arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/uae-ias.md

@@ -0,0 +1,93 @@
+# UAE Information Assurance Standard (IAS) Playbook
+
+> **Guide Origin**: Community | **ArcKit Version**: [VERSION]
+
+`/arckit:uae-ias` generates a UAE IAS Statement of Applicability against the 188 controls — 60 management controls (M1–M6) plus 128 technical controls (T1–T9) — priority-tiered P1 to P4. Anchored on the UAE Cybersecurity Council Information Assurance Standard v2.
+
+Targeted at federal entities and Critical Information Infrastructure (CII) operators.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Requirements (`ARC-<id>-REQ-v1.0.md`) | System scope and functional context |
+| Architecture (`ARC-<id>-ARCH-v1.0.md`) | Components and trust boundaries |
+| Security NFRs (`ARC-<id>-NFR-SEC-v1.0.md`) | Security requirements |
+| Security design (`ARC-<id>-SECD-v1.0.md`) | Existing controls and posture |
+
+---
+
+## Command
+
+```bash
+/arckit:uae-ias <project ID or system description>
+```
+
+Output: `projects/<id>/ARC-<id>-IAS-v1.0.md`
+
+---
+
+## Assessment Structure
+
+| Section | Contents |
+|---------|----------|
+| Scope | System boundary, CII designation status, sector authority |
+| Statement of Applicability | All 188 controls with P1–P4 priority and applicability rationale |
+| Risk Treatment Plan | Per-gap risk score, treatment option, owner, deadline |
+| CII Registration | Cybersecurity Council registration status and obligations |
+| External References | UAE Cybersecurity Council IAS v2 citations |
+
+---
+
+## Control Family Reference
+
+| Family | Range | Description |
+|--------|-------|-------------|
+| Management | M1 | Strategy and Planning |
+| Management | M2 | Information Security Risk Management |
+| Management | M3 | Awareness and Training |
+| Management | M4 | Human Resources Security |
+| Management | M5 | Compliance |
+| Management | M6 | Performance Evaluation and Improvement |
+| Technical | T1 | Asset Management |
+| Technical | T2 | Physical and Environmental Security |
+| Technical | T3 | Operations Management |
+| Technical | T4 | Communications |
+| Technical | T5 | Access Control Management |
+| Technical | T6 | Third-Party Security |
+| Technical | T7 | Information Systems Acquisition, Development & Maintenance |
+| Technical | T8 | Information Security Incident Management |
+| Technical | T9 | Information Systems Continuity Management |
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Architecture | System scope and security NFRs | `/arckit:requirements`, `/arckit:platform-design` |
+| IAS | Statement of Applicability + Risk Treatment Plan | `/arckit:uae-ias` |
+| Residency | T-family controls into CSP / region choice | `/arckit:uae-cloud-residency` |
+| Risk | Surface IAS gaps to project risk register | `/arckit:risk` |
+
+---
+
+## Review Checklist
+
+- All 188 controls present in the Statement of Applicability.
+- Each control has Applicable / Not Applicable + rationale (no blank cells).
+- Priority tier (P1–P4) assigned per control.
+- Gaps have a treatment option (mitigate / transfer / accept / avoid) with named owner.
+- CII registration status is explicit (registered / pending / not designated).
+- T-family gaps that constrain residency choice flagged for `/arckit:uae-cloud-residency`.
+
+---
+
+## Key Notes
+
+- **CII status**: Designation as Critical Information Infrastructure changes priority profile and obligations. Confirm with the Cybersecurity Council before relying on the SoA.
+- **Audit cadence**: IAS expects independent assessment on a defined cycle — capture the next assessment date in Document Control.
+- **Run order**: Run after the security architecture is stable; rerun on material architecture changes.
+- **Community-contributed**: Output should be reviewed by qualified RSSI / federal compliance counsel before reliance.

