Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.
Does Arc Kit need an API key?
No required environment variable is listed on this record.
What transport does Arc Kit use?
Arc Kit runs locally over stdio.
When was Arc Kit last checked?
Last checked 2026-11-09. The Enterprise Architecture Governance Harness — strategy, architecture, delivery, and assurance using AI coding assistants
# ArcKit: The Enterprise Architecture Governance Harness
[](https://github.com/tractorjuice/arc-kit/stargazers)
[
💼 Business case justification (HM Treasury Green Book SOBC)
📋 Creating comprehensive requirements documents
🗄️ Data modeling with ERD, GDPR compliance, and data governance
🔬 Technology research with build vs buy analysis (web search powered)
Key features
01. The Enterprise Architecture Governance Harness — strategy, architecture, delivery, and assurance using AI coding assistants
02. # ArcKit: The Enterprise Architecture Governance Harness
📎 Citation traceability for external documents (inline [DOC-CN] markers with source quotes)
ArcKit produces DRAFT artefacts for qualified people to review, not legal, regulatory, clinical, or security advice. See What ArcKit does not do.
Watch first
New to ArcKit, or explaining it to someone who doesn't use a coding assistant? Start with a film:
ArcKit explained: what ArcKit is and how it keeps AI-drafted architecture documents reviewable, in under eight minutes.
ArcKit for Beginners: one fictional council project, followed from its architecture principles to the release decision. One hour, or four shorter parts.
ArcKit commands: a film of about a minute and a half for each command: what it is for, when to run it and what it produces.
The ArcKit YouTube channel also has a playlist for each overlay. The narration is AI-generated and the films are experimental; tell us on Discord what to cover next.
Quick Start
Installation
Claude Code (premier experience) — install the ArcKit plugin (requires v2.1.287+):
First, make sure Claude Code is on the latest version:
Then install from the Discover tab, or via CLI. The marketplace ships 17 plugins — install only the overlays you need:
# Core (76 commands — UK Government civilian + generic enterprise)
claude plugin install arckit@arckit-claude
# Core + UAE federal
claude plugin install arckit arckit-uae
# Broad overlay set (UK + UAE + FR + CA + EU + AT + AU + US + UK-NHS + UK-GCloud)
claude plugin install arckit arckit-{uae,fr,ca,eu,at,au,us,uk-nhs,uk-gcloud}
# Enterprise architecture and AI agent governance overlays
claude plugin install arckit arckit-togaf-adm arckit-agent-architecture
The standalone tractorjuice/arckit-claude marketplace hosts all Claude Code plugins: the arckit core plugin, regional overlays, sector overlays, the TOGAF ADM and AI agent architecture overlays, the arckit-fde tooling plugin, and the public-but-proprietary arckit-uk-gcloud supplier overlay. The 14 community plugins (arckit-uae, arckit-fr, arckit-ca, arckit-eu, arckit-at, arckit-au, arckit-au-energy, arckit-us, arckit-uk-finance, arckit-uk-nhs, arckit-uk-gcloud, arckit-togaf-adm, arckit-agent-architecture, arckit-oaa) require the arckit core plugin. arckit-au-energy (sector) additionally requires arckit-au (jurisdiction), which it composes — install with claude plugin install arckit arckit-au arckit-au-energy. arckit-uk-gcloud is a proprietary, Claude Code only supplier-side G-Cloud bid-authoring overlay — it is public for installation and inspection, but not MIT licensed and not distributed to the non-Claude extension formats. One tooling plugin — arckit-fde — is a lean, Claude Code only plugin with one command, /arckit-fde:create, that generates a brandable (white-label) Forward Deploy Engineering consulting website into docs/ (GitHub Pages ready), with UK Public Sector and Generic market presets; no dependencies, not converted to non-Claude formats, no governance doc-types.
The older tractorjuice/arc-kit marketplace remains available for compatibility, but new Claude Code installs should use tractorjuice/arckit-claude. Claude Code is the primary development platform for ArcKit and provides the most complete experience: all official commands, autonomous research agents, automation hooks, bundled MCP servers (AWS Knowledge, Microsoft Learn, Google Developer Knowledge, govreposcrape, uk-tenders), and automatic updates via the marketplace. See Why Claude Code? below.
Why v2.1.287? It adds Claude mods, which ArcKit uses to draw a status line above the prompt: how many projects and artefacts you have, how many are DRAFT, and how many reviews are overdue. It also fixes plugin SessionStart hooks not running in new cloud sessions, which skipped ArcKit's session set-up and version check there.
The floor also carries earlier releases ArcKit depends on:
Models
v2.1.284 adds Claude Sonnet 5.5 (claude-sonnet-5-5), the default Sonnet model on the Anthropic API, with 1M context; earlier clients cannot select it. Like Opus 5.5 it always thinks and defaults to effort: medium, so ArcKit's effort: max commands run at max on it.
v2.1.280 adds Claude Opus 5.5 (claude-opus-5-5), the default Opus model. It always thinks, so ArcKit's effort: max commands can no longer be quietly sent as high by a session with thinking off, and the Effective Effort row in each artefact's Build Provenance is accurate.
v2.1.219 adds Claude Opus 5 (claude-opus-5), with 1M context and fast mode, which earlier clients cannot select (superseded as the default by Opus 5.5).
v2.1.197 makes Claude Sonnet 5 the default, with native 1M context.
