القائمة
Perform comprehensive governance quality analysis across architecture artifacts (requirements, principles, designs, assessments)
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/tractorjuice/arckit-codex --skill arckit-analyzeيبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
[COMMUNITY] Assess EU Cloud Sovereignty Framework (v1.2.1) posture for cloud procurement — score the eight sovereignty objectives and record SEAL-level evidence
Document architectural decisions with options analysis and traceability
Design AI agent governance — oversight models, approval workflows, audit requirements, compliance mapping
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | arckit-analyze |
| description | Perform comprehensive governance quality analysis across architecture artifacts (requirements, principles, designs, assessments) |
$ARGUMENTS
Identify inconsistencies, gaps, ambiguities, and compliance issues across all architecture governance artifacts before implementation or procurement. This command performs non-destructive analysis and produces a structured report saved to the project directory for tracking and audit purposes.
Non-Destructive Analysis: Do not modify existing artifacts. Generate a comprehensive analysis report and save it to the project directory for tracking, sharing, and audit trail.
Architecture Principles Authority: The architecture principles (ARC-000-PRIN-*.md in projects/000-global/) are non-negotiable. Any conflicts with principles are automatically CRITICAL and require adjustment of requirements, designs, or vendor proposals—not dilution or reinterpretation of the principles.
UK Government Compliance Authority (if applicable): TCoP, AI Playbook, and ATRS compliance are mandatory for UK government projects. Non-compliance is CRITICAL.
Read the template (with user override support):
.arckit/templates-custom/analysis-report-template.md exists in the project root.arckit/templates/analysis-report-template.md (default).arckit/templates/_partials/RENDERING.md and resolve the <!-- DOC-CONTROL-HEADER --> marker in the template before writing. Do not hand-write the Document Control table: the partial RENDERING.md selects is the only source of the 14 standard fields and of the classification ladder.Tip: Users can customize templates with
$arckit-customize analyze
If the hook has injected a ## Governance Scan Pre-processor Complete section in the context, follow this protocol. If no hook data is present, proceed with Steps 1-2 as normal.
Rule 1 — Hook tables are primary data. Use them directly for all detection passes. Do NOT re-read any artifact file listed in the Artifact Inventory table.
Rule 2 — Targeted reads only. When a detection pass needs evidence beyond hook tables, use Grep (search for specific patterns) or Read with offset/limit (specific sections). NEVER read an entire artifact file.
Rule 3 — Skip Steps 1-2 entirely. Go directly to Step 3. Still read the template (Step 0) for output formatting.
Use this table to identify the primary data source for each detection pass. Only perform a targeted read when the hook data is genuinely insufficient for a specific check.
| Detection Pass | Primary Hook Data | Targeted Read (only if needed) |
|---|---|---|
| A. Requirements Quality | Requirements Inventory, Priority Distribution, Placeholder Counts | Hook data sufficient for all Pass A checks |
| B. Principles Alignment | Principles table + Requirements Inventory | Grep PRIN files for full validation criteria of specific principles flagged as violated |
| C. Req-Design Traceability | Coverage Summary, Orphan Requirements, Cross-Reference Map | Hook data sufficient for all Pass C checks |
| D. Vendor Procurement | Vendor Inventory + Cross-Reference Map | Grep vendor HLD/DLD for specific requirement IDs missing from cross-ref map |
| E. Stakeholder Traceability | Artifact Inventory (STKE presence) + Requirements Inventory | Grep STKE for driver-goal-outcome chains when validating orphan requirements |
| F. Risk Management | Risks table + Requirements Inventory | Grep RISK file for "Risk Appetite" section only (appetite thresholds) |
| G. Business Case | Artifact Inventory (SOBC presence) + Risks table | Grep SOBC for benefits table and option analysis section |
| H. Data Model Consistency | Requirements Inventory (DR-xxx) + Cross-Reference Map | Grep DATA file for entity catalog when validating DR-entity mapping |
| I. UK Gov Compliance | Compliance Artifact Presence | Grep TCOP for per-point scores; Grep AIPB for risk level and principle status |
| J. MOD SbD Compliance | Compliance Artifact Presence | Grep SECD-MOD for SbD principle scores and NIST CSF function scores |
| K. Cross-Artifact Consistency | All hook tables (Document Control, coverage, cross-refs) | Hook data sufficient for all Pass K checks |
Correct (surgical):
