Cyber Research Library v3.4Evidence-gated roadmap

v3.4 · evidence before expansion

A roadmap with gates, not guesses.

This page separates what is available now from work that still depends on evidence, quality, rights, or source availability. No calendar date is promised where an external event controls readiness.

Corpus
5,090
Future
30
Non-corpus
7,185
Searchable
12,305
Words
13,323,933

Available in this release

Shipped in v3.4

v3.4 is a presentation and release-integrity update over the frozen corpus. The searchable payload and all five headline KPIs remain unchanged.

01

First-class public roadmap

A responsive, keyboard-accessible roadmap now sits beside simple and advanced search. It identifies completed behavior, gated work, operating rules, measurable acceptance gates, and every unresolved Future reference.

02

Consistent v3.4 identity

Page chrome and public machine-readable release metadata identify the release as v3.4, with v3.4.0 used for semantic versioning.

03

Frozen search parity

Corpus records, Future records, Non-corpus records, full-text shards, and search behavior are carried forward without corpus expansion.

04

Portable by design

The public application remains a static, offline-capable release with local assets and no remote runtime dependency.

Active maintenance

Now

Work that can proceed without waiting for an external publication, permission, or endpoint recovery.

Preserve release invariants

  • Keep stable record identities and append-only lifecycle history.
  • Prove payload-to-interface parity for collection-qualified counts and effective rights decisions.
  • Reject silent deletion, identity reuse, and destructive correction.

Strengthen search evidence

  • Maintain exact phrase, field, exclusion, identifier, source, author, date, entity, and collection behavior.
  • Improve match explanations and passage highlighting without silently broadening exact searches.
  • Maintain representative acceptance queries for OT/ICS, standards, legislation, vulnerabilities, and advisories.

Close operational gaps

  • Refresh source coverage denominators and known-gap statements before corpus claims change.
  • Automate effective replacement, fork, parent/body, rename, suppression, and withdrawn-state checks.
  • Keep metadata-only records free of body text, excerpts, hidden content fields, content hashes, and full-text affordances.

Begins when gates pass

Next

These capabilities are planned, not shipped. Each moves only after its prerequisite evidence and acceptance checks pass.

  1. 01

    Passage-level evidence navigation

    Stable block anchors, highlighted match passages, source/version context, and copyable citations. Gate: stable normalized blocks and citation round-trip tests.

  2. 02

    Research workspace

    A temporary evidence tray, comparison of two to six records, and citation export in transparent formats. Gate: keyboard-complete workflows, export validation, and no mutation of source evidence.

  3. 03

    Coverage and change views

    Source coverage, known gaps, entity timelines, and version-to-version change views. Gate: defensible denominators, explicit confidence, and evidence-addressable relationships.

  4. 04

    Event-dependent promotions

    Promote a Future record only after its listed final-publication, rights-grant, or endpoint-recovery trigger occurs and the full promotion gate passes.

Uncommitted exploration

Later

Separate discovery and scope approval are required. These are not fallback tasks for the current release.

Transparent related-record signals

Shared entities and topics first; semantic similarity only as a separately labeled signal after retrieval quality is proven.

Optional AI assistance

Grounded synthesis may be evaluated only after citation quality, passage retrieval, provenance, and evaluation datasets are mature. Source language must remain distinguishable from generated analysis.

Accounts and personalization

Saved work, sharing, and collaboration require a separate privacy, security, retention, and product scope decision.

Broader source growth and redesign

Unrelated source-family expansion and major visual redesign require their own evidence, priorities, capacity, and release locks.

Non-negotiable

Operating principles

Preserve

Keep source identity stable. Record changes as versions, relationships, and lifecycle events.

Trace

Make transformations reproducible and attach analysis to specific evidence and methods.

Fail closed

When rights, identity, or quality evidence is incomplete, publish metadata only or hold the record.

Separate layers

Keep raw capture, normalized source material, and derived analysis distinct.

Qualify claims

State collection scope, denominators, known gaps, and confidence; do not imply exhaustiveness.

Stay portable

Keep public static and offline outputs independently usable, private by default, and free of remote runtime requirements.

Definition of ready

Measurable release gates

A future release is publishable only when every applicable gate passes. A failed gate blocks the release rather than becoming a known-good exception.

