メニュー
Perform comprehensive governance quality analysis across architecture artifacts (requirements, principles, designs, assessments)
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
[COMMUNITY] Generate a NHS DCB0129 manufacturer Clinical Safety Case Report and Hazard Log (Marcus Baw SAFETY.md 3-file spec) for a digital health product placed on the NHS market.
[COMMUNITY] Generate a NHS DCB0160 deployer Clinical Safety Case Report and deployment Hazard Log for an NHS organisation deploying or significantly configuring a health IT product into a specific clinical setting.
Document architectural decisions with options analysis and traceability
Design AI agent architecture — patterns, tool contracts, memory, orchestration, guardrails
Design AI agent governance — oversight models, approval workflows, audit requirements, compliance mapping
Assess AI agent program maturity across design, governance, security, integration, and operations
| name | arckit-analyze |
| description | Perform comprehensive governance quality analysis across architecture artifacts (requirements, principles, designs, assessments) |
$ARGUMENTS
Identify inconsistencies, gaps, ambiguities, and compliance issues across all architecture governance artifacts before implementation or procurement. This command performs non-destructive analysis and produces a structured report saved to the project directory for tracking and audit purposes.
Non-Destructive Analysis: Do not modify existing artifacts. Generate a comprehensive analysis report and save it to the project directory for tracking, sharing, and audit trail.
Architecture Principles Authority: The architecture principles (ARC-000-PRIN-*.md in projects/000-global/) are non-negotiable. Any conflicts with principles are automatically CRITICAL and require adjustment of requirements, designs, or vendor proposals—not dilution or reinterpretation of the principles.
UK Government Compliance Authority (if applicable): TCoP, AI Playbook, and ATRS compliance are mandatory for UK government projects. Non-compliance is CRITICAL.
Read the template (with user override support):
.arckit/templates-custom/analysis-report-template.md exists in the project root.arckit/templates/analysis-report-template.md (default)Tip: Users can customize templates with
$arckit-customize analyze
If the hook has injected a ## Governance Scan Pre-processor Complete section in the context, follow this protocol. If no hook data is present, proceed with Steps 1-2 as normal.
Rule 1 — Hook tables are primary data. Use them directly for all detection passes. Do NOT re-read any artifact file listed in the Artifact Inventory table.
Rule 2 — Targeted reads only. When a detection pass needs evidence beyond hook tables, use Grep (search for specific patterns) or Read with offset/limit (specific sections). NEVER read an entire artifact file.
Rule 3 — Skip Steps 1-2 entirely. Go directly to Step 3. Still read the template (Step 0) for output formatting.
Use this table to identify the primary data source for each detection pass. Only perform a targeted read when the hook data is genuinely insufficient for a specific check.
| Detection Pass | Primary Hook Data | Targeted Read (only if needed) |
|---|---|---|
| A. Requirements Quality | Requirements Inventory, Priority Distribution, Placeholder Counts | Hook data sufficient for all Pass A checks |
| B. Principles Alignment | Principles table + Requirements Inventory | Grep PRIN files for full validation criteria of specific principles flagged as violated |
| C. Req-Design Traceability | Coverage Summary, Orphan Requirements, Cross-Reference Map | Hook data sufficient for all Pass C checks |
| D. Vendor Procurement | Vendor Inventory + Cross-Reference Map | Grep vendor HLD/DLD for specific requirement IDs missing from cross-ref map |
| E. Stakeholder Traceability | Artifact Inventory (STKE presence) + Requirements Inventory | Grep STKE for driver-goal-outcome chains when validating orphan requirements |
| F. Risk Management | Risks table + Requirements Inventory | Grep RISK file for "Risk Appetite" section only (appetite thresholds) |
| G. Business Case | Artifact Inventory (SOBC presence) + Risks table | Grep SOBC for benefits table and option analysis section |
| H. Data Model Consistency | Requirements Inventory (DR-xxx) + Cross-Reference Map | Grep DATA file for entity catalog when validating DR-entity mapping |
| I. UK Gov Compliance | Compliance Artifact Presence | Grep TCOP for per-point scores; Grep AIPB for risk level and principle status |
| J. MOD SbD Compliance | Compliance Artifact Presence | Grep SECD-MOD for SbD principle scores and NIST CSF function scores |
