# tiberscope — Changelog

## v1.0.0 — 2026-06-22

Initial release. Phase 4 of the cli.johlem.net consulting layer
(jfind → complymap → dossier → inciclass → roigen → **tiberscope**).

### Purpose

TLPT scoping helper for **DORA Art. 24** under the **TIBER-EU**
framework (batch-2 RTS). Walks the applicability questions, builds
the four-phase plan, and cross-references intended attack paths to a
real pentree methodology node + an existing suite tool, then emits
the artefact as a `jfind/v1` brief so dossier renders the scoping
deliverable.

### Subcommands

```
tiberscope scope   --entity-type credit-institution --functions f.json \
                   --answers y,n,n,n,n -F json -o scope.json
tiberscope plan    --scope scope.json --start 2026-09-01T00:00:00Z -F json
tiberscope map     --scope scope.json -F json
tiberscope brief   --scope scope.json                # default -F jfind
```

### Recommendation logic

```
Q1 (systemically important)            \
Q2 (provides critical ICT to others)    >   any YES → TLPT
Q3 (meets size thresholds in RTS)      /
Q4 (hosts RoI critical functions)      \
Q5 (had major incident last 24 months)  >   any YES → Reduced
                                              else  → Standard
```

### TIBER-EU four-phase plan

| Phase | Name                  | Min weeks | Owner            |
|-------|-----------------------|-----------|------------------|
| P1    | Preparation phase     |  4        | Whitehat + TCT   |
| P2    | Threat Intelligence   |  4        | TI Provider      |
| P3    | Red-Team phase        | 12        | RT Provider      |
| P4    | Closure phase         |  4        | Whitehat + TCT   |

Per-phase `start_date` / `end_date` are derived from `--start` and
`min_duration_weeks`.

### Attack-path map

Eight attack paths (AP-001 … AP-008) covering MITRE ATT&CK
TA0001/TA0002/TA0006/TA0008, each pinned to one of the 13 real
suite tools (phishprobe, urlrecon, credsweep, vlanrecon, wifiaudit,
avwatch, darkrecon, mailforge, payloadforge, specter, openclaw,
pentree, socq) and one of the real pentree methodology nodes
(`web_app/{recon,auth,input,reporting}`,
`windows_ad/{external-access,phishing-execution,direct-rce,local-user-session,lateral-movement,domain-admin}`).
Tests pin these references so a pentree node rename breaks the
build, not the field.

### Vendored methodology

`data/tiber_methodology.json` ships embedded in the binary
(`include_str!`). Extending = fork + edit + recompile. The data IS
the source of truth (same principle as complymap / inciclass /
roigen).

### Acceptance gate (Phase 4) — PASSED

Per consulting-layer spec §4.3:

> Given a sample function inventory, `tiberscope plan` produces the
> TIBER-EU four-phase plan and `map` references real pentree nodes
> + suite tools.

Pinned by
`acceptance_gate_plan_produces_four_phases_and_map_references_pentree_nodes`:

1. `scope` over a critical function with Q1=YES → recommends `tlpt`.
2. `plan` over that scope produces `[P1, P2, P3, P4]` exactly.
3. `map` over that scope emits entries whose `pentree_node` and
   `suite_tool` are each in the known catalogue.

### Suite integration

- Library crate (`tiberscope`) + CLI binary.
- 10 unit tests + 10 integration tests. Zero compiler warnings.
- Fully offline — no network, no Anthropic API key, no Claude SDK.
- Suite-standard exit codes per `SUITE_STANDARDS.md` §1:
  0 ok · 2 usage · 3 runtime / unknown format / bad input file.
- Mandatory tagline footer on every `--help`:
  `[ tiberscope ] ─ an independent project by johlem.net`.
- `--full` extended help (suite convention).

### Deferred to v1.1

- TIBER-EU launch document (`tlpt-charter`) template emitter.
- ATT&CK Navigator JSON export (`map -F navigator`).
- Per-phase deliverable templates (`plan --emit-deliverables`).
- TI-Provider scoping questionnaire builder.