Security and permissions
v2.1.251 stops the file tools (Read, Write, Edit) following a symlink swapped inside the working directory after the permission check, and makes Grep and Glob honour Read() deny rules through a symlinked search path. That is the same class of bypass the v2.1.222–v2.1.224 fixes closed for Bash, and the class ArcKit's file-protection and secret-file-scanner gates sit in front of.
v2.1.234 stops Claude Code's MCP diagnostics printing resolved secrets. ArcKit bundles two keyed MCP servers whose ${user_config.*} API keys sit in request headers. On a session with no keys configured those connections fail by design, so ArcKit routinely produces exactly the diagnostics this fixed.
v2.1.222 stops PreToolUse auto-allow hooks bypassing tool restrictions inside background agent tasks, which became load-bearing when v2.1.232 made subagent spawns background by default.
v2.1.223 and v2.1.224 close Bash permission-check bypasses, a sandbox denyRead/denyWrite trailing-slash bypass, and a bug where project paths over 200 characters resolved into another project's session directory. v2.1.224 also surfaces sandbox violation details in Bash results.
v2.1.172 fixes wildcard-domain WebFetch rules (WebFetch(domain:*.gov.uk)) that never matched subdomains on earlier clients. That is the exact shape ArcKit recommends for confining research-agent traffic in OFFICIAL-SENSITIVE deployments.
Effort and thinking
v2.1.251 sends Opus 5 effort: xhigh/max as high when thinking is off instead of failing, so ArcKit's effort: max commands complete on thinking-off sessions.
v2.1.221 fixes WebSearch returning a 400 at effort: xhigh/max when thinking is disabled, which silently broke ArcKit's effort: max commands and its three max-effort research agents for anyone running with thinking off.
Plugin loading and agents
v2.1.246 fixes four plugin-loading bugs that hit ArcKit's exact layout: /reload-plugins counted 0 skills for plugins that define skills under skills/*/SKILL.md, hook error messages showed a literal ${CLAUDE_PLUGIN_ROOT} instead of the resolved path, the plugin cache created duplicate SHA-named directories, and claude plugin update <bare-name> failed.
v2.1.200 fixes project-scoped plugin loading from git worktrees and claude agents --plugin-dir <dir> visibility, which makes ArcKit's branch and test-repo workflows reliable.
v2.1.198–v2.1.199 fix background-subagent reliability, parent error propagation and hook stderr visibility, which matter to /arckit:build, reader/writer handoffs and hook diagnosis.
Older fixes: v2.1.156 Opus 4.8 thinking-block fix, v2.1.154 plugin defaultEnabled: false, v2.1.144 session-title and headless Skill tool fixes, v2.1.143 plugin dependency enforcement, v2.1.139 hook args: string[], v2.1.129 monitor layout and prompt-cache fixes, v2.1.121 MCP/provenance hook unlocks, v2.1.118–v2.1.119 release/telemetry unlocks, and the earlier /context, Auto mode, plugin update, MCP leak, retry and subagent working-directory fixes.
Zero-config: all 76 official commands, templates, scripts, and bundled MCP servers (AWS Knowledge, Microsoft Learn). Updates via gemini extensions update arckit.
GitHub Copilot (VS Code) — install the ArcKit CLI and scaffold prompt files:
# Install with pip
pip install git+https://github.com/tractorjuice/arc-kit.git
# Scaffold a project with Copilot prompt files
arckit init my-project --ai copilot
Creates .github/prompts/arckit-*.prompt.md (165 prompt files — the 76 official commands plus the community overlays), .github/agents/arckit-*.agent.md (10 custom agents), and .github/copilot-instructions.md (repo-wide context). Invoke commands in Copilot Chat as /arckit-requirements, /arckit-stakeholders, etc.
Codex CLI — install the ArcKit CLI:
# Install with pip
pip install git+https://github.com/tractorjuice/arc-kit.git
# Or with uv
uv tool install arckit-cli --from git+https://github.com/tractorjuice/arc-kit.git
# Or run without installing
uvx --from git+https://github.com/tractorjuice/arc-kit.git arckit init my-project
Mistral Vibe CLI — link the ArcKit extension:
# Clone the standalone extension repository
git clone https://github.com/tractorjuice/arckit-vibe.git
cd arckit-vibe
# Create extensions directory and link
mkdir -p ~/.vibe/extensions/
ln -s $(pwd) ~/.vibe/extensions/arckit
Zero-config: 76 official commands as skills, 10 specialized agents, all templates, and bundled MCP servers (AWS Knowledge, Microsoft Learn, Google Developer Knowledge, GovRepoScrape).
Kimi Code CLI — start kimi, then install the ArcKit plugin from the prompt:
Every ArcKit command ships as an Agent Skill, invoked with /skill:arckit-<command> (for example /skill:arckit-requirements). The kimi.plugin.json manifest carries all six bundled MCP servers and auto-loads the architecture-workflow skill at session start.
ArcKit can exchange Markdown knowledge bundles using an Open Knowledge Format-shaped frontmatter layer:
/arckit:export-okf copies ArcKit ARC-*.md artifacts into an OKF bundle with portable type, title, resource, tags, timestamp, and arckit metadata.
/arckit:import-okf scans an OKF bundle, writes .arckit/tmp/okf-import-report.json, and materializes safe imports as RSCH review notes by default.
Native ArcKit files remain unchanged unless you explicitly enable source frontmatter stamping with ARCKIT_OKF_FRONTMATTER=1 or .arckit/config.json containing { "okfFrontmatter": true }.
Platform Support
Platform
Claude Code Plugin
Gemini CLI Extension
GitHub Copilot
Codex / OpenCode CLI
Mistral Vibe
Kimi Code CLI
macOS
Full support
Full support
Full support
Full support
Full support
Full support
Linux
Full support
Full support
Full support
Full support
Full support
Full support
Windows (WSL2)
Full support
Full support
Full support
Full support
Full support
Full support
Windows (native)
Full support
Full support
Full support
Partial
Full support
Full support
Windows users: The Claude Code plugin, Gemini CLI extension, GitHub Copilot prompt files, Mistral Vibe extension, and Kimi Code CLI extension work natively on all platforms. For Codex CLI / OpenCode CLI on native Windows (without WSL), some commands containing inline bash snippets may require Git Bash or WSL2. We recommend WSL2 for the best experience.
