arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/mlops.md

@@ -0,0 +1,126 @@
+# MLOps Strategy Playbook
+
+> **Guide Origin**: Official | **ArcKit Version**: [VERSION]
+
+`/arckit:mlops` creates a machine learning operations strategy covering model lifecycle, training pipelines, serving, monitoring, and governance.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Requirements (`ARC-<id>-REQ-v1.0.md`) | ML-related functional and non-functional requirements |
+| Data model (`ARC-<id>-DATA-v1.0.md`) | Training data sources and features |
+| AI Playbook assessment | Responsible AI context (UK Government) |
+| Architecture principles | AI/ML technology standards |
+
+---
+
+## Command
+
+```bash
+/arckit:mlops Create MLOps strategy for <initiative>
+```
+
+Output: `projects/<id>/ARC-<id>-MLOPS-v1.0.md`
+
+---
+
+## Strategy Structure
+
+| Section | Contents |
+|---------|----------|
+| ML System Overview | Use cases, model types, maturity level, stakeholders |
+| Model Inventory | Catalog of models with metadata, dependencies, risk classification |
+| Data Pipeline | Training data sources, feature engineering, feature store, data versioning |
+| Training Pipeline | Infrastructure, experiment tracking, hyperparameter optimization |
+| Model Registry | Storage, versioning, metadata, approval workflow, promotion stages |
+| Serving Infrastructure | Deployment patterns, platforms, scaling, A/B testing |
+| Model Monitoring | Data drift, concept drift, performance, prediction drift, fairness |
+| Retraining Strategy | Triggers, automated vs manual, champion-challenger, rollback |
+| LLM/GenAI Operations | Prompt management, guardrails, token monitoring, RAG pipeline |
+| CI/CD for ML | Source control, testing, continuous training/deployment |
+| Model Governance | Documentation, approval, audit trail, risk assessment, retirement |
+| Responsible AI Operations | Bias detection, explainability, human oversight, incident response |
+| UK Government AI Compliance | AI Playbook, ATRS, JSP 936, DPIA alignment |
+| Costs and Resources | Infrastructure costs, licensing, team structure |
+
+---
+
+## MLOps Maturity Levels
+
+| Level | Characteristics | Automation | When to Use |
+|-------|-----------------|------------|-------------|
+| 0 | Manual, notebooks | None | PoC, exploration |
+| 1 | Automated training | Training pipeline | First production model |
+| 2 | CI/CD for ML | + Serving pipeline | Multiple models |
+| 3 | Automated retraining | + Monitoring triggers | Production at scale |
+| 4 | Full automation | + Auto-remediation | Enterprise ML |
+
+---
+
+## Model Types
+
+| Type | Characteristics | MLOps Needs |
+|------|-----------------|-------------|
+| Custom Trained | Full control, internal data | Full training infrastructure |
+| Fine-Tuned | Base model + custom training | Compute for fine-tuning |
+| Foundation Model (API) | External API (OpenAI, Anthropic) | Prompt management, cost control |
+| Pre-built (SaaS) | Cloud AI services | Configuration management |
+
+---
+
+## Monitoring Requirements
+
+| Monitoring Type | What It Detects |
+|-----------------|-----------------|
+| Data Drift | Statistical changes in input distributions |
+| Concept Drift | Changes in the relationship between inputs and outputs |
+| Model Performance | Degradation in accuracy, precision, recall over time |
+| Prediction Drift | Changes in output distributions |
+| Fairness | Bias across protected groups |
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Discovery | Identify ML use cases, data sources | `/arckit:requirements`, `/arckit:data-model` |
+| Governance | Assess AI risks and compliance | `/arckit:ai-playbook`, `/arckit:atrs`, `/arckit:dpia` |
+| Strategy | Create MLOps strategy | `/arckit:mlops` |
+| Implementation | Build pipelines, deploy models | `/arckit:backlog`, `/arckit:devops` |
+| Operations | Monitor, retrain, govern | `/arckit:operationalize` |
+
+---
+
+## Review Checklist
+
+- All ML requirements have model mapping.
+- Monitoring covers data drift, concept drift, and performance.
+- Model governance process defined (approval, audit, retirement).
+- Responsible AI addressed (fairness, explainability, human oversight).
+- Retraining triggers and thresholds defined.
+- UK Government compliance addressed (ATRS, AI Playbook, JSP 936 if MOD).
