ArcKit: The Enterprise Architecture Governance Harness

GitHub Stars GitHub Forks License: MIT Latest Release GitHub Issues Ask DeepWiki

ArcKit: The Enterprise Architecture Governance Harness

Build better enterprise architecture through structured strategy, design, delivery, and assurance workflows.

ArcKit is a toolkit for enterprise architects that transforms architecture governance from scattered documents into a systematic, AI-assisted workflow for:

  • 🏛️ Establishing and enforcing architecture principles
  • 👥 Analyzing stakeholder drivers, goals, and outcomes
  • 🛡️ Risk management (HM Treasury Orange Book)
  • 💼 Business case justification (HM Treasury Green Book SOBC)
  • 📋 Creating comprehensive requirements documents
  • 🗄️ Data modeling with ERD, GDPR compliance, and data governance
  • 🔬 Technology research with build vs buy analysis (web search powered)
  • ☁️ Azure-specific research using Microsoft Learn MCP for authoritative documentation
  • 🗺️ Strategic planning with Wardley Mapping
  • 📊 Generating visual architecture diagrams (Mermaid)
  • 🤝 Managing vendor RFP and selection processes
  • ✅ Conducting formal design reviews (HLD/DLD)
  • 🔧 ServiceNow service management design
  • 🔗 Maintaining requirements traceability
  • 📎 Citation traceability for external documents (inline [DOC-CN] markers with source quotes)

Star History

Quick Start

Installation

Claude Code (premier experience) — install the ArcKit plugin (requires v2.1.200+):

First, make sure Claude Code is on the latest version:

claude install latest

Then in Claude Code:

/plugin marketplace add tractorjuice/arckit-claude

Then install from the Discover tab, or via CLI. The marketplace ships 15 plugins — install only the overlays you need:

# Core (75 commands — UK Government civilian + generic enterprise)
claude plugin install arckit@arckit-claude

# Core + UAE federal
claude plugin install arckit arckit-uae

# Broad overlay set (UK + UAE + FR + CA + EU + AT + AU + US + UK-NHS + UK-GCloud)
claude plugin install arckit arckit-{uae,fr,ca,eu,at,au,us,uk-nhs,uk-gcloud}

# Enterprise architecture and AI agent governance overlays
claude plugin install arckit arckit-togaf-adm arckit-agent-architecture

The standalone tractorjuice/arckit-claude marketplace hosts all Claude Code plugins: the arckit core plugin, regional overlays, sector overlays, the TOGAF ADM and AI agent architecture overlays, the arckit-fde tooling plugin, and the public-but-proprietary arckit-uk-gcloud supplier overlay. The 13 community plugins (arckit-uae, arckit-fr, arckit-ca, arckit-eu, arckit-at, arckit-au, arckit-au-energy, arckit-us, arckit-uk-finance, arckit-uk-nhs, arckit-uk-gcloud, arckit-togaf-adm, arckit-agent-architecture) require the arckit core plugin. arckit-au-energy (sector) additionally requires arckit-au (jurisdiction), which it composes — install with claude plugin install arckit arckit-au arckit-au-energy. arckit-uk-gcloud is a proprietary, Claude Code only supplier-side G-Cloud bid-authoring overlay — it is public for installation and inspection, but not MIT licensed and not distributed to the non-Claude extension formats. One tooling plugin — arckit-fde — is a lean, Claude Code only plugin with one command, /arckit-fde:create, that generates a brandable (white-label) Forward Deploy Engineering consulting website into docs/ (GitHub Pages ready), with UK Public Sector and Generic market presets; no dependencies, not converted to non-Claude formats, no governance doc-types.

The older tractorjuice/arc-kit marketplace remains available for compatibility, but new Claude Code installs should use tractorjuice/arckit-claude. Claude Code is the primary development platform for ArcKit and provides the most complete experience: all official commands, autonomous research agents, automation hooks, bundled MCP servers (AWS Knowledge, Microsoft Learn, Google Developer Knowledge, govreposcrape, uk-tenders), and automatic updates via the marketplace. See Why Claude Code? below.