Initialize a Project
Claude Code: No initialization needed — the plugin provides everything.
Mistral Vibe: No initialization needed — the extension provides everything.
Kimi Code CLI:
# Create a new architecture governance project
arckit init payment-modernization --ai kimi
# Or initialize in current directory
arckit init . --ai kimi
GitHub Copilot (VS Code):
# Create a new architecture governance project
arckit init payment-modernization --ai copilot
# Or initialize in current directory
arckit init . --ai copilot
OpenCode CLI:
# Create a new architecture governance project
arckit init payment-modernization --ai opencode
# Or initialize in current directory
arckit init . --ai opencode
Codex CLI:
# Create a new architecture governance project
arckit init payment-modernization --ai codex
# Minimal install (skip docs and guides)
arckit init payment-modernization --ai codex --minimal
# Or initialize in current directory
arckit init . --ai codex
Start Using ArcKit
# GitHub Copilot (VS Code)
cd payment-modernization && code .
# In Copilot Chat, use ArcKit commands:
/arckit-principles Create principles for a financial services company
/arckit-requirements Build a payment processing system...
# Codex CLI
cd payment-modernization
codex
# Inside your AI assistant, use ArcKit commands:
/arckit:principles Create principles for a financial services company
/arckit:requirements Build a payment processing system...
/arckit:sow Generate RFP for vendor selection
# Mistral Vibe CLI
cd payment-modernization
vibe
# Use ArcKit skills:
/arckit-principles Create principles for a financial services company
/arckit-requirements Build a payment processing system...
/arckit-sow Generate RFP for vendor selection
# Or use specialized agents:
vibe --agent arckit-research "Research cloud providers"
# Kimi Code CLI
cd payment-modernization
kimi
# Use ArcKit skills:
/skill:arckit-principles Create principles for a financial services company
/skill:arckit-requirements Build a payment processing system...
/skill:arckit-sow Generate RFP for vendor selection
Upgrading
Claude Code plugin: Updates are automatic via the marketplace — no action needed.
Gemini CLI extension: Updates via gemini extensions update arckit.
GitHub Copilot: Re-run arckit init --here --ai copilot to update prompt files, agents, and instructions.
Mistral Vibe: Pull the latest standalone extension repo: cd ~/.vibe/extensions/arckit && git pull.
Kimi Code CLI: Re-run the install command from the kimi prompt to pick up the latest release: /plugins install https://github.com/tractorjuice/arckit-kimi.git.
Codex CLI:
# Step 1: Upgrade the CLI tool
pip install --upgrade git+https://github.com/tractorjuice/arc-kit.git
# Or with uv:
uv tool install --force arckit-cli --from git+https://github.com/tractorjuice/arc-kit.git
# Step 2: Update your existing project (re-run init in place)
cd /path/to/your-existing-project
arckit init --here --ai codex
This updates commands, templates, scripts, and agents while preserving your project data (projects/) and custom templates (.arckit/templates-custom/).
If upgrading from v0.x, you may also need to migrate legacy filenames — see the upgrading guide for full details.
Explore Example Outputs
Public demonstration repositories showcase complete ArcKit deliverables:
Token cost of installing the arckit core plugin in a Claude Code session, captured from claude plugin details arckit on v2.1.143+:
Always-on per session: ~10,042 tokens — added to every session's system context, covering the 73 command-skills + 5 utility skills (architecture-workflow, arckit-build, mermaid-syntax, plantuml-syntax, wardley-mapping) + 29 agent descriptors. Hooks (9 events) and MCP servers (6) are harness-resolved at runtime and not counted.
On-invoke: ~250 to ~60K tokens per command — paid only when a specific skill or agent fires. Most commands are in the 5–10K range.
On-invoke cost by command
Costs are estimates from the Claude Code tokenizer and may differ from actual usage. Use this table to budget research-heavy multi-command sessions.
jsp-936 (~60K — MOD JSP 936 AI assurance, defence-only)
Trimming the footprint
The five utility skills already use paths: globs to scope their always-on cost to relevant projects (mermaid-syntax only loads under *.mmd, wardley-mapping under WARD artefacts, etc.). The 73 command-skills are listed but not described in detail in the always-on context — the full prompt only loads on invocation.
Community overlays (arckit-uae, arckit-fr, arckit-nl, arckit-ca, arckit-eu, arckit-at, arckit-au, arckit-au-energy, arckit-us, arckit-uk-finance, arckit-uk-nhs) are independent plugins — install only the jurisdictions / sectors you need. Each adds its own always-on baseline. arckit-uk-finance, arckit-uk-nhs, and arckit-au-energy are sector overlays (arckit-au-energy layers the energy sector on the arckit-au jurisdiction baseline); the rest are jurisdiction-based.
Heavy commands (jsp-936, analyze, diagram, backlog) are on-invoke only; the always-on cost is unaffected by which heavy commands exist.
To measure your own session footprint, run /context all (Claude Code v2.1.139+) for per-skill token estimates against your active model.
Why ArcKit?
Problem: Architecture Governance is Broken
Traditional enterprise architecture suffers from:
❌ Scattered documents across tools (Word, Confluence, PowerPoint)
❌ Inconsistent governance enforcement
❌ Manual vendor evaluation with bias
❌ Lost traceability between requirements and design
❌ Stale documentation that doesn't match reality
Solution: Structured, AI-Assisted Governance
ArcKit provides:
✅ Template-Driven Quality: Comprehensive templates ensure nothing is forgotten
✅ AI Assistance: Let AI handle document generation, you focus on decisions
✅ Enforced Traceability: Automatic gap detection and coverage analysis
✅ Version Control: Git-based workflow for all architecture artifacts
What ArcKit does not do
ArcKit generates DRAFT artefacts for qualified people to review. It is not legal, regulatory, clinical, or security advice, and no output it produces is a submission, a certification, an accreditation, or a compliance decision. Every artefact carries Status: DRAFT until a named accountable person signs it off, and that is the point at which responsibility for the content transfers to your organisation.