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/uae-overlay-maintenance.md

@@ -0,0 +1,154 @@
+# UAE Federal Overlay Maintenance Reference
+
+> **Overlay Origin**: Official Baseline | **ArcKit Version**: [VERSION]
+
+This document is the maintenance source of truth for the UAE Federal Overlay shipped in v4.10.0. It records every regulatory citation the 12 commands rely on, when each was last verified, what is not yet verified, and how the overlay is reviewed quarterly.
+
+For the user-facing overview of the overlay, see [`uae-overlay.md`](./uae-overlay.md).
+
+---
+
+## Citation Register
+
+Each row records a regulatory or policy instrument cited by one or more `uae-*` commands. "Verified date" is the date the maintainer last checked the cited text against the authoritative source. "Next review" is the scheduled re-check date under the quarterly cadence below.
+
+| Regulation / Instrument | Authority | Primary URL | Verified | Next Review | Used By |
+|---|---|---|---|---|---|
+| Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law) | UAE Data Office | u.ae/en/about-the-uae/digital-uae/data/data-protection-laws | 2026-04-30 | 2026-07-30 | uae-pdpl, uae-data-sharing |
+| UAE Cabinet Decree (23 April 2026) — agentic AI mandate | UAE Cabinet | docs/sources/2026-04-23-uae-cabinet-decree.md (repo-mirrored) | 2026-04-30 | 2026-07-30 | uae-ai-charter, uae-ai-autonomy-tier, uae-priorities-alignment |
+| UAE Smart Data Framework | TDRA / UAE Data Office | u.ae/en/about-the-uae/digital-uae/data | 2026-04-30 | 2026-07-30 | uae-classification |
+| UAE National Cloud Security Policy v2 | UAE Cybersecurity Council | csc.gov.ae | 2026-04-30 | 2026-07-30 | uae-cloud-residency |
+| UAE IAS (Information Assurance Standard) v2 | UAE Cybersecurity Council | csc.gov.ae | 2026-04-30 | 2026-07-30 | uae-ias |
+| UAE Pass Service Provider integration guide | TDRA | uaepass.ae | 2026-04-30 | 2026-07-30 | uae-uaepass |
+| UAE Code for Government Services | Office of the Prime Minister | u.ae/en/about-the-uae/the-uae-government/government-of-future | 2026-04-30 | 2026-07-30 | uae-zero-bureaucracy |
+| UAE Government Services Digital Records Policy | Cabinet Affairs / National Archives | u.ae | 2026-04-30 | 2026-07-30 | uae-digital-records |
+| UAE Government Services Data Sharing Policy | Cabinet Affairs | u.ae | 2026-04-30 | 2026-07-30 | uae-data-sharing |
+| Federal Government Guide to Aligning Digital Government Projects with National Priorities | Office of the Prime Minister | u.ae | 2026-04-30 | 2026-07-30 | uae-priorities-alignment |
+| UAE Charter for the Development and Use of AI | UAE AI Office | ai.gov.ae | 2026-04-30 | 2026-07-30 | uae-ai-charter |
+| Federal Decree-Law No. 11 of 2023 on Procurements in the Federal Government | Ministry of Finance | mof.gov.ae | 2026-04-30 | 2026-07-30 | uae-procurement |
+| MoF Digital Procurement Platform | Ministry of Finance | mof.gov.ae | 2026-04-30 | 2026-07-30 | uae-procurement |
+
+---
+
+## Quarterly Review Cadence
+
+The UAE regulatory landscape is moving quickly. The overlay is reviewed every quarter to catch:
+
+- New Executive Regulations gazetted under the PDPL.
+- Cabinet Resolutions that supersede or amend the four Cabinet instruments.
+- Updates to the Cybersecurity Council standards (IAS, Cloud Security Policy).
+- Procurement threshold changes under the MoF Decree-Law.
+- Updates to the Charter for AI and any sector-specific AI guidance (Central Bank, etc.).