Why v2.1.200? v2.1.200 fixes project-scoped plugin loading from git worktrees and claude agents --plugin-dir <dir> visibility for plugin agents/skills, which makes ArcKit's branch and test-repo workflows reliable. It also carries the v2.1.198-v2.1.199 background-subagent reliability, parent error-propagation, and hook stderr-visibility fixes that matter to /arckit:build, reader/writer handoffs, and hook diagnosis. v2.1.197 makes Claude Sonnet 5 the default Claude Code model with native 1M context, while v2.1.172 fixed wildcard-domain WebFetch permission rules (WebFetch(domain:*.gov.uk)) that never matched subdomains on earlier clients — the exact shape ArcKit recommends for confining research-agent traffic in OFFICIAL-SENSITIVE deployments. The floor also carries forward the v2.1.156 Opus 4.8 thinking-block fix, v2.1.154 plugin defaultEnabled: false, v2.1.144 session-title and headless Skill tool fixes, v2.1.143 plugin dependency enforcement, v2.1.139 hook args: string[], v2.1.129 monitor layout and prompt-cache fixes, v2.1.121 MCP/provenance hook unlocks, v2.1.118-v2.1.119 release/telemetry unlocks, and the earlier /context, Auto mode, plugin update, MCP leak, retry, and subagent working-directory fixes.

Gemini CLI — install the ArcKit extension:

gemini extensions install https://github.com/tractorjuice/arckit-gemini

Zero-config: all 75 official commands, templates, scripts, and bundled MCP servers (AWS Knowledge, Microsoft Learn). Updates via gemini extensions update arckit.

GitHub Copilot (VS Code) — install the ArcKit CLI and scaffold prompt files:

# Install with pip
pip install git+https://github.com/tractorjuice/arc-kit.git

# Scaffold a project with Copilot prompt files
arckit init my-project --ai copilot

Creates .github/prompts/arckit-*.prompt.md (80 prompt files), .github/agents/arckit-*.agent.md (10 custom agents), and .github/copilot-instructions.md (repo-wide context). Invoke commands in Copilot Chat as /arckit-requirements, /arckit-stakeholders, etc.

Codex CLI — install the ArcKit CLI:

# Install with pip
pip install git+https://github.com/tractorjuice/arc-kit.git

# Or with uv
uv tool install arckit-cli --from git+https://github.com/tractorjuice/arc-kit.git

# Or run without installing
uvx --from git+https://github.com/tractorjuice/arc-kit.git arckit init my-project

Mistral Vibe CLI — link the ArcKit extension:

# Clone the standalone extension repository
git clone https://github.com/tractorjuice/arckit-vibe.git
cd arckit-vibe

# Create extensions directory and link
mkdir -p ~/.vibe/extensions/
ln -s $(pwd) ~/.vibe/extensions/arckit

Zero-config: 75 official commands as skills, 10 specialized agents, all templates, and bundled MCP servers (AWS Knowledge, Microsoft Learn, Google Developer Knowledge, GovRepoScrape).

Latest Release: v6.3.0

OKF Interoperability

ArcKit can exchange Markdown knowledge bundles using an Open Knowledge Format-shaped frontmatter layer:

  • /arckit:export-okf copies ArcKit ARC-*.md artifacts into an OKF bundle with portable type, title, resource, tags, timestamp, and arckit metadata.
  • /arckit:import-okf scans an OKF bundle, writes .arckit/tmp/okf-import-report.json, and materializes safe imports as RSCH review notes by default.
  • Native ArcKit files remain unchanged unless you explicitly enable source frontmatter stamping with ARCKIT_OKF_FRONTMATTER=1 or .arckit/config.json containing { "okfFrontmatter": true }.

Platform Support

Platform Claude Code Plugin Gemini CLI Extension GitHub Copilot Codex / OpenCode CLI Mistral Vibe
macOS Full support Full support Full support Full support Full support
Linux Full support Full support Full support Full support Full support
Windows (WSL2) Full support Full support Full support Full support Full support
Windows (native) Full support Full support Full support Partial Full support

Windows users: The Claude Code plugin, Gemini CLI extension, GitHub Copilot prompt files, and Mistral Vibe extension work natively on all platforms. For Codex CLI / OpenCode CLI on native Windows (without WSL), some commands containing inline bash snippets may require Git Bash or WSL2. We recommend WSL2 for the best experience.

Initialize a Project

Claude Code: No initialization needed — the plugin provides everything.

Mistral Vibe: No initialization needed — the extension provides everything.