Concretely, and regardless of how complete an artefact looks:
A /arckit:dpia output is not a completed DPIA. UK GDPR Article 35 places the assessment on the controller, and Article 36 requires prior consultation with the ICO where high residual risk remains. ArcKit drafts the document. The controller and the Data Protection Officer own it, and only they can conclude it.
/arckit:secure and /arckit:mod-secure do not produce an assurance decision. NCSC CAF outcomes, Cyber Essentials certification, and MOD Secure by Design assurance are all judged by named accountable individuals and, where relevant, by certification bodies. A generated assessment is input to that judgement, never a substitute for it.
/arckit:atrs and /arckit:ai-playbook do not make an algorithmic tool lawful, fair, or transparent. An ATRS record is published by the department after its own internal clearance, and the UK Government AI Playbook principles are obligations on the deploying organisation.
The EU overlay does not perform conformity assessment. It drafts documentation referencing the AI Act, NIS2, DORA, CRA, DSA and the Data Act. It is not a notified-body activity, it does not determine your risk classification, and it does not track amendments or implementing acts as they are made.
/arckit:jsp-936 and the NHS clinical safety commands are not assurance either. Defence AI assurance requires the accountable authority; DCB0129 and DCB0160 require a suitably registered Clinical Safety Officer.
No output is a procurement decision. Research, scoring, and evaluation commands rank options against stated criteria. The Senior Responsible Owner and the procurement officer decide, under whatever framework rules apply to them.
Two limits apply to everything above:
Citations reflect the moment they were fetched. Commands cite sources at fetch time and record the URL, but legislation, standards, framework agreements, and vendor pricing all change. A citation that resolved when the artefact was generated may not describe the current text.
Generated content can be wrong. Output is produced by a language model, and research commands extract from third-party web pages that may themselves be inaccurate or written to mislead. ArcKit isolates that extraction behind schema validation and keeps scoring deterministic, which reduces the blast radius but does not make the underlying facts true.
Who must review what
Before any ArcKit artefact is relied on, published, or submitted:
Data protection artefacts (DPIA, records of processing): Data Protection Officer
Security and assurance artefacts: CISO, or the assessing authority for the relevant regime
Clinical safety artefacts: a registered Clinical Safety Officer
Business cases and procurement artefacts: Senior Responsible Owner and procurement or commercial lead
Anything referencing a regulation, in any jurisdiction: qualified legal counsel for that jurisdiction
The community overlays each carry their own, narrower version of this warning. This section applies to all of ArcKit, including the officially-maintained core commands.
UK Government Compliance
ArcKit includes dedicated commands for UK public sector delivery:
/arckit:tcop — Assess all 13 Technology Code of Practice points across delivery phases.
/arckit:ai-playbook — Produce responsible AI assessments aligned to the UK Government AI Playbook and ATRS.
/arckit:secure — Generate Secure by Design artefacts covering NCSC CAF, Cyber Essentials, and UK GDPR controls.
/arckit:mod-secure — Map MOD Secure by Design requirements (JSP 440, IAMM, clearance pathways).
/arckit:jsp-936 — Deliver JSP 936 AI assurance packs for defence AI systems.
See the demo repositories for end-to-end examples, especially arckit-test-project-v7-nhs-appointment (civilian services) and arckit-test-project-v9-cabinet-office-genai (AI governance).
⚠️ Community-contributed. EU and French commands are domain-maintained by @thomas-jardinet, Austrian commands by @gtonic. The 27 commands below cover EU regulations (GDPR, NIS2, AI Act, DORA, CRA, DSA, Data Act, Cloud Sovereignty Framework), French government standards (SecNumCloud, ANSSI, EBIOS, CNIL, DINUM, etc.), Dutch government standards (Rijksbreed cloudbeleid, VIRBI 2025, BIO2, cloud exit), and Austrian government standards (DSG, NISG 2026, BVergG 2018, BaFG / WZG accessibility). They are not part of the officially-maintained baseline — output should be reviewed by qualified DPO / CISO / Vergabejurist / legal counsel before reliance, and citations may lag current source text. Each command surfaces with a [COMMUNITY] prefix in /help listings and renders a warning banner before generating.
EU regulations (member-state-neutral baselines, applicable across EU/EEA):
/arckit:nl-tbb — Te Beschermen Belangen (TBB) category determination (BIV scoring across five kernbelangen; any existing VIRBI 2025 rubricering is applied as a floor on the category, never derived from it)
/arckit:nl-bio — BIO2 conformance (OBDO, on NEN-EN-ISO/IEC 27001:2023 and 27002:2022)
/arckit:nl-exit — Cloud exit plan under Rijksbreed cloudbeleid clause 3.2 (planned exit and disruptive interruption, annual review)
Austrian government (apply on top of the EU baseline for Austrian deployments — domain-maintained by @gtonic):
/arckit:at-dsgvo — Austrian DSG layer on GDPR (image processing on the GDPR per the VwGH's §12 DSG ruling, ELGA/GTelG health, §96a ArbVG employee monitoring, age 14 consent, DSB enforcement)
/arckit:at-nisg — Austrian NISG 2026 (NIS2 transposition, BGBl. I Nr. 94/2025, in force since 1 Oct 2026) — Essential/Important designation, Cybersicherheitsbehörde registration, CSIRT reporting (CERT.at / GovCERT / HealthCERT), KSÖ, sectoral overlaps (DORA, equivalent sector acts)
/arckit:at-barrierefreiheit — Digital accessibility across both transposition tracks — BaFG (European Accessibility Act, private sector) and WZG (public sector), EN 301 549 / WCAG 2.1 AA, Barrierefreiheitserklärung, SMS and FFG
These layer cleanly on the existing baseline — fr-rgpd / at-dsgvo extend eu-rgpd, fr-pssi / at-nisg reference eu-nis2, and fr-secnumcloud integrates with arckit.research and arckit.evaluate for procurement workflows. Austrian commands carry [NEEDS VERIFICATION] markers where a point is genuinely open rather than unreviewed — further implementing ordinances under the NISG 2026, the applicable Land accessibility laws, current guidance versions, and recent DSB case law. nl-cloud and nl-tbb play the same role for Dutch deployments, with nl-cloud keying its public-cloud eligibility off the TBB category determined by nl-tbb.