+
+---
+
+## UK Government AI Requirements
+
+| Requirement | Document | When Needed |
+|-------------|----------|-------------|
+| AI Playbook Compliance | `ARC-<id>-AIPB-v1.0.md` | All UK Gov AI projects |
+| Algorithmic Transparency | `ARC-<id>-ATRS-v1.0.md` | Public-facing algorithmic decisions |
+| MOD AI Assurance | `ARC-<id>-JSP936-v1.0.md` | Defence AI systems |
+| Data Protection Impact | `ARC-<id>-DPIA-v1.0.md` | AI processing personal data |
+
+---
+
+## Key Principles
+
+1. **Reproducibility First**: All training must be reproducible (versioned data, code, config).
+2. **Monitoring is Essential**: Models degrade over time; monitoring is not optional.
+3. **Governance is Built-In**: Governance is part of the pipeline, not an afterthought.
+4. **Responsible AI**: Fairness and bias monitoring from day one.
+5. **Human Oversight**: Maintain human oversight where required by risk level.

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/mod-secure.md

@@ -0,0 +1,124 @@
+# MOD Secure by Design Playbook
+
+> **Guide Origin**: Official | **ArcKit Version**: [VERSION]
+
+`/arckit:mod-secure` generates a Ministry of Defence Secure by Design assessment using CAAT and continuous assurance methodology.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Requirements (`ARC-<id>-REQ-v1.0.md`) | Security requirements and classification |
+| Architecture diagrams | System boundaries and data flows |
+| Risk register | Security risks identified |
+| Data model | Data classification and handling |
+
+---
+
+## Command
+
+```bash
+/arckit:mod-secure Create MOD Secure by Design assessment for <system>
+```
+
+Output: `projects/<id>/ARC-<id>-SECD-MOD-v1.0.md`
+
+---
+
+## Assessment Structure
+
+| Section | Contents |
+|---------|----------|
+| System Overview | Name, purpose, classification, boundaries |
+| 7 SbD Principles Assessment | Compliance against each MOD SbD principle |
+| CAAT Summary | Continuous Assurance Assessment Tool results |
+| Security Classification | Data classification and handling requirements |
+| Threat Assessment | Threat actors, attack vectors, mitigations |
+| Security Controls | Technical, procedural, and physical controls |
+| Accreditation Status | Path to accreditation and outstanding actions |
+| Risk Acceptance | Residual risks requiring SIRO acceptance |
+
+---
+
+## 7 MOD Secure by Design Principles
+
+| # | Principle | Focus Area |
+|---|-----------|------------|
+| 1 | Establish Context | Understand threats and business context |
+| 2 | Make Compromise Difficult | Defense in depth, secure architecture |
+| 3 | Make Disruption Difficult | Resilience and availability |
+| 4 | Make Detection Easier | Logging, monitoring, alerting |
+| 5 | Reduce Impact | Contain and limit damage |
+| 6 | Secure Operations | Operational security processes |
+| 7 | Enable Assurance | Evidence and continuous compliance |
+
+---
+
+## CAAT (Continuous Assurance Assessment Tool)
+
+| Aspect | Description |
+|--------|-------------|
+| Purpose | Structured security assessment methodology |
+| Scope | Covers all 7 SbD principles |
+| Output | RAG status per principle with evidence |
+| Integration | Feeds into accreditation documentation |
+
+---
+
+## Security Classifications
+
+| Classification | Handling | Examples |
+|----------------|----------|----------|
+| OFFICIAL | Standard controls | Most MOD business |
+| OFFICIAL-SENSITIVE | Enhanced controls | Personnel data, commercial |
+| SECRET | Accredited systems | Intelligence, operations |
+| TOP SECRET | Highest controls | Most sensitive material |
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Discovery | Define requirements and classification | `/arckit:requirements`, `/arckit:data-model` |
+| Risk | Identify security risks and threats | `/arckit:risk` |
+| Assessment | Create MOD SbD assessment | `/arckit:mod-secure` |
+| Accreditation | Progress through accreditation stages | Manual |
+| Operations | Continuous assurance monitoring | `/arckit:operationalize` |
+
+---
+
+## Review Checklist
+
+- System classification correctly determined.
+- All 7 SbD principles assessed with evidence.
+- Threat assessment covers relevant threat actors.