GitHub Copilot (VS Code):

# Create a new architecture governance project
arckit init payment-modernization --ai copilot

# Or initialize in current directory
arckit init . --ai copilot

OpenCode CLI:

# Create a new architecture governance project
arckit init payment-modernization --ai opencode

# Or initialize in current directory
arckit init . --ai opencode

Codex CLI:

# Create a new architecture governance project
arckit init payment-modernization --ai codex

# Minimal install (skip docs and guides)
arckit init payment-modernization --ai codex --minimal

# Or initialize in current directory
arckit init . --ai codex

Start Using ArcKit

# GitHub Copilot (VS Code)
cd payment-modernization && code .
# In Copilot Chat, use ArcKit commands:
/arckit-principles Create principles for a financial services company
/arckit-requirements Build a payment processing system...

# Codex CLI
cd payment-modernization
codex
# Inside your AI assistant, use ArcKit commands:
/arckit:principles Create principles for a financial services company
/arckit:requirements Build a payment processing system...
/arckit:sow Generate RFP for vendor selection

# Mistral Vibe CLI
cd payment-modernization
vibe
# Use ArcKit skills:
/arckit-principles Create principles for a financial services company
/arckit-requirements Build a payment processing system...
/arckit-sow Generate RFP for vendor selection

# Or use specialized agents:
vibe --agent arckit-research "Research cloud providers"

Upgrading

Claude Code plugin: Updates are automatic via the marketplace — no action needed.

Gemini CLI extension: Updates via gemini extensions update arckit.

GitHub Copilot: Re-run arckit init --here --ai copilot to update prompt files, agents, and instructions.

Mistral Vibe: Pull the latest standalone extension repo: cd ~/.vibe/extensions/arckit && git pull.

Codex CLI:

# Step 1: Upgrade the CLI tool
pip install --upgrade git+https://github.com/tractorjuice/arc-kit.git
# Or with uv:
uv tool upgrade arckit-cli --from git+https://github.com/tractorjuice/arc-kit.git

# Step 2: Update your existing project (re-run init in place)
cd /path/to/your-existing-project
arckit init --here --ai codex

This updates commands, templates, scripts, and agents while preserving your project data (projects/) and custom templates (.arckit/templates-custom/).

If upgrading from v0.x, you may also need to migrate legacy filenames — see the upgrading guide for full details.

Explore Example Outputs

Public demonstration repositories showcase complete ArcKit deliverables:

What it costs (plugin footprint)

Token cost of installing the arckit core plugin in a Claude Code session, captured from claude plugin details arckit on v2.1.143+:

  • Always-on per session: ~10,042 tokens — added to every session's system context, covering the 73 command-skills + 5 utility skills (architecture-workflow, arckit-build, mermaid-syntax, plantuml-syntax, wardley-mapping) + 16 agent descriptors. Hooks (9 events) and MCP servers (6) are harness-resolved at runtime and not counted.
  • On-invoke: ~250 to ~60K tokens per command — paid only when a specific skill or agent fires. Most commands are in the 5–10K range.

On-invoke cost by command

Costs are estimates from the Claude Code tokenizer and may differ from actual usage. Use this table to budget research-heavy multi-command sessions.

Tier Range Commands
Lightweight <2K start, init, build, search, impact, navigator, graph-report, framework, gov-landscape, aws-research, azure-research, gcp-research
Standard 2–7K customize, score, principles, mermaid-syntax, plantuml-syntax, architecture-workflow, datascout, tenders, competitors, evaluate, hld-review, mlops, devops, finops, research, tcop, wardley-mapping, template-builder, glossary, dld-review, traceability, stakeholders, presentation, dfd, operationalize, requirements, maturity-model, data-model, gov-reuse, strategy, presentation, atrs, gov-code-search, READER-PATTERN
Heavy 7–15K wardley.value-chain, gcloud-clarify, ai-playbook, sow, sobc, risk, secure, dpia, dos, mod-secure, plan, conformance, roadmap, health, wardley.doctrine, wardley.gameplay, pages, servicenow, gcloud-search, principles-compliance, story, wardley, wardley.climate, data-mesh-contract, platform-design, adr, arckit-build, grants
Research-heavy 15–25K service-assessment, analyze, backlog, diagram
Specialist >25K jsp-936 (~60K — MOD JSP 936 AI assurance, defence-only)