Canada Federal Overlay (12 commands)
Federal Canadian regulatory baseline as a [COMMUNITY] overlay — covering FITAA (Bill C-70 2024), federal privacy and access (Privacy Act, ATI Act), Treasury Board Directive on Automated Decision-Making, Charter rights design review, ITSG-33 + Standard on Security Categorization, Security of Information Act handling, GC Cloud sovereign residency, GC Digital Standards conformance, Official Languages Act, federal procurement (PSPC + PSIB), and First Nations OCAP® data sovereignty.
Command
Type code
Purpose
/arckit:ca-fitaa
FITAA
Foreign Influence Transparency and Accountability Act compliance assessment
/arckit:ca-pia
PIA
Privacy Impact Assessment per Privacy Act + TBS Standard on PIA
/arckit:ca-atip
ATIP
Access to Information / Privacy Act reconciliation and severance design
/arckit:ca-aia
AIA
Algorithmic Impact Assessment per TBS Directive on Automated Decision-Making (Levels I–IV)
/arckit:ca-charter
CHRT
Charter rights design review (s.2 / s.7 / s.8 / s.15) with Oakes proportionality
/arckit:ca-itsg-33
ITSG
ITSG-33 Statement of Applicability + Standard on Security Categorization
/arckit:ca-soia
SOIA
Security of Information Act handling plan for SECRET / TOP SECRET systems
/arckit:ca-cloud-residency
CACR
GC Cloud sovereign residency assessment with CLOUD-Act analysis
/arckit:ca-gc-digital-standards
DIGSTD
Government of Canada Digital Standards conformance scorecard
/arckit:ca-ola
OLA
Official Languages Act review (Parts IV / V / VI)
/arckit:ca-pspc
PROC
Federal procurement strategy (PSPC Supply Manual + PSIB 5%)
/arckit:ca-ocap
OCAP
First Nations OCAP® sovereignty assessment with FNIGC pre-engagement gate
Help wanted: looking for a Canadian federal enterprise architect to co-maintain this overlay. Open an issue or DM @tractorjuice.
UAE Federal Overlay (Community-contributed)
⚠️ Community-contributed overlay. The 12 commands below cover UAE federal regulatory and digital-government instruments and ship as a community-contributed overlay (not part of the officially-maintained baseline of 68). They are anchored on the UAE Cabinet decree of 23 April 2026 mandating that 50% of federal services run on agentic AI by April 2028, and on the federal data, identity, AI governance, and procurement frameworks the decree references. The overlay is currently solo-maintained by @tractorjuice; a UAE domain co-maintainer is being recruited before the overlay can be re-evaluated for official-baseline promotion. Six citations are flagged [NEEDS VERIFICATION] pending Executive Regulations and authority confirmations — see docs/guides/uae-overlay-maintenance.md. Output should be reviewed by qualified UAE federal compliance counsel before reliance.
Set governance_framework: UAE Federal and classification_scheme: UAE Smart Data in plugin userConfig to switch the Document Control header into UAE Smart Data classification rendering across every artefact.
Federal data and security:
/arckit:uae-classification — UAE Smart Data Classification Register (Open / Confidential / Sensitive / Secret, the four Smart Data Framework classes) with handling rules and declassification schedule
/arckit:uae-pdpl — Federal Decree-Law No. 45 of 2021 (PDPL) compliance assessment — DPIA, lawful-basis register, data-subject-rights procedure, cross-border transfer log
/arckit:uae-ias — UAE Cybersecurity Council Information Assurance Standard v2 — Statement of Applicability against 188 controls (60 management M1–M6, 128 technical T1–T9), priority-tiered P1–P4
/arckit:uae-cloud-residency — National Cloud Security Policy v2 sovereign cloud assessment — per-classification residency, candidate CSPs (Core42 / G42, Microsoft UAE North/Central, TDRA FedNet, e& Sovereign Launchpad on AWS) checked against the policy's tiers and minimum certifications, shared-responsibility matrix, exit/portability plan
/arckit:uae-zero-bureaucracy — Service Catalogue review under the UAE Code for Government Services and Zero Bureaucracy programme
/arckit:uae-digital-records — Digital Records Plan under the UAE Government Services Digital Records Policy (source-of-truth register per service, retention schedule, official-source designation)
/arckit:uae-data-sharing — Data Sharing Agreement under the UAE Government Services Data Sharing Policy ("collect once, use securely") with PDPL lawful basis per share
/arckit:uae-priorities-alignment — National Priorities Alignment Statement under the UAE Federal Government Guide — reuse-vs-build, capability-reuse register (UAE Pass, FedNet), strategy alignment to NIS 2031 / AI 2031 / We the UAE 2031
AI governance:
/arckit:uae-ai-charter — UAE Charter for the Development and Use of AI compliance assessment (12 principles)
/arckit:uae-procurement — Federal procurement strategy under Federal Decree-Law No. 11 of 2023 — ITT/RFP packs against MoF Digital Procurement Platform templates, In-Country Value (ICV) plan, evaluation report structure, contract register
The commands chain together in a canonical order from principles → uae-classification → uae-pdpl → uae-ias → uae-cloud-residency → uae-uaepass → uae-zero-bureaucracy → uae-digital-records → uae-data-sharing → uae-ai-charter → uae-ai-autonomy-tier → uae-priorities-alignment → uae-procurement → sobc → wardley → framework. Full guide: docs/guides/uae-overlay.md.