Grep "Risk Appetite" in projects/001-*/ARC-*-RISK-*.md then read only 10-20 lines around matchGrep "### 5\. Cloud" in projects/000-global/ARC-000-PRIN-*.md to get one principle's full criteriaRead ARC-001-TCOP-v1.0.md offset=50 limit=30 to get just the scoring tableWrong (wasteful — this data is already in hook tables):
Read ARC-001-REQ-v1.0.md — entire requirements file (use Requirements Inventory table)Read ARC-001-RISK-v1.0.md — entire risk register (use Risks table)Read ARC-000-PRIN-v1.0.md — entire principles file (use Principles table, grep only for specific criteria)Identify the project directory to analyze:
Expected structure:
projects/
└── {project-dir}/
├── ARC-{PROJECT_ID}-STKE-v*.md (RECOMMENDED - stakeholder analysis)
├── ARC-{PROJECT_ID}-RISK-v*.md (RECOMMENDED - risk register)
├── ARC-{PROJECT_ID}-SOBC-v*.md (RECOMMENDED - business case)
├── ARC-{PROJECT_ID}-REQ-v*.md (requirements)
├── ARC-{PROJECT_ID}-DATA-v*.md (if DR-xxx requirements exist - data model)
├── ARC-*-SOW-*.md (if vendor procurement)
├── ARC-*-EVAL-*.md (if vendor procurement)
├── vendors/
│ └── {vendor-name}/
│ ├── hld-v1.md
│ ├── dld-v1.md
│ └── reviews/
├── ARC-*-TCOP-*.md (if UK Gov)
├── ARC-*-AIPB-*.md (if UK Gov AI)
├── ARC-*-ATRS-*.md (if UK Gov AI)
├── ARC-*-SECD-MOD-*.md (if MOD project)
└── ARC-{PROJECT_ID}-TRAC-v*.md (traceability matrix)
Load only minimal necessary context from each artifact:
From any ARC-000-PRIN-*.md file in projects/000-global/ (if exists):
From any ARC-*-STKE-*.md file in projects/{project-dir}/ (if exists):
From any ARC-*-RISK-*.md file in projects/{project-dir}/ (if exists):
From any ARC-*-SOBC-*.md file in projects/{project-dir}/ (if exists):
From any ARC-*-REQ-*.md file in projects/{project-dir}/ (if exists):
From any ARC-*-DATA-*.md file in projects/{project-dir}/ (if exists):
From projects/{project-dir}/ARC-*-SOW-*.md (if exists):
From projects/{project-dir}/vendors/{vendor}/hld-v*.md (if exists):
From projects/{project-dir}/vendors/{vendor}/dld-v*.md (if exists):
From UK Government Assessments (if exist):
ARC-*-TCOP-*.md: TCoP compliance statusARC-*-AIPB-*.md: AI Playbook compliance statusARC-*-ATRS-*.md: ATRS record completenessFrom MOD Assessment (if exists):
ARC-*-SECD-MOD-*.md: MOD SbD compliance status
Create internal representations (do not include raw artifacts in output):
Stakeholder Traceability Matrix (if ARC--STKE-.md exists):
Risk Coverage Matrix (if ARC--RISK-.md exists):
Business Case Alignment Matrix (if ARC--SOBC-.md exists):
Requirements Inventory:
Data Model Coverage Matrix (if ARC--DATA-.md exists):
Principles Compliance Matrix:
Design Coverage Matrix:
UK Government Compliance Matrix (if applicable):
MOD Compliance Matrix (if ARC--SECD-MOD-.md exists):
Focus on high-signal findings. Limit to 50 findings total; aggregate remainder in overflow summary.
Duplication Detection:
Ambiguity Detection:
<placeholder>)Underspecification:
Priority Issues:
Principle Violations (CRITICAL):
Missing Principle Coverage:
Principle Drift:
Coverage Gaps:
Orphan Design Elements:
Traceability Completeness:
SOW Quality:
Vendor Evaluation:
Vendor Design Review:
Stakeholder Coverage:
Conflict Resolution:
RACI Governance Alignment:
Missing Stakeholder Analysis:
$arckit-stakeholders)Risk Coverage:
Risk-SOBC Alignment (if ARC--SOBC-.md exists):
Risk-Requirements Alignment:
Missing Risk Assessment:
$arckit-risk)Benefits Traceability:
Option Analysis Quality:
SOBC-Requirements Alignment:
SOBC-Risk Alignment:
Missing Business Case:
$arckit-sobc)DR-xxx Requirements Coverage:
Data Model-Design Alignment:
Data Governance Alignment:
Data Model Quality:
Missing Data Model:
$arckit-data-model)Technology Code of Practice (TCoP):
AI Playbook (for AI systems):
ATRS (for AI systems):
Compliance Alignment:
7 SbD Principles Assessment:
NIST Cybersecurity Framework Coverage:
Continuous Assurance Process (replaced RMADS August 2023):
Three Lines of Defence Implementation:
Supplier Attestation (if vendor-delivered system):
Classification-Specific Requirements:
Critical Issues (Deployment Blockers):
Missing MOD SbD Assessment:
$arckit-mod-secure)Terminology Drift:
Data Model Consistency:
Technology Stack Consistency:
Timeline/Budget Consistency (if vendor procurement):
Security Coverage:
Compliance Coverage:
Data Protection:
Use this heuristic to prioritise findings:
CRITICAL:
HIGH:
MEDIUM:
LOW:
Generate a comprehensive Markdown report and save it to projects/{project-dir}/ARC-{PROJECT_ID}-ANAL-v1.0.md with the following structure:
# Architecture Governance Analysis Report
**Project**: {project-name}
**Date**: {current-date}
**Analyzed By**: ArcKit v{version}
---
## Executive Summary
**Overall Status**: ✅ Ready / ⚠️ Issues Found / ❌ Critical Issues
**Key Metrics**:
- Total Requirements: {count}
- Requirements Coverage: {percentage}%
- Critical Issues: {count}
- High Priority Issues: {count}
