{
  "schema_version": "1.0",
  "lab_id": "WACK-EVIDENCE-RELATIONSHIP-LAB-0001",
  "content_id": "WACK-CONTENT-0168",
  "source_digest": "sha256:cb6548a8f96948dfbc04c2c3031421b2a814828f7e1e8790621f41eaa29df2f8",
  "name": "Evidence Relationship Cold-Reader Laboratory",
  "status": "public-pilot-derived-from-reviewed-source",
  "authority_classification": ["PRACTITIONER_METHOD", "AI_ASSISTED"],
  "duration": "30 minutes",
  "purpose": "Test whether a cold reader can traverse one fictional assessment conclusion backward to its authoritative source, then propagate one contradictory fact forward to every affected object and accountable reviewer.",
  "boundary": "This lab exercises relationship quality, change propagation, and accountable review. It does not determine PCI DSS compliance, evidence sufficiency, requirement applicability, an assessment result, or acceptance by a compliance-accepting entity.",
  "objects": [
    {"id": "conclusion", "symbol": "W/?", "label": "Conclusion", "prompt": "What exact report statement is being considered, and where must it stop?"},
    {"id": "disposition", "symbol": "W/!", "label": "Disposition", "prompt": "Who made the bounded interpretation, under which authority and limitations?"},
    {"id": "test", "symbol": "W/→", "label": "Test", "prompt": "What procedure was performed, against which population and selection?"},
    {"id": "evidence", "symbol": "W/", "label": "Evidence", "prompt": "What object was observed, when, from where, and with which limitations?"},
    {"id": "population", "symbol": "W/×", "label": "Population", "prompt": "What complete candidate set, predicates, exclusions, and variants bounded the test?"},
    {"id": "subject", "symbol": "W/↔", "label": "Subject", "prompt": "Which system, service, identity plane, environment, and boundary does the claim describe?"},
    {"id": "source", "symbol": "W/∞", "label": "Authoritative source", "prompt": "Which native system or record is authoritative for the represented fact?"}
  ],
  "case": {
    "case_id": "WACK-ER-CASE-0001",
    "title": "The filtered support tenant",
    "assessment_period": "2026-07-01 through 2026-09-30",
    "starting_assertion": "The complete population of identities capable of privileged production administration was reviewed during the fictional Q3 access-review occurrence.",
    "brief": "Nimbus Checkout operates a fictional hosted-payment application. Production administration is available through a primary workforce tenant and a separate support tenant used for emergency engineering support. The assessment packet contains an access-review workbook, query notes, approval records, architecture facts, and draft report language. The packet is intentionally mixed. Reconstruct the seven-object chain before looking at the model.",
    "facts": [
      {"id": "ER-01", "at": "2026-09-02", "title": "Draft report sentence", "text": "The draft says all identities capable of privileged production administration were reviewed for Q3.", "object": "conclusion", "why": "This is the bounded statement a reviewer may eventually permit, revise, or reject; it is not self-proving."},
      {"id": "ER-02", "at": "2026-09-01", "title": "Reviewer sign-off", "text": "The PCI program owner marked the supplied review workbook supported with the limitation that completeness depended on the declared population export.", "object": "disposition", "why": "The sign-off is an accountable interpretation with a named limitation, not the underlying test or source fact."},
      {"id": "ER-03", "at": "2026-08-29", "title": "Review procedure", "text": "The reviewer compared each exported identity to current role, manager, business need, privileged group, and recorded action.", "object": "test", "why": "This describes the performed procedure and attributes, but only for the records admitted to the export."},
      {"id": "ER-04", "at": "2026-08-28", "title": "Access-review workbook", "text": "Twenty-four primary-tenant identities appear with owner, role, decision, reviewer, date, and retained approval reference.", "object": "evidence", "why": "The workbook preserves observed review results for twenty-four rows; it cannot establish that the population was complete."},
      {"id": "ER-05", "at": "2026-08-27", "title": "Population predicate", "text": "The export used tenant=primary, environment=production, privileged=true, enabled=true, with no recorded variant analysis.", "object": "population", "why": "The query predicates define the candidate set that the test actually consumed and expose the tenant restriction."},
      {"id": "ER-06", "at": "2026-07-14", "title": "Administrative boundary", "text": "The architecture record states that both workforce-primary and support-prod identities can reach the production management plane through different privileged groups.", "object": "subject", "why": "This defines the system and boundary the claim describes, including the second identity variant."},
      {"id": "ER-07", "at": "2026-08-27", "title": "Native identity source", "text": "The workforce-primary directory and support-prod directory are the authoritative sources for enabled identities and privileged-group membership.", "object": "source", "why": "These native directories are authoritative for the population facts; the workbook is a derivative."},
      {"id": "ER-08", "at": "2026-09-05", "title": "Two unrepresented accounts", "text": "A joined query across both directories returns two enabled support-prod emergency identities absent from the review workbook.", "object": "population", "why": "This contradicts the completeness of the original candidate set and reopens downstream objects without deciding their final disposition."}
    ],
    "model_chain": {
      "conclusion": "EX-CONCLUSION-01 — The proposed statement may describe only the twenty-four reviewed primary-tenant identities until population completeness and the two support identities are evaluated.",
      "disposition": "EX-DISPOSITION-01 — PCI program owner; supported with explicit population limitation; reopened by contradictory population evidence.",
      "test": "EX-TEST-01 — Review owner, role, business need, privileged membership, and action for every admitted row; no procedure tested the omitted tenant variant.",
      "evidence": "EX-EVIDENCE-01 — Twenty-four-row review workbook representing the primary-tenant export, Q3 review decisions, and approval references.",
      "population": "EX-POPULATION-01 — Enabled privileged production identities selected by tenant=primary; declared complete before the support-prod variant was reconciled.",
      "subject": "EX-SUBJECT-01 — Nimbus Checkout production management identity plane spanning workforce-primary and support-prod privileged paths.",
      "source": "EX-SOURCE-01 — Native directory objects and privileged-group memberships from both identity tenants, joined at an attributable observation time."