| K. Cross-Artifact Consistency | All hook tables (Document Control, coverage, cross-refs) | Hook data sufficient for all Pass K checks |
Correct (surgical):
Grep "Risk Appetite" in projects/001-*/ARC-*-RISK-*.md then read only 10-20 lines around matchGrep "### 5\. Cloud" in projects/000-global/ARC-000-PRIN-*.md to get one principle's full criteriaRead ARC-001-TCOP-v1.0.md offset=50 limit=30 to get just the scoring tableWrong (wasteful — this data is already in hook tables):
Read ARC-001-REQ-v1.0.md — entire requirements file (use Requirements Inventory table)Read ARC-001-RISK-v1.0.md — entire risk register (use Risks table)Read ARC-000-PRIN-v1.0.md — entire principles file (use Principles table, grep only for specific criteria)Identify the project directory to analyze:
Expected structure:
projects/
└── {project-dir}/
├── ARC-{PROJECT_ID}-STKE-v*.md (RECOMMENDED - stakeholder analysis)
├── ARC-{PROJECT_ID}-RISK-v*.md (RECOMMENDED - risk register)
├── ARC-{PROJECT_ID}-SOBC-v*.md (RECOMMENDED - business case)
├── ARC-{PROJECT_ID}-REQ-v*.md (requirements)
├── ARC-{PROJECT_ID}-DATA-v*.md (if DR-xxx requirements exist - data model)
├── ARC-*-SOW-*.md (if vendor procurement)
├── ARC-*-EVAL-*.md (if vendor procurement)
├── vendors/
│ └── {vendor-name}/
│ ├── hld-v1.md
│ ├── dld-v1.md
│ └── reviews/
├── ARC-*-TCOP-*.md (if UK Gov)
├── ARC-*-AIPB-*.md (if UK Gov AI)
├── ARC-*-ATRS-*.md (if UK Gov AI)
├── ARC-*-SECD-MOD-*.md (if MOD project)
└── ARC-{PROJECT_ID}-TRAC-v*.md (traceability matrix)
Load only minimal necessary context from each artifact:
From any ARC-000-PRIN-*.md file in projects/000-global/ (if exists):
From any ARC-*-STKE-*.md file in projects/{project-dir}/ (if exists):
From any ARC-*-RISK-*.md file in projects/{project-dir}/ (if exists):
From any ARC-*-SOBC-*.md file in projects/{project-dir}/ (if exists):
From any ARC-*-REQ-*.md file in projects/{project-dir}/ (if exists):
From any ARC-*-DATA-*.md file in projects/{project-dir}/ (if exists):
From projects/{project-dir}/ARC-*-SOW-*.md (if exists):
From projects/{project-dir}/vendors/{vendor}/hld-v*.md (if exists):
From projects/{project-dir}/vendors/{vendor}/dld-v*.md (if exists):
From UK Government Assessments (if exist):
ARC-*-TCOP-*.md: TCoP compliance statusARC-*-AIPB-*.md: AI Playbook compliance statusARC-*-ATRS-*.md: ATRS record completenessFrom MOD Assessment (if exists):
ARC-*-SECD-MOD-*.md: MOD SbD compliance status
Create internal representations (do not include raw artifacts in output):
Stakeholder Traceability Matrix (if ARC--STKE-.md exists):
Risk Coverage Matrix (if ARC--RISK-.md exists):
Business Case Alignment Matrix (if ARC--SOBC-.md exists):
Requirements Inventory:
Data Model Coverage Matrix (if ARC--DATA-.md exists):
Principles Compliance Matrix:
Design Coverage Matrix:
UK Government Compliance Matrix (if applicable):
MOD Compliance Matrix (if ARC--SECD-MOD-.md exists):
Focus on high-signal findings. Limit to 50 findings total; aggregate remainder in overflow summary.
Duplication Detection:
Ambiguity Detection:
<placeholder>)Underspecification:
Priority Issues:
Principle Violations (CRITICAL):
Missing Principle Coverage:
Principle Drift:
Coverage Gaps:
Orphan Design Elements:
Traceability Completeness:
SOW Quality:
Vendor Evaluation:
Vendor Design Review:
Stakeholder Coverage:
Conflict Resolution:
RACI Governance Alignment:
Missing Stakeholder Analysis:
$arckit-stakeholders)Risk Coverage:
Risk-SOBC Alignment (if ARC--SOBC-.md exists):
Risk-Requirements Alignment:
Missing Risk Assessment:
$arckit-risk)Benefits Traceability:
Option Analysis Quality:
SOBC-Requirements Alignment:
SOBC-Risk Alignment:
Missing Business Case:
$arckit-sobc)DR-xxx Requirements Coverage:
Data Model-Design Alignment:
Data Governance Alignment:
Data Model Quality:
Missing Data Model:
$arckit-data-model)Technology Code of Practice (TCoP):
AI Playbook (for AI systems):
ATRS (for AI systems):
Compliance Alignment:
7 SbD Principles Assessment:
NIST Cybersecurity Framework Coverage:
Continuous Assurance Process (replaced RMADS August 2023):
Three Lines of Defence Implementation:
Supplier Attestation (if vendor-delivered system):
Classification-Specific Requirements:
Critical Issues (Deployment Blockers):
Missing MOD SbD Assessment:
$arckit-mod-secure)Terminology Drift:
Data Model Consistency:
Technology Stack Consistency:
Timeline/Budget Consistency (if vendor procurement):
Security Coverage:
Compliance Coverage:
Data Protection:
Use this heuristic to prioritise findings:
CRITICAL:
HIGH:
MEDIUM:
LOW:
Generate a comprehensive Markdown report and save it to projects/{project-dir}/ARC-{PROJECT_ID}-ANAL-v1.0.md with the following structure:
