assured development evidence

CHANGELOG.md

@@ -5,6 +5,56 @@ Notable changes to the ASSURED methodology and its site. The format follows
 follow the policy in [GOVERNANCE.md](GOVERNANCE.md). The current version is
 stamped in the site footer.
 
+## [Unreleased]
+
+### Added
+
+- A "Development and evidence" page documenting the author's path into
+  event triage, the AUSPICED precursor, the structural redesign into
+  ASSURED, applied use in the Lateral Work Program, the practitioner design
+  loop, current evidence limits, and a concrete validation roadmap.
+- Investigation Theory and Chris Sanders's public research to the
+  related-work map, including the derivation method behind the
+  Ambiguity-Driven Convergence model and the 2021 dissertation *The
+  Analyst Mindset*.
+- A falsification section on the development page ("What would count
+  against ASSURED") naming the observations that would force the
+  teachability, phase-decomposition, depth-ladder, and generalization
+  claims to change.
+- A plain conflict-of-interest statement and an account of how early
+  feedback reached the framework: no systematic log, mentoree
+  clarifications folded in while teaching, and daily use on the author's
+  own case queue.
+- The program's approximate scale (around a dozen participants) and the
+  dated development timeline, from the October 2023 AUSPICED draft through
+  the 2026 releases.
+- A build gate that fails when the README version badge disagrees with
+  package.json, plus contract pins for the corrected AUSPICED expansion
+  and the falsification section.
+
+### Changed
+
+- Replaced the universal absence claim in "Where ASSURED sits" with a
+  narrower, inspectable contribution claim: ASSURED is one open, named,
+  versioned operational workflow with explicit phase outputs and a
+  close-or-escalate boundary.
+- Corrected the AUSPICED record against the surviving October 2023 draft:
+  the E stood for Enrichment, not Escalation, the precursor named no
+  escalation or risk stage, and it never reached testing; the redesign
+  table now maps all eight original parts.
+- Strengthened the validation roadmap: the scoring rubric will be frozen
+  publicly before any pre/post assessment, and at least one scorer will
+  come from outside the program.
+- Recast outcome wording in the README tagline and the introduction's
+  framing callout as design intent, and adopted Sanders's own
+  "vendor-agnostic" phrasing in the related-work map.
+- Expanded the README author history and linked the public provenance and
+  evidence record.
+
+### Fixed
+
+- The README version badge, stale at 1.1.0 since the 1.2.0 release.
+
 ## [1.2.0] - 2026-07-16
 
 The assurance release: a full accuracy, accessibility, and release-assurance

README.md

@@ -1,8 +1,8 @@
 # ASSURED Cybersecurity Methodology
 
-> **A structured, repeatable methodology for security analysts to triage, investigate, and document events with clarity, context, and confidence.**
+> **A structured methodology designed to help security analysts triage, investigate, and document events with clarity, context, and confidence.**
 
-[![Version](https://img.shields.io/badge/Version-1.1.0-blue.svg)](CHANGELOG.md)
+[![Version](https://img.shields.io/badge/Version-1.2.0-blue.svg)](CHANGELOG.md)
 [![Code License: MIT](https://img.shields.io/badge/Code-MIT-yellow.svg)](LICENSE)
 [![Content License: CC BY 4.0](https://img.shields.io/badge/Content-CC%20BY%204.0-lightgrey.svg)](LICENSE-CONTENT)
 [![Documentation](https://img.shields.io/badge/Documentation-Live-blue.svg)](https://assured-methodology.vercel.app)
@@ -87,9 +87,15 @@ This repository uses a dual license:
 
 The methodology is versioned: the current version is stamped in the site footer, releases are recorded in [CHANGELOG.md](CHANGELOG.md), and the bump rules (what counts as a major vs. minor change) live in [GOVERNANCE.md](GOVERNANCE.md). To cite ASSURED in training material, research, or documentation, use [CITATION.cff](CITATION.cff) (GitHub renders it as APA/BibTeX under "Cite this repository").
 