Trimming the footprint

  • The five utility skills already use paths: globs to scope their always-on cost to relevant projects (mermaid-syntax only loads under *.mmd, wardley-mapping under WARD artefacts, etc.). The 73 command-skills are listed but not described in detail in the always-on context — the full prompt only loads on invocation.
  • Community overlays (arckit-uae, arckit-fr, arckit-ca, arckit-eu, arckit-at, arckit-au, arckit-au-energy, arckit-us, arckit-uk-finance, arckit-uk-nhs) are independent plugins — install only the jurisdictions / sectors you need. Each adds its own always-on baseline. arckit-uk-finance, arckit-uk-nhs, and arckit-au-energy are sector overlays (arckit-au-energy layers the energy sector on the arckit-au jurisdiction baseline); the rest are jurisdiction-based.
  • Heavy commands (jsp-936, analyze, diagram, backlog) are on-invoke only; the always-on cost is unaffected by which heavy commands exist.

To measure your own session footprint, run /context all (Claude Code v2.1.139+) for per-skill token estimates against your active model.

Why ArcKit?

Problem: Architecture Governance is Broken

Traditional enterprise architecture suffers from:

  • ❌ Scattered documents across tools (Word, Confluence, PowerPoint)
  • ❌ Inconsistent governance enforcement
  • ❌ Manual vendor evaluation with bias
  • ❌ Lost traceability between requirements and design
  • ❌ Stale documentation that doesn't match reality

Solution: Structured, AI-Assisted Governance

ArcKit provides:

  • ✅ Template-Driven Quality: Comprehensive templates ensure nothing is forgotten
  • ✅ Systematic Workflows: Clear processes from requirements → procurement → design review
  • ✅ AI Assistance: Let AI handle document generation, you focus on decisions
  • ✅ Enforced Traceability: Automatic gap detection and coverage analysis
  • ✅ Version Control: Git-based workflow for all architecture artifacts

UK Government Compliance

ArcKit includes dedicated commands for UK public sector delivery:

  • /arckit:tcop — Assess all 13 Technology Code of Practice points across delivery phases.
  • /arckit:ai-playbook — Produce responsible AI assessments aligned to the UK Government AI Playbook and ATRS.
  • /arckit:secure — Generate Secure by Design artefacts covering NCSC CAF, Cyber Essentials, and UK GDPR controls.
  • /arckit:mod-secure — Map MOD Secure by Design requirements (JSP 440, IAMM, clearance pathways).
  • /arckit:jsp-936 — Deliver JSP 936 AI assurance packs for defence AI systems.

See the demo repositories for end-to-end examples, especially arckit-test-project-v7-nhs-appointment (civilian services) and arckit-test-project-v9-cabinet-office-genai (AI governance).

EU, French & Austrian Regulatory Compliance (Community)

⚠️ Community-contributed. EU and French commands are domain-maintained by @thomas-jardinet; Austrian commands are a seed contribution inviting an Austrian domain maintainer. The 21 commands below cover EU regulations (GDPR, NIS2, AI Act, DORA, CRA, DSA, Data Act), French government standards (SecNumCloud, ANSSI, EBIOS, CNIL, DINUM, etc.), and Austrian government standards (DSG, NISG 2024, BVergG 2018). They are not part of the officially-maintained baseline — output should be reviewed by qualified DPO / CISO / Vergabejurist / legal counsel before reliance, and citations may lag current source text. Each command surfaces with a [COMMUNITY] prefix in /help listings and renders a warning banner before generating.

EU regulations (member-state-neutral baselines, applicable across EU/EEA):

  • /arckit:eu-rgpd — GDPR (EU 2016/679) compliance assessment — legal basis, data subject rights, transfers, DPIA screening, breach notification
  • /arckit:eu-nis2 — NIS2 Directive — operators of essential / important entities, Article 21 measures, incident reporting timelines
  • /arckit:eu-ai-act — EU AI Act (Regulation 2024/1689) — risk classification (prohibited / high-risk / GPAI), conformity routes
  • /arckit:eu-dora — Digital Operational Resilience Act (EU 2022/2554) — financial sector ICT risk, TLPT, third-party register
  • /arckit:eu-cra — Cyber Resilience Act (Regulation 2024/2847) — products with digital elements, SBOM, VDP, CE marking
  • /arckit:eu-dsa — Digital Services Act (Regulation 2022/2065) — intermediaries, platforms, VLOPs, ARCOM
  • /arckit:eu-data-act — Data Act (Regulation 2023/2854) — connected products, B2B FRAND, cloud switching, Article 27

French government (apply on top of the EU baseline for French deployments):

