# Verification checklist (author completes before any release or submission)

Initial and date each line in your own copy. `scripts/publish_gate.py` (from the open-project-build skill) checks the mechanical items (DRAFT stamps, `[VERIFY]` tags, placeholders, secrets); everything below is yours to judge.

**Author sign-off: Friday Ogochukwu Ikwuogu, 2026-09-19.** Zenodo release: https://doi.org/10.5281/zenodo.22852102. See the CPG 2.0 resolution note at the bottom of this file for the one substantive decision made at sign-off.

## Reproduce
- [x] Fresh run of `python code/01_fetch.py && python code/02_build.py && python code/03_qa.py` reproduces `data/processed/crosswalk.csv` and `adjudication.csv` exactly (0 QA mismatches; verdict counts unchanged: Reinforce=2, Partial=10, Gap=9, Conflict=1)
- [x] `python code/04_figures.py --final` and `node code/05_manuscript.js --final` (and `node code/06_supplement.js --final`) regenerate DRAFT-free outputs
- [x] Every number in the manuscript re-derived from `paper/stats.json` after the re-run (spot-checked against the rendered PDF: n_total_rows=90, n_verdict counts, n_mapping_confidence.LOW=2, n_unresolved_source_blocked_rows=11, author_signoff_date)

## Source-level checks (the priority queue)
- [ ] **Marquee claim:** confirm NERC CIP-008's 1-hour E-ISAC/NCCIC clock and the currently-effective TSA 24-hour clock directly against primary/GAO text, not this project's paraphrase -- this is the paper's central Conflict finding (RS.CO). Author reviewed the paraphrase as stated on 2026-09-19 and is comfortable publishing it; a from-primary-text re-confirmation is still recommended before submission and is carried to v0.2 (docs/NEXT_STEPS.md item 2).
- [ ] Reconfirm TSA's rule status (still proposed, or has a final rule published?) as of your actual submission date
- [x] **CPG 2.0 placeholder/unresolved rows — author decision (2026-09-19):** the 2 placeholder rows (`CPG-GOV-NEW`, `CPG-3P-NEW`) and 9 further `coder_note`-flagged CPG rows are retained in the dataset and formally marked `row_status = "UNRESOLVED_SOURCE_BLOCKED"`, `confidence = "LOW"` (placeholders) or unchanged confidence with the coder_note attached (the 9 notes), with an explicit `coder_note` explaining the CISA CPG 2.0 PDF WAF-block. This is a deliberate v0.1 decision, not an oversight: reconciliation against the primary CPG 2.0 PDF is deferred to v0.2 (docs/NEXT_STEPS.md item 1). Per author instruction, this decision changes no human coding or agreement statistic -- confirmed: verdict counts and category adjudications are identical before and after this change.
- [ ] Licenses/terms of every source re-read; nothing forbids redistribution of the derived crosswalk (all sources used are U.S. Government public-domain works or public secondary summaries)

## Row-level spot checks (minimum 7, per code/03_qa.py's named list)
- [ ] CIP-013 (easy case)
- [ ] TSA-SD-REPORT24H (hard case -- verify against GAO-25-107947 directly)
- [ ] CIP-008-REPORT (extreme case -- the marquee conflict claim)
- [ ] CPG-2.F (easy case; carries a coder_note -- see CPG 2.0 resolution above)
- [ ] TSA-PROP-CRM (hard case -- verify 49 CFR citations against the Federal Register text)
- [ ] CIP-014 (representative case)
- [x] CPG-GOV-NEW (placeholder -- author reviewed 2026-09-19 and elected to retain as a documented, explicitly-labeled `UNRESOLVED_SOURCE_BLOCKED`/`LOW`-confidence placeholder rather than omit; see coder_note in data/processed/crosswalk.csv)

## Judgment calls to own (edit or document agreement)
- [x] All 13 `medium`-confidence category mappings in crosswalk.csv (`mapping_confidence == "medium"`) -- these are genuine either-of-two-categories calls. Author reviewed 2026-09-19; no changes made.
- [ ] The RS.CO "Conflict" verdict framing -- confirm you're comfortable with "Conflict" rather than a softer label given CPG's goal is voluntary, not binding
- [ ] The TSA public-proxy substitution itself -- confirm you're comfortable publishing on this basis (Limitation 3), or want the framing softened further
- [ ] NERC CIP scope (CIP-002 through CIP-014) -- confirm this is the set you intend, or add/remove standards

## Before it goes public
- [x] README, limitations, and manuscript rewritten in your own voice where needed; nothing you cannot personally defend remains (CPG 2.0 sourcing limitation now stated plainly with explicit row-level status rather than bracketed `[VERIFY]` tags)
- [x] Draft stamps removed by regenerating with `--final` on all three build scripts; `publish_gate.py` passes
- [x] License files, name, ORCID, contact in place (AUTHORS.json is the single source -- confirm it, don't edit downstream files)
- [x] Evidence log recorded in this checklist on the day of release: Zenodo DOI `10.5281/zenodo.22852102`; repository `https://github.com/foikwuogu/crosswalk-ci-cyber`; status: published.

## CPG 2.0 resolution note (author decision, 2026-09-19)

> "v0.1 retains the two CPG 2.0 placeholder rows and nine `[VERIFY]` notes, marks them as unresolved due to source access failure, and defers reconciliation to v0.2. No changes to the human coding or agreement statistics are required."

Implemented exactly as specified: all 11 affected rows carry `row_status = "UNRESOLVED_SOURCE_BLOCKED"` and a `coder_note` explaining the CISA WAF block; the 2 placeholder rows additionally carry `confidence = "LOW"`. No `[VERIFY]` bracket tags remain anywhere in the dataset or manuscript. Verdict counts (Reinforce=2, Partial=10, Gap=9, Conflict=1) and all category adjudications are unchanged from the pre-resolution build. Reconciliation against CPG 2.0's primary PDF remains the top v0.2 priority (docs/NEXT_STEPS.md item 1).