{ "schema_version": "1.0", "program_id": "WACK-HIGHLIGHTS-0001", "name": "W/ Highlight Reels", "status": "active", "promise": "Short, sequenced routes through the governed library for readers who have a real PCI problem and do not need another disconnected post.", "cadence": "One anchor reel each month after the current publication runway, with actual release still gated by the lead record's exact-digest review and the owner's publication decision.", "boundary": "A highlight reel is a curated derivative over reviewed source records. It does not broaden the underlying claims, replace source review, decide PCI DSS compliance, or prove that a planned item was published.", "reels": [ { "id": "WACK-HIGHLIGHT-0001", "slug": "scope-is-a-living-relationship-story", "title": "Scope Is a Living Relationship Story", "headline": "Stop drawing a circle. Start preserving the relationships that make the circle defensible.", "question": "Can one changed identity, endpoint, provider, or deployment path reopen every affected scope artifact?", "takeaway": "Move from scope-by-spreadsheet to one traversable story across architecture, data flow, public presence, influence, ownership, and change.", "lead_content_id": "WACK-CONTENT-0116", "content_ids": [ "WACK-CONTENT-0116", "WACK-CONTENT-0120", "WACK-CONTENT-0132", "WACK-CONTENT-0091", "WACK-CONTENT-0021" ], "planned_at": "2027-03-02T08:15-07:00", "accent": "purple", "cta": "Trace one payment path across the five readings and mark the first relationship your current scope package cannot reproduce." }, { "id": "WACK-HIGHLIGHT-0002", "slug": "evidence-that-can-explain-itself", "title": "Evidence That Can Explain Itself", "headline": "A pile of authentic files can still fail to tell the assessment story.", "question": "Can a cold reviewer traverse one conclusion back to claim, subject, population, source, test, limitation, and decision?", "takeaway": "Treat evidence as attributable relationships and bounded facts—not folders, screenshots, or inherited green statuses.", "lead_content_id": "WACK-CONTENT-0168", "content_ids": [ "WACK-CONTENT-0168", "WACK-CONTENT-0164", "WACK-CONTENT-0131", "WACK-CONTENT-0129", "WACK-CONTENT-0107" ], "planned_at": "2027-04-06T08:15-07:00", "accent": "lime", "cta": "Choose one conclusion and run the backward trace before asking for another file." }, { "id": "WACK-HIGHLIGHT-0003", "slug": "the-provider-boundary-after-the-aoc", "title": "The Provider Boundary After the AOC", "headline": "The assurance packet begins the responsibility conversation. It does not end it.", "question": "Does the relied-upon service, feature, period, responsibility, customer configuration, and actual architecture match the packet?", "takeaway": "Turn vendor assurance into testable, service-specific claims while preserving retained customer infrastructure and decision authority.", "lead_content_id": "WACK-CONTENT-0128", "content_ids": [ "WACK-CONTENT-0128", "WACK-CONTENT-0099", "WACK-CONTENT-0100", "WACK-CONTENT-0022", "WACK-CONTENT-0158" ], "planned_at": "2027-05-04T08:15-07:00", "accent": "teal", "cta": "Select one relied-upon provider service and reconcile assurance, responsibility, consumption, customer action, and evidence." }, { "id": "WACK-HIGHLIGHT-0004", "slug": "testing-the-architecture-you-actually-have", "title": "Testing the Architecture You Actually Have", "headline": "The report is not the methodology, and the target list is not the attack surface.", "question": "Can the entity explain why every tested and untested population, perspective, role, interface, and limitation belongs in the conclusion?", "takeaway": "Derive testing from current propositions, populations, material variants, production representation, public exposure, constraints, and change.", "lead_content_id": "WACK-CONTENT-0117", "content_ids": [ "WACK-CONTENT-0117", "WACK-CONTENT-0118", "WACK-CONTENT-0121", "WACK-CONTENT-0159", "WACK-CONTENT-0115" ], "planned_at": "2027-06-01T08:15-07:00", "accent": "red", "cta": "Pick one test conclusion and reconstruct the methodology, population, limitation, and retest path that supports it." }, { "id": "WACK-HIGHLIGHT-0005", "slug": "operate-the-clock-not-the-checklist", "title": "Operate the Clock, Not the Checklist", "headline": "A control has to happen when required, survive failure, and leave an honest occurrence record.", "question": "Which timestamp proves the work operated in the required window rather than when evidence was finally requested?", "takeaway": "Join obligation, trigger, runbook, occurrence, failure, corrective action, evidence, and present-tense assessment without rewriting history.", "lead_content_id": "WACK-CONTENT-0170", "content_ids": [ "WACK-CONTENT-0170", "WACK-CONTENT-0103", "WACK-CONTENT-0142", "WACK-CONTENT-0113", "WACK-CONTENT-0126" ], "planned_at": "2027-07-06T08:15-07:00", "accent": "orange", "cta": "Cold-run one recurring activity and preserve the first late, failed, blocked, or ambiguous branch." }, { "id": "WACK-HIGHLIGHT-0006", "slug": "design-the-payment-boundary-before-the-launch", "title": "Design the Payment Boundary Before the Launch", "headline": "Zero revenue and stealth do not make deployed capability disappear.", "question": "Which current capability, identity, callback, secret, provider configuration, or support path makes the proposed boundary real today?", "takeaway": "Separate proposed, present, production-capable, and effective facts; design reversibility and evidence before customers arrive.", "lead_content_id": "WACK-CONTENT-0140", "content_ids": [ "WACK-CONTENT-0140", "WACK-CONTENT-0139", "WACK-CONTENT-0136", "WACK-CONTENT-0138", "WACK-CONTENT-0124" ], "planned_at": "2027-08-03T08:15-07:00", "accent": "purple", "cta": "Run the boundary gate on the current production-capable architecture before launch turns intent into operating fact." }, { "id": "WACK-HIGHLIGHT-0007", "slug": "admit-the-evidence-without-importing-the-conclusion", "title": "Admit the Evidence Without Importing the Conclusion", "headline": "Crosswalks, certifications, dashboards, and donor reports can contribute facts. Their conclusions do not inherit PCI authority.", "question": "What exact fact survives the receiving PCI claim's scope, population, period, procedure, result, limitation, and authority gates?", "takeaway": "Reuse evidence precisely, preserve residual testing, and keep applicability, assessment judgment, and recipient acceptance separate.", "lead_content_id": "WACK-CONTENT-0169", "content_ids": [ "WACK-CONTENT-0169", "WACK-CONTENT-0130", "WACK-CONTENT-0141", "WACK-CONTENT-0134", "WACK-CONTENT-0058" ], "planned_at": "2027-09-07T08:15-07:00", "accent": "lime", "cta": "Take one reused artifact through the seven admission gates and name the smallest residual PCI test." }, { "id": "WACK-HIGHLIGHT-0008", "slug": "one-question-three-cloud-dialects", "title": "One Question, Three Cloud Dialects", "headline": "Standardize the assessment contract. Preserve the provider difference.", "question": "Can one bounded claim cross AWS, Azure, and Google Cloud without collapsing resource, identity, evidence, responsibility, or time semantics?", "takeaway": "Use stable assessment identifiers at the core and provider-native resource and evidence identifiers at the edge.", "lead_content_id": "WACK-CONTENT-0171", "content_ids": [ "WACK-CONTENT-0171", "WACK-CONTENT-0108", "WACK-CONTENT-0109", "WACK-CONTENT-0122", "WACK-CONTENT-0160" ], "planned_at": "2027-10-05T08:15-07:00", "accent": "teal", "cta": "Build one cross-cloud translation record and mark every false equivalence, unknown population, and evidence limitation." } ] }