+- Security controls mapped to threats and risks.
+- JSP 440 requirements addressed for classification.
+- CAAT assessment completed and documented.
+- Residual risks documented for SIRO acceptance.
+- Accreditation pathway and timeline defined.
+
+---
+
+## JSP 440 Alignment
+
+| JSP 440 Requirement | SbD Principle |
+|--------------------|---------------|
+| Protective Marking | Establish Context |
+| Access Control | Make Compromise Difficult |
+| Audit and Accountability | Make Detection Easier |
+| Incident Response | Reduce Impact |
+| Configuration Management | Secure Operations |
+
+---
+
+## Key Principles
+
+1. **Classification Drives Controls**: Security controls match data classification.
+2. **Continuous Assurance**: Security is ongoing, not a one-time assessment.
+3. **Evidence-Based**: All claims supported by documented evidence.
+4. **Risk-Informed**: Accept risk consciously through SIRO process.
+5. **Defence in Depth**: Multiple layers of security controls.

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/national-data-strategy.md

@@ -0,0 +1,115 @@
+# UK National Data Strategy — ArcKit Reference Guide
+
+> **Guide Origin**: Official | **ArcKit Version**: [VERSION]
+
+This guide maps the [UK National Data Strategy](https://www.gov.uk/government/publications/uk-national-data-strategy/national-data-strategy) (NDS) to ArcKit commands and artefacts. The NDS sets the government's vision for how data should be used, managed, and governed across the economy and public services.
+
+---
+
+## Five Missions
+
+| # | Mission | Description | ArcKit Commands |
+|---|---------|-------------|-----------------|
+| 1 | **Unlocking data value** | Use data to grow the economy, improve efficiency, and drive innovation | `/arckit:data-model`, `/arckit:data-mesh-contract`, `/arckit:backlog` |
+| 2 | **Pro-growth, trusted data regime** | Regulation and standards that enable data use while maintaining trust | `/arckit:dpia`, `/arckit:principles`, `/arckit:tcop` |
+| 3 | **Transforming government use of data** | Better data use for improved public services and decision-making | `/arckit:data-model`, `/arckit:strategy`, `/arckit:plan` |
+| 4 | **Secure, resilient data infrastructure** | Infrastructure that keeps data safe and available | `/arckit:secure`, `/arckit:hld-review`, `/arckit:operationalize` |
+| 5 | **International data flows** | Champion free and trusted data flows across borders | `/arckit:dpia` (cross-border transfer), `/arckit:data-mesh-contract` |
+
+---
+
+## Four Pillars
+
+| Pillar | Focus | ArcKit Evidence |
+|--------|-------|-----------------|
+| **Data Foundations** | Standards, metadata, interoperability, quality | `/arckit:data-model` (Data Quality Framework, entity catalogue, metadata standards) |
+| **Skills** | Data literacy, analytical capability across the workforce | `/arckit:stakeholders` (data governance roles), `/arckit:operationalize` (training) |
+| **Availability** | Findability, access, sharing, open data | `/arckit:data-mesh-contract` (data product contracts, SLAs), `/arckit:data-model` (CRUD matrix) |
+| **Responsibility** | Ethics, governance, public trust, accountability | `/arckit:dpia` (privacy impact), `/arckit:principles` (data governance principles), `/arckit:risk` |
+
+---
+
+## Mission-to-Artefact Crosswalk
+
+This table shows which ArcKit artefacts provide evidence for each NDS mission during assurance reviews.
+
+| NDS Mission | Artefact | What It Evidences |
+|-------------|----------|-------------------|
+| Mission 1 (Value) | Data Model (`ARC-*-DATA`) | Structured data assets, quality metrics, governance roles |
+| Mission 1 (Value) | Data Mesh Contract (`ARC-*-DMC`) | Federated data products with SLAs and quality guarantees |
+| Mission 2 (Trust) | DPIA (`ARC-*-DPIA`) | Lawful basis, privacy risks, data subject rights |
+| Mission 2 (Trust) | Architecture Principles (`ARC-000-PRIN`) | Data governance and ethical data use principles |
+| Mission 3 (Government) | Strategy (`ARC-*-STGY`) | Data strategy aligned to organisational objectives |
+| Mission 3 (Government) | Plan (`ARC-*-PLAN`) | Milestones for data capability improvements |
+| Mission 4 (Security) | Secure Assessment (`ARC-*-SECD`) | CAF assessment, data protection controls (S3, B3) |
+| Mission 5 (International) | DPIA (`ARC-*-DPIA`) | Cross-border data transfer safeguards |
+
+---
+
+## NDS Pillar Checklist
+
+Use this checklist when reviewing ArcKit artefacts for NDS alignment.