# Architecture Governance Analysis Report
**Project**: {project-name}
**Date**: {current-date}
**Analyzed By**: ArcKit v{version}
---
## Executive Summary
**Overall Status**: ✅ Ready / ⚠️ Issues Found / ❌ Critical Issues
**Key Metrics**:
- Total Requirements: {count}
- Requirements Coverage: {percentage}%
- Critical Issues: {count}
- High Priority Issues: {count}
- Medium Priority Issues: {count}
- Low Priority Issues: {count}
**Recommendation**: [PROCEED / RESOLVE CRITICAL ISSUES FIRST / MAJOR REWORK NEEDED]
---
## Findings Summary
| ID | Category | Severity | Location(s) | Summary | Recommendation |
|----|----------|----------|-------------|---------|----------------|
| R1 | Requirements Quality | HIGH | ARC-*-REQ-*.md:L45-52 | Duplicate security requirements | Merge NFR-S-001 and NFR-S-005 |
| P1 | Principles Alignment | CRITICAL | ARC-*-REQ-*.md:L120 | Violates Cloud-First principle | Change to cloud-native architecture |
| T1 | Traceability | HIGH | No HLD coverage | NFR-P-002 (10K TPS) not addressed | Add performance architecture section to HLD |
| UK1 | UK Gov Compliance | CRITICAL | Missing DPIA | AI system requires DPIA before deployment | Complete DPIA for AI Playbook compliance |
---
## Requirements Analysis
### Requirements Coverage Matrix
| Requirement ID | Type | Priority | Design Coverage | Tests Coverage | Status |
|----------------|------|----------|-----------------|----------------|--------|
| BR-001 | Business | MUST | ✅ HLD | ❌ Missing | ⚠️ Partial |
| FR-001 | Functional | MUST | ✅ HLD, DLD | ✅ Tests | ✅ Complete |
| NFR-S-001 | Security | MUST | ❌ Missing | ❌ Missing | ❌ Not Covered |
**Statistics**:
- Total Requirements: {count}
- Fully Covered: {count} ({percentage}%)
- Partially Covered: {count} ({percentage}%)
- Not Covered: {count} ({percentage}%)
### Uncovered Requirements (CRITICAL)
| Requirement ID | Priority | Description | Why Critical |
|----------------|----------|-------------|--------------|
| NFR-S-003 | MUST | Encrypt data at rest | Security requirement |
| NFR-P-002 | MUST | Support 10K TPS | Performance critical |
---
## Architecture Principles Compliance
| Principle | Status | Evidence | Issues |
|-----------|--------|----------|--------|
| Cloud-First | ✅ COMPLIANT | AWS architecture in HLD | None |
| API-First | ⚠️ PARTIAL | REST APIs defined, missing OpenAPI specs | Document API contracts |
| Security-by-Design | ❌ NON-COMPLIANT | No threat model, missing security architecture | Add security sections |
**Critical Principle Violations**: {count}
---
## Stakeholder Traceability Analysis
**Stakeholder Analysis Exists**: ✅ Yes / ❌ No (RECOMMENDED)
**Stakeholder-Requirements Coverage**:
- Requirements traced to stakeholder goals: {percentage}%
- Orphan requirements (no stakeholder justification): {count}
- Requirement conflicts documented and resolved: ✅ Yes / ⚠️ Partial / ❌ No
**RACI Governance Alignment**:
| Artifact | Role | Aligned with RACI? | Issues |
|----------|------|-------------------|--------|
| Risk Register | Risk Owners | ✅ Yes / ❌ No | Missing 3 risk owners from RACI |
| Data Model | Data Owners | ✅ Yes / ❌ No | None |
| SOBC | Benefits Owners | ✅ Yes / ❌ No | 2 benefits lack owner assignment |
**Critical Issues**:
- Orphan requirements: {count} requirements not linked to stakeholder goals
- Unresolved conflicts: {count} requirement conflicts without resolution
---
## Risk Management Analysis
**Risk Register Exists**: ✅ Yes / ❌ No (RECOMMENDED)
**Risk Coverage**:
| Risk ID | Category | Inherent | Residual | Response | Mitigation in Req? | Mitigation in Design? |
|---------|----------|----------|----------|----------|-------------------|---------------------|
| R-001 | Strategic | Very High | High | Treat | ✅ BR-003 | ✅ HLD Section 4 |
| R-005 | Technology | High | Medium | Treat | ❌ Missing | ❌ Missing |
**High/Very High Risks Requiring Attention**:
| Risk ID | Description | Current Status | Required Action |
|---------|-------------|----------------|-----------------|
| R-005 | Cloud provider lock-in | No mitigation | Add multi-cloud requirements |
| R-012 | Data breach | Partial mitigation | Complete security architecture in HLD |
**Risk-SOBC Alignment** (if SOBC exists):
- Strategic risks reflected in Strategic Case: ✅ Yes / ❌ No
- Financial risks in Economic Case cost contingency: ✅ Yes / ❌ No
- Risks included in Management Case Part E: ✅ Yes / ❌ No
**Risk Governance**:
- Risk owners from stakeholder RACI: ✅ Yes / ⚠️ Partial / ❌ No
- Risk appetite compliance: {count} risks within tolerance
---