+## 🧭 Development and evidence
+
+The public [Development and evidence](https://assured-methodology.vercel.app/docs/development/) page records the framework's provenance: the author's path into event triage, the AUSPICED precursor and why it was replaced, the redesign into ASSURED, its use in a workplace lateral-development program, the limits of the evidence available today, and the observations that would count against the framework's claims. ASSURED is practice-derived and in active use; it has not yet been evaluated through a controlled or comparative study.
+
 ## 👨‍💻 About the Author
 
-**Timothy Zilber** is a security engineer specializing in event triage and incident response. ASSURED grew out of his experience mentoring analysts through a workplace lateral-development program: teaching event triage exposed the lack of a clear, repeatable methodology for it. Existing frameworks covered incident response at a high level but not the alert-by-alert analysis work that precedes it. ASSURED is the structured method that came out of years of iterating on that training, shared here so the gap he had to cross informally is easier for the next analyst.
+**Timothy Zilber** is a security engineer specializing in event triage and incident response. After leaving the Army, he moved through IT support, network engineering in support of the Defense Information Systems Agency, and physical security systems administration before entering security operations through mentorship and an hour-a-day lateral-work arrangement. He later created a formal Lateral Work Program to make that kind of supervised opportunity available to others.
+
+ASSURED began during parental leave after the birth of his second child, while he was comparing incident-response literature with the alert-by-alert work of event triage. Its first form, AUSPICED, fell apart during writing and never reached use; it was replaced by the seven-phase ASSURED structure. Timothy now teaches ASSURED through the Lateral Work Program and maintains it as an open practitioner methodology.
 
 - 💼 **LinkedIn**: [timothy-zilber](https://linkedin.com/in/timothy-zilber)
 - 📧 **Email**: [tzilber@block.xyz](mailto:tzilber@block.xyz)

scripts/check-content-contracts.mjs

@@ -26,6 +26,37 @@ const ROOT = new URL("..", import.meta.url).pathname;
  * ordered: [earlier, later] — both must appear, in that order.
  */
 const CONTRACTS = [
+  {
+    id: "development-evidence",
+    file: "src/content/docs/development.mdx",
+    why: "the provenance page must preserve the AUSPICED history, the empirical-evidence limit, and the falsification criteria",
+    mustContain: [
+      "The first attempt was **AUSPICED**",
+      "has not yet been evaluated through a controlled or comparative study",
+      "Investigation Theory",
+      "What would count against ASSURED",
+      "The Analyst Mindset",
+    ],
+  },
+  {
+    id: "auspiced-expansion",
+    file: "src/content/docs/development.mdx",
+    why: "per the October 2023 draft, AUSPICED's E was Enrichment; it named no escalation phase",
+    mustContain: ["| E | Enrichment |"],
+    mustNotContain: ["| E | Escalation |"],
+  },
+  {
+    id: "related-work-investigation-theory",
+    file: "src/content/docs/positioning.mdx",
+    why: "the related-work map must credit Investigation Theory and avoid a universal absence claim",
+    mustContain: [
+      "Investigation Theory and Chris Sanders's public work",
+      "a universal claim that no other methodology exists cannot",
+    ],
+    mustNotContain: [
+      "no widely adopted, named, freely available, public methodology specific to event triage exists",
+    ],
+  },
   {
     id: "ai-admission-gate",
     file: "src/content/docs/ai-triage.mdx",
@@ -168,6 +199,19 @@ const CONTRACTS = [
   },
 ];
 
+// Computed contract: the README version badge must track package.json, the
+// source of truth for the released version, so the repo's front door never
+// misstates which methodology version is current.
+const pkgVersion = JSON.parse(
+  readFileSync(join(ROOT, "package.json"), "utf8"),
+).version;
+CONTRACTS.push({
+  id: "readme-version-badge",
+  file: "README.md",
+  why: `the README badge must show the released version (${pkgVersion} per package.json)`,
+  mustContain: [`Version-${pkgVersion}-blue.svg`],
+});
+
 let failures = 0;
 
 for (const c of CONTRACTS) {

src/components/Header.astro

@@ -261,7 +261,7 @@ const isActiveSection = (item: NavItem): boolean =>
     flex-wrap: nowrap;
   }
 
-  /* Eleven top-level items (the five guide pages fold into the Guides
+  /* Eleven top-level items (the six guide pages fold into the Guides
      dropdown) need about 1200px of content width even at the tightest
      spacing with an icon-only search, so the desktop nav starts at 1240px
      (laptops keep it; Windows scrollbars eat ~17px of the media-query