- Medium Priority Issues: {count}
- Low Priority Issues: {count}
**Recommendation**: [PROCEED / RESOLVE CRITICAL ISSUES FIRST / MAJOR REWORK NEEDED]
---
## Findings Summary
| ID | Category | Severity | Location(s) | Summary | Recommendation |
|----|----------|----------|-------------|---------|----------------|
| R1 | Requirements Quality | HIGH | ARC-*-REQ-*.md:L45-52 | Duplicate security requirements | Merge NFR-S-001 and NFR-S-005 |
| P1 | Principles Alignment | CRITICAL | ARC-*-REQ-*.md:L120 | Violates Cloud-First principle | Change to cloud-native architecture |
| T1 | Traceability | HIGH | No HLD coverage | NFR-P-002 (10K TPS) not addressed | Add performance architecture section to HLD |
| UK1 | UK Gov Compliance | CRITICAL | Missing DPIA | AI system requires DPIA before deployment | Complete DPIA for AI Playbook compliance |
---
## Requirements Analysis
### Requirements Coverage Matrix
| Requirement ID | Type | Priority | Design Coverage | Tests Coverage | Status |
|----------------|------|----------|-----------------|----------------|--------|
| BR-001 | Business | MUST | ✅ HLD | ❌ Missing | ⚠️ Partial |
| FR-001 | Functional | MUST | ✅ HLD, DLD | ✅ Tests | ✅ Complete |
| NFR-S-001 | Security | MUST | ❌ Missing | ❌ Missing | ❌ Not Covered |
**Statistics**:
- Total Requirements: {count}
- Fully Covered: {count} ({percentage}%)
- Partially Covered: {count} ({percentage}%)
- Not Covered: {count} ({percentage}%)
### Uncovered Requirements (CRITICAL)
| Requirement ID | Priority | Description | Why Critical |
|----------------|----------|-------------|--------------|
| NFR-S-003 | MUST | Encrypt data at rest | Security requirement |
| NFR-P-002 | MUST | Support 10K TPS | Performance critical |
---
## Architecture Principles Compliance
| Principle | Status | Evidence | Issues |
|-----------|--------|----------|--------|
| Cloud-First | ✅ COMPLIANT | AWS architecture in HLD | None |
| API-First | ⚠️ PARTIAL | REST APIs defined, missing OpenAPI specs | Document API contracts |
| Security-by-Design | ❌ NON-COMPLIANT | No threat model, missing security architecture | Add security sections |
**Critical Principle Violations**: {count}
---
## Stakeholder Traceability Analysis
**Stakeholder Analysis Exists**: ✅ Yes / ❌ No (RECOMMENDED)
**Stakeholder-Requirements Coverage**:
- Requirements traced to stakeholder goals: {percentage}%
- Orphan requirements (no stakeholder justification): {count}
- Requirement conflicts documented and resolved: ✅ Yes / ⚠️ Partial / ❌ No
**RACI Governance Alignment**:
| Artifact | Role | Aligned with RACI? | Issues |
|----------|------|-------------------|--------|
| Risk Register | Risk Owners | ✅ Yes / ❌ No | Missing 3 risk owners from RACI |
| Data Model | Data Owners | ✅ Yes / ❌ No | None |
| SOBC | Benefits Owners | ✅ Yes / ❌ No | 2 benefits lack owner assignment |
**Critical Issues**:
- Orphan requirements: {count} requirements not linked to stakeholder goals
- Unresolved conflicts: {count} requirement conflicts without resolution
---
## Risk Management Analysis
**Risk Register Exists**: ✅ Yes / ❌ No (RECOMMENDED)
**Risk Coverage**:
| Risk ID | Category | Inherent | Residual | Response | Mitigation in Req? | Mitigation in Design? |
|---------|----------|----------|----------|----------|-------------------|---------------------|
| R-001 | Strategic | Very High | High | Treat | ✅ BR-003 | ✅ HLD Section 4 |
| R-005 | Technology | High | Medium | Treat | ❌ Missing | ❌ Missing |
**High/Very High Risks Requiring Attention**:
| Risk ID | Description | Current Status | Required Action |
|---------|-------------|----------------|-----------------|
| R-005 | Cloud provider lock-in | No mitigation | Add multi-cloud requirements |
| R-012 | Data breach | Partial mitigation | Complete security architecture in HLD |
**Risk-SOBC Alignment** (if SOBC exists):
- Strategic risks reflected in Strategic Case: ✅ Yes / ❌ No
- Financial risks in Economic Case cost contingency: ✅ Yes / ❌ No
- Risks included in Management Case Part E: ✅ Yes / ❌ No
**Risk Governance**:
- Risk owners from stakeholder RACI: ✅ Yes / ⚠️ Partial / ❌ No
- Risk appetite compliance: {count} risks within tolerance
---
## Business Case Analysis
**SOBC Exists**: ✅ Yes / ❌ No (RECOMMENDED for major investments)
**Benefits Traceability**:
| Benefit ID | Description | Stakeholder Goal | Requirements | Measurable? | Status |
|------------|-------------|------------------|--------------|-------------|--------|
| B-001 | Reduce costs 40% | CFO Goal G-1 | BR-002, NFR-P-003 | ✅ Yes | ✅ Complete |
| B-003 | Improve UX | CTO Goal G-5 | FR-008, NFR-A-001 | ❌ No | ❌ Not measurable |
**Benefits Coverage**:
- Total benefits: {count}
- Benefits traced to stakeholder goals: {percentage}%
- Benefits supported by requirements: {percentage}%
- Benefits measurable and verifiable: {percentage}%