+
+The review process is:
+
+1. Walk every row of the Citation Register and re-fetch the primary URL.
+2. Compare against the verified date. Flag any document with a different last-modified or version field.
+3. For each flagged row, read the diff against the version cited in the overlay's templates and command prompts.
+4. Open one issue per material change. Tag with `uae-overlay`, `regulatory-update`, and the affected command(s).
+5. Roll the changes into the next ArcKit release (typically a patch or minor) with a changelog entry under `### UAE Overlay Updates`.
+6. Bump the verified date and next-review date in the table above.
+
+Cadence: 30 January, 30 April, 30 July, 30 October. Next scheduled review: **2026-07-30**.
+
+---
+
+## Known Limitations / Not-Verified Items
+
+Six citations in the overlay are marked `[NEEDS VERIFICATION]` in the affected commands' prompts. They render in generated artefacts as inline notes so the architect can see at-glance where to apply local expertise.
+
+### 1. PDPL Executive Regulation status
+
+The PDPL (Federal Decree-Law No. 45 of 2021) was issued in November 2021. Its Executive Regulation, which contains the operative rules on lawful basis tests, DPIA thresholds, and cross-border transfer instruments, was not in force at the time of writing. The overlay applies the conservative reading consistent with the published Decree-Law and the UAE Data Office guidance, but anything that depends on the Executive Regulation should be verified against the gazette.
+
+Tracking: GitHub issue (to be opened post-merge under the v4.10 tracking issue).
+
+### 2. Smart Data Classifications exact level names
+
+The UAE Smart Data Framework references five classification levels. The overlay uses `Open / Shared / Confidential / Secret / Top Secret` based on the most recent published guidance. Federal entities have used slight name variations historically, and we have not yet seen the canonical level names in a single authoritative source. The mapping is conservative; the names should be verified against the entity's local Data Office guidance before publication.
+
+Tracking: GitHub issue (to be opened post-merge).
+
+### 3. UAE Pass Loa-to-eIDAS mapping
+
+UAE Pass publishes Basic and Verified profiles. There is no formal mapping between these profiles and the eIDAS Levels of Assurance (Low / Substantial / High). The overlay's `uae-uaepass` command applies a working assumption (Verified ~= Substantial; Basic ~= Low) that aligns with how some federal entities have treated cross-recognition. This should be checked with TDRA before any cross-border identity acceptance design.
+
+Tracking: GitHub issue (to be opened post-merge).
+
+### 4. AWS me-south-1 acceptability
+
+AWS operates the `me-south-1` region in Bahrain. Several UAE federal use-cases have run on it historically. The current Cloud Security Policy v2 may or may not accept it for `Confidential` and above; the overlay's `uae-cloud-residency` command lists it as a borderline option pending Cybersecurity Council confirmation. UAE-resident options (Microsoft UAE North/Central, Core42 / G42 sovereign, e& Sovereign Launchpad on AWS) are recommended in preference until the position is verified.
+
+Tracking: GitHub issue (to be opened post-merge).
+
+### 5. UAE Central Bank AI guidance
+
+The Central Bank of the UAE has issued AI-related guidance for licensed financial entities. The overlay's `uae-ai-autonomy-tier` Tier 3 (regulated/financial) refers to it generically. The exact citation, and the boundary between Central Bank guidance and Securities and Commodities Authority (SCA) guidance for capital-markets entities, is not yet pinned down.
+
+Tracking: GitHub issue (to be opened post-merge).
+
+### 6. Cabinet Affairs vs National Archives ownership of the Digital Records Policy
+
+The UAE Government Services Digital Records Policy is owned and published under the federal Office of the Prime Minister. The day-to-day stewardship has historically sat with both Cabinet Affairs and the National Archives (different aspects: governance vs records-management technical detail). The overlay names "Cabinet Affairs / National Archives" as joint authority. A clearer single owner would help reviewers know whose interpretation to defer to in edge cases.
