{ "model": { "rank": 2310, "code": "thing-q485", "model_id": "vr.tr.computer-virus", "name": "computer virus", "purpose": "Let an agent explain computer viruses for defensive and educational purposes, relay types, history, transmission and protection from cybersecurity sources, describe the named types and examples, and distinguish viruses from worms, trojans, ransomware and other malware, without providing any code or instructions to create or spread malware.", "family": "Thing Registry", "category": "Physical world and living systems", "status": "research-draft", "kind": "thing", "plane": "PHY", "domain": "PHY.OBJ", "industry": "", "version": "", "url": "/models/thing/q485/", "tier": 2, "score": 109, "payload": { "layer": "wikidata", "aliases": [ "joke virus", "HyperCard virus", "SWF.LFM.926", "resident virus", "boot sector virus", "AIDS", "A and A", "stealth virus", "iframe virus", "multipartite virus", "Macro virus", "polymorphic code", "Ripper", "Alcon", "AntiCMOS", "VBS.Avm" ], "aliasCount": 16, "merged": 17, "knownIn": 109, "facets": null, "markers": [], "lexicalClass": "", "senseRank": null, "alsoRegisteredAs": null, "source": { "dataset": "wikidata", "item": "Q485", "url": "https://www.wikidata.org/wiki/Q485", "license": "CC0 1.0" } }, "research": { "vercy": "1.0-draft", "publication": { "status": "research-draft", "adjudicationStatus": "unreviewed", "publishableCanonical": false, "generatedAt": "2026-09-14T01:37:39Z", "providers": [ "Claude" ], "breadth": "written by Claude from model knowledge without web access - no source was read, every claim is a lead to verify", "pass": 2, "wave": 4, "engine": "claude" }, "metaModel": { "id": "THING-Q485", "registryId": "vr.tr.computer-virus", "name": "computer virus", "version": "0.2.0-wave.4", "entryKind": "thing", "family": "Thing Registry", "domain": [ "PHY.OBJ" ], "status": "research-draft" }, "canonicalUrl": "https://ver.cy/models/thing/q485/", "model": { "registry_id": "vr.tr.computer-virus", "name": "computer virus", "purpose": "Let an agent explain computer viruses for defensive and educational purposes, relay types, history, transmission and protection from cybersecurity sources, describe the named types and examples, and distinguish viruses from worms, trojans, ransomware and other malware, without providing any code or instructions to create or spread malware.", "definition": "A type of malware that inserts its code into other programs or documents so that it replicates when the host runs, potentially damaging data, spreading through files, boot sectors or networks, and often carrying a payload; kinds the registry aliases name include boot sector viruses that infect disk startup areas, resident viruses that stay in memory, macro and HyperCard document viruses, joke viruses that are harmless pranks, and specific historical examples such as the AIDS trojan of 1989 and SWF.LFM.926. The model explains viruses for defence and education only and gives no instructions for creating or spreading malware; people should use reputable antivirus software and keep backups, and infected systems should be handled with official guidance.", "what_it_is_for": "Not applicable; malicious software, described for defence.", "affordances": [ "explain types and history", "relay transmission and protection", "describe named examples", "distinguish malware types" ], "distinguishing_features": [ "Requires a host", "Self-replicating", "May carry payloads", "Spreads on execution" ], "appearance": "Not visible; detected by antivirus tools and by symptoms such as corrupted files.", "visual_identification": [ "Self-replicating malicious code that infects host programs", "Joke virus, HyperCard virus, SWF.LFM.926, resident virus, boot sector virus, AIDS trojan", "Worms spread without a host; trojans disguise as legitimate software; ransomware encrypts files for ransom; spyware collects data" ], "physical_properties": [ { "quantity": "Creeper experiment", "typical_range": "1971", "unit": "note", "note": "early self-replicating program" }, { "quantity": "Brain boot sector virus", "typical_range": "1986", "unit": "year", "note": "early PC virus" }, { "quantity": "registry parents", "typical_range": "malware, digital organism", "unit": "note", "note": "" } ], "families_and_kinds": [ "boot sector viruses", "file infectors", "macro viruses", "resident viruses", "polymorphic viruses" ], "related_models": [ { "relation": "is a kind of", "target": "malware", "why": "in registry terms" }, { "relation": "is contrasted with", "target": "computer worm", "why": "" }, { "relation": "is contrasted with", "target": "trojan horse", "why": "" }, { "relation": "is detected by", "target": "antivirus software", "why": "" } ], "identifiers": [], "standards_and_regulation": [ "Computer misuse