  • /arckit:fr-secnumcloud — SecNumCloud 3.2 qualification (sovereign cloud, OIV/OSE, extraterritorial risk)
  • /arckit:fr-dinum — DINUM standards: RGI, RGAA, RGESN, RGS, doctrine cloud de l'État, FranceConnect, DSFR
  • /arckit:fr-marche-public — French public procurement (code de la commande publique, UGAP, sovereignty clauses)
  • /arckit:fr-rgpd — CNIL-specific GDPR layer (cookies Délibération 2020-091, HDS, age 15, DPO registration)
  • /arckit:fr-ebios — EBIOS Risk Manager — 5-workshop study (VM/ER/SR/CO/SS/SO/MS IDs, MITRE ATT&CK, homologation)
  • /arckit:fr-anssi — ANSSI Guide d'hygiène informatique (42 measures) + cloud security recommendations
  • /arckit:fr-anssi-carto — ANSSI SI cartography across business / application / system / network levels
  • /arckit:fr-dr — Diffusion Restreinte handling under II 901 / SGDSN / ANSSI
  • /arckit:fr-algorithme-public — Public algorithm transparency notice (Article L311-3-1 CRPA, Loi République Numérique)
  • /arckit:fr-pssi — Information System Security Policy (PSSI) per ANSSI / RGS
  • /arckit:fr-code-reuse — Public code reuse assessment (code.gouv.fr, SILL, EUPL) — build-vs-reuse decision matrix

Austrian government (apply on top of the EU baseline for Austrian deployments — seed contribution pending a domain maintainer):

  • /arckit:at-dsgvo — Austrian DSG layer on GDPR (§§12–13 image processing, ELGA/GTelG health, §96a ArbVG employee monitoring, age 14 consent, DSB enforcement)
  • /arckit:at-nisg — Austrian NISG 2024 (NIS2 transposition) — Essential/Important designation, GovCERT reporting, KSÖ, AT sectoral authorities
  • /arckit:at-bvergg — Bundesvergabegesetz 2018 procurement — Oberschwellen/Unterschwellen, ANKÖ publication, Bestbieterprinzip, BVwG review

These layer cleanly on the existing baseline — fr-rgpd / at-dsgvo extend eu-rgpd, fr-pssi / at-nisg reference eu-nis2, and fr-secnumcloud integrates with arckit.research and arckit.evaluate for procurement workflows. Austrian commands carry extra [NEEDS VERIFICATION] markers reflecting their seed status — a future domain maintainer is expected to tighten the citations.

Canada Federal Overlay (12 commands)

Federal Canadian regulatory baseline as a [COMMUNITY] overlay — covering FITAA (Bill C-70 2024), federal privacy and access (Privacy Act, ATI Act), Treasury Board Directive on Automated Decision-Making, Charter rights design review, ITSG-33 + Standard on Security Categorization, Security of Information Act handling, GC Cloud sovereign residency, GC Digital Standards conformance, Official Languages Act, federal procurement (PSPC + PSAB), and First Nations OCAP® data sovereignty.

Command Type code Purpose
/arckit:ca-fitaa FITAA Foreign Influence Transparency and Accountability Act compliance assessment
/arckit:ca-pia PIA Privacy Impact Assessment per Privacy Act + TBS Directive on PIA
/arckit:ca-atip ATIP Access to Information / Privacy Act reconciliation and severance design
/arckit:ca-aia AIA Algorithmic Impact Assessment per TBS Directive on Automated Decision-Making (Levels I–IV)
/arckit:ca-charter CHRT Charter rights design review (s.2 / s.7 / s.8 / s.15) with Oakes proportionality
/arckit:ca-itsg-33 ITSG ITSG-33 Statement of Applicability + Standard on Security Categorization
/arckit:ca-soia SOIA Security of Information Act handling plan for SECRET / TOP SECRET systems
/arckit:ca-cloud-residency CACR GC Cloud sovereign residency assessment with CLOUD-Act analysis
/arckit:ca-gc-digital-standards DIGSTD Government of Canada Digital Standards conformance scorecard
/arckit:ca-ola OLA Official Languages Act review (Parts IV / V / VI)
/arckit:ca-pspc PROC Federal procurement strategy (PSPC Supply Manual + PSAB 5%)
/arckit:ca-ocap OCAP First Nations OCAP® sovereignty assessment with FNIGC pre-engagement gate

Help wanted: looking for a Canadian federal enterprise architect to co-maintain this overlay. Open an issue or DM @tractorjuice.