    },
    "joins": [
      {"from": "conclusion", "relation": "AUTHORIZED_BY", "to": "disposition", "meaning": "A report statement is limited by the accountable disposition."},
      {"from": "disposition", "relation": "INFORMED_BY", "to": "test", "meaning": "The decision depends on the performed procedure and observed result."},
      {"from": "test", "relation": "CONSUMED", "to": "evidence", "meaning": "The test records which evidence objects it actually evaluated."},
      {"from": "evidence", "relation": "REPRESENTS", "to": "population", "meaning": "The object represents a defined candidate set and period, not an abstract control."},
      {"from": "population", "relation": "BOUNDS", "to": "subject", "meaning": "Predicates and variants identify which part of the subject entered the test."},
      {"from": "subject", "relation": "RESOLVES_TO", "to": "source", "meaning": "The subject's facts resolve to named authoritative systems and records."}
    ],
    "cold_reader_questions": [
      "Can I quote the exact conclusion without widening its subject, population, or period?",
      "Can I identify the accountable disposition and its limitations?",
      "Can I reproduce the test procedure and distinguish it from evidence collection?",
      "Can I identify the evidence object's provenance, represented period, and non-claims?",
      "Can I reconstruct the complete population predicates, exclusions, and variants?",
      "Can I identify the stable subject and every relevant administrative path?",
      "Can I reach the native authoritative source without relying on the derivative workbook?"
    ],
    "changed_fact": {
      "id": "EX-CHANGE-01",
      "title": "The support-prod tenant was filtered out",
      "observed_at": "2026-09-05T10:30:00-07:00",
      "statement": "Two enabled support-prod emergency identities could administer production during the assessment period but were excluded by tenant=primary and do not appear in the review workbook.",
      "source": "Joined native-directory query plus the dated production-management architecture record.",
      "effects": [
        {"object_id": "population", "effect": "Population completeness is contradicted; record the missing variant and the two identities."},
        {"object_id": "evidence", "effect": "The workbook remains authentic for twenty-four rows but is insufficient to represent the newly understood complete population."},
        {"object_id": "test", "effect": "The prior procedure did not evaluate the two support identities; additional work or a bounded exception decision is required."},
        {"object_id": "disposition", "effect": "The prior supported-with-limitation disposition reopens for accountable evaluation."},
        {"object_id": "conclusion", "effect": "The proposed complete-population statement is no longer supportable as written."}
      ],
      "review_queue": [
        "Identity owner — confirm the authoritative joined population and period",
        "Control owner — determine whether and when the two identities were reviewed",
        "Assessor or accountable reviewer — evaluate the new evidence and performed procedure",
        "Report owner — hold or bound the affected report statement pending disposition"
      ],
      "stop_rule": "No automatic PCI DSS conclusion. Preserve the contradiction, reopen the affected records, perform the required work, and route the result to accountable human judgment."
    }
  },
  "workbench_fields": [
    {"id": "first_broken_join", "label": "First broken join", "prompt": "Where did the cold reader first lose the chain?"},
    {"id": "first_overextended_claim", "label": "First overextended claim", "prompt": "Which statement reached beyond its represented population, subject, or period?"},
    {"id": "smallest_repair", "label": "Smallest repair", "prompt": "What is the smallest change that would make the relationship explicit?"},
    {"id": "retest_condition", "label": "Retest condition", "prompt": "What must another cold reader be able to reconstruct without oral rescue?"}
  ],
  "downloads": {
    "model": "/downloads/evidence-relationships/evidence-relationship-cold-reader-lab.json",
    "guide": "/downloads/evidence-relationships/evidence-relationship-cold-reader-guide.md",
    "worksheet": "/tools/evidence-relationship-record.md"
  }
}