and cybercrime laws", "Data protection breach notification rules" ], "failure_modes_and_hazards": [ "Data loss and system damage", "Providing malware instructions", "Spread through removable media and email" ], "in_scope": [], "out_of_scope": [], "characteristics": [] }, "sources": [], "structure": { "bundles": [ { "id": "understand", "name": "Understand", "description": "What a computer virus is.", "rationale": "Definition.", "layers": [ { "id": "definition", "name": "Definition", "description": "Definition.", "findings": [ { "id": "definition-finding", "name": "Definition", "description": "Definition.", "questions": [ { "text": "Is a device infected or showing ransom demands, in which case disconnect it, seek official guidance and do not pay ransoms without advice?", "kind": "boundary" }, { "text": "What is a computer virus, and how does it differ from worms, trojans, ransomware and spyware?", "kind": "definition" } ] } ] }, { "id": "types", "name": "Types", "description": "Named types.", "findings": [ { "id": "types-finding", "name": "Types", "description": "Types.", "questions": [ { "text": "What are boot sector, resident, macro and joke viruses, and what were the AIDS trojan and SWF.LFM.926?", "kind": "definition" }, { "text": "Is any request to create or spread malware refused?", "kind": "boundary" } ] } ] } ] }, { "id": "history", "name": "History", "description": "History.", "rationale": "Sources.", "layers": [ { "id": "early", "name": "Early viruses", "description": "Early viruses.", "findings": [ { "id": "early-finding", "name": "Early viruses", "description": "Early viruses.", "questions": [ { "text": "How did early viruses such as Brain and the Morris worm shape the field?", "kind": "provenance" }, { "text": "Which references are standard?", "kind": "provenance" } ] } ] }, { "id": "evolution", "name": "Evolution", "description": "Modern malware.", "findings": [ { "id": "evolution-finding", "name": "Evolution", "description": "Evolution.", "questions": [ { "text": "How has malware shifted from viruses to worms, botnets and ransomware?", "kind": "provenance" }, { "text": "Which sources are cited?", "kind": "provenance" } ] } ] } ] }, { "id": "defence", "name": "Defence", "description": "Protection.", "rationale": "Regulation.", "layers": [ { "id": "protection", "name": "Protection", "description": "Protection measures.", "findings": [ { "id": "protection-finding", "name": "Protection", "description": "Protection.", "questions": [ { "text": "How do antivirus software, updates and backups protect systems?", "kind": "action" }, { "text": "Is the information current?", "kind": "boundary" } ] } ] }, { "id": "response", "name": "Response", "description": "Incident response.", "findings": [ { "id": "response-finding", "name": "Response", "description": "Response.", "questions": [ { "text": "What steps do official guides recommend after infection?", "kind": "provenance" }, { "text": "Which entry fits incident response?", "kind": "action" } ] } ] } ] }, { "id": "context", "name": "Context", "description": "Detection.", "rationale": "Science.", "layers": [ { "id": "detection", "name": "Detection", "description": "Detection methods.", "findings": [ { "id": "detection-finding", "name": "Detection", "description": "Detection.", "questions": [ { "text": "How do signature and behaviour-based detection work?", "kind": "provenance" }, { "text": "Which entry fits antivirus software?", "kind": "action" } ] } ] }, { "id": "law", "name": "Law", "description": "Cybercrime law.", "findings": [ { "id": "law-finding", "name": "Law", "description": "Law.", "questions": [ { "text": "How do laws treat creating and spreading malware?", "kind": "provenance" }, { "text": "Is the presentation neutral and attributed?", "kind": "boundary" } ] } ] } ] } ] }, "openQuestions": [ "Should the AIDS trojan be reclassified, since it is a trojan rather than a virus?", "Should macro viruses be a separate entry?", "How should malware taxonomy sources be linked?" ], "statistics": { "bundles": 4, "layers": 8, "findings": 8, "questions": 16 } }, "draft": { "generator": "vr.draft.v3", "status": "draft-generated", "researched": false, "archetype": "device, machine or tool", "method": "Written from the archetype playbook - what this kind of thing needs beyond identity and provenance - and from the structure that recurred across 6,333 models already researched by two engines. Applied to this entry by rule. No source was read for this thing and no claim here is researched. This entry carries no facets of its own, so they were inferred from its domain - a guess about a whole domain applied to one thing.", "facetsInferred": true, "nextPass": "A researcher replaces this draft with a sourced specification. Treat every sentence below as a