UAE Federal Overlay (Community-contributed)

⚠️ Community-contributed overlay. The 12 commands below cover UAE federal regulatory and digital-government instruments and ship as a community-contributed overlay (not part of the officially-maintained baseline of 68). They are anchored on the UAE Cabinet decree of 23 April 2026 mandating that 50% of federal services run on agentic AI by April 2028, and on the federal data, identity, AI governance, and procurement frameworks the decree references. The overlay is currently solo-maintained by @tractorjuice; a UAE domain co-maintainer is being recruited before the overlay can be re-evaluated for official-baseline promotion. Six citations are flagged [NEEDS VERIFICATION] pending Executive Regulations and authority confirmations — see docs/guides/uae-overlay-maintenance.md. Output should be reviewed by qualified UAE federal compliance counsel before reliance.

Set governance_framework: UAE Federal and classification_scheme: UAE Smart Data in plugin userConfig to switch the Document Control header into UAE Smart Data classification rendering across every artefact.

Federal data and security:

  • /arckit:uae-classification — UAE Smart Data Classification Register (Open / Shared / Confidential / Secret / Top Secret) with handling rules and declassification schedule
  • /arckit:uae-pdpl — Federal Decree-Law No. 45 of 2021 (PDPL) compliance assessment — DPIA, lawful-basis register, data-subject-rights procedure, cross-border transfer log
  • /arckit:uae-ias — UAE Cybersecurity Council Information Assurance Standard v2 — Statement of Applicability against 188 controls (60 management M1–M6, 128 technical T1–T9), priority-tiered P1–P4
  • /arckit:uae-cloud-residency — National Cloud Security Policy v2 sovereign cloud assessment — per-classification residency, approved CSPs (Core42 / G42, Microsoft UAE North/Central, TDRA FedNet, e& Sovereign Launchpad on AWS), shared-responsibility matrix, exit/portability plan

Federal identity:

  • /arckit:uae-uaepass — UAE Pass integration design (OIDC/OAuth flow, claim mapping, Basic vs Verified profile selection, Service Provider onboarding, e-signature audit trail)

Cabinet instruments:

  • /arckit:uae-zero-bureaucracy — Service Catalogue review under the UAE Code for Government Services and Zero Bureaucracy programme
  • /arckit:uae-digital-records — Digital Records Plan under the UAE Government Services Digital Records Policy (source-of-truth register per service, retention schedule, official-source designation)
  • /arckit:uae-data-sharing — Data Sharing Agreement under the UAE Government Services Data Sharing Policy ("collect once, use securely") with PDPL lawful basis per share
  • /arckit:uae-priorities-alignment — National Priorities Alignment Statement under the UAE Federal Government Guide — reuse-vs-build, capability-reuse register (UAE Pass, FedNet), strategy alignment to NIS 2031 / AI 2031 / We the UAE 2031

AI governance:

  • /arckit:uae-ai-charter — UAE Charter for the Development and Use of AI compliance assessment (12 principles)
  • /arckit:uae-ai-autonomy-tier — Three-tier AI autonomy posture (Tier 1 internal-productivity, Tier 2 investor-facing-with-approval, Tier 3 regulated/financial) with per-tier guard-rails, approval gates, audit obligations, tier-promotion criteria

Procurement:

  • /arckit:uae-procurement — Federal procurement strategy under Federal Decree-Law No. 11 of 2023 — ITT/RFP packs against MoF Digital Procurement Platform templates, In-Country Value (ICV) plan, evaluation report structure, contract register

The commands chain together in a canonical order from principles → uae-classification → uae-pdpl → uae-ias → uae-cloud-residency → uae-uaepass → uae-zero-bureaucracy → uae-digital-records → uae-data-sharing → uae-ai-charter → uae-ai-autonomy-tier → uae-priorities-alignment → uae-procurement → sobc → wardley → framework. Full guide: docs/guides/uae-overlay.md.

UK NHS Clinical Safety Overlay (Community-contributed)

⚠️ Community-contributed overlay — first sector-specific overlay in ArcKit. The 4 commands below cover NHS clinical safety (DCB0129 manufacturer + DCB0160 deployer), NHS DTAC procurement assurance, and UK MDR 2002 + EU MDR 2017/745 software-as-medical-device classification. Adopts Dr Marcus Baw's SAFETY.md spec for DCB0129/0160 file naming and YAML-frontmatter hazard log. Output is not clinical, legal, or regulatory advice — MUST be reviewed by a qualified Clinical Safety Officer (CSO with appropriate GMC / NMC / HCPC / GPhC registration) and, for MDR classification, by a qualified Regulatory Affairs specialist before reliance.