+
+Tracking: GitHub issue (to be opened post-merge).
+
+---
+
+## Open GitHub Issues
+
+A tracking issue will be opened for each of the six gaps under the v4.10 milestone. They will be linked here once filed:
+
+- `[ ]` PDPL Executive Regulation status
+- `[ ]` Smart Data Classifications exact level names
+- `[ ]` UAE Pass LoA-to-eIDAS mapping
+- `[ ]` AWS me-south-1 acceptability
+- `[ ]` UAE Central Bank AI guidance
+- `[ ]` Cabinet Affairs vs National Archives ownership
+
+---
+
+## Help Wanted: UAE Domain Co-Maintainer
+
+The overlay is officially maintained by the ArcKit core maintainer. A UAE-resident co-maintainer with regulatory or federal architecture experience would substantially improve responsiveness.
+
+The role:
+
+- Auto-requested for review on PRs touching `plugins/arckit-uae/commands/uae-*.md`, `plugins/arckit-uae/templates/uae-*-template.md`, `plugins/arckit-uae/recipes/uae-*.yaml`, and `.arckit/templates/uae-*-template.md`.
+- Owns the quarterly review for the Citation Register.
+- Confirms or rejects the six not-verified items above.
+- Recommends additions when new federal instruments are gazetted.
+- Not in the merge path; the repository owner remains the final approver.
+
+Profile: enterprise architect, DPO, RSSI, or programme manager with hands-on UAE federal experience. Particularly useful are people who have run pathfinders on the Cabinet's agentic-AI programme, contributed to a federal entity's IAS implementation, or worked on UAE Pass integrations as a Service Provider.
+
+To apply: open an issue tagged `uae-overlay` and `co-maintainer` on the [arc-kit](https://github.com/tractorjuice/arc-kit) repository, with a short note on background and proposed time commitment.
+
+---
+
+## v4.11 / v5.0 Backlog
+
+Four overlay extensions are deliberately out of scope for v4.10 and tracked here for the next minor release window:
+
+### Federal Mandate Doc-Types Category
+
+The four Cabinet instruments (`ZBUR`, `DREC`, `DSHR`, `NPRA`) currently sit under the existing `Governance` doc-types category. A dedicated `Federal Mandate` category would improve discoverability and group these alongside any future Cabinet-derived artefacts. Requires a doc-types registry change and a manifest re-generation.
+
+### `uae-translate` (Bilingual Arabic / English)
+
+A future command that takes any ArcKit artefact and generates an Arabic-language version, plus a side-by-side bilingual version for ministerial submissions. Requires a translation backend, glossary management for federal terms (where Arabic precision matters), and cultural-review handoff. Complex enough to warrant a v5.0 commitment.
+
+### Sector Overlays
+
+Sector-specific overlays for federal entities operating in regulated verticals. Initial targets: ADHICS (Abu Dhabi healthcare), Dubai ISR (Dubai information security regulation), Central Bank financial services, SCA capital markets. These are good candidates for community contributions, similar to the EU/French/Austrian pattern.
+
+### Sovereign-Vendor Evaluation
+
+A `uae-vendor-sovereignty` command that scores vendors against the federal sovereign-cloud and ICV criteria, comparable in shape to `fr-secnumcloud` for France. Requires a vendor matrix (Core42, G42, Microsoft UAE, e&, du, Mubadala-portfolio, etc.) and an ICV scoring rubric.
+
+---
+
+**Generated by**: ArcKit overlay maintenance documentation
+**ArcKit Version**: [VERSION]
+**Last full review**: 2026-04-30
+**Next scheduled review**: 2026-07-30

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/uae-overlay.md

@@ -0,0 +1,208 @@
+# UAE Federal Overlay Guide
+
+> **Overlay Origin**: Official Baseline | **ArcKit Version**: [VERSION]
+
+The UAE Federal Overlay adds 12 official-baseline commands covering the federal regulatory and digital-government instruments that apply to UAE federal entities, contracted suppliers, and Critical Information Infrastructure (CII) operators. It is anchored on the Cabinet decree of 23 April 2026 mandating that 50% of federal services run on agentic AI by April 2028, and on the federal data, identity, AI, and procurement frameworks that the decree references.