GatePass condition
Data integrityZero silent deletions; stable IDs; exact expected count deltas; database integrity and foreign-key checks pass where a database is in scope.
Rights and privacyZero prohibited body, excerpt, content-hash, retained-path, private-name, or source-path leaks; uncertain records fail closed.
Search qualityAt least 80% success on the fixed representative-query benchmark; intentional exact-search misses excluded from a below-10% zero-result target.
PerformanceSearch response at or below 200 ms after input debounce at the 75th percentile; initial usable view at or below 2.5 seconds on the defined broadband profile.
AccessibilityNo critical accessibility violations; all priority keyboard workflows pass; focus, labels, contrast, reduced-motion, 320 px, 390 px, tablet, and desktop checks pass without horizontal overflow.
ParityPublic database, static site, offline application, manifests, and search shards agree on eligible identities, payloads, counts, and release identity for every output actually shipped.
ReproducibilityClean rebuilds are deterministic; tree hashes match; replay writes zero unexpected rows; checksums and machine-readable validation evidence are complete.
PromotionArtifact, identity, rights, duplicate, quality, analysis, and explicit authorization gates all pass before a Future record enters the Corpus.

30 event-dependent holds

Final Future registry

All 30 records remain body-free and non-promotable in v3.4. A trigger reopens review; it does not automatically authorize publication. Promotion still requires artifact, identity, rights, duplicate, quality, analysis, and explicit authorization gates.

16 references

PERA final-publication triggers

Trigger: PERA publishes an authoritative final version. Current drafts are review material, not authoritative final publications.

  1. 01ACS Architecture Levels (Process Industry)
  2. 02Structure of ISA/IEC 62443 documents
  3. 03Combining Cybersecurity and SIS/SIL Safety Standards
  4. 04Cybersecure PLC and RTU Operation
  5. 05Cybersecure Modifications and Upgrades for PLCs and RTUs
  6. 06Response to Control System Cyber Incidents
  7. 07Level 1 & 2 Field Device and Network Design
  8. 08PERA User Guide — Preparing a Corporate Cybersecurity Master Plan for a Process Industry Owner/Operator
  9. 09PERA User Guide — Implementing a Corporate Cybersecurity Master Plan (EPC-led)
  10. 10PERA User Guide — Operations & Maintenance phases (Phase 6 to 8)
  11. 11PERA User Guide — Preparing an IACS / OT Project Master Plan
  12. 12PERA User Guide 1-2-1 (Vendor variant of the Corporate Cybersecurity Master Plan guide)
  13. 13PERA User Guide 1-3-1 (EPC contractor variant)
  14. 14PERA User Guide 1-4-1 (Service provider variant)
  15. 15Cyber-section copy of the Corporate Cybersecurity Master Plan user guide
  16. 16Cyber-section copy of the IACS/OT Project Master Plan guide

7 references

Rights-grant triggers

Trigger: the publisher issues an explicit artifact-wide reuse grant or identifies separable text that is clearly permitted.

  1. 01FFIEC Cybersecurity Assessment Tool (May 2017)
  2. 02Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP) — Main Document
  3. 03Maritime Cybersecurity Assessment and Annex Guide (MCAAG), January 2023
  4. 04NIPP — Sector-Specific Plan — Information Technology (2010)
  5. 05Cybersecurity Risk Management Process Guideline
  6. 06NISTIR-7628 — Guidelines for Smart Grid Cyber Security (consolidated) Rev. 1
  7. 07NISTIR-8183A-1 — CSF Manufacturing Profile — Low Security Level — Example Implementation Guide — Vol. 2

7 references

Endpoint-recovery triggers

Trigger: the official endpoint becomes retrievable or the publisher supplies an exact, stable artifact.

  1. 01SB 7020: OGSR/Agency Cybersecurity Information
  2. 02Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024
  3. 03Cybersecurity for Critical Infrastructure Protection (GAO) (2004)
  4. 04Cyber Threat Report 2015
  5. 05Strategies to Mitigate Cyber Security Incidents 2017 — Details
  6. 06Advanced Cyber ICS Tactics, Techniques, and Procedures for DoD ICS
  7. 07Cyberattack Impacts MTSA Facility Operations