proposal to argue with.", "purpose": "Give an agent a durable, checkable way to recognise a computer virus, record what state it is in, and decide what may be done with it.", "whatItIs": "Let an agent explain computer viruses for defensive and educational purposes, relay types, history, transmission and protection from cybersecurity sources, describe the named types and examples, and distinguish viruses from worms, trojans, ransomware and other malware, without providing any code or instructions to create or spread malware.", "characteristics": { "substance": "material", "origin": "manufactured", "agency": "inert", "mobility": "varies" }, "whatYouCanDoWithIt": [ "observed and measured" ], "distinguishingFeatures": [ "Names folded into this entry, which a task may need to split apart again: joke virus, HyperCard virus, SWF.LFM.926, resident virus, boot sector virus, AIDS, A and A, stealth virus, iframe virus, multipartite virus, Macro virus, polymorphic code.", "17 finer distinctions are held as aliases rather than separate entries, because telling them apart needs a task that asks for it.", "Described in 109 Wikipedia languages, which is a measure of how widely the thing is known, not of how important it is." ], "openQuestionsForResearch": [ "Which of the bundles below does a real task actually need, and which are ceremony?", "What does this thing have that the facets do not capture at all?", "Which neighbouring kind is most often confused with a computer virus, and on what evidence are they told apart?" ], "whatItIsMadeOf": "matter you can touch", "physicalCharacter": [ "Mobility varies between examples.", "Does nothing on its own; everything it does, something else did to it.", "These come from the domain this entry sits in rather than from the entry itself, so treat them as a first guess about the whole domain applied to one thing." ], "whatCanBeDoneWithIt": [ "observe it, measure it, record its state" ], "howItIsRecognised": [ "Recognised by form, by the arrangement of its controls, and by markings - a plate, a model number, a certification mark. Form alone rarely separates two models that do very different things." ], "relatedModels": [ { "relation": "covers", "note": "Finer kinds folded into this entry because telling them apart needs a task that asks for it. Each is a model waiting to be split out when one does.", "targets": [ "joke virus", "HyperCard virus", "SWF.LFM.926", "resident virus", "boot sector virus", "AIDS", "A and A", "stealth virus", "iframe virus", "multipartite virus", "Macro virus", "polymorphic code" ] } ], "standing": "Described in 109 Wikipedia languages, which measures how widely it is written about rather than how important or how common it is. 17 finer distinctions are held inside this entry as names rather than as separate models.", "structure": { "bundles": [ { "id": "identity-and-classification", "name": "Identity, naming and classification", "description": "How an agent tells one computer virus from another, and a computer virus from things that resemble it.", "rationale": "Recognition comes before every other claim. Without stable identity nothing else in the model can be trusted to be about the same thing twice.", "layers": [ { "id": "naming-and-identifiers", "name": "Names and identifiers", "description": "The names this thing goes by and the identifiers that survive translation and time.", "findings": [ { "id": "preferred-name-and-aliases", "name": "Preferred name, aliases and local names", "description": "Which name to use, which names mean the same thing, and which merely sound similar.", "questions": [ { "id": "preferred-name-and-aliases-q01", "text": "What identifies and describes the name of a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "preferred-name-and-aliases-q02", "text": "Who or what asserted this about the name of a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "preferred-name-and-aliases-q03", "text": "What may an agent decide or do once the name of a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] }, { "id": "stable-identifiers", "name": "Stable identifiers and external keys", "description": "Identifiers that keep pointing at this kind of thing across systems and languages.", "questions": [ { "id": "stable-identifiers-q01", "text": "What identifies and describes an identifier for a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "stable-identifiers-q02", "text": "Who or what asserted this about an identifier for a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "stable-identifiers-q03", "text": "What may an agent decide or do once an identifier for a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "classification-and-granularity", "name": "Classification and granularity", "description": "Where a computer virus