## Business Case Analysis
**SOBC Exists**: ✅ Yes / ❌ No (RECOMMENDED for major investments)
**Benefits Traceability**:
| Benefit ID | Description | Stakeholder Goal | Requirements | Measurable? | Status |
|------------|-------------|------------------|--------------|-------------|--------|
| B-001 | Reduce costs 40% | CFO Goal G-1 | BR-002, NFR-P-003 | ✅ Yes | ✅ Complete |
| B-003 | Improve UX | CTO Goal G-5 | FR-008, NFR-A-001 | ❌ No | ❌ Not measurable |
**Benefits Coverage**:
- Total benefits: {count}
- Benefits traced to stakeholder goals: {percentage}%
- Benefits supported by requirements: {percentage}%
- Benefits measurable and verifiable: {percentage}%
**Option Analysis Quality**:
- Do Nothing baseline included: ✅ Yes / ❌ No
- Options analyzed: {count} options
- Recommended option: {option name}
- Justification: ✅ Strong / ⚠️ Weak / ❌ Missing
**SOBC-Requirements Alignment**:
- Strategic Case drivers in requirements: ✅ Yes / ⚠️ Partial / ❌ No
- Economic Case benefits achievable with requirements: ✅ Yes / ⚠️ Questionable / ❌ No
- Financial Case budget adequate: ✅ Yes / ⚠️ Tight / ❌ Insufficient
**Critical Issues**:
- Non-measurable benefits: {count}
- Benefits without requirement support: {count}
- Budget shortfall: £{amount} (requirements scope exceeds budget)
---
## Data Model Analysis
**Data Model Exists**: ✅ Yes / ❌ No (RECOMMENDED if DR-xxx exist)
**DR-xxx Requirements Coverage**:
| Requirement ID | Description | Entities | Attributes | Status |
|----------------|-------------|----------|------------|--------|
| DR-001 | Store customer data | E-001: Customer | customer_id, email, name | ✅ Complete |
| DR-005 | GDPR erasure | E-001: Customer | [All PII] | ✅ Complete |
| DR-008 | Payment history | ❌ No entity | N/A | ❌ Missing |
**Data Requirements Coverage**:
- Total DR-xxx requirements: {count}
- DR-xxx mapped to entities: {percentage}%
- Entities traced to DR-xxx: {percentage}%
**Data Model Quality**:
- ERD exists and renderable: ✅ Yes / ❌ No
- Entities with complete specs: {count}/{total}
- PII identified: ✅ Yes / ⚠️ Partial / ❌ No
- GDPR compliance documented: ✅ Yes / ⚠️ Partial / ❌ No
**Data Governance**:
| Entity | Data Owner (from RACI) | Data Steward | Technical Custodian | Status |
|--------|------------------------|--------------|---------------------|--------|
| E-001: Customer | CFO (from stakeholder RACI) | Data Governance Lead | Database Team | ✅ Complete |
| E-003: Payment | ❌ Not assigned | ❌ Not assigned | Database Team | ❌ Missing owners |
**Data Model-Design Alignment**:
- Database schemas in DLD match entities: ✅ Yes / ⚠️ Partial / ❌ No / N/A
- CRUD matrix aligns with HLD components: ✅ Yes / ⚠️ Partial / ❌ No / N/A
- Data integration flows match upstream/downstream: ✅ Yes / ⚠️ Partial / ❌ No / N/A
**Critical Issues**:
- DR-xxx requirements with no entity mapping: {count}
- PII not identified (GDPR risk): {count} entities
- Data owners not from RACI matrix: {count} entities
---
## UK Government Compliance Analysis
### Technology Code of Practice (TCoP)
**Overall Score**: {score}/130 ({percentage}%)
**Status**: ✅ Compliant / ⚠️ Partial / ❌ Non-Compliant
| Point | Requirement | Status | Score | Issues |
|-------|-------------|--------|-------|--------|
| 1 | Define User Needs | ✅ | 9/10 | Minor: User research from 2023 (update) |
| 5 | Use Cloud First | ✅ | 10/10 | AWS cloud-native |
| 6 | Make Things Secure | ❌ | 3/10 | Missing: Cyber Essentials, threat model |
**Critical TCoP Issues**: {count}
### AI Playbook (if AI system)
**Risk Level**: HIGH-RISK / MEDIUM-RISK / LOW-RISK
**Overall Score**: {score}/160 ({percentage}%)
**Status**: ✅ Compliant / ⚠️ Partial / ❌ Non-Compliant
**Blocking Issues**:
- [ ] DPIA not completed (MANDATORY for high-risk)
- [ ] No human-in-the-loop (REQUIRED for high-risk)
- [ ] ATRS not published (MANDATORY for central government)
### ATRS (if AI system)
**Completeness**: {percentage}%
**Status**: ✅ Ready for Publication / ⚠️ Incomplete / ❌ Missing
**Missing Mandatory Fields**:
- [ ] Senior Responsible Owner
- [ ] Bias testing results
- [ ] Fallback procedures
---
## MOD Secure by Design Analysis
**MOD SbD Assessment Exists**: ✅ Yes / ❌ No (MANDATORY for MOD projects)
**Overall SbD Maturity**: Level {0-5} (Target: Level 3+ for operational systems)
### 7 SbD Principles Compliance
| Principle | Status | Score | Issues |
|-----------|--------|-------|--------|
| 1. Understand and Define Context | ✅ | 9/10 | Minor: Data classification pending final review |
| 2. Apply Security from the Start | ⚠️ | 6/10 | Security architecture not in initial specs |
| 3. Apply Defence in Depth | ❌ | 3/10 | Missing: Network segmentation, IDS/IPS |
| 4. Follow Secure Design Patterns | ✅ | 8/10 | NCSC guidance applied, minor OWASP gaps |