**Option Analysis Quality**:
- Do Nothing baseline included: ✅ Yes / ❌ No
- Options analyzed: {count} options
- Recommended option: {option name}
- Justification: ✅ Strong / ⚠️ Weak / ❌ Missing
**SOBC-Requirements Alignment**:
- Strategic Case drivers in requirements: ✅ Yes / ⚠️ Partial / ❌ No
- Economic Case benefits achievable with requirements: ✅ Yes / ⚠️ Questionable / ❌ No
- Financial Case budget adequate: ✅ Yes / ⚠️ Tight / ❌ Insufficient
**Critical Issues**:
- Non-measurable benefits: {count}
- Benefits without requirement support: {count}
- Budget shortfall: £{amount} (requirements scope exceeds budget)
---
## Data Model Analysis
**Data Model Exists**: ✅ Yes / ❌ No (RECOMMENDED if DR-xxx exist)
**DR-xxx Requirements Coverage**:
| Requirement ID | Description | Entities | Attributes | Status |
|----------------|-------------|----------|------------|--------|
| DR-001 | Store customer data | E-001: Customer | customer_id, email, name | ✅ Complete |
| DR-005 | GDPR erasure | E-001: Customer | [All PII] | ✅ Complete |
| DR-008 | Payment history | ❌ No entity | N/A | ❌ Missing |
**Data Requirements Coverage**:
- Total DR-xxx requirements: {count}
- DR-xxx mapped to entities: {percentage}%
- Entities traced to DR-xxx: {percentage}%
**Data Model Quality**:
- ERD exists and renderable: ✅ Yes / ❌ No
- Entities with complete specs: {count}/{total}
- PII identified: ✅ Yes / ⚠️ Partial / ❌ No
- GDPR compliance documented: ✅ Yes / ⚠️ Partial / ❌ No
**Data Governance**:
| Entity | Data Owner (from RACI) | Data Steward | Technical Custodian | Status |
|--------|------------------------|--------------|---------------------|--------|
| E-001: Customer | CFO (from stakeholder RACI) | Data Governance Lead | Database Team | ✅ Complete |
| E-003: Payment | ❌ Not assigned | ❌ Not assigned | Database Team | ❌ Missing owners |
**Data Model-Design Alignment**:
- Database schemas in DLD match entities: ✅ Yes / ⚠️ Partial / ❌ No / N/A
- CRUD matrix aligns with HLD components: ✅ Yes / ⚠️ Partial / ❌ No / N/A
- Data integration flows match upstream/downstream: ✅ Yes / ⚠️ Partial / ❌ No / N/A
**Critical Issues**:
- DR-xxx requirements with no entity mapping: {count}
- PII not identified (GDPR risk): {count} entities
- Data owners not from RACI matrix: {count} entities
---
## UK Government Compliance Analysis
### Technology Code of Practice (TCoP)
**Overall Score**: {score}/130 ({percentage}%)
**Status**: ✅ Compliant / ⚠️ Partial / ❌ Non-Compliant
| Point | Requirement | Status | Score | Issues |
|-------|-------------|--------|-------|--------|
| 1 | Define User Needs | ✅ | 9/10 | Minor: User research from 2023 (update) |
| 5 | Use Cloud First | ✅ | 10/10 | AWS cloud-native |
| 6 | Make Things Secure | ❌ | 3/10 | Missing: Cyber Essentials, threat model |
**Critical TCoP Issues**: {count}
### AI Playbook (if AI system)
**Risk Level**: HIGH-RISK / MEDIUM-RISK / LOW-RISK
**Overall Score**: {score}/160 ({percentage}%)
**Status**: ✅ Compliant / ⚠️ Partial / ❌ Non-Compliant
**Blocking Issues**:
- [ ] DPIA not completed (MANDATORY for high-risk)
- [ ] No human-in-the-loop (REQUIRED for high-risk)
- [ ] ATRS not published (MANDATORY for central government)
### ATRS (if AI system)
**Completeness**: {percentage}%
**Status**: ✅ Ready for Publication / ⚠️ Incomplete / ❌ Missing
**Missing Mandatory Fields**:
- [ ] Senior Responsible Owner
- [ ] Bias testing results
- [ ] Fallback procedures
---
## MOD Secure by Design Analysis
**MOD SbD Assessment Exists**: ✅ Yes / ❌ No (MANDATORY for MOD projects)
**Overall SbD Maturity**: Level {0-5} (Target: Level 3+ for operational systems)
### 7 SbD Principles Compliance
| Principle | Status | Score | Issues |
|-----------|--------|-------|--------|
| 1. Understand and Define Context | ✅ | 9/10 | Minor: Data classification pending final review |
| 2. Apply Security from the Start | ⚠️ | 6/10 | Security architecture not in initial specs |
| 3. Apply Defence in Depth | ❌ | 3/10 | Missing: Network segmentation, IDS/IPS |
| 4. Follow Secure Design Patterns | ✅ | 8/10 | NCSC guidance applied, minor OWASP gaps |
| 5. Continuously Manage Risk | ✅ | 9/10 | Risk register active, continuous monitoring planned |
| 6. Secure the Supply Chain | ⚠️ | 5/10 | Missing: SBOM, supplier attestations |
| 7. Enable Through-Life Assurance | ⚠️ | 6/10 | Monitoring planned, incident response incomplete |
**Overall Score**: {score}/70 ({percentage}%)
### NIST Cybersecurity Framework Coverage
| Function | Status | Coverage | Critical Gaps |
|----------|--------|----------|---------------|
| Identify | ✅ | 90% | Asset inventory incomplete for contractor systems |
| Protect | ⚠️ | 65% | MFA not implemented, PAM missing |
| Detect | ❌ | 40% | No SIEM integration, limited monitoring |
| Respond | ⚠️ | 70% | Incident response plan exists, not tested |
| Recover | ✅ | 85% | Backup/DR tested, BC plan approved |