UK NHS Clinical Safety Overlay (Community-contributed)
⚠️ Community-contributed overlay — second sector-specific overlay in ArcKit, after arckit-uk-finance. The 4 commands below cover NHS clinical safety (DCB0129 manufacturer + DCB0160 deployer), NHS DTAC procurement assurance, and UK MDR 2002 + EU MDR 2017/745 software-as-medical-device classification. Adopts Dr Marcus Baw's SAFETY.md spec for DCB0129/0160 file naming and YAML-frontmatter hazard log. Output is not clinical, legal, or regulatory advice — MUST be reviewed by a qualified Clinical Safety Officer (CSO with appropriate GMC / NMC / HCPC / GPhC registration) and, for MDR classification, by a qualified Regulatory Affairs specialist before reliance.
Clinical safety (DCB0129 + DCB0160):
/arckit:uk-nhs-dcb0129 — NHS DCB0129 manufacturer Clinical Safety Case + Hazard Log. Produces a 3-file set in projects/{NNN}/clinical-safety/: SAFETY.md (front-door anchor), SAFETY-CASE.md (GSN-inspired safety argument), HAZARD-LOG.md (YAML-frontmatter hazard array + rendered Markdown table; 6 starter hazards covering wrong-patient, stale data, audit, authorisation, alert delivery, write integrity)
/arckit:uk-nhs-dcb0160 — NHS DCB0160 deployer Clinical Safety Case + Deployment Hazard Log. Produces a 3-file deployer-side set in projects/{NNN}/clinical-safety/deployment/; 10 starter deployment hazards covering training, workflow integration, BC, parallel running, migration, local configuration, terminology, RBAC, incident reporting
Procurement and regulation:
/arckit:uk-nhs-dtac — NHS Digital Technology Assessment Criteria, following the DTAC form version 2.0 (24 February 2026; required from 6 April 2026): context sections A and B, assessed sections C1–C4 (Clinical safety, Data protection, Technical security, Interoperability) and scored section D1 (Usability and accessibility), plus an optional AI supplement outside DTAC. Cross-references DCB0129, MDR classification, DPIA, ATRS, Secure by Design
/arckit:uk-mdr-classification — UK MDR 2002 (as amended) + EU MDR 2017/745 software-as-medical-device (SaMD) and AI-as-medical-device (AIaMD) classification. UKCA / UKNI / CE marking pathway, Windsor Framework NI handling, conformity-assessment route, MHRA SaMD/AIaMD Programme alignment, ISO 14971 / IEC 62304 / ISO 13485 standards mapping, post-market obligations
The commands compose with — not replace — the UK government baseline (tcop, secure, dpia, atrs, risk, service-assessment). Recipe: uk-nhs-clinical-safety (44 targets across the clinical-safety waves). Proposed domain co-maintainer: Dr Marcus Baw (@pacharanero) — clinical informatician at RCPCH, openEHR, NHS England.
The DCB0129/0160 outputs deliberately do not carry the ARC- prefix — they follow Marcus's SAFETY.md spec convention so they remain readable by clinicians, MHRA reviewers, and procurement teams who do not use ArcKit. Other artefacts cross-reference them by relative path. Full design log (as committed in #501): docs/superpowers/specs/2026-05-19-uk-nhs-overlay-design.md.
USA Federal Civilian Overlay (10 commands)
⚠️ Community-contributed overlay. The 10 commands below cover US federal civilian compliance instruments (FedRAMP authorization, FISMA / NIST 800-53 Rev 5, CISA Zero Trust Maturity Model, OMB M-19-17 ICAM, NIST AI RMF + OMB M-25-21/M-25-22 AI assurance, E-Government Act §208 PIA, EO 14028 SBOM self-attestation). They ship as the arckit-us community-contributed overlay (not part of the officially-maintained baseline of 72). EO 14110 was revoked January 2025; the live AI mandates are OMB M-25-21 (use of AI; it rescinded and replaced M-24-10 on 3 April 2025) + M-25-22 (acquisition of AI; it replaced M-24-18). FedRAMP completed the Rev 5 transition in 2024. The overlay is currently solo-maintained by @tractorjuice; a US federal-civilian domain co-maintainer is being recruited (CISO / SAOP / FedRAMP PMO / CAIO backgrounds welcome) before the overlay can be re-evaluated for official-baseline promotion. Output should be reviewed by qualified US federal counsel before reliance.
In scope (v1): federal civilian agencies and the vendors that sell to them.
Out of scope (sibling overlays for the future): federal defense (CMMC / RMF / DISA STIGs), state regimes (StateRAMP / TX-RAMP / CJIS / IRS Pub 1075 / CCPA), sector-specific (HIPAA / GLBA / SOX / FERPA / PCI DSS), Section 508 accessibility (deferred to v5.2).
Install: claude plugin install arckit arckit-us. See docs/guides/us-federal-overlay.md for the USA Federal Civilian overlay maintenance guide and citation register.
UK Finance Payments Overlay (4 commands) — First Sector Overlay
EXPERIMENTAL sector overlay. The 4 commands below cover established UK Payment Service Providers, E-Money Institutions and Payment Institutions working under an FCA authorisation: SCA-RTS exemption design, safeguarding under the EMRs 2011, PSRs 2017 and CASS 15, the FCA Consumer Duty board report, and Critical Third Parties dependencies. They ship as the arckit-uk-finance community-contributed overlay — the first sector-specific overlay (distinct from the 8 jurisdictional overlays). Output requires review by qualified UK FS regulatory counsel, MLRO, and the firm's accountable senior managers (SMF holders only where the firm is within SM&CR) before implementation.
Payments architecture and compliance:
/arckit:uk-fs-sca-rts — SCA-RTS exemption design: the ten exemptions in UK SCA-RTS Articles 10 to 18 (FCA technical standards under PSRs 2017 regulation 106A), TRA reference fraud rates and the Article 20 cessation rule, fraud monitoring (FSSCA)
/arckit:uk-fs-safeguarding — EMI / PI safeguarding assessment under EMRs 2011 regulations 20 to 22, PSRs 2017 regulation 23 and CASS 15 (from 7 May 2026), including the monthly safeguarding return; CRITICAL severity (FSSAFE)
/arckit:uk-fs-consumer-duty — FCA Consumer Duty annual board report under Principle 12 and PRIN 2A (FSCD)
/arckit:uk-fs-ctp-dependency — Critical Third Parties dependency register and resilience testing plan under PS24/16 and FSMA 2023 (FSCTP)
Recipe: uk-fs-payments (11 targets across baseline and overlay commands).
Install: claude plugin install arckit arckit-uk-finance. Help wanted: recruiting a UK financial services domain co-maintainer (CISO / Compliance / Head of Architecture background welcome) to transition to official-baseline status.
UK G-Cloud Supplier Bid-Authoring Overlay (15 commands) — Proprietary
PROPRIETARY, Claude Code only. The 15 commands below are a supplier-side overlay for authoring UK G-Cloud 15 (RM1557.15) Digital Marketplace bids, run by the Government Commercial Agency (GCA, formerly CCS): supplier profile, social value, lot questions, the Procurement Act 2023 supplier declaration, service design, a Service Definition Document for each of the five lots (1a, 1b, 2a, 2b, 3), pricing, security evidence, competitor benchmarking, submission review, and a final submission pack. Unlike every other ArcKit plugin, arckit-uk-gcloud ships under a proprietary licence (not MIT) and is not distributed to the non-Claude extension formats (Codex / Gemini / OpenCode / Copilot) — it runs on Claude Code only. It is the 4th sector-specific overlay (after arckit-uk-finance, arckit-uk-nhs, arckit-au-energy) and requires the arckit core plugin.
/arckit:social-value — Social value commitments, Social Value Contact and operational readiness, 10% pass/fail on every lot (SOCV)
/arckit:lot-questions — Lot questions per lot group: conditions of participation, scored Lot 1a/1b quality answers, Lot 2 and Lot 3 mandatory award criteria (LOTQ)
/arckit:service-design — Service design, lot choice and value proposition (SVCD)
/arckit:sdd-lot1a — Service Definition Document, Lot 1a IaaS and PaaS (SDD)
/arckit:sdd-lot1b — Service Definition Document, Lot 1b IaaS and PaaS above OFFICIAL (SDD)
/arckit:sdd-lot2a — Service Definition Document, Lot 2a Infrastructure Software as a Service (SDD)
/arckit:sdd-lot2b — Service Definition Document, Lot 2b Software as a Service (SDD)
/arckit:sdd-lot3 — Service Definition Document, Lot 3 Cloud Support, with the DDaT role levels that deliver it (SDD)
/arckit:pricing — Pricing by lot: 1a/1b price formula, 2a/2b discount bands; for Lot 3, the supplier's one DDaT rate card, shared by every Lot 3 service (PRIC, RATE)
/arckit:security — Security evidence: certifications by lot and the NCSC Cloud Security Principles (SECA)
/arckit:review — G-Cloud submission review and gap analysis (GCRV)
/arckit:submission-pack — Assemble the final G-Cloud submission pack
Recommended order: supplier-profile → social-value → service-design → the lot's SDD command → pricing and security → lot-questions → declaration → review → submission-pack. The lot questions come after the SDDs because their award criteria repeat each service's answers.
Skills: gcloud-framework (G-Cloud 15 question set, limits and evaluation), cloud-security, ddat-rate-card (Lot 3 job families, roles and levels; replaces sfia-skills). Recipe: uk-gcloud-submission (end-to-end bid assembly). G-Cloud 14 is no longer supported: /arckit:sdd-lot1 is replaced by sdd-lot1a and sdd-lot1b, and /arckit:sdd-lot2 by sdd-lot2a and sdd-lot2b.
Install: claude plugin install arckit arckit-uk-gcloud. Proprietary — see the licence-exception note at the foot of this README. Ported from the standalone gcloud-kit plugin.
TOGAF ADM Overlay (arckit-togaf-adm) [COMMUNITY]
Enterprise Architecture Development Method — 9 commands covering the full ADM cycle.
Command
Doc Type
Phase
Description
/arckit:adm-preliminary
ADMP
Preliminary
Architecture vision, scope, drivers, constraints
/arckit:business-capability-map
BPCM
Phase B
Business capability hierarchy, value streams, maturity
/arckit:application-inventory
APP
Phase C
Application catalog with strategic fit scoring
/arckit:application-rationalization
APPR
Phase C
Keep/merge/replace/retire decisions
/arckit:gap-analysis
GAPA
Phase E
Capability gap matrix, workstream mapping
/arckit:transition-architecture
TRANS
Phase F
Work packages, migration waves, acceptance criteria
/arckit:architecture-board
BORD
Phase G
Board charter, compliance scorecard, governance
/arckit:architecture-change
ACHG
Phase H
Change requests, ADM cycle re-entry
/arckit:architecture-repository
REPO
Repository
Patterns, standards, reference architectures
Install:claude plugin install arckit arckit-togaf-admRecipe:togaf-adm-full — full ADM cycle via build recipe
O-AA Overlay (arckit-oaa) [COMMUNITY]
Open Agile Architecture (O-AA Standard, Version 2.0, C262) — agile enterprise architecture for product-driven, sprint-based delivery. A standalone overlay alongside arckit-togaf-adm; the two are complementary, not competitors — see the O-AA vs TOGAF ADM decision guide.
The two overlays are complementary, not competitors. Each depends only on the arckit core (=6.18.3 pin) — neither depends on the other. O-AA maps the ADM cycle onto sprints within a 4–8 week engagement; arckit-togaf-adm keeps the full document-centric ADM. Decision guide: O-AA vs TOGAF ADM.
Pattern
When to use
Sequence
A — Baseline, then sprints (recommended when both apply)
Regulatory audit trail and sprint delivery
TOGAF togaf-adm-full → O-AA oaa-full on the same project
B — O-AA only
Hard deadline < 8 weeks, agile culture, product-centric; no enterprise baseline needed
O-AA oaa-full (foundation targets come from core)
C — TOGAF ADM only
Full regulatory audit, 50+ stakeholder gates, quarterly architecture boards
TOGAF togaf-adm-full
Install for pattern A (one plugin per CLI invocation; community plugins install disabled):
claude plugin install arckit
claude plugin install arckit-togaf-adm && claude plugin enable arckit-togaf-adm
claude plugin install arckit-oaa && claude plugin enable arckit-oaa
Running both in the same project:
No collisions: separate namespaces (/arckit-togaf-adm: vs /arckit-oaa:) and doc-type codes; one core install satisfies both =6.18.3 pins.
No schema files are shared between the overlays. The O-AA YAML sprint artefacts are defined in the O-AA templates and kept consistent with the matching TOGAF documents: vision.yaml with the ADM Preliminary, which oaa-adm-lite reads, and implementation-strategy.yaml with the transition architecture. oaa-adm-lite sends Sprint 4+ architecture change requests through /arckit-togaf-adm:architecture-change. agile-governance defines its own change-request.yaml and compliance-evidence.yaml (the latter shared with agile-security) and does not read architecture-change output.
Order: run the TOGAF baseline first, then let O-AA sprints execute it at sprint velocity. O-AA commands read TOGAF outputs when they exist (ADM Preliminary, business capability map, transition architecture) but do not require them, so the reverse order works mechanically — you just lose the "sprints execute the baseline" benefit.
AI Agent Architecture Overlay (arckit-agent-architecture) [COMMUNITY]
Governance, design, and security for autonomous AI agent programs — 6 commands.
Command
Doc Type
Description
/arckit:agent-inventory
AAGI
Agent catalog with capabilities, security classification
Service Standard gates: Alpha/Beta/Live assessment milestones (UK Government)
Dependencies: Mermaid flowchart showing initiative sequencing and critical path
Success metrics: Cloud adoption %, technical debt reduction, deployment frequency, time to market
Traceability: Links roadmap themes to stakeholder drivers, architecture principles, requirements
UK Government specifics: Spending Review alignment, TCoP compliance timeline, NCSC CAF progression
Use this when: You have a multi-year transformation program with multiple initiatives running in parallel. Roadmaps are strategic (multi-year, multi-initiative, executive communication) vs project plans which are tactical (single initiative, detailed tasks, team execution).
Roadmap feeds into: /arckit:plan for detailed phase execution, /arckit:sobc for investment business case, /arckit:backlog for prioritized user stories, /arckit:strategy for executive-level synthesis.
Phase 7.6: Architecture Strategy Synthesis
/arckit:strategy → Synthesise strategic artifacts into executive-level Architecture Strategy
Create a comprehensive Architecture Strategy document that synthesises multiple strategic artifacts into a single coherent narrative:
Strategic vision: 2-3 paragraphs articulating the transformation vision and success definition
Strategic drivers: Summarised from stakeholder analysis with external drivers (regulatory, market, technology)
Guiding principles: Key principles with strategic implications, compliance summary
Current state assessment: Technology landscape, capability maturity baseline (L1-L5), technical debt, SWOT
Use this when: You have multiple strategic artifacts (principles, stakeholders, wardley, roadmap, sobc) and need to create a single executive-level document that synthesises them into a coherent strategy. Ideal for Strategy Board presentations, executive briefings, or stakeholder communication.
Unique requirement: This is the only ArcKit command with TWO mandatory inputs (principles AND stakeholders). Strategy cannot be created without understanding both the decision framework and the stakeholder drivers.
Strategy feeds into: /arckit:requirements for detailed requirements, /arckit:roadmap for expanded timeline, /arckit:plan for project delivery.
Phase 7.7: Architecture Decision Records
/arckit:adr → Document architectural decisions
Create Architecture Decision Records (ADRs) following MADR v4.0 format enhanced with UK Government requirements:
Context and problem statement: Why this decision is needed, business/technical/regulatory drivers
Decision drivers: Technical forces (performance, security, scalability), business forces (cost, time), compliance forces (GDS Service Standard, TCoP, NCSC, UK GDPR)
Options analysis: Minimum 2-3 options plus "Do Nothing" baseline, each with pros/cons, cost (CAPEX/OPEX/TCO), GDS Service Standard impact, Wardley evolution stage
Y-Statement: Structured justification - "In the context of X, facing Y, we decided for Z to achieve A, accepting B"
UK Government specifics: Escalation levels (Team → Cross-team → Department → Cross-government), governance forums (ARB, TDA, Programme Board), Service Standard/TCoP compliance documentation
Use this when: Making significant architectural decisions that affect system structure, quality attributes, or behavior - technology choices (databases, frameworks, cloud services), integration patterns, security approaches, deployment strategies, data management.
Periodically assess governance quality across all artifacts:
Architecture principles compliance
Requirements coverage and traceability
Stakeholder alignment verification
Risk management completeness
Design review quality
Documentation completeness and quality
Gap identification and recommendations
When to use: Run periodically (before milestones, design reviews, or procurement decisions) to identify gaps and ensure governance standards are maintained.