Clinical safety (DCB0129 + DCB0160):

  • /arckit:uk-nhs-dcb0129 — NHS DCB0129 manufacturer Clinical Safety Case + Hazard Log. Produces a 3-file set in projects/{NNN}/clinical-safety/: SAFETY.md (front-door anchor), SAFETY-CASE.md (GSN-inspired safety argument), HAZARD-LOG.md (YAML-frontmatter hazard array + rendered Markdown table; 6 starter hazards covering wrong-patient, stale data, audit, authorisation, alert delivery, write integrity)
  • /arckit:uk-nhs-dcb0160 — NHS DCB0160 deployer Clinical Safety Case + Deployment Hazard Log. Produces a 3-file deployer-side set in projects/{NNN}/clinical-safety/deployment/; 10 starter deployment hazards covering training, workflow integration, BC, parallel running, migration, local configuration, terminology, RBAC, incident reporting

Procurement and regulation:

  • /arckit:uk-nhs-dtac — NHS Digital Technology Assessment Criteria v3 — 5 sections (Clinical Safety, Data Protection, Technical Assurance, Interoperability, Usability + Accessibility) plus AI annex. Cross-references DCB0129/0160, DPIA, ATRS, Secure by Design
  • /arckit:uk-mdr-classification — UK MDR 2002 (as amended) + EU MDR 2017/745 software-as-medical-device (SaMD) and AI-as-medical-device (AIaMD) classification. UKCA / UKNI / CE marking pathway, Windsor Framework NI handling, conformity-assessment route, MHRA SaMD/AIaMD Programme alignment, ISO 14971 / IEC 62304 / ISO 13485 standards mapping, post-market obligations

The commands compose with — not replace — the UK government baseline (tcop, secure, dpia, atrs, risk, service-assessment). Recipe: uk-nhs-clinical-safety (44 targets across the clinical-safety waves). Proposed domain co-maintainer: Dr Marcus Baw (@pacharanero) — clinical informatician at RCPCH, openEHR, NHS England.

The DCB0129/0160 outputs deliberately do not carry the ARC- prefix — they follow Marcus's SAFETY.md spec convention so they remain readable by clinicians, MHRA reviewers, and procurement teams who do not use ArcKit. Other artefacts cross-reference them by relative path. Full design log: docs/superpowers/specs/2026-05-19-uk-nhs-overlay-design.md.

USA Federal Civilian Overlay (10 commands)

⚠️ Community-contributed overlay. The 10 commands below cover US federal civilian compliance instruments (FedRAMP authorization, FISMA / NIST 800-53 Rev 5, CISA Zero Trust Maturity Model, OMB M-19-17 ICAM, NIST AI RMF + OMB M-24-10/M-25-21 AI assurance, E-Government Act §208 PIA, EO 14028 SBOM self-attestation). They ship as the arckit-us community-contributed overlay (not part of the officially-maintained baseline of 72). EO 14110 was revoked January 2025; the live AI mandates are OMB M-24-10 + M-25-21. FedRAMP completed the Rev 5 transition in 2024. The overlay is currently solo-maintained by @tractorjuice; a US federal-civilian domain co-maintainer is being recruited (CISO / SAOP / FedRAMP PMO / CAIO backgrounds welcome) before the overlay can be re-evaluated for official-baseline promotion. Output should be reviewed by qualified US federal counsel before reliance.

In scope (v1): federal civilian agencies and the vendors that sell to them.

Out of scope (sibling overlays for the future): federal defense (CMMC / RMF / DISA STIGs), state regimes (StateRAMP / TX-RAMP / CJIS / IRS Pub 1075 / CCPA), sector-specific (HIPAA / GLBA / SOX / FERPA / PCI DSS), Section 508 accessibility (deferred to v5.2).