**Overall CSF Score**: {percentage}%
### Continuous Assurance Process
**CAAT (Cyber Activity and Assurance Tracker)**:
- CAAT registered: ✅ Yes / ❌ No (MANDATORY)
- Registration date: {date}
- Self-assessment question sets completed: {count}/{total}
- Based on 7 SbD Principles: ✅ Yes / ⚠️ Partial / ❌ No
- Continuously updated: ✅ Yes / ⚠️ Sporadic / ❌ One-time only
- Last update: {date}
**Key Roles**:
- Delivery Team Security Lead (DTSL) appointed: ✅ Yes / ❌ No (REQUIRED)
- DTSL name: {name}
- Security Assurance Coordinator (SAC) appointed: ✅ Yes / ❌ No / N/A
- Project Security Officer (PSyO) for SECRET+: ✅ Yes / ❌ No / N/A
### Three Lines of Defence
| Line | Responsibility | Implementation | Status |
|------|----------------|----------------|--------|
| First Line | Delivery team owns security (DTSL) | DTSL appointed, day-to-day management | ✅ Effective |
| Second Line | Technical Coherence assurance | Quarterly reviews scheduled | ⚠️ Partial |
| Third Line | Independent audit (NAO, GIAA) | Pen test planned Q2 | ⚠️ Planned |
**Overall Governance**: ✅ Strong / ⚠️ Adequate / ❌ Weak
### Supplier Attestation (if vendor-delivered)
**Supplier Attestation Required**: ✅ Yes / ❌ No / N/A
**Attestation Status**:
- Suppliers attest systems are secure (ISN 2023/10): ✅ Yes / ❌ No
- Supplier-owned continuous assurance: ✅ Yes / ❌ No
- Supplier security requirements in contracts: ✅ Yes / ⚠️ Partial / ❌ No
- Contract includes CAAT self-assessment obligations: ✅ Yes / ❌ No
### Classification-Specific Requirements
**Data Classification**: OFFICIAL / OFFICIAL-SENSITIVE / SECRET / TOP SECRET
**Classification Requirements Met**:
| Requirement | Status | Evidence |
|-------------|--------|----------|
| Personnel security clearances | ✅ / ❌ | All SC cleared for OFFICIAL-SENSITIVE |
| Cryptography (CESG-approved) | ✅ / ❌ | AES-256, TLS 1.3 |
| Network security (air-gap/assured) | ✅ / ⚠️ / ❌ | Assured connectivity approved |
| Physical security | ✅ / ❌ | Enhanced access controls in place |
| Cyber Essentials / Cyber Essentials Plus | ✅ / ❌ | Cyber Essentials Plus certified |
### Critical Issues (Deployment Blockers)
**Blocking Issues**:
- [ ] CAAT not registered (MANDATORY for all programmes)
- [ ] No DTSL appointed (required from Discovery phase)
- [ ] SECRET+ data without SC cleared personnel
- [ ] No encryption at rest or in transit
- [ ] No threat model or risk assessment
- [ ] Critical vulnerabilities unpatched
- [ ] Supplier attestation missing for vendor-delivered system
**Deployment Readiness**: ✅ Ready / ⚠️ Issues to resolve / ❌ BLOCKED
---
## Traceability Analysis
**Traceability Matrix**: ✅ Exists / ❌ Missing
**Forward Traceability** (Requirements → Design → Tests):
- Requirements → HLD: {percentage}%
- HLD → DLD: {percentage}%
- DLD → Tests: {percentage}%
**Backward Traceability** (Tests → Requirements):
- Orphan components (not linked to requirements): {count}
**Gap Summary**:
- {count} requirements with no design coverage
- {count} design elements with no requirement justification
- {count} components with no test coverage
---
## Vendor Procurement Analysis
### SOW Quality
**Status**: ✅ Complete / ⚠️ Issues / ❌ Insufficient
**Issues**:
- [ ] SOW missing NFR-P-xxx performance requirements
- [ ] Acceptance criteria ambiguous for deliverable 3
- [ ] Timeline unrealistic for scope (6 months vs 50 requirements)
### Vendor Evaluation
**Evaluation Criteria Defined**: ✅ Yes / ❌ No
**Alignment Check**:
- All MUST requirements in scoring? ✅ Yes / ❌ No
- Scoring methodology fair? ✅ Yes / ⚠️ Issues / ❌ No
- Technical evaluation covers all areas? ✅ Yes / ⚠️ Gaps / ❌ No
### Vendor Design Review
**HLD Review Completed**: ✅ Yes / ❌ No
**DLD Review Completed**: ✅ Yes / ❌ No
**Coverage Analysis**:
| SOW Requirement | HLD Coverage | DLD Coverage | Status |
|-----------------|--------------|--------------|--------|
| Cloud infrastructure | ✅ | ✅ | Complete |
| Security architecture | ❌ | ❌ | Missing |
| Performance (10K TPS) | ⚠️ | ❌ | Insufficient |
---
## Security & Compliance Summary
### Security Posture
- Security requirements defined: ✅ Yes / ❌ No
- Threat model documented: ✅ Yes / ❌ No
- Security architecture in HLD: ✅ Yes / ⚠️ Partial / ❌ No
- Security implementation in DLD: ✅ Yes / ⚠️ Partial / ❌ No
- Security testing plan: ✅ Yes / ❌ No
**Security Coverage**: {percentage}%
### Compliance Posture
- Regulatory requirements identified: ✅ Yes / ❌ No
- GDPR/UK GDPR compliance: ✅ Yes / ⚠️ Partial / ❌ No
- Industry compliance (PCI-DSS, HIPAA, etc.): ✅ Yes / ⚠️ Partial / ❌ No / N/A
- Audit readiness: ✅ Yes / ⚠️ Partial / ❌ No
**Compliance Coverage**: {percentage}%
---
## Recommendations
### Critical Actions (MUST resolve before implementation/procurement)
1. **[P1] Add Cloud-First architecture**: Current design violates Cloud-First principle. Redesign with AWS/Azure/GCP.
