◇ OpenCyber Academy
Doctoral research · Chapter 7 · English

Chapter 7 — Thesis synthesis and reproducibility archive

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 7 — Thesis synthesis and reproducibility archive

Lesson map

Lesson 07 published. Map, example, EX039.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 Building the argument"]
  N2["7.2 Proportionate contributions"]
  N3["7.3 The reproducibility archive"]
  N4["Lab — Archive manifest and verification"]
  N5["7.4 Confidential versus shareable"]
  N6["7.5 Writing limitations well"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX039"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 Building the argument"]
  N2["7.2 Proportionate contributions"]
  N3["7.3 The reproducibility archive"]
  N4["Lab — Archive manifest and verification"]
  N5["7.4 Confidential versus shareable"]
  N6["7.5 Writing limitations well"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX039"]
[Learning outcomes]
    |
    v
[7.1 Building the argument]
    |
    v
[7.2 Proportionate contributions]
    |
    v
[7.3 The reproducibility archive]
    |
    v
[Lab — Archive manifest and verification]
    |
    v
[7.4 Confidential versus shareable]
    |
    v
[7.5 Writing limitations well]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX039]

Learning outcomes

You will (1) synthesise studies into a coherent thesis argument; (2) state contributions and limits in proportion to evidence; (3) build a reproducibility archive with integrity checks; (4) separate shareable artefacts from confidential data.

7.1 Building the argument

Amara's thesis has four empirical parts: the coding manual and its agreement, the baseline replication, the pilot and the main study with validation. The synthesis chapter connects them into one argument. Reliable measurement made the baseline trustworthy; the baseline exposed a dashboard error; the pilot refined the protocol; and the main study estimated a modest effect that survived validation and critique. Each link names its evidence. A thesis is not a collection of papers but an argument in which each part supplies a premise, and the synthesis shows the reader how the premises support the conclusion.

7.2 Proportionate contributions

She lists contributions with the strength of evidence for each. Strong: a reusable coding manual with substantial agreement and a public synthetic replication package. Moderate: an estimate of about a fifth fewer post-release architecture defects at one organisation. Weak and exploratory: the association between fidelity and effect. She lists what the thesis does not show: effects in other industries, effects on undiscovered defects or long-term design quality. Proportion matters because readers in industry may adopt practices on the strength of a thesis summary, and overstatement can waste their resources or create false confidence.

7.3 The reproducibility archive

Real defect records cannot leave Tessaro, so Amara's archive contains the analysis scripts, the coding manual, the fidelity checklist, a synthetic dataset generated to match the real data's structure and summary statistics, and a document explaining how the real data can be requested under agreement. Each file is listed in a manifest with its SHA-256 digest, so anyone can check that what they downloaded is what she archived. The lab below builds such a manifest for synthetic files and verifies it. She deposits the archive with a persistent identifier from her university repository.

Lab — Archive manifest and verification

# Build and verify a SHA-256 manifest for a synthetic replication package.
import hashlib
files = {"analysis/did.py": b"# synthetic analysis script\n", "data/synthetic_teams.csv": b"team,wave,pre,post\nT01,1,3.6,2.9\n",
         "docs/coding_manual.md": b"# Coding manual v3\n", "docs/fidelity_checklist.md": b"- DFD drawn\n- STRIDE per element\n"}
manifest = {p: hashlib.sha256(b).hexdigest() for p, b in files.items()}
files["data/synthetic_teams.csv"] += b"T02,2,4.1,3.0\n"   # simulated later edit
for p, b in files.items():
    print(f"{p:28} {'OK' if hashlib.sha256(b).hexdigest() == manifest[p] else 'MISMATCH'}")

Run with python3 lab_archive.py. Verified output:

analysis/did.py              OK
data/synthetic_teams.csv     MISMATCH
docs/coding_manual.md        OK
docs/fidelity_checklist.md   OK

7.4 Confidential versus shareable

Amara applies a simple rule: share everything that does not identify people, customers or exploitable weaknesses. Coding manuals, scripts and synthetic data are shared. Real defect descriptions, which could reveal live vulnerabilities in Tessaro systems, are not. Interview transcripts are summarised in themes without quotes that could identify architects. She asks Tessaro's security team to review the archive for accidental disclosure, and they find one script comment naming an internal system, which she removes. Responsible sharing makes the work reproducible without creating a map of the partner's weaknesses.

7.5 Writing limitations well

The limitations section is specific. Instead of saying that results may not generalise, Amara writes that Tessaro has a central architecture board and mature defect tracking, so organisations lacking either may see different effects. Instead of saying that measurement may be imperfect, she gives the agreement value and names the defect types coders found hardest to classify. Specific limitations help later researchers design better studies, and they show examiners that the candidate understands the evidence well enough to know exactly where it stops. Vague limitations, by contrast, read as ritual and are usually skipped.

Worked example

Amara writes a synthesis chapter linking four studies, grades contributions strong, moderate or weak, builds a SHA-256 manifest for a synthetic replication package and removes one disclosing comment after partner review.

Synthetic case. Archive contents and partner review are synthetic.

Errors and limits

Synthetic datasets can omit correlations that matter for some analyses. Manifests detect changes but do not authenticate the author unless signed.

Exercises

Synthesis

A thesis synthesis argues proportionately from linked evidence and leaves a verified, responsibly redacted archive behind.

Continue studying — chapter 07 of 08

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →