arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/gov-landscape.md

@@ -0,0 +1,114 @@
+# Government Code Landscape Analysis Guide
+
+> **Guide Origin**: Official | **ArcKit Version**: 4.4.0
+
+`/arckit:gov-landscape` maps what UK government has built in a domain — organisations active in the space, common technology patterns, adopted standards, maturity levels, and collaboration opportunities — giving architects a broad situational picture before making design decisions.
+
+> **Agent Architecture**: This command runs as an autonomous agent via the Task tool. The agent issues 8-12 govreposcrape queries across the domain, uses WebFetch to inspect representative repositories at depth, and synthesises findings into a structured landscape report, keeping the main conversation clean. The slash command is a thin wrapper that delegates to the agent.
+
+---
+
+## Prerequisites
+
+### govreposcrape MCP Server (AUTO-INSTALLED)
+
+This command uses the govreposcrape MCP server which is **automatically included** with the ArcKit plugin. No manual setup required.
+
+**Endpoint**: `https://govreposcrape-api-1060386346356.us-central1.run.app/mcp`
+
+### Project Prerequisites
+
+- Requirements document (`ARC-*-REQ-*.md`) - Recommended (used to anchor domain focus)
+- Architecture principles (`ARC-000-PRIN-*.md`) - Recommended
+- Stakeholder analysis (`ARC-*-STKE-*.md`) - Optional
+
+---
+
+## Scenario Matrix
+
+| Scenario | Prompt seed | Focus |
+|---------|-------------|-------|
+| Domain mapping | "Map the government landscape for `<domain>`" | Breadth of activity across departments |
+| Technology survey | "Survey technology used in government `<domain>`" | Language, framework, and platform spread |
+| Standards adoption | "Which government teams have adopted `<standard>`?" | Compliance patterns and gaps |
+| Collaboration discovery | "Find government teams working on `<problem>`" | Potential reuse partners or communities of practice |
+| Gap analysis | "What is missing from the government `<domain>` landscape?" | Under-served capabilities and build opportunities |
+
+Add a time qualifier ("in the last 2 years") or a department name to scope the landscape further.
+
+---
+
+## Command
+
+```bash
+/arckit:gov-landscape <domain>
+```
+
+Outputs: `projects/<id>/research/ARC-<id>-GLND-v1.0.md`
+
+> **Auto-versioning**: Re-running this command when a document already exists automatically increments the version.
+
+---
+
+## How It Works
+
+The agent uses a broad-to-specific search strategy across the govreposcrape semantic search API:
+
+| Step | Action |
+|------|--------|
+| 1 | Generate 8-12 domain-spanning queries covering different facets |
+| 2 | Run all queries, collecting a wide pool of repositories |
+| 3 | Cluster results by organisation and technology theme |
+| 4 | Fetch GitHub repo details via WebFetch for representative samples in each cluster |
+| 5 | Score each organisation's activity on domain maturity (depth, recency, documentation) |
+| 6 | Synthesise findings into a landscape map with technology breakdown and gap analysis |
+
+### Maturity Scoring
+
+Each active organisation in the domain is rated on three dimensions:
+
+| Dimension | High | Low |
+|-----------|------|-----|
+| Depth | Multiple repos, clear investment | Single exploratory repo |
+| Recency | Active commits within 12 months | No activity in 2+ years |
+| Documentation | Architecture docs, guides, READMEs | Minimal or no documentation |
+
+---
+
+## Output Highlights
+
+- **Landscape map** showing organisations active in the domain and their relative maturity
+- **Technology stack analysis** with language and framework distribution across repos
+- **Standards adoption** summary — which standards are widely, partially, or not yet adopted
+- **Maturity scores** per organisation for depth, recency, and documentation
+- **Collaboration opportunities** identifying teams solving similar problems
+- **Gap analysis** for capabilities or standards with little or no existing government code
+
+---
+
+## Follow-on Actions
+
+- Run `/arckit:gov-reuse` to perform a scored reuse assessment for specific capabilities identified in the landscape
+- Run `/arckit:framework` to transform landscape findings into architectural principles and patterns
+- Run `/arckit:wardley` to map domain components onto a Wardley Map for evolution analysis
+
+---
+
+## Comparison with /arckit:gov-reuse and /arckit:gov-code-search
+
+| Feature | `/arckit:gov-landscape` | `/arckit:gov-reuse` | `/arckit:gov-code-search` |
+|---------|------------------------|--------------------|--------------------------|
+| Purpose | Map an entire domain | Assess candidates for a project | Discover repos matching a query |
+| Scope | Domain-wide (8-12 queries) | Capability-specific (3-5 queries) | Query-specific (3-5 queries) |
+| Output | Landscape map + maturity scores | Scored reuse assessment per capability | Search results + repo profiles |
+| Project required | No (recommended) | Yes (requirements MANDATORY) | No |
+| When to use | Early-stage situational awareness | Before building a capability | Exploratory or ad-hoc search |
+
+**Workflow**: Use `/arckit:gov-landscape` to understand the domain, `/arckit:gov-code-search` for targeted queries, and `/arckit:gov-reuse` for project-specific reuse decisions.
+
+---
+
+## Resources
+
+- [govreposcrape](https://github.com/chrisns/govreposcrape) - Semantic search over UK government repositories
+- [govreposcrape API](https://govreposcrape-api-1060386346356.us-central1.run.app/openapi.json) - OpenAPI specification

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/gov-reuse.md

@@ -0,0 +1,112 @@
+# Government Code Reuse Assessment Guide
+
+> **Guide Origin**: Official | **ArcKit Version**: 4.4.0
+
+`/arckit:gov-reuse` searches 24,500+ UK government open-source repositories to discover existing implementations that can be reused, forked, or referenced before building from scratch.
+
+> **Agent Architecture**: This command runs as an autonomous agent via the Task tool. The agent performs multiple govreposcrape searches per capability and uses WebFetch to assess each candidate's GitHub repository, keeping the main conversation clean. The slash command is a thin wrapper that delegates to the agent.
+
+---
+
+## Prerequisites
+
+### govreposcrape MCP Server (AUTO-INSTALLED)
+
+This command uses the govreposcrape MCP server which is **automatically included** with the ArcKit plugin. No manual setup required.
+
+**Endpoint**: `https://govreposcrape-api-1060386346356.us-central1.run.app/mcp`
+
+### Project Prerequisites
+
+- Requirements document (`ARC-*-REQ-*.md`) - **MANDATORY**
+- Architecture principles (`ARC-000-PRIN-*.md`) - Recommended
+- Stakeholder analysis (`ARC-*-STKE-*.md`) - Optional
+
+---
+
+## Scenario Matrix
+
+| Scenario | Prompt seed | Focus |
+|---------|-------------|-------|
+| Pre-build check | "Check for existing government code for `<capability>`" | Capability-by-capability reuse search |
+| Open source evaluation | "Find government open source for `<domain>`" | License and code quality assessment |
+| UK Government project | "Assess government reuse for UK Government `<project>`" | OGL-licensed, GDS-standard code |
+| Specific tech stack | "Find government `<language/framework>` implementations for `<use case>`" | Tech stack alignment |
+| Cost reduction | "What can we reuse to reduce build effort for `<project>`?" | Effort savings estimation |
+
+Add constraints (language, framework, license) in the prompt for tailored results.
+
+---
+
+## Command
+
+```bash
+/arckit:gov-reuse <capability or domain>
+```
+
+Outputs: `projects/<id>/research/ARC-<id>-GOVR-v1.0.md`
+
+> **Auto-versioning**: Re-running this command when a document already exists automatically increments the version.
+
+---
+
+## How It Works
+
+The agent uses the govreposcrape semantic search API to query 24,500+ UK government repositories:
+
+| Step | Action |
+|------|--------|
+| 1 | Extract capabilities from project requirements |
+| 2 | Search govreposcrape with 3-5 query variations per capability |
+| 3 | Fetch GitHub repo details via WebFetch for each candidate |
+| 4 | Score candidates on 5 criteria (1-5 scale) |
+| 5 | Recommend strategy: Fork, Library, Reference, or None |
+
+### Scoring Criteria
+
+| Criterion | Weight | 5 (Best) | 1 (Worst) |
+|-----------|--------|----------|-----------|
+| License compatibility | Equal | OGL / MIT | Proprietary |
+| Code quality | Equal | Tests, CI, clean | No tests, unmaintained |
+| Documentation | Equal | Comprehensive README, guides | No documentation |
+| Tech stack alignment | Equal | Same stack | Incompatible |
+| Activity / maintenance | Equal | Active (recent commits) | Abandoned (>2 years) |
+
+---
+
+## Output Highlights
+
+- **Reuse candidates** per capability with scores and strategies
+- **License compatibility matrix** across all candidates
+- **Tech stack alignment** comparison with your project
+- **Gap analysis** for capabilities with no reusable code
+- **Effort savings** estimates vs building from scratch
+
+---
+
+## Follow-on Actions
+
+- Run `/arckit:research` to feed reuse findings into build vs buy analysis
+- Run `/arckit:adr` to document reuse decisions
+- Run `/arckit:requirements` to refine requirements based on discovered capabilities
+
+---
+
+## Comparison with /arckit:research
+
+| Feature | `/arckit:gov-reuse` | `/arckit:research` |
+|---------|--------------------|--------------------|
+| Scope | UK government repos only | Multi-cloud, SaaS, open-source |
+| Focus | Code reuse and adaptation | Build vs buy, vendor comparison |
+| Source | govreposcrape + GitHub | Web search, vendor sites |
+| Output | Reuse assessment with scoring | Market research with TCO |
+| When to use | Before building, to find existing code | To evaluate commercial options |
+
+**Workflow**: Run `/arckit:gov-reuse` first, then `/arckit:research` to compare reuse candidates against commercial alternatives.
+
+---
+
+## Resources
+
+- [govreposcrape](https://github.com/chrisns/govreposcrape) - Semantic search over UK government repositories
+- [govreposcrape API](https://govreposcrape-api-1060386346356.us-central1.run.app/openapi.json) - OpenAPI specification

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/govs-007-security.md

@@ -0,0 +1,93 @@
+# GovS 007: Security — ArcKit Reference Guide
+
+> **Guide Origin**: Official | **ArcKit Version**: [VERSION]
+
+This guide maps the [Government Functional Standard GovS 007: Security](https://www.gov.uk/government/publications/government-functional-standard-govs-007-security) to ArcKit commands and artefacts. GovS 007 is the cross-government baseline for protective security, sitting above the Cyber Security Standard and NCSC CAF in the governance hierarchy.
+
+---
+
+## Governance Hierarchy
+
+```text
+GovS 007: Security (functional standard — 9 principles)
+  └── Cyber Security Standard (July 2025 — mandatory CAF profiles, GovAssure, SbD)
+        └── NCSC Cyber Assessment Framework (operational — 14 principles, 4 objectives)
+              └── /arckit:secure assessment (evidence & tracking)
+```
+
+---
+
+## Nine Security Principles
+
+| # | GovS 007 Principle | Description | ArcKit Command / Artefact |
+|---|---------------------|-------------|---------------------------|
+| 1 | Governance aligned to organisational purpose | Security governance structures support organisational objectives | `/arckit:secure` (CAF A1), `/arckit:stakeholders` (SSRO/DSO roles) |
+| 2 | Risk-based approach | Protective security decisions based on assessed risk | `/arckit:risk` (risk register), `/arckit:secure` (CAF A2) |
+| 3 | Security integrated into all activities | Security considered throughout delivery, not bolted on | `/arckit:secure` (Secure Development S4), `/arckit:tcop` (Point 6) |
+| 4 | Holistic security planning | Physical, personnel, cyber, technical, and industry security planned together | `/arckit:secure` (full CAF S1–S8), `/arckit:plan` |
+| 5 | Security culture embedded | Staff aware of security responsibilities and behaviours | `/arckit:secure` (CAF B6 Staff Awareness) |
+| 6 | Accountability at all levels | Named individuals accountable for security outcomes | `/arckit:stakeholders` (SSRO, DSO, SIRO roles), `/arckit:secure` sign-off |
+| 7 | Proportionate security measures | Controls matched to data classification and risk level | `/arckit:secure` (Executive Summary classification → controls) |
+| 8 | Continuous improvement | Security posture regularly reviewed and improved | `/arckit:secure` (CAF D2), `/arckit:operationalize` |
+| 9 | Legal and regulatory compliance | Compliance with UK GDPR, Data Protection Act, sector regulations | `/arckit:dpia`, `/arckit:secure` (S3 UK GDPR) |
+
+---
+
+## Security Lifecycle
+
+GovS 007 defines a four-phase security lifecycle. The table below maps each phase to ArcKit commands.
+
+| Lifecycle Phase | Activities | ArcKit Commands |
+|-----------------|-----------|-----------------|
+| **Strategy & Planning** | Define security strategy, risk appetite, asset classification, roles | `/arckit:principles`, `/arckit:risk`, `/arckit:stakeholders` |
+| **Prevention & Detection** | Implement controls, monitor threats, manage vulnerabilities | `/arckit:secure` (CAF B1–B6, C1–C2), `/arckit:diagram` |
+| **Incident Response** | Detect, respond, report, recover from security incidents | `/arckit:operationalize` (incident management runbooks) |
+| **Learning & Improvement** | Post-incident reviews, metrics, continuous improvement | `/arckit:secure` (CAF D2), `/arckit:risk` (updated risk register) |
+
+---
+
+## Protective Security Disciplines
+
+| Discipline | Scope | Primary ArcKit Artefact |
+|------------|-------|-------------------------|
+| **Cyber Security** | Network, systems, data protection | `/arckit:secure` (CAF assessment) |
+| **Physical Security** | Premises, facilities, physical access | `/arckit:mod-secure` (JSP 440), or noted in `/arckit:secure` |
+| **Personnel Security** | Vetting, insider threat, staff clearances | `/arckit:mod-secure` (personnel vetting), `/arckit:stakeholders` |
+| **Technical Security** | Counter-eavesdropping, emanations | Specialist — flag in `/arckit:secure` if applicable |
+| **Industry Security** | Contractor/supplier security obligations | `/arckit:secure` (CAF A4 Supply Chain, S7 Third-Party Risk) |
+
+**Supporting practices**: Risk Management (`/arckit:risk`), Information Management (`/arckit:dpia`), Critical Assets (CAF A3), Capability (CAF B6), Culture (CAF B6).
+
+---
+
+## Key Security Roles
+
+| Role | GovS 007 Responsibility | ArcKit Appearance |
+|------|------------------------|-------------------|
+| **Accounting Officer** | Overall accountability for organisational security | `/arckit:secure` sign-off |
+| **Senior Security Risk Owner (SSRO)** | Board-level protective security risk ownership | `/arckit:stakeholders`, `/arckit:secure` sign-off |
+| **Departmental Security Officer (DSO)** | Day-to-day security coordination and policy delivery | `/arckit:stakeholders`, `/arckit:secure` sign-off |
+| **Senior Information Risk Owner (SIRO)** | Information and cyber security risk ownership | `/arckit:stakeholders`, `/arckit:secure` sign-off |
+
+---
+
+## Relationship to Other Standards
+
+| Standard | Relationship to GovS 007 |
+|----------|--------------------------|
+| **Cyber Security Standard** (CSS) | Implements the cyber discipline of GovS 007 — mandates CAF profiles, GovAssure, SbD |
+| **NCSC CAF** | Operational framework for assessing cyber security (14 principles) |
+| **Cyber Essentials** | Baseline technical controls for government contracts |
+| **GovS 005: Digital** | Sibling functional standard — digital governance, TCoP, Service Standard |
+| **JSP 440 / JSP 604** | MOD-specific physical and personnel security (extends GovS 007 for Defence) |
+
+---
+
+## References
+
+- [GovS 007: Security (GOV.UK)](https://www.gov.uk/government/publications/government-functional-standard-govs-007-security)
+- [GovS 007 PDF](https://assets.publishing.service.gov.uk/media/613a195bd3bf7f05b694d647/GovS_007-_Security.pdf)
+- [Functional Standards overview](https://www.gov.uk/government/collections/functional-standards)
+- [NCSC Cyber Assessment Framework](https://www.ncsc.gov.uk/collection/caf)
+- [NCSC GovAssure](https://www.ncsc.gov.uk/collection/govassure)
+- [UK Government Cyber Security Standard](https://www.gov.uk/government/publications/government-cyber-security-standard)

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/grants.md

@@ -0,0 +1,106 @@
+# UK Grants & Funding Research Playbook
+
+> **Guide Origin**: Official | **ArcKit Version**: [VERSION]
+
+`/arckit:grants` researches UK government grants, charitable funding, and accelerator programmes for the project, with eligibility scoring per programme. Runs as a research-heavy agent that produces a per-grant briefing plus reusable tech-notes.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Requirements (`ARC-<id>-REQ-v1.0.md`) | Project scope and outcomes |
+| SOBC (`ARC-<id>-SOBC-v*.md`) | Strategic case and funding ask |
+| Architecture principles (`ARC-000-PRIN-*.md`) | Eligibility-relevant principles (open source, accessibility, etc.) |
+
+---
+
+## Command
+
+```bash
+/arckit:grants <project ID or domain>
+```
+
+Outputs:
+
+- `projects/<id>/research/ARC-<id>-GRNT-NNN-v1.0.md` — per-grant briefing, one per programme researched
+- `projects/<id>/tech-notes/<grant-slug>.md` — reusable knowledge note per programme (when 2+ substantive facts captured)
+
+---
+
+## Long runs: Remote Control + push notifications
+
+`/arckit:grants` frequently exceeds 10 minutes as the agent crawls UKRI, Innovate UK, NIHR, charitable foundations, and accelerator programmes for live deadlines and eligibility criteria. To avoid babysitting the terminal, pair it with [Claude Code Remote Control](https://code.claude.com/docs/en/remote-control):
+
+```bash
+claude remote-control
+```
+
+Drive the session from claude.ai/code or the mobile app, then enable `/config → Push when Claude decides` so your phone gets a notification on completion or when the agent reaches a decision point (programme shortlist confirmation, eligibility ambiguity). ArcKit's minimum Claude Code floor (v2.1.121) already covers the v2.1.110 RC requirement.
+
+Caveats: Pro/Max plans only (no API keys, no Bedrock/Vertex/Foundry), push is a single on/off so chatty agents can over-notify, and the local `claude` process must keep running.
+
+---
+
+## Briefing Structure
+
+| Section | Contents |
+|---------|----------|
+| Programme Overview | Funder, scheme name, total fund, individual grant size |
+| Eligibility | Sector, organisation type, project stage, geography, IP requirements |
+| Eligibility Scoring | Project's fit against each criterion with rationale |
+| Application Process | Stages, gates, deadlines, panel / peer review model |
+| Match Funding & Co-Investment | Funder match rules, partner requirements |
+| Reporting & Compliance | Milestone reporting, audit, IP and dissemination obligations |
+| Decision | Pursue / monitor / discard with rationale |
+| External References | Programme guidance, recent awards, funder priorities |
+
+---
+
+## Funder Coverage
+
+Typical programmes researched:
+
+| Funder | Examples |
+|--------|----------|
+| UKRI | EPSRC, ESRC, MRC, NERC, Innovate UK |
+| Innovate UK | Smart Grants, KTPs, sector challenge programmes |
+| NIHR | Health and care research funding streams |
+| Wellcome | Biomedical, climate, mental health |
+| Nesta | Innovation challenges and challenge prizes |
+| Charitable trusts | Domain-specific philanthropic funding |
+| Accelerators | Government-backed and corporate accelerators |
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Discovery | Project scope and outcomes | `/arckit:requirements` |
+| Funding research | Programme scan + eligibility scoring | `/arckit:grants` |
+| Business case | Folding funding into Economic Case | `/arckit:sobc` |
+| Plan | Align project plan to grant milestones | `/arckit:plan` |
+| Risk | Grant-specific risks (rejection, compliance, reporting) | `/arckit:risk` |
+
+---
+
+## Review Checklist
+
+- At least one programme researched per relevant funder family.
+- Eligibility scoring shows rationale per criterion (not just a number).
+- Match-funding requirements identified for every "pursue" recommendation.
+- Reporting and IP obligations called out before "pursue" decision.
+- Pursue / monitor / discard decision recorded for every programme.
+- Funding inputs handed off to SOBC Economic Case and project plan.
+- Grant-specific risks added to the risk register.
+
+---
+
+## Key Notes
+
+- **Agent command**: Heavy WebSearch / WebFetch — runs as the `arckit-grants` autonomous agent in Claude Code; the slash command is a thin wrapper.