+
+### Data Foundations
+
+- [ ] Data standards defined (naming, formats, reference data)
+- [ ] Metadata captured for all entities (data dictionary/catalogue)
+- [ ] Interoperability requirements documented (APIs, open standards)
+- [ ] Data quality dimensions defined with measurable targets
+- [ ] Data quality monitoring and remediation process in place
+
+### Skills
+
+- [ ] Data ownership roles assigned (Owner, Steward, Custodian)
+- [ ] Data literacy requirements identified for key stakeholders
+- [ ] Training plan for data governance processes
+
+### Availability
+
+- [ ] Data access controls defined (CRUD matrix)
+- [ ] Data sharing agreements documented (internal/external)
+- [ ] Data products defined with SLAs (if data mesh architecture)
+- [ ] Open data obligations assessed
+
+### Responsibility
+
+- [ ] DPIA completed for personal data processing
+- [ ] Data ethics considerations documented
+- [ ] Data governance accountability clear (RACI)
+- [ ] Public trust and transparency measures in place
+- [ ] Data retention and disposal policies defined
+
+---
+
+## National Data Library
+
+The [National Data Library](https://www.gov.uk/government/publications/national-data-library-progress-update-january-2026/national-data-library-progress-update-january-2026) (backed by DSIT investment) aims to make key government datasets discoverable and AI-ready. Projects building government data platforms should consider:
+
+- **AI Readiness**: Are datasets structured for machine learning consumption?
+- **Discoverability**: Are data products catalogued with standard metadata?
+- **Interoperability**: Do data contracts use open standards for cross-department sharing?
+
+These considerations are captured in `/arckit:data-model` (metadata, quality) and `/arckit:data-mesh-contract` (data products, SLAs).
+
+---
+
+## Relationship to Other Standards
+
+| Standard | Relationship to NDS |
+|----------|---------------------|
+| **Data Quality Framework** | Operational tool for NDS Data Foundations pillar |
+| **GovS 005: Digital** | Sibling policy — digital delivery standards (TCoP, Service Standard) |
+| **GovS 010: Analysis** | Data quality and analytical standards supporting NDS Missions 1 and 3 |
+| **UK GDPR / Data Protection Act** | Legal framework underpinning NDS Responsibility pillar |
+| **Technology Code of Practice** | Point 8 (Share, reuse, collaborate) directly supports NDS Availability |
+| **AI Playbook** | AI-readiness requirements build on NDS Data Foundations |
+
+---
+
+## References
+
+- [UK National Data Strategy](https://www.gov.uk/government/publications/uk-national-data-strategy/national-data-strategy)
+- [NDS Monitoring & Evaluation Framework](https://www.gov.uk/government/publications/national-data-strategy-monitoring-and-evaluation-update/national-data-strategy-monitoring-and-evaluation-framework)
+- [National Data Library Progress Update (January 2026)](https://www.gov.uk/government/publications/national-data-library-progress-update-january-2026/national-data-library-progress-update-january-2026)
+- [Government Data Quality Framework](https://www.gov.uk/government/publications/the-government-data-quality-framework)
+- [GDS Data Standards](https://www.gov.uk/government/collections/data-standards-for-government)

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/navigator.md

@@ -0,0 +1,86 @@
+# `/arckit:navigator` — what should I do next?
+
+A read-only project GPS. Run it any time you're unsure which ArcKit command to run next, or you want a quick health snapshot of a project.
+
+## Quick start
+
+```text
+/arckit:navigator 001
+```
+
+Or for a single-project repo:
+
+```text
+/arckit:navigator
+```
+
+## What you get
+
+A console report (no file written) that answers four questions:
+
+1. **Where am I?** — coverage of the eight essential ArcKit doc types: REQ, STKE, RISK, SOBC, ADR, HLDR, TRAC, CONF.
+2. **What's next?** — the missing essential doc types, ordered by tier (1 = foundational → 4 = governance) with the exact slash command to run.