2. **[R1] Cover security requirements**: NFR-S-003, NFR-S-007, NFR-S-012 have no design coverage. Add security architecture to HLD.
3. **[UK1] Complete DPIA**: HIGH-RISK AI system requires completed DPIA before deployment (AI Playbook MANDATORY).
### High Priority Actions (SHOULD resolve before implementation/procurement)
1. **[T1] Document API contracts**: Add OpenAPI specifications for all REST APIs.
2. **[T2] Add performance architecture**: NFR-P-002 (10K TPS) not addressed in design. Add performance section to HLD.
3. **[V1] Update SOW acceptance criteria**: Deliverable 3 acceptance criteria too vague. Add measurable criteria.
### Medium Priority Actions (Improve quality)
1. **[Q1] Consolidate duplicate requirements**: Merge NFR-S-001 and NFR-S-005 (identical).
2. **[Q2] Fix terminology drift**: "User" vs "Customer" used inconsistently. Standardize.
3. **[D1] Complete traceability matrix**: Add backward traceability from tests to requirements.
### Low Priority Actions (Optional improvements)
1. **[S1] Improve requirement wording**: Replace "fast" with measurable criteria (e.g., "< 200ms p95").
2. **[S2] Add edge case documentation**: Document edge cases for error handling.
---
## Metrics Dashboard
### Requirement Quality
- Total Requirements: {count}
- Ambiguous Requirements: {count}
- Duplicate Requirements: {count}
- Untestable Requirements: {count}
- **Quality Score**: {percentage}%
### Architecture Alignment
- Principles Compliant: {count}/{total}
- Principles Violations: {count}
- **Alignment Score**: {percentage}%
### Traceability
- Requirements Covered: {count}/{total}
- Orphan Components: {count}
- **Traceability Score**: {percentage}%
### Stakeholder Traceability (if applicable)
- Requirements traced to stakeholder goals: {percentage}%
- Orphan requirements: {count}
- Conflicts resolved: {percentage}%
- RACI governance alignment: {percentage}%
- **Stakeholder Score**: {percentage}%
### Risk Management (if applicable)
- High/Very High risks mitigated: {percentage}%
- Risk owners from RACI: {percentage}%
- Risks reflected in design: {percentage}%
- Risk-SOBC alignment: {percentage}%
- **Risk Management Score**: {percentage}%
### Business Case (if applicable)
- Benefits traced to stakeholder goals: {percentage}%
- Benefits supported by requirements: {percentage}%
- Benefits measurable: {percentage}%
- Budget adequacy: ✅ Adequate / ⚠️ Tight / ❌ Insufficient
- **Business Case Score**: {percentage}%
### Data Model (if applicable)
- DR-xxx requirements mapped to entities: {percentage}%
- Entities traced to DR-xxx: {percentage}%
- PII identified: {percentage}%
- Data governance complete: {percentage}%
- Data model-design alignment: {percentage}%
- **Data Model Score**: {percentage}%
### UK Government Compliance (if applicable)
- TCoP Score: {score}/130 ({percentage}%)
- AI Playbook Score: {score}/160 ({percentage}%)
- ATRS Completeness: {percentage}%
- **UK Gov Compliance Score**: {percentage}%
### MOD Compliance (if applicable)
- 7 SbD Principles Score: {score}/70 ({percentage}%)
- NIST CSF Coverage: {percentage}%
- CAAT registered and updated: ✅ Yes / ❌ No
- Three Lines of Defence: {percentage}%
- **MOD SbD Score**: {percentage}%
### Overall Governance Health
**Score**: {percentage}%
**Grade**: A / B / C / D / F
**Grade Thresholds**:
- A (90-100%): Excellent governance, ready to proceed
- B (80-89%): Good governance, minor issues
- C (70-79%): Adequate governance, address high-priority issues
- D (60-69%): Poor governance, major rework needed
- F (<60%): Insufficient governance, do not proceed
---
## Next Steps
### Immediate Actions
1. **If CRITICAL issues exist**: ❌ **DO NOT PROCEED** with implementation/procurement until resolved.
