# tabletop — Changelog

## v1.0.0 — 2026-06-25

Initial release. Tenth tool in the "productivity-boost" series.
Consulting differentiator per the 2026-06-23 fleet review.

### Purpose

DORA Art. 25 mandates regular tests of the operational-resilience
plan. NIS2 Art. 21(2)(h) repeats the requirement. Most consultants
ship a Word template; tabletop ships six fully-curated scenarios with
timeline injects, decision points, success criteria, and signed
evidence via `report -F jfind`. Pair with `shellrec` to record the
exercise; pair with `dossier` to ship the after-action report.

### Subcommands

```
tabletop list
tabletop show     <id>  [-F human|markdown|json]
tabletop inject   <id>
tabletop generate <id>  [-F human|markdown|json|jfind]
tabletop report   <id>  --participants alice,bob --date 2026-06-25T10:00:00Z [-F jfind|json|human]
```

### Scenarios (6)

| id | category | title |
|---|---|---|
| `ransomware-01`    | ransomware       | Friday-afternoon ransomware on a critical-function workstation |
| `insider-01`       | insider          | Disgruntled DBA bulk-exports the customer table |
| `supply-chain-01`  | supply-chain     | Compromised dependency in the build pipeline (Log4j-style) |
| `third-party-01`   | third-party      | Critical SaaS provider outage during business hours |
| `data-exfil-01`    | data-exfil       | Anomalous outbound data flow from a database tier |
| `ddos-01`          | ddos             | Volumetric DDoS during a regulatory filing window |

Each scenario carries 4–5 injects on a `T+HH:MM` timeline, 3–4
decision points (each with multiple-choice options), 4–5 success
criteria, and an explicit framework-control mapping (DORA Art. 17 /
Art. 25 / Art. 28 etc., NIS2 Art. 23, ISO/IEC 27001:2022).

### jfind/v1 output

`report -F jfind` emits an `asset-inventory` Info record proving the
exercise ran. The record carries:
- `raw.scenario_id`, `raw.title`, `raw.participants`, `raw.ran_on`
- the scenario's framework controls (pre-curated per scenario)
- evidence path `tabletop://<id>` (logical, not a file)

Combine with `jfind sign` (or `shellrec`) for a tamper-evident
record that satisfies DORA Art. 25 evidence retention.

### Build

- Library crate + thin CLI binary.
- 11 integration tests, all green.
- Zero compiler warnings.
- Pure-static catalogue — no external state, no network access.

### Suite interop

| Producer | Consumer | Use case |
|---|---|---|
| operator | tabletop | run an exercise |
| tabletop | dossier  | append after-action to the incident report |
| tabletop | shellrec | capture the exercise session itself |
| tabletop | complymap | DORA Art. 25 evidence in the gap-assessment |

### Deferred to v1.1

- Operator-supplied custom scenarios via TOML.
- Multi-scenario campaign mode (run 3 over 6 months → trend report).
- Per-decision-point branching (today: linear timeline).
- `tabletop run` interactive walkthrough with timers.
- Localised renderings (today: English only).