+
+This guide is the entry point. The companion document `uae-overlay-maintenance.md` is the source of truth for citation provenance, known gaps, and the quarterly review cadence.
+
+---
+
+## Purpose
+
+Five jobs in one overlay:
+
+1. Make UAE federal regulatory text easy to apply during architecture work, not bolted on at the end.
+2. Embed UAE Smart Data classification into the same Document Control header that UK and Generic ladders already use, controlled by a single `classification_scheme` userConfig value.
+3. Capture the four Cabinet instruments (Zero Bureaucracy, Digital Records, Data Sharing, National Priorities Alignment) as first-class artefact types.
+4. Ground AI delivery in the UAE Charter for AI and a three-tier autonomy posture so the federal AI mandate has architectural rails, not just slides.
+5. Tie procurement to UAE Federal Decree-Law No. 11 of 2023 and the Ministry of Finance Digital Procurement Platform.
+
+---
+
+## When to Use
+
+Use the overlay if any of the following apply to the project:
+
+- The contracting authority is a UAE federal entity (ministry, federal authority, federal council, or federally-owned company).
+- The project handles personal data of UAE residents and is in scope of Federal Decree-Law No. 45 of 2021 (PDPL).
+- The project provides citizen-facing services that need UAE Pass authentication.
+- The system is designated as Critical Information Infrastructure (CII) by the UAE Cybersecurity Council and must align to the Information Assurance Standard (IAS).
+- The procurement is run through the Ministry of Finance Digital Procurement Platform.
+- The project is one of the agentic-AI pathfinders under the 23 April 2026 Cabinet mandate.
+
+For non-UAE projects the overlay is dormant: existing UK and Generic ladders are unchanged, and Document Control output remains byte-identical to v4.9.4.
+
+---
+
+## Prerequisites
+
+Before running the commands, set the plugin userConfig values:
+
+| userConfig key | Value |
+|---|---|
+| `governance_framework` | `UAE Federal` |
+| `classification_scheme` | `UAE Smart Data` |
+| `organisation_name` | the federal entity name |
+| `default_classification` | one of `Open`, `Shared`, `Confidential`, `Secret`, `Top Secret` |
+
+The first two values switch the Document Control header into UAE rendering. The third and fourth populate the per-artefact header automatically. With these set, every artefact across the entire toolkit (UAE-specific or otherwise) uses the UAE Smart Data classification ladder.
+
+If you are migrating an existing UK-classified project, run the one-time helper described under [Migration from UK Ladder](#migration-from-uk-ladder) below.
+
+---
+
+## The 12 Commands
+
+### Federal Data and Security
+
+#### `/arckit:uae-classification`
+
+Generates a UAE Smart Data Classification Register for the project, mapping every dataset to one of `Open`, `Shared`, `Confidential`, `Secret`, or `Top Secret` with handling rules and a declassification schedule. Anchored on the UAE Smart Data Framework. Handoffs: `data-model` (per-entity sensitivity tags), `uae-cloud-residency` (residency obligations follow from classification), `uae-data-sharing` (per-share sensitivity).
+
+#### `/arckit:uae-pdpl`
+
+Generates a UAE PDPL (Federal Decree-Law No. 45 of 2021) compliance assessment including DPIA, lawful-basis register, data-subject-rights procedure, and cross-border transfer log. Anchored on the UAE Data Office statutory framework. Handoffs: `risks` (DPIA into the risk register), `uae-data-sharing` (lawful basis into shares), `uae-classification` (PDPL-relevant datasets must be classified).