+3. **What might I have forgotten?** — contextual prompts for DPIA, SECD, TCOP, DATA when their domain triggers apply.
+4. **What needs attention?** — DRAFT artifacts, artifacts that haven't been touched in 90+ days, and orphaned artifacts (no cross-references in the dependency graph).
+
+## How coverage is measured
+
+Eight essential doc types form the baseline:
+
+| Tier | Type | Purpose |
+|---|---|---|
+| 1 | REQ | Requirements |
+| 1 | STKE | Stakeholder Analysis |
+| 1 | RISK | Risk Register |
+| 2 | SOBC | Strategic Outline Business Case |
+| 3 | ADR | Architecture Decision Record |
+| 3 | HLDR | High-Level Design Review |
+| 4 | TRAC | Traceability Matrix |
+| 4 | CONF | Conformance Assessment |
+
+Tiers reflect rough dependency order — get tier 1 in place before tier 3, etc. Coverage is `present / 8` rounded to a percentage.
+
+The navigator also checks whether `projects/000-global/ARC-000-PRIN-v*.md` (architecture principles) exist; if not, it surfaces that as the very first recommendation.
+
+## Contextual artifacts
+
+Some doc types depend on context, not project maturity:
+
+| Type | Trigger |
+|---|---|
+| DPIA | Processing personal data |
+| SECD | Security-sensitive system |
+| TCOP | UK Gov Service Standard |
+| DATA | DR-* requirements present in the REQ doc |
+
+These are listed under "Contextual artifacts to consider" — they don't count toward coverage, but the navigator nudges you to think about them.
+
+## Stale and orphan detection
+
+- **DRAFT**: Document Control `Status` field equals `DRAFT` (case-insensitive).
+- **Stale**: `Last Modified` (or `Created Date` if no modification recorded) is 90+ days ago.
+- **Orphan**: an `ARC-*` doc that doesn't appear as either source or target of any cross-reference edge in the project's portion of the dependency graph. Architecture principles (PRIN) often legitimately stand alone — treat the orphan list as a prompt to verify, not a verdict.
+
+## When to run it
+
+- At the start of an engagement to understand the gap.
+- After a long gap between sessions to remember what was in progress.
+- Before a steering review to see what's missing for governance sign-off.
+- After running a few commands to confirm coverage shifted as expected.
+
+## Multi-project repos
+
+If you have more than one working project in `projects/`, you must specify which:
+
+```text
+/arckit:navigator 001
+/arckit:navigator PROJECT=001-payment-gateway
+```
+
+Without an explicit project, the hook exits silently to avoid mixing reports.
+
+## Limitations
+
+- The eight essential doc types are an opinionated baseline. They cover the typical UK Gov-style enterprise architecture engagement; specialist domains (e.g. data-platform-only projects) may need a different baseline. A future `/arckit:navigator --baseline=...` switch could make this configurable.
+- The orphan check only sees `ARC-*` docs. Free-form `external/` references and external policy docs are out of scope.
+- Coverage doesn't measure quality — a one-paragraph REQ counts the same as a 30-page REQ. Use `/arckit:health` and `/arckit:analyze` for quality signals.