| 5. Continuously Manage Risk | ✅ | 9/10 | Risk register active, continuous monitoring planned |
| 6. Secure the Supply Chain | ⚠️ | 5/10 | Missing: SBOM, supplier attestations |
| 7. Enable Through-Life Assurance | ⚠️ | 6/10 | Monitoring planned, incident response incomplete |
**Overall Score**: {score}/70 ({percentage}%)
### NIST Cybersecurity Framework Coverage
| Function | Status | Coverage | Critical Gaps |
|----------|--------|----------|---------------|
| Identify | ✅ | 90% | Asset inventory incomplete for contractor systems |
| Protect | ⚠️ | 65% | MFA not implemented, PAM missing |
| Detect | ❌ | 40% | No SIEM integration, limited monitoring |
| Respond | ⚠️ | 70% | Incident response plan exists, not tested |
| Recover | ✅ | 85% | Backup/DR tested, BC plan approved |
**Overall CSF Score**: {percentage}%
### Continuous Assurance Process
**CAAT (Cyber Activity and Assurance Tracker)**:
- CAAT registered: ✅ Yes / ❌ No (MANDATORY)
- Registration date: {date}
- Self-assessment question sets completed: {count}/{total}
- Based on 7 SbD Principles: ✅ Yes / ⚠️ Partial / ❌ No
- Continuously updated: ✅ Yes / ⚠️ Sporadic / ❌ One-time only
- Last update: {date}
**Key Roles**:
- Delivery Team Security Lead (DTSL) appointed: ✅ Yes / ❌ No (REQUIRED)
- DTSL name: {name}
- Security Assurance Coordinator (SAC) appointed: ✅ Yes / ❌ No / N/A
- Project Security Officer (PSyO) for SECRET+: ✅ Yes / ❌ No / N/A
### Three Lines of Defence
| Line | Responsibility | Implementation | Status |
|------|----------------|----------------|--------|
| First Line | Delivery team owns security (DTSL) | DTSL appointed, day-to-day management | ✅ Effective |
| Second Line | Technical Coherence assurance | Quarterly reviews scheduled | ⚠️ Partial |
| Third Line | Independent audit (NAO, GIAA) | Pen test planned Q2 | ⚠️ Planned |
**Overall Governance**: ✅ Strong / ⚠️ Adequate / ❌ Weak
### Supplier Attestation (if vendor-delivered)
**Supplier Attestation Required**: ✅ Yes / ❌ No / N/A
**Attestation Status**:
- Suppliers attest systems are secure (ISN 2023/10): ✅ Yes / ❌ No
- Supplier-owned continuous assurance: ✅ Yes / ❌ No
- Supplier security requirements in contracts: ✅ Yes / ⚠️ Partial / ❌ No
- Contract includes CAAT self-assessment obligations: ✅ Yes / ❌ No
### Classification-Specific Requirements
**Data Classification**: OFFICIAL / OFFICIAL-SENSITIVE / SECRET / TOP SECRET
**Classification Requirements Met**:
| Requirement | Status | Evidence |
|-------------|--------|----------|
| Personnel security clearances | ✅ / ❌ | All SC cleared for OFFICIAL-SENSITIVE |
| Cryptography (CESG-approved) | ✅ / ❌ | AES-256, TLS 1.3 |
| Network security (air-gap/assured) | ✅ / ⚠️ / ❌ | Assured connectivity approved |
| Physical security | ✅ / ❌ | Enhanced access controls in place |
| Cyber Essentials / Cyber Essentials Plus | ✅ / ❌ | Cyber Essentials Plus certified |
### Critical Issues (Deployment Blockers)
**Blocking Issues**:
- [ ] CAAT not registered (MANDATORY for all programmes)
- [ ] No DTSL appointed (required from Discovery phase)
- [ ] SECRET+ data without SC cleared personnel
- [ ] No encryption at rest or in transit
- [ ] No threat model or risk assessment
- [ ] Critical vulnerabilities unpatched
- [ ] Supplier attestation missing for vendor-delivered system
**Deployment Readiness**: ✅ Ready / ⚠️ Issues to resolve / ❌ BLOCKED
---
## Traceability Analysis
**Traceability Matrix**: ✅ Exists / ❌ Missing
**Forward Traceability** (Requirements → Design → Tests):
- Requirements → HLD: {percentage}%
- HLD → DLD: {percentage}%
- DLD → Tests: {percentage}%
**Backward Traceability** (Tests → Requirements):
- Orphan components (not linked to requirements): {count}
**Gap Summary**:
- {count} requirements with no design coverage
- {count} design elements with no requirement justification
- {count} components with no test coverage
---
## Vendor Procurement Analysis
### SOW Quality
**Status**: ✅ Complete / ⚠️ Issues / ❌ Insufficient
**Issues**:
- [ ] SOW missing NFR-P-xxx performance requirements
- [ ] Acceptance criteria ambiguous for deliverable 3
- [ ] Timeline unrealistic for scope (6 months vs 50 requirements)
### Vendor Evaluation
**Evaluation Criteria Defined**: ✅ Yes / ❌ No
**Alignment Check**:
- All MUST requirements in scoring? ✅ Yes / ❌ No
- Scoring methodology fair? ✅ Yes / ⚠️ Issues / ❌ No
- Technical evaluation covers all areas? ✅ Yes / ⚠️ Gaps / ❌ No
### Vendor Design Review
**HLD Review Completed**: ✅ Yes / ❌ No
**DLD Review Completed**: ✅ Yes / ❌ No
**Coverage Analysis**:
| SOW Requirement | HLD Coverage | DLD Coverage | Status |
|-----------------|--------------|--------------|--------|
| Cloud infrastructure | ✅ | ✅ | Complete |