sits among kinds, and how finely a task needs to cut it.", "findings": [ { "id": "kind-and-parents", "name": "Kind, parents and neighbouring kinds", "description": "The classes this thing belongs to and the ones it is next to.", "questions": [ { "id": "kind-and-parents-q01", "text": "What identifies and describes the kind of a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "kind-and-parents-q02", "text": "Who or what asserted this about the kind of a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "kind-and-parents-q03", "text": "What may an agent decide or do once the kind of a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] }, { "id": "distinguishing-features", "name": "Distinguishing features", "description": "What separates a computer virus from the things most often confused with it.", "questions": [ { "id": "distinguishing-features-q01", "text": "What identifies and describes what distinguishes a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "distinguishing-features-q02", "text": "Who or what asserted this about what distinguishes a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "distinguishing-features-q03", "text": "What may an agent decide or do once what distinguishes a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] }, { "id": "form-and-composition", "name": "Form, composition and condition", "description": "What a computer virus is made of, what shape and size it takes, and what state it is in.", "rationale": "A physical thing can be measured, and a model that cannot record its measurements cannot support any decision that depends on them.", "layers": [ { "id": "form-and-dimensions", "name": "Form and dimensions", "description": "Shape, size, mass and the ranges these take across examples.", "findings": [ { "id": "measurable-dimensions", "name": "Measurable dimensions and their units", "description": "The quantities worth recording and the units they are recorded in.", "questions": [ { "id": "measurable-dimensions-q01", "text": "What identifies and describes the dimensions of a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "measurable-dimensions-q02", "text": "Who or what asserted this about the dimensions of a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "measurable-dimensions-q03", "text": "What may an agent decide or do once the dimensions of a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "material-and-composition", "name": "Material and composition", "description": "Materials, parts and how they are put together.", "findings": [ { "id": "parts-and-materials", "name": "Parts and materials", "description": "What a computer virus is built from and which parts are replaceable.", "questions": [ { "id": "parts-and-materials-q01", "text": "What identifies and describes the composition of a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "parts-and-materials-q02", "text": "Who or what asserted this about the composition of a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "parts-and-materials-q03", "text": "What may an agent decide or do once the composition of a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "condition-and-integrity", "name": "Condition and integrity", "description": "Wear, damage, health and the difference between working and broken.", "findings": [ { "id": "condition-assessment", "name": "Condition, damage and health", "description": "How the condition of a computer virus is judged and by whom.", "questions": [ { "id": "condition-assessment-q01", "text": "What identifies and describes the condition of a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "condition-assessment-q02", "text": "Who or what asserted this about the condition of a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "condition-assessment-q03", "text": "What may an agent decide or do once the condition of a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] }, { "id": "place-and-movement", "name": "Place and movement", "description": "Where a computer virus is, how it got there and where it may go (varies).", "rationale": "A thing that can move needs its position recorded with a time, or every later claim about it is about a place it has left.", "layers": [ { "id": "location-and-placement", "name": "Location and placement", "description": "Position, containment and the reference frame the position is given in.", "findings": [ { "id": "position-and-frame", "name": "Position, container and reference frame", "description": "Where a computer virus is, and what that position is measured against.", "questions": [ { "id": "position-and-frame-q01", "text": "What identifies and describes the location of a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "position-and-frame-q02", "text": "Who or what asserted this about the location