- Run: `$arckit-requirements` to fix requirements issues
- Run: `$arckit-hld-review` to address design gaps
- Run: `$arckit-ai-playbook` (if AI system) to complete mandatory assessments
2. **If only HIGH/MEDIUM issues**: ⚠️ **MAY PROCEED** with caution, but address issues in parallel.
- Document exceptions for HIGH issues
- Create remediation plan for MEDIUM issues
3. **If only LOW issues**: ✅ **READY TO PROCEED**
- Address LOW issues during implementation as improvements
### Suggested Commands
Based on findings, consider running:
**Governance Foundation**:
- `$arckit-principles` - Create/update architecture principles
- `$arckit-stakeholders` - Analyze stakeholder drivers, goals, conflicts (RECOMMENDED)
- `$arckit-risk` - Create risk register using Orange Book framework (RECOMMENDED)
- `$arckit-sobc` - Create Strategic Outline Business Case using Green Book 5-case model (RECOMMENDED for major investments)
**Requirements & Design**:
- `$arckit-requirements` - Refine requirements to address ambiguity/gaps
- `$arckit-data-model` - Create data model with ERD, GDPR compliance (RECOMMENDED if DR-xxx exist)
- `$arckit-hld-review` - Re-review HLD after addressing issues
- `$arckit-dld-review` - Re-review DLD after addressing issues
**UK Government Compliance**:
- `$arckit-tcop` - Complete TCoP assessment for UK Gov projects
- `$arckit-ai-playbook` - Complete AI Playbook assessment for AI systems
- `$arckit-atrs` - Generate ATRS record for algorithmic tools
- `$arckit-secure` - UK Government Secure by Design review
**MOD Compliance**:
- `$arckit-mod-secure` - MOD Secure by Design assessment with CAAT (MANDATORY for MOD projects)
**Vendor Procurement**:
- `$arckit-sow` - Generate statement of work for RFP
- `$arckit-evaluate` - Update vendor evaluation criteria
**Analysis & Traceability**:
- `$arckit-traceability` - Generate/update traceability matrix
- `$arckit-analyze` - Re-run this analysis after fixes
### Re-run Analysis
After making changes, re-run analysis:
```bash
$arckit-analyze
```text
Expected improvement in scores after addressing findings.
---
## Detailed Findings
(Expand top findings with examples and specific recommendations)
### Finding R1: Duplicate Security Requirements (HIGH)
**Location**: `ARC-*-REQ-*.md:L45-52` and `ARC-*-REQ-*.md:L120-125`
**Details**:
```text
NFR-S-001: System MUST encrypt data at rest using AES-256
NFR-S-005: All stored data SHALL be encrypted with AES-256 encryption
Issue: These are duplicate requirements with inconsistent language (MUST vs SHALL).
Impact: Confuses implementation team, wastes evaluation points in vendor scoring.
Recommendation:
Estimated Effort: 10 minutes
Location: ARC-*-REQ-*.md:L120, Architecture Principles violation
Details:
FR-025: System SHALL deploy to on-premise servers in corporate datacenter
Issue: Violates "Cloud-First" architecture principle defined in projects/000-global/ARC-000-PRIN-*.md. Principle states "MUST use public cloud (AWS/Azure/GCP) unless explicitly justified exception."
Impact: Architecture doesn't align with organization standards. Blocks procurement approval.
Recommendation:
Estimated Effort: 2 hours (requirement change + design update)
(Continue with detailed findings for top 10-20 issues)
Artifacts Analyzed:
Detection Rules Applied:
Analysis Runtime: {duration}
Analysis Version: ArcKit v{version}
END OF ANALYSIS REPORT
---
**CRITICAL - Auto-Populate Document Control Fields**:
Before completing the document, populate ALL document control fields in the header:
**Construct Document ID**:
- **Document ID**: `ARC-{PROJECT_ID}-ANAL-v{VERSION}` (e.g., `ARC-001-ANAL-v1.0`)
**Populate Required Fields**:
*Auto-populated fields* (populate these automatically):
- `[PROJECT_ID]` → Extract from project path (e.g., "001" from "projects/001-project-name")
- `[VERSION]` → "1.0" (or increment if previous version exists)
- `[DATE]` / `[YYYY-MM-DD]` → Current date in YYYY-MM-DD format
- `[DOCUMENT_TYPE_NAME]` → "Governance Analysis Report"
- `ARC-[PROJECT_ID]-ANAL-v[VERSION]` → Construct using format above
- `[COMMAND]` → "arckit.analyze"
*User-provided fields* (extract from project metadata or user input):
- `[PROJECT_NAME]` → Full project name from project metadata or user input
- `[OWNER_NAME_AND_ROLE]` → Document owner (prompt user if not in metadata)
- **Classification** → comes from the resolved Document Control header, not from a placeholder. `_partials/RENDERING.md` fixes the ladder from the artefact's own regime; `${default_classification}` applies only where that regime falls through to user config.