| Security architecture | ❌ | ❌ | Missing |
| Performance (10K TPS) | ⚠️ | ❌ | Insufficient |
---
## Security & Compliance Summary
### Security Posture
- Security requirements defined: ✅ Yes / ❌ No
- Threat model documented: ✅ Yes / ❌ No
- Security architecture in HLD: ✅ Yes / ⚠️ Partial / ❌ No
- Security implementation in DLD: ✅ Yes / ⚠️ Partial / ❌ No
- Security testing plan: ✅ Yes / ❌ No
**Security Coverage**: {percentage}%
### Compliance Posture
- Regulatory requirements identified: ✅ Yes / ❌ No
- GDPR/UK GDPR compliance: ✅ Yes / ⚠️ Partial / ❌ No
- Industry compliance (PCI-DSS, HIPAA, etc.): ✅ Yes / ⚠️ Partial / ❌ No / N/A
- Audit readiness: ✅ Yes / ⚠️ Partial / ❌ No
**Compliance Coverage**: {percentage}%
---
## Recommendations
### Critical Actions (MUST resolve before implementation/procurement)
1. **[P1] Add Cloud-First architecture**: Current design violates Cloud-First principle. Redesign with AWS/Azure/GCP.
2. **[R1] Cover security requirements**: NFR-S-003, NFR-S-007, NFR-S-012 have no design coverage. Add security architecture to HLD.
3. **[UK1] Complete DPIA**: HIGH-RISK AI system requires completed DPIA before deployment (AI Playbook MANDATORY).
### High Priority Actions (SHOULD resolve before implementation/procurement)
1. **[T1] Document API contracts**: Add OpenAPI specifications for all REST APIs.
2. **[T2] Add performance architecture**: NFR-P-002 (10K TPS) not addressed in design. Add performance section to HLD.
3. **[V1] Update SOW acceptance criteria**: Deliverable 3 acceptance criteria too vague. Add measurable criteria.
### Medium Priority Actions (Improve quality)
1. **[Q1] Consolidate duplicate requirements**: Merge NFR-S-001 and NFR-S-005 (identical).
2. **[Q2] Fix terminology drift**: "User" vs "Customer" used inconsistently. Standardize.
3. **[D1] Complete traceability matrix**: Add backward traceability from tests to requirements.
### Low Priority Actions (Optional improvements)
1. **[S1] Improve requirement wording**: Replace "fast" with measurable criteria (e.g., "< 200ms p95").
2. **[S2] Add edge case documentation**: Document edge cases for error handling.
---
## Metrics Dashboard
### Requirement Quality
- Total Requirements: {count}
- Ambiguous Requirements: {count}
- Duplicate Requirements: {count}
- Untestable Requirements: {count}
- **Quality Score**: {percentage}%
### Architecture Alignment
- Principles Compliant: {count}/{total}
- Principles Violations: {count}
- **Alignment Score**: {percentage}%
### Traceability
- Requirements Covered: {count}/{total}
- Orphan Components: {count}
- **Traceability Score**: {percentage}%
### Stakeholder Traceability (if applicable)
- Requirements traced to stakeholder goals: {percentage}%
- Orphan requirements: {count}
- Conflicts resolved: {percentage}%
- RACI governance alignment: {percentage}%
- **Stakeholder Score**: {percentage}%
### Risk Management (if applicable)
- High/Very High risks mitigated: {percentage}%
- Risk owners from RACI: {percentage}%
- Risks reflected in design: {percentage}%
- Risk-SOBC alignment: {percentage}%
- **Risk Management Score**: {percentage}%
### Business Case (if applicable)
- Benefits traced to stakeholder goals: {percentage}%
- Benefits supported by requirements: {percentage}%
- Benefits measurable: {percentage}%
- Budget adequacy: ✅ Adequate / ⚠️ Tight / ❌ Insufficient
- **Business Case Score**: {percentage}%
### Data Model (if applicable)
- DR-xxx requirements mapped to entities: {percentage}%
- Entities traced to DR-xxx: {percentage}%
- PII identified: {percentage}%
- Data governance complete: {percentage}%
- Data model-design alignment: {percentage}%
- **Data Model Score**: {percentage}%
### UK Government Compliance (if applicable)
- TCoP Score: {score}/130 ({percentage}%)
- AI Playbook Score: {score}/160 ({percentage}%)
- ATRS Completeness: {percentage}%
- **UK Gov Compliance Score**: {percentage}%
### MOD Compliance (if applicable)
- 7 SbD Principles Score: {score}/70 ({percentage}%)
- NIST CSF Coverage: {percentage}%
- CAAT registered and updated: ✅ Yes / ❌ No
- Three Lines of Defence: {percentage}%
- **MOD SbD Score**: {percentage}%
### Overall Governance Health
**Score**: {percentage}%
**Grade**: A / B / C / D / F
**Grade Thresholds**:
- A (90-100%): Excellent governance, ready to proceed
- B (80-89%): Good governance, minor issues
- C (70-79%): Adequate governance, address high-priority issues
- D (60-69%): Poor governance, major rework needed
- F (<60%): Insufficient governance, do not proceed
---
## Next Steps
### Immediate Actions
1. **If CRITICAL issues exist**: ❌ **DO NOT PROCEED** with implementation/procurement until resolved.