Command Anchor Doc-type
/arckit:us-fisma-categorization FIPS Publication 199 + NIST SP 800-60 Vol 2 Rev 1 FIPS199
/arckit:us-nist-800-53 NIST SP 800-53 Rev 5 + SP 800-53B + FedRAMP Rev 5 baselines NIST
/arckit:us-fedramp-ssp FedRAMP SSP Template Rev 5 + NIST SP 800-37 Rev 2 FRSSP
/arckit:us-fedramp-readiness FedRAMP 3PAO Readiness Assessment Report template FRRR
/arckit:us-zero-trust CISA Zero Trust Maturity Model v2.0 + OMB M-22-09 + NIST SP 800-207 ZTA
/arckit:us-icam OMB M-19-17 + NIST SP 800-63-3 (A/B/C) + FIPS 201-3 + login.gov ICAM
/arckit:us-ai-rmf NIST AI RMF 1.0 + NIST AI 600-1 (Generative AI Profile) AIRMF
/arckit:us-ai-impact OMB M-24-10 + OMB M-25-21 AIIA
/arckit:us-privacy-pia E-Government Act §208 + OMB M-03-22 + Privacy Act §552a + NIST SP 800-122 USPIA
/arckit:us-sbom-eo-14028 EO 14028 + OMB M-22-18 + OMB M-23-16 + CISA Self-Attestation Form + NTIA Minimum Elements SBOM

Recipe: us-federal (5 waves — baseline → controls → posture → ai → authorization).

Install: claude plugin install arckit arckit-us. See docs/guides/us-federal-overlay.md for the USA Federal Civilian overlay maintenance guide and citation register.

UK Finance Payments Overlay (4 commands) — First Sector Overlay

EXPERIMENTAL sector overlay. The 4 commands below cover UK regulated payment system operators scaling operations under PSD2 SCA-RTS, CASS V, FCA Consumer Duty, and CREST protocols. They ship as the arckit-uk-finance community-contributed overlay — the first sector-specific overlay (distinct from the 7 jurisdictional overlays). Output requires review by qualified UK FS regulatory counsel, MLRO, and SMF holders before implementation.

Payments architecture and compliance:

  • /arckit:uk-nhs-dcb0129 — TBD
  • /arckit:uk-nhs-dcb0160 — TBD
  • /arckit:uk-nhs-dtac — TBD
  • /arckit:uk-mdr-classification — TBD

Recipe: uk-fs-payments (multi-wave payment system modernization).

Install: claude plugin install arckit arckit-uk-finance. Help wanted: recruiting a UK financial services domain co-maintainer (CISO / Compliance / Head of Architecture background welcome) to transition to official-baseline status.

UK G-Cloud Supplier Bid-Authoring Overlay (11 commands) — Proprietary

PROPRIETARY, Claude Code only. The 11 commands below are a supplier-side overlay for authoring UK G-Cloud (Digital Marketplace) framework bids: supplier profile, service design, the three Service Definition Document lots, the supplier declaration, pricing, security assertions, competitor benchmarking, submission review, and a final submission pack. Unlike every other ArcKit plugin, arckit-uk-gcloud ships under a proprietary licence (not MIT) and is not distributed to the non-Claude extension formats (Codex / Gemini / OpenCode / Copilot) — it runs on Claude Code only. It is the 4th sector-specific overlay (after arckit-uk-finance, arckit-uk-nhs, arckit-au-energy) and requires the arckit core plugin.

G-Cloud bid authoring:

  • /arckit:supplier-profile — Supplier profile and company capability statement (SUPP)
  • /arckit:service-design — Service design and value proposition (SVCD)
  • /arckit:sdd-lot1 — Service Definition Document, Lot 1 Cloud Hosting (SDD)
  • /arckit:sdd-lot2 — Service Definition Document, Lot 2 Cloud Software (SDD)
  • /arckit:sdd-lot3 — Service Definition Document, Lot 3 Cloud Support (SDD)
  • /arckit:declaration — Supplier declaration and framework attestations (DECL)
  • /arckit:pricing — Pricing document and SFIA rate card (PRIC)
  • /arckit:security — Security assertions and cloud security assessment (SECA)
  • /arckit:gcloud-competitors — G-Cloud competitor benchmark (GCMP)
  • /arckit:review — G-Cloud submission review and gap analysis (GCRV)
  • /arckit:submission-pack — Assemble the final G-Cloud submission pack

Skills: gcloud-framework, cloud-security, sfia-skills. Recipe: uk-gcloud-submission (end-to-end bid assembly).

Install: claude plugin install arckit arckit-uk-gcloud. Proprietary — see the licence-exception note at the foot of this README. Ported from the standalone gcloud-kit plugin.

TOGA