*Calculated fields*:
- `[YYYY-MM-DD]` for Next Review Date → Current date + 30 days
*Pending fields* (leave as [PENDING] until manually updated):
- `[REVIEWER_NAME]` → [PENDING]
- `[APPROVER_NAME]` → [PENDING]
- `[DISTRIBUTION_LIST]` → Default to "Project Team, Architecture Team" or [PENDING]
**Populate Revision History**:
```markdown
| 1.0 | {DATE} | ArcKit AI | Initial creation from `$arckit-analyze` command | [PENDING] | [PENDING] |
Populate Generation Metadata Footer:
The footer should be populated with:
**Generated by**: ArcKit `$arckit-analyze` command
**Generated on**: {DATE} {TIME} GMT
**ArcKit Version**: {ARCKIT_VERSION}
**Project**: {PROJECT_NAME} (Project {PROJECT_ID})
**AI Model**: [Use actual model name, e.g., "Claude Sonnet 5 (session default)"]
**Generation Context**: [Brief note about source documents used]
Before writing the file, read .arckit/references/quality-checklist.md and verify all Common Checks plus the ANAL per-type checks pass. Fix any failures before proceeding.
Save the complete analysis report generated in Step 6 to:
projects/{project-dir}/ARC-{PROJECT_ID}-ANAL-v1.0.md
The saved report must include:
CRITICAL - Show Summary Only: After writing the file, show ONLY the concise summary below. Do NOT output the full analysis report content in your response, as analysis reports can be 1000+ lines with detailed findings and metrics tables.
After writing the file, provide a summary message to the user:
✅ Governance Analysis Complete
**Project**: {project-name}
**Report Location**: projects/{project-dir}/ARC-{PROJECT_ID}-ANAL-v1.0.md
**Overall Status**: ✅ Ready / ⚠️ Issues Found / ❌ Critical Issues
**Governance Health Score**: {score}/100 ({grade})
**Issue Summary**:
- Critical Issues: {count}
- High Priority Issues: {count}
- Medium Priority Issues: {count}
- Low Priority Issues: {count}
**Key Metrics**:
- Requirements Coverage: {percentage}%
- Principles Compliance: {percentage}%
- Traceability Score: {percentage}%
- Stakeholder Alignment: {percentage}%
- Risk Management: {percentage}%
- UK Gov Compliance: {percentage}% (if applicable)
- MOD SbD Compliance: {percentage}% (if applicable)
**Top 3 Critical Issues**:
1. {issue} - {location}
2. {issue} - {location}
3. {issue} - {location}
**Recommendation**: {PROCEED / RESOLVE CRITICAL ISSUES FIRST / MAJOR REWORK NEEDED}
**Next Steps**:
- {action}
- {action}
- {action}
📄 Full analysis report saved to: projects/{project-dir}/ARC-{PROJECT_ID}-ANAL-v1.0.md
After outputting the report, ask:
Would you like me to suggest concrete remediation steps for the top {N} critical/high priority issues?
I can provide:
- Specific edits to fix requirements
- Design review guidance
- Command sequences to address gaps
- Templates for missing artifacts
(I will NOT make changes automatically - you must approve each action)
projects/{project-dir}/ARC-{PROJECT_ID}-ANAL-v1.0.mdUnlike Spec Kit's focus on code implementation, ArcKit analyze focuses on:
User: $arckit-analyze
You should:
Example output: "Architecture Governance Analysis Report" with 18 findings (3 CRITICAL, 6 HIGH, 7 MEDIUM, 2 LOW), 87% requirements coverage, 92% stakeholder traceability, 85% risk mitigation, TCoP score 98/130 (75%), MOD SbD score 58/70 (83%), recommendation: "Resolve 3 CRITICAL issues (1 stakeholder orphan, 2 high risks unmitgated) before procurement"
This is non-destructive analysis - existing artifacts are not modified
Analysis report is saved to projects/{project-dir}/ARC-{PROJECT_ID}-ANAL-v1.0.md for audit trail
Run $arckit-analyze after major changes to requirements, designs, or assessments
Ideal times to run:
Analysis identifies issues; you decide how to resolve them
Re-run after fixing issues to verify improvements
Target: 90%+ governance health score before proceeding
Markdown escaping: When writing less-than or greater-than comparisons, always include a space after < or > (e.g., < 3 seconds, > 99.9% uptime) to prevent markdown renderers from interpreting them as HTML tags or emoji
After analysis, you may need:
Governance Foundation:
$arckit-principles - Create/update architecture principles$arckit-stakeholders - Analyze stakeholder drivers and conflicts$arckit-risk - Create Orange Book risk register$arckit-sobc - Create Green Book business caseRequirements & Data:
$arckit-requirements - Fix requirements issues$arckit-data-model - Create data model with ERD and GDPR complianceDesign Reviews:
$arckit-hld-review - Re-review high-level design$arckit-dld-review - Re-review detailed designUK Government Compliance:
$arckit-tcop - Complete TCoP assessment$arckit-ai-playbook - Complete AI Playbook assessment$arckit-atrs - Generate ATRS record$arckit-secure - UK Government Secure by Design reviewMOD Compliance:
$arckit-mod-secure - MOD Secure by Design assessment with CAATTraceability:
$arckit-traceability - Update traceability matrix