+- **Tech notes**: Programmes worth detailed study spawn a reusable tech-note that future projects can read without re-running the research.
+- **Plan alignment**: Grants impose milestone and reporting cadences that must be reflected in the project plan — do not skip the `/arckit:plan` handoff.
+- **Multi-instance numbering**: `GRNT-001`, `GRNT-002`, etc. — one document per programme, generated automatically.

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/graph-report.md

@@ -0,0 +1,77 @@
+# `/arckit:graph-report` — governance metrics dashboard
+
+A read-only multi-project dashboard. Run it when you want a portfolio view: which projects are best-governed, which have weak traceability, which are missing compliance artifacts.
+
+## Quick start
+
+```text
+/arckit:graph-report
+```
+
+No arguments. The command always scans every working project under `projects/` (excluding `000-global`).
+
+## What you get
+
+A console dashboard (no file written) with four sections:
+
+### 1. Project Comparison
+
+One row per project:
+
+| Column | What |
+|---|---|
+| **Artifacts** | Count of `ARC-*.md` documents |
+| **Cross-refs** | Count of cross-reference edges originating in the project |
+| **Density** | Cross-refs per artifact (a traceability proxy) |
+| **Compliance readiness** | Fraction of 12 HIGH-severity doc types present |
+
+### 2. Coverage by Category
+
+A matrix showing each project's doc-type coverage in each ArcKit category (Discovery, Planning, Architecture, Governance, Compliance, Operations, Procurement, Research, Reporting). Each cell shows `present / total (%)`.
+
+### 3. Compliance Readiness (HIGH-severity doc types)
+
+For each project, lists which of these 12 HIGH-severity doc types are present and which are missing:
+
+`TCOP, SECD, SECD-MOD, DPIA, SVCASS, RISK, TRAC, CONF, PRIN-COMP, AIPB, ATRS, JSP936`
+
+Not every project needs all 12. UK Gov projects typically need TCOP / SECD / DPIA / SVCASS / TRAC / CONF; MOD projects add SECD-MOD / JSP936; AI-related projects add AIPB / ATRS. The dashboard surfaces gaps for the architect to decide.
+
+### 4. Cross-Reference Density Interpretation
+
+A legend mapping density values to qualitative meaning:
+
+| Density | Meaning |
+|---|---|
+| 0.0 | Isolated artifacts, traceability broken |
+| 0.0–0.5 | Sparse — most artifacts stand alone |
+| 0.5–1.5 | Moderate — typical for early-stage projects |
+| 1.5–3.0 | Healthy — good traceability for a mature project |
+| 3.0+ | Dense — every artifact references multiple others |
+
+Density is `edges / nodes`. Edges are extracted from `ARC-NNN-XXX-vN.M` references inside artifact bodies during the graph scan.
+
+## When to run it
+
+- **Portfolio review** — when you have multiple projects and need to compare them.
+- **Steering committee prep** — to show which projects are governance-ready and which need attention.
+- **Onboarding** — to orient a new architect to the relative maturity of each project.
+- **After bulk imports** — when you've added many artifacts and want to verify traceability is intact (look at density).
+
+## Differences from related commands
+
+| Command | Scope | Focus |
+|---|---|---|
+| `/arckit:graph-report` | All projects | Cross-project comparison + compliance readiness |
+| `/arckit:navigator <project>` | Single project | "What's next" recommendation |
+| `/arckit:analyze <project>` | Single project | Deep governance analysis (sections, requirements, principles, risks) |
+| `/arckit:health` | All projects | Point-in-time rules (stale, forgotten, orphaned) |
+
+`graph-report` is the highest-level view; `analyze` is the deepest single-project view.
+
+## Limitations
+
+- **No trend data**: this is a point-in-time snapshot. Future enhancements could compare against historical manifests for delta tracking.
+- **Compliance readiness is a presence check, not a quality check**: a one-paragraph DPIA counts the same as a complete DPIA. Use `/arckit:analyze` for quality signals.
+- **Density doesn't measure direction**: a doc that references many others scores the same as one referenced by many. For directional traceability, use `/arckit:traceability`.
+- **HIGH-severity list is fixed**: domain-specific compliance frameworks (e.g. EU AI Act community commands) aren't yet counted in the readiness score. They show up in the category matrix instead.