+
+#### `/arckit:uae-ias`
+
+Generates a UAE IAS Statement of Applicability against the 188 controls (60 management M1 to M6 plus 128 technical T1 to T9), priority-tiered P1 to P4. Anchored on the UAE Cybersecurity Council Information Assurance Standard v2. Handoffs: `risks` (gaps and treatment plan), `uae-cloud-residency` (T-family controls constrain CSP choice).
+
+#### `/arckit:uae-cloud-residency`
+
+Assesses sovereign cloud residency under the UAE National Cloud Security Policy v2. Validates per-classification residency, names approved CSP options (Core42 / G42 sovereign, Microsoft UAE North and Central, TDRA FedNet, e& Sovereign Launchpad on AWS), and captures the shared-responsibility matrix and exit/portability plan. Handoffs: `uae-classification` (depends on it), `adr` (residency decisions captured as ADRs).
+
+### Federal Identity
+
+#### `/arckit:uae-uaepass`
+
+Generates a UAE Pass integration design covering the OIDC/OAuth flow, claim mapping, Basic vs Verified profile selection, the Service Provider onboarding pack, and the e-signature audit trail. Handoffs: `integration` (OIDC endpoints into the integration spec), `adr` (profile selection and e-signature mechanism are architecturally significant).
+
+### Cabinet Instruments
+
+#### `/arckit:uae-zero-bureaucracy`
+
+Generates a Service Catalogue review under the UAE Code for Government Services and the Zero Bureaucracy programme. Captures service catalogue mapping, bureaucracy-elimination baseline, and customer-experience KPIs. Handoffs: `uae-priorities-alignment` (service-level outputs feed the alignment statement).
+
+#### `/arckit:uae-digital-records`
+
+Generates a Digital Records Plan under the UAE Government Services Digital Records Policy. Captures the source-of-truth register per service, retention schedule, and records-as-official-source designation. Handoffs: `data-model` (source-of-truth into entity ownership), `uae-data-sharing` (official-source records feed shares).
+
+#### `/arckit:uae-data-sharing`
+
+Generates a Data Sharing Agreement under the UAE Government Services Data Sharing Policy ("collect once, use securely"). Captures collect-once mapping, federation/API plan, and PDPL lawful basis per share. Handoffs: `integration` (federation mechanisms), `uae-pdpl` (lawful basis into the PDPL assessment).
+
+#### `/arckit:uae-priorities-alignment`
+
+Generates a National Priorities Alignment Statement under the UAE Federal Government Guide. Captures reuse-vs-build justification, capability-reuse register (UAE Pass, FedNet), and strategy alignment to NIS 2031 / AI 2031 / Digital Economy Strategy / We the UAE 2031. Handoffs: `sobc` (alignment into the business case), `uae-uaepass` (reuse becomes integration design).
+
+### AI Governance
+
+#### `/arckit:uae-ai-charter`
+
+Generates a UAE Charter for AI compliance assessment against the 12 principles (human-machine ties, safety, bias mitigation, data privacy, transparency, human oversight, governance/accountability, technological excellence, human commitment, peaceful coexistence, inclusive access, lawful compliance). Handoffs: `uae-ai-autonomy-tier` (charter posture into the per-tier guard-rails), `risks` (gaps into the risk register).
+
+#### `/arckit:uae-ai-autonomy-tier`
+
+Generates a three-tier AI autonomy posture (Tier 1 internal-productivity, Tier 2 investor-facing-with-approval, Tier 3 regulated/financial). Captures per-tier guard-rails, approval gates, audit obligations, and tier-promotion criteria. Handoffs: `adr` (tier-promotion is architecturally significant), `risks` (per-tier residual risks).
+
+### Procurement
+
+#### `/arckit:uae-procurement`
+
+Generates a federal procurement strategy under UAE Federal Decree-Law No. 11 of 2023. Produces ITT/RFP packs against the MoF Digital Procurement Platform templates, an In-Country Value (ICV) plan, the evaluation report structure, and the contract register. Handoffs: `evaluate` (formal supplier evaluation), `sobc` (procurement strategy and ICV into the business case).
+
+---
+
+## The Canonical Chain
+
+For a federal pathfinder project the recommended sequence is:
+
+```text
+principles
+  → uae-classification
+  → uae-pdpl
+  → uae-ias
+  → uae-cloud-residency
+  → uae-uaepass
+  → uae-zero-bureaucracy
+  → uae-digital-records
+  → uae-data-sharing
+  → uae-ai-charter
+  → uae-ai-autonomy-tier
+  → uae-priorities-alignment
+  → uae-procurement
+  → sobc
+  → wardley
+  → framework
+```
+
+The UAE-specific commands sit between requirements/data-model and the cross-cutting commands (sobc, wardley, framework) that already exist in the toolkit. The handoffs declared in each command's frontmatter render as a `## Suggested Next Steps` section in non-Claude variants and as marketplace-driven follow-ups in Claude Code.
+
+---
+
+## Document Control Rendering
+
+Every artefact carries a Document Control header. The header used to be a hard-coded table per template; from v4.10 it is rendered at command-execution time from a `<!-- DOC-CONTROL-HEADER -->` marker, using the rules in `templates/_partials/RENDERING.md`.
+
+Three rendering paths exist:
+
+| `governance_framework` | `classification_scheme` | Classification ladder rendered |
+|---|---|---|
+| `UK Gov` | (any) | UK Government: PUBLIC / OFFICIAL / OFFICIAL-SENSITIVE / SECRET / TOP SECRET |
+| `Generic` | (any) | Generic: PUBLIC / INTERNAL / CONFIDENTIAL / RESTRICTED |
+| `UAE Federal` | `UAE Smart Data` | UAE Smart Data: Open / Shared / Confidential / Secret / Top Secret |
+
+The conditional means the same template renders correctly across jurisdictions without per-jurisdiction template duplication. Non-UAE projects produce byte-identical output to v4.9.4.
+
+---
+
+## Migration from UK Ladder
+
+If a project already has artefacts using the UK ladder and you are switching to the UAE Smart Data ladder, run:
+
+```bash
+arckit migrate-classification --root projects   # report only, no writes
+arckit migrate-classification --root projects --apply  # apply mappings
+```
+
+The mapping is:
+
+| From (UK) | To (UAE Smart Data) |
+|---|---|
+| `PUBLIC` | `Open` |
+| `OFFICIAL` | `Shared` |
+| `OFFICIAL-SENSITIVE` | `Confidential` |
+| `SECRET` | `Secret` |
+| `TOP SECRET` | `Top Secret` |
+
+The helper writes a unified diff to stdout. Review it before the `--apply` run. The mapping is intentionally conservative; an architect should verify Confidential and above against the UAE Data Office sensitivity guidance before publication.
+
+---
+
+## Known Limitations
+
+The maintenance document lists six citations that the overlay flags as not-yet-verified:
+
+1. PDPL Executive Regulation status
+2. Smart Data Classifications exact level names
+3. UAE Pass Loa-to-eIDAS mapping
+4. AWS me-south-1 acceptability under the Cloud Security Policy
+5. UAE Central Bank AI guidance
+6. Cabinet Affairs vs National Archives ownership of the Digital Records Policy
+
+See `uae-overlay-maintenance.md` for the canonical list and the GitHub issues tracking each gap. Commands that touch these citations carry an inline `[NEEDS VERIFICATION]` marker on the affected paragraph until the gap is closed.
+
+---
+
+## Contributing
+
+The overlay is currently maintained by [@tractorjuice](https://github.com/tractorjuice). A UAE domain co-maintainer is being recruited; the recruiting brief is in `uae-overlay-maintenance.md`. Pull requests touching the `uae-*` paths auto-request review through CODEOWNERS.
+
+If you find a regulatory citation that has