    "The provider responsibility record describes payment processing but does not identify callback delivery or customer receiver operation.",
    "A screenshot from staging is attached to a production control claim."
  ],
  "change_injection": "The webhook now invokes a serverless function through a workload identity and writes transaction references to a managed queue used by customer support.",
  "positions": [
    {
      "id": "scope",
      "name": "Scope",
      "job": "Reopen the represented subjects and relationships.",
      "prompt": "Which people, processes, technologies, locations, data flows, connected relationships, security-influencing relationships, and provider services require fresh analysis?",
      "stop_rule": "Do not turn an Internet-facing endpoint or provider dependency into an automatic in-scope or out-of-scope conclusion."
    },
    {
      "id": "applicability",
      "name": "Applicability",
      "job": "Reopen predicates that depended on the prior facts.",
      "prompt": "Which obligations, reporting responses, testing questions, or prior N/A conclusions relied on the old endpoint, identity, data path, or operating model?",
      "stop_rule": "Do not treat a row in an instrument as the conclusion; preserve the tested fact, authority, response, and reopening trigger."
    },
    {
      "id": "responsibility",
      "name": "Implementation and Responsibility",
      "job": "Name the operating verbs and accountable owners.",
      "prompt": "Who configures, deploys, monitors, scans, tests, changes, responds, preserves, and proves the edge, function, identity, queue, provider handoff, and support use?",
      "stop_rule": "Do not replace the verb map with 'the provider handles it' or assign the repair to the assessor."
    },
    {
      "id": "evidence",
      "name": "Evidence",
      "job": "Bound what can be supported now.",
      "prompt": "Which objects support the correct subject, population, period, environment, and procedure—and where do staging evidence, stale targets, or absent propositions stop the claim?",
      "stop_rule": "Preserve contradictions. Do not let evidence volume repair a stale fact or an undefined population."
    }
  ],
  "consumers": [
    {"id": "component-inventory", "label": "System and component inventory", "question": "Does it identify the edge, function, workload identity, queue, and relevant environments?"},
    {"id": "software-inventory", "label": "Software and application inventory", "question": "Does it identify the receiver code, dependencies, deployment source, and change owner?"},
    {"id": "diagrams", "label": "Architecture and data-flow narrative", "question": "Do the diagram and narrative agree about normal, failure, support, identity, and provider paths?"},
    {"id": "public-presence", "label": "Public-presence and scan target records", "question": "Have the actual terminating hostnames and infrastructure been reconciled to the applicable scan populations?"},
    {"id": "penetration-test", "label": "Penetration-testing methodology", "question": "Does the method test the relevant external interface, trust transitions, identity, and application behavior?"},
    {"id": "provider-assurance", "label": "Provider assurance and responsibility", "question": "Do the exact service, callback behavior, customer configuration, and retained verbs reconcile to current assurance?"},
    {"id": "identity", "label": "Identity and access records", "question": "Is the workload identity attributable, bounded, reviewed, monitored, and linked to the correct deployment?"},
    {"id": "sdlc", "label": "SDLC and change record", "question": "Can the released function and configuration be traced from approved change through testing and production?"},
    {"id": "evidence", "label": "Evidence contract and claims ledger", "question": "Do the evidence subject, environment, population, period, and provenance match the production claim?"},
    {"id": "reporting", "label": "Assessment and reporting responses", "question": "Which prior assertions must reopen before the assessment can describe the current environment?"}
  ],
  "sequence": [
    {"minutes": "00–05", "move": "Freeze the baseline", "instruction": "Read the facts without repairing them. Name the current authoritative fact version."},
    {"minutes": "05–12", "move": "Fly four positions", "instruction": "Record one bounded claim and one unresolved question for each position."},
    {"minutes": "12–15", "move": "Inject the change", "instruction": "Reveal the serverless function, workload identity, and support queue."},
    {"minutes": "15–27", "move": "Move the consumers", "instruction": "Classify each downstream artifact as move, reopen, or hold with a stated reason."},
    {"minutes": "27–35", "move": "Reconcile contradictions", "instruction": "Name the first stale relationship, unsupported claim, and ownerless verb."},
    {"minutes": "35–41", "move": "Bound the disposition", "instruction": "State what is supported, what remains unresolved, who owns the next fact, and what reopens the decision."},
    {"minutes": "41–45", "move": "Observe the method", "instruction": "Capture the first missed dependency, oral rescue, smallest repair, and retest condition."}
  ],
  "model_reconstruction": [
    "The changed fact is not merely a new URL; it is a new production relationship among an edge, receiver, workload identity, managed queue, provider callback, and support process.",
    "The public interface and related infrastructure must be reconciled to the applicable external vulnerability, ASV, and penetration-testing populations; the exercise does not predetermine the result of that analysis.",
    "Provider assurance must be reconciled to the exact service and callback behavior while retained customer verbs remain explicit.",
    "The staging screenshot cannot, by itself, support a production implementation claim.",
    "The assessment conclusion stops wherever the current subject, population, period, procedure, ownership, or evidence cannot be supported."
  ],
  "observation_fields": [
    "tested_surface",
    "session_date",
    "first_missed_dependency",
    "first_oral_rescue",
    "smallest_repair",
    "retest_condition",
    "workshop_disposition",
    "known_limitation"
  ],
  "authority_boundary": "The Diamond Fulcrum is Scott Norton's independent practitioner model. It is not PCI SSC terminology or U.S. Navy doctrine and does not imply affiliation with or endorsement by PCI SSC, the U.S. Navy, or the Blue Angels."
}