- Run: `$arckit-requirements` to fix requirements issues
- Run: `$arckit-hld-review` to address design gaps
- Run: `$arckit-ai-playbook` (if AI system) to complete mandatory assessments
2. **If only HIGH/MEDIUM issues**: ⚠️ **MAY PROCEED** with caution, but address issues in parallel.
- Document exceptions for HIGH issues
- Create remediation plan for MEDIUM issues
3. **If only LOW issues**: ✅ **READY TO PROCEED**
- Address LOW issues during implementation as improvements
### Suggested Commands
Based on findings, consider running:
**Governance Foundation**:
- `$arckit-principles` - Create/update architecture principles
- `$arckit-stakeholders` - Analyze stakeholder drivers, goals, conflicts (RECOMMENDED)
- `$arckit-risk` - Create risk register using Orange Book framework (RECOMMENDED)
- `$arckit-sobc` - Create Strategic Outline Business Case using Green Book 5-case model (RECOMMENDED for major investments)
**Requirements & Design**:
- `$arckit-requirements` - Refine requirements to address ambiguity/gaps
- `$arckit-data-model` - Create data model with ERD, GDPR compliance (RECOMMENDED if DR-xxx exist)
- `$arckit-hld-review` - Re-review HLD after addressing issues
- `$arckit-dld-review` - Re-review DLD after addressing issues
**UK Government Compliance**:
- `$arckit-tcop` - Complete TCoP assessment for UK Gov projects
- `$arckit-ai-playbook` - Complete AI Playbook assessment for AI systems
- `$arckit-atrs` - Generate ATRS record for algorithmic tools
- `$arckit-secure` - UK Government Secure by Design review
**MOD Compliance**:
- `$arckit-mod-secure` - MOD Secure by Design assessment with CAAT (MANDATORY for MOD projects)
**Vendor Procurement**:
- `$arckit-sow` - Generate statement of work for RFP
- `$arckit-evaluate` - Update vendor evaluation criteria
**Analysis & Traceability**:
- `$arckit-traceability` - Generate/update traceability matrix
- `$arckit-analyze` - Re-run this analysis after fixes
### Re-run Analysis
After making changes, re-run analysis:
```bash
$arckit-analyze
```text
Expected improvement in scores after addressing findings.
---
## Detailed Findings
(Expand top findings with examples and specific recommendations)
### Finding R1: Duplicate Security Requirements (HIGH)
**Location**: `ARC-*-REQ-*.md:L45-52` and `ARC-*-REQ-*.md:L120-125`
**Details**:
```text
NFR-S-001: System MUST encrypt data at rest using AES-256
NFR-S-005: All stored data SHALL be encrypted with AES-256 encryption
Issue: These are duplicate requirements with inconsistent language (MUST vs SHALL).
Impact: Confuses implementation team, wastes evaluation points in vendor scoring.
Recommendation:
Estimated Effort: 10 minutes
Location: ARC-*-REQ-*.md:L120, Architecture Principles violation
Details:
FR-025: System SHALL deploy to on-premise servers in corporate datacenter
Issue: Violates "Cloud-First" architecture principle defined in projects/000-global/ARC-000-PRIN-*.md. Principle states "MUST use public cloud (AWS/Azure/GCP) unless explicitly justified exception."
Impact: Architecture doesn't align with organization standards. Blocks procurement approval.
Recommendation:
Estimated Effort: 2 hours (requirement change + design update)
(Continue with detailed findings for top 10-20 issues)
Artifacts Analyzed:
Detection Rules Applied:
Analysis Runtime: {duration}
Analysis Version: ArcKit v{version}
END OF ANALYSIS REPORT
---
**CRITICAL - Auto-Populate Document Control Fields**:
Before completing the document, populate ALL document control fields in the header:
**Construct Document ID**:
- **Document ID**: `ARC-{PROJECT_ID}-ANAL-v{VERSION}` (e.g., `ARC-001-ANAL-v1.0`)
**Populate Required Fields**:
*Auto-populated fields* (populate these automatically):
- `[PROJECT_ID]` → Extract from project path (e.g., "001" from "projects/001-project-name")
- `[VERSION]` → "1.0" (or increment if previous version exists)
- `[DATE]` / `[YYYY-MM-DD]` → Current date in YYYY-MM-DD format
- `[DOCUMENT_TYPE_NAME]` → "Governance Analysis Report"
- `ARC-[PROJECT_ID]-ANAL-v[VERSION]` → Construct using format above
- `[COMMAND]` → "arckit.analyze"
*User-provided fields* (extract from project metadata or user input):
- `[PROJECT_NAME]` → Full project name from project metadata or user input
- `[OWNER_NAME_AND_ROLE]` → Document owner (prompt user if not in metadata)
- `[CLASSIFICATION]` → Default to `${default_classification}`; if unavailable, use "OFFICIAL" for UK Gov, "PUBLIC" otherwise (or prompt user)
*Calculated fields*:
- `[YYYY-MM-DD]` for Review Date → Current date + 30 days
*Pending fields* (leave as [PENDING] until manually updated):
- `[REVIEWER_NAME]` → [PENDING]
- `[APPROVER_NAME]` → [PENDING]
- `[DISTRIBUTION_LIST]` → Default to "Project Team, Architecture Team" or [PENDING]
**Populate Revision History**:
```markdown
| 1.0 | {DATE} | ArcKit AI | Initial creation from `$arckit-analyze` command | [PENDING] | [PENDING] |
Populate Generation Metadata Footer:
The footer should be populated with:
**Generated by**: ArcKit `$arckit-analyze` command
**Generated on**: {DATE} {TIME} GMT
**ArcKit Version**: {ARCKIT_VERSION}
**Project**: {PROJECT_NAME} (Project {PROJECT_ID})
**AI Model**: [Use actual model name, e.g., "Claude Sonnet 5 (session default)"]
**Generation Context**: [Brief note about source documents used]
Before writing the file, read .arckit/references/quality-checklist.md and verify all Common Checks plus the ANAL per-type checks pass. Fix any failures before proceeding.
