{
 "about": "What the risk graph is missing, as rules. Each rule names the nodes it looks at (of), what each should reach (a kind of node, within so many steps, through which verbs, if named), and who could close a gap. The build computes every rule on every release and writes /grc/gaps/; add a rule here and it appears there. Kept by dev@php.newsroom and the GRC desk.",
 "rules": [
  {
   "id": "control-no-test",
   "of": "control",
   "reach": [
    "test",
    "code"
   ],
   "within": 3,
   "title": "Controls joined to no code or test that implements them",
   "why": "A security requirement with nothing that implements or exercises it. Today every control is joined only through the risks it governs, so none is shown to be implemented or tested.",
   "close": "grc",
   "verbs": [
    "tests",
    "realised_in",
    "located_in",
    "implemented_by"
   ]
  },
  {
   "id": "code-no-owner",
   "of": "code",
   "reach": [
    "stakeholder",
    "member",
    "role"
   ],
   "within": 1,
   "title": "Code with no owner one step away",
   "why": "A file that matters to a risk with nobody named against it.",
   "close": "grc"
  },
  {
   "id": "code-no-test",
   "of": "code",
   "reach": "test",
   "within": 2,
   "title": "Code no test reaches",
   "why": "Changed or named code with no test joined through its remediation.",
   "close": "dev",
   "verbs": [
    "realised_in",
    "tests"
   ]
  },
  {
   "id": "risk-no-story",
   "of": "risk",
   "reach": "story",
   "within": 1,
   "title": "Risks no story tells",
   "why": "A risk on the register that no story on the site explains to a reader.",
   "close": "journalist"
  },
  {
   "id": "risk-no-treatment",
   "of": "risk",
   "reach": "treatment",
   "within": 1,
   "title": "Risks with no treatment",
   "why": "A risk with nothing recorded that reduces it.",
   "close": "grc"
  },
  {
   "id": "risk-no-owner",
   "of": "risk",
   "reach": [
    "stakeholder",
    "role"
   ],
   "verbs": [
    "owned_by"
   ],
   "within": 1,
   "title": "Risks with no owner",
   "why": "A risk nobody holds.",
   "close": "grc"
  },
  {
   "id": "vulnerability-no-test",
   "of": "vulnerability",
   "reach": "test",
   "within": 2,
   "title": "Vulnerabilities no test reaches",
   "why": "A flaw whose fix nobody can show is tested.",
   "close": "dev"
  },
  {
   "id": "edges-inferred",
   "of": "edge",
   "basis": "inferred",
   "title": "Edges inferred by an agent, not yet checked",
   "why": "A join an agent made that nobody has checked against a source, the code or a person.",
   "close": "grc"
  }
 ]
}