of a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "position-and-frame-q03", "text": "What may an agent decide or do once the location of a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "movement-and-transfer", "name": "Movement and transfer", "description": "How a computer virus is carried, installed or relocated.", "findings": [ { "id": "movement-events", "name": "Movement events and constraints", "description": "What counts as a movement, what records it and what limits it.", "questions": [ { "id": "movement-events-q01", "text": "What identifies and describes the movement of a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "movement-events-q02", "text": "Who or what asserted this about the movement of a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "movement-events-q03", "text": "What may an agent decide or do once the movement of a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] }, { "id": "state-and-lifecycle", "name": "State and lifecycle", "description": "The states a computer virus passes through and the events that move it between them.", "rationale": "Most decisions about a thing depend on what state it is in now, which is a claim with a time on it, not a property.", "layers": [ { "id": "lifecycle-stages", "name": "Lifecycle stages", "description": "From coming into existence to ceasing to be one of these.", "findings": [ { "id": "stages-and-transitions", "name": "Stages and transitions", "description": "The stages worth naming and what moves a computer virus between them.", "questions": [ { "id": "stages-and-transitions-q01", "text": "What identifies and describes the lifecycle of a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "stages-and-transitions-q02", "text": "Who or what asserted this about the lifecycle of a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "stages-and-transitions-q03", "text": "What may an agent decide or do once the lifecycle of a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "observations-and-status", "name": "Observations and current status", "description": "What is observed about a computer virus, how often and by whom.", "findings": [ { "id": "observation-record", "name": "Observation record", "description": "How an observation of a computer virus is recorded so that it can be superseded rather than overwritten.", "questions": [ { "id": "observation-record-q01", "text": "What identifies and describes an observation of a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "observation-record-q02", "text": "Who or what asserted this about an observation of a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "observation-record-q03", "text": "What may an agent decide or do once an observation of a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] }, { "id": "function-and-principle", "name": "Function and operating principle", "description": "What computer virus is for and how it achieves it.", "rationale": "Two devices with the same name can work on different principles, and the principle is what predicts failure and constrains use.", "layers": [ { "id": "intended-function", "name": "Intended function", "description": "The job it does, and the jobs it is used for anyway.", "findings": [ { "id": "function-record", "name": "Function, principle and variants", "description": "What it does, how, and which variants do it differently.", "questions": [ { "id": "function-record-q01", "text": "What function does computer virus perform, on what operating principle, and which variants differ in that principle?", "kind": "definition" }, { "id": "function-record-q02", "text": "What use falls outside the intended function but happens in practice?", "kind": "boundary" } ] } ] }, { "id": "capacity-and-rating", "name": "Capacity and rating", "description": "The numbers that say what it can do and where it stops.", "findings": [ { "id": "ratings", "name": "Ratings and their conditions", "description": "Rated capacity, power, throughput and the conditions each assumes.", "questions": [ { "id": "ratings-q01", "text": "What ratings characterise computer virus, in what units, and under what stated conditions?", "kind": "measurement" }, { "id": "ratings-q02", "text": "What happens beyond the rating - degradation, refusal, damage - and how is that detected?", "kind": "action" } ] } ] } ] }, { "id": "operation-and-state", "name": "Operation, controls and state", "description": "How computer virus is operated and what state it is in right now.", "rationale": "An agent acting on a device needs its current state and the controls that change it, not just its specification.", "layers": [ { "id": "controls-and-modes", "name": "Controls and modes", "description": "What can be set, what that changes, and what is interlocked.", "findings": [ { "id": "control-surface", "name": "Control surface and interlocks", "description": "The settings available and the conditions that block them.", "questions": [ { "id": "control-surface-q01", "text": "What controls and modes does computer virus have, and what does each change?", "kind": "definition" }, { "id": "control-surface-q02", "text": "Which actions are interlocked or forbidden in which state, and what must be true before acting?", "kind": "action" } ] } ] }, { "id": "condition-and-maintenance", "name": "Condition and maintenance", "description": "Wear, service intervals, consumables and the line between working and broken.", "findings": [ { "id": "service-record", "name": "Condition, service and consumables", "description": "What is consumed, what is serviced, and how condition is judged.", "questions": [ { "id": "service-record-q01", "text": "What consumables and service does computer virus need, at what interval, and on whose authority?", "kind": "measurement" }, { "id": "service-record-q02", "text": "What evidence separates a unit that is working from one that is out of service?", "kind": "boundary" } ] } ] } ] }, { "id": "kind-model-unit", "name": "Kind, model and unit", "description": "Whether a claim about computer virus is about the kind, a product line, or one physical unit.", "rationale": "This is the boundary most often got wrong for made things, and getting it wrong mixes a catalogue entry with the machine in the yard.", "layers": [ { "id": "level-of-reference", "name": "Level of reference", "description": "The three levels and what belongs at each.", "findings": [ { "id": "level-rules", "name": "What belongs to kind, model and unit", "description": "Which properties are shared by all of them and which are not.", "questions": [ { "id": "level-rules-q01", "text": "Which facts about computer virus hold for every one of them, which for a model, and which only for one unit?", "kind": "boundary" }, { "id": "level-rules-q02", "text": "What identifies an individual unit, and what should an agent do when it has only the kind?", "kind": "action" } ] } ] }, { "id": "standards-and-conformity", "name": "Standards and conformity", "description": "The standards a working example must meet and who attests it.", "findings": [ { "id": "conformity", "name": "Standards, marks and attestation", "description": "Which standard applies, who certifies, and what the mark means.", "questions": [ { "id": "conformity-q01", "text": "Which standards govern computer virus, issued by whom, and what does conformity actually assert?", "kind": "provenance" }, { "id": "conformity-q02", "text": "What may an agent conclude from a certification mark, and what may it not?", "kind": "boundary" } ] } ] } ] }, { "id": "provenance-and-evidence", "name": "Provenance, evidence and time", "description": "Where every claim about a computer virus came from and when it held.", "rationale": "A claim without a source and a time cannot be superseded, only overwritten, and an agent that overwrites loses the ability to explain itself.", "layers": [ { "id": "source-and-authority", "name": "Source and authority", "description": "Who said it, on what evidence, and how strongly.", "findings": [ { "id": "claim-provenance", "name": "Claim provenance and confidence", "description": "The authority behind each claim about a computer virus and how confident it is.", "questions": [ { "id": "claim-provenance-q01", "text": "What identifies and describes a claim about a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "claim-provenance-q02", "text": "Who or what asserted this about a claim about a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "claim-provenance-q03", "text": "What may an agent decide or do once a claim about a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "time-and-versions", "name": "Time, versions and supersession", "description": "When a claim was true, when it was learnt, and what replaced it.", "findings": [ { "id": "validity-and-supersession", "name": "Validity period and supersession", "description": "How an old claim about a computer virus is retired without being erased.", "questions": [ { "id": "validity-and-supersession-q01", "text": "What identifies and describes the validity of a claim about a computer virus, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "validity-and-supersession-q02", "text": "Who or what asserted this about the validity of a claim about a computer virus, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "validity-and-supersession-q03", "text": "What may an agent decide or do once the validity of a claim about a computer virus is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] } ] }, "statistics": { "bundles": 8, "layers": 17, "findings": 19, "questions": 51 } } } }