Save the complete analysis report generated in Step 6 to:
projects/{project-dir}/ARC-{PROJECT_ID}-ANAL-v1.0.md
The saved report must include:
CRITICAL - Show Summary Only: After writing the file, show ONLY the concise summary below. Do NOT output the full analysis report content in your response, as analysis reports can be 1000+ lines with detailed findings and metrics tables.
After writing the file, provide a summary message to the user:
✅ Governance Analysis Complete
**Project**: {project-name}
**Report Location**: projects/{project-dir}/ARC-{PROJECT_ID}-ANAL-v1.0.md
**Overall Status**: ✅ Ready / ⚠️ Issues Found / ❌ Critical Issues
**Governance Health Score**: {score}/100 ({grade})
**Issue Summary**:
- Critical Issues: {count}
- High Priority Issues: {count}
- Medium Priority Issues: {count}
- Low Priority Issues: {count}
**Key Metrics**:
- Requirements Coverage: {percentage}%
- Principles Compliance: {percentage}%
- Traceability Score: {percentage}%
- Stakeholder Alignment: {percentage}%
- Risk Management: {percentage}%
- UK Gov Compliance: {percentage}% (if applicable)
- MOD SbD Compliance: {percentage}% (if applicable)
**Top 3 Critical Issues**:
1. {issue} - {location}
2. {issue} - {location}
3. {issue} - {location}
**Recommendation**: {PROCEED / RESOLVE CRITICAL ISSUES FIRST / MAJOR REWORK NEEDED}
**Next Steps**:
- {action}
- {action}
- {action}
📄 Full analysis report saved to: projects/{project-dir}/ARC-{PROJECT_ID}-ANAL-v1.0.md
After outputting the report, ask:
Would you like me to suggest concrete remediation steps for the top {N} critical/high priority issues?
I can provide:
- Specific edits to fix requirements
- Design review guidance
- Command sequences to address gaps
- Templates for missing artifacts
(I will NOT make changes automatically - you must approve each action)
projects/{project-dir}/ARC-{PROJECT_ID}-ANAL-v1.0.mdUnlike Spec Kit's focus on code implementation, ArcKit analyze focuses on:
User: $arckit-analyze
You should:
Example output: "Architecture Governance Analysis Report" with 18 findings (3 CRITICAL, 6 HIGH, 7 MEDIUM, 2 LOW), 87% requirements coverage, 92% stakeholder traceability, 85% risk mitigation, TCoP score 98/130 (75%), MOD SbD score 58/70 (83%), recommendation: "Resolve 3 CRITICAL issues (1 stakeholder orphan, 2 high risks unmitgated) before procurement"
This is non-destructive analysis - existing artifacts are not modified
Analysis report is saved to projects/{project-dir}/ARC-{PROJECT_ID}-ANAL-v1.0.md for audit trail
Run $arckit-analyze after major changes to requirements, designs, or assessments
Ideal times to run:
Analysis identifies issues; you decide how to resolve them
Re-run after fixing issues to verify improvements
Target: 90%+ governance health score before proceeding
Markdown escaping: When writing less-than or greater-than comparisons, always include a space after < or > (e.g., < 3 seconds, > 99.9% uptime) to prevent markdown renderers from interpreting them as HTML tags or emoji
After analysis, you may need:
Governance Foundation:
$arckit-principles - Create/update architecture principles$arckit-stakeholders - Analyze stakeholder drivers and conflicts$arckit-risk - Create Orange Book risk register$arckit-sobc - Create Green Book business caseRequirements & Data:
$arckit-requirements - Fix requirements issues$arckit-data-model - Create data model with ERD and GDPR complianceDesign Reviews:
$arckit-hld-review - Re-review high-level design$arckit-dld-review - Re-review detailed designUK Government Compliance:
$arckit-tcop - Complete TCoP assessment$arckit-ai-playbook - Complete AI Playbook assessment$arckit-atrs - Generate ATRS record$arckit-secure - UK Government Secure by Design reviewMOD Compliance:
$arckit-mod-secure - MOD Secure by Design assessment with CAATTraceability:
$arckit-traceability - Update traceability matrix