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/operationalize.md

@@ -0,0 +1,143 @@
+# Operational Readiness Playbook
+
+> **Guide Origin**: Official | **ArcKit Version**: [VERSION]
+
+`/arckit:operationalize` creates an operational readiness pack covering support model, runbooks, DR/BCP, on-call, and handover documentation.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Requirements (`ARC-<id>-REQ-v1.0.md`) | NFRs for availability, performance, recovery |
+| Architecture diagrams | Components for runbook inventory |
+| Risk register | Operational risks to mitigate |
+| Data model | Backup requirements and data dependencies |
+
+---
+
+## Command
+
+```bash
+/arckit:operationalize Create operational readiness pack for <service>
+```
+
+Output: `projects/<id>/ARC-<id>-OPS-v1.0.md`
+
+---
+
+## Readiness Pack Structure
+
+| Section | Contents |
+|---------|----------|
+| Service Overview | Name, criticality, tier, stakeholders, dependencies |
+| Service Level Objectives | SLIs, SLOs, error budgets, breach response |
+| Support Model | Support tiers, escalation matrix, on-call rotation |
+| Monitoring & Observability | Health checks, metrics, dashboards, logs, tracing |
+| Alerting Strategy | Routing rules, severity definitions, fatigue prevention |
+| Runbooks | Service start/stop, health check failures, errors, capacity |
+| Disaster Recovery | DR strategy, RTO/RPO, failover/failback procedures |
+| Business Continuity | Impact analysis, workarounds, communication plan |
+| Backup & Restore | Schedule, retention, verification, restore procedures |
+| Capacity Planning | Baseline, projections, scaling thresholds |
+| Security Operations | Access management, vulnerability scanning (11.3 with VMS), remediation SLAs (11.4 with VMS benchmarks), patch management (11.5) |
+| Deployment & Release | Windows, rollback, feature flags, migrations |
+| Knowledge Transfer | Training materials, SME contacts, onboarding |
+| Handover Checklist | Comprehensive go-live checklist |
+| Operational Metrics | MTTR, MTBF, change failure rate, deployment frequency |
+| UK Government Considerations | GDS Point 14, NCSC guidance, cross-government dependencies |
+
+---
+
+## Service Tier Mapping
+
+| Tier | Availability | RTO | RPO | Support | On-Call |
+|------|-------------|-----|-----|---------|---------|
+| Critical | 99.95%+ | <1hr | <15min | 24/7 | Yes, immediate |
+| Important | 99.9% | <4hr | <1hr | 24/7 | Yes, 15min response |
+| Standard | 99.5% | <24hr | <4hr | Business hours | Best effort |
+
+---
+
+## Runbook Structure
+
+Each runbook must include:
+
+| Section | Contents |
+|---------|----------|
+| Purpose | What problem this runbook addresses |
+| Prerequisites | Access, tools, knowledge required |
+| Detection | How you know this runbook is needed |
+| Steps | Numbered, specific, actionable steps |
+| Verification | How to confirm the issue is resolved |
+| Escalation | When and how to escalate |
+| Rollback | How to undo changes if needed |
+
+---
+
+## Standard Runbooks Required
+
+| Runbook | Purpose |
+|---------|---------|
+| Service Start/Stop | Graceful start and stop procedures |
+| Health Check Failures | Response when health checks fail |
+| High Error Rate | Diagnosis and mitigation for elevated errors |
+| Performance Degradation | Response when SLOs are breached |
+| Capacity Issues | Scaling procedures (manual and automatic) |
+| Security Incident | Initial response for security events |
+| Critical Vulnerability Remediation | Response when critical CVEs or VMS alerts require urgent patching |
+| Dependency Failure | Response when upstream services fail |
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Discovery | Define requirements and architecture | `/arckit:requirements`, `/arckit:diagram` |
+| Design | Create HLD/DLD, identify risks | `/arckit:hld-review`, `/arckit:risk` |
+| Build | Implement, test, document | `/arckit:backlog`, `/arckit:devops` |
+| Readiness | Create operational pack | `/arckit:operationalize` |
+| Go-Live | Handover, train, transition | `/arckit:servicenow` |
+
+---
+
+## Handover Checklist Summary
+
+- [ ] All runbooks written and reviewed
+- [ ] Monitoring dashboards created and tested
+- [ ] Alerts configured and tested
+- [ ] On-call rotation staffed
+- [ ] DR tested within last 6 months
+- [ ] Backups verified and restore tested
+- [ ] Support team trained
+- [ ] Escalation contacts confirmed
+- [ ] Access provisioned for support team
+- [ ] Documentation in knowledge base
+- [ ] SLOs agreed with stakeholders
+- [ ] VMS enrolled and scanning active (UK Government)
+- [ ] Vulnerability remediation SLAs documented and agreed
+- [ ] Critical vulnerability remediation runbook tested
+
+---
+
+## Review Checklist
+
+- Every NFR has corresponding SLO/SLI.
+- Every major component has a runbook.
+- DR/BCP procedures documented and tested.
+- On-call rotation defined with sustainable schedule.
+- Escalation paths clear with contact details.
+- Training plan exists for operations team.
+- RTO/RPO align with architecture capability.
+
+---
+
+## Key Principles
+
+1. **SRE-First**: Define SLIs before SLOs before alerts.
+2. **Actionable Runbooks**: Specific, numbered steps with actual commands.
+3. **Realistic RTO/RPO**: Must match architecture capability.
+4. **Human-Centric**: On-call should be sustainable (no burnout).
+5. **Continuous Improvement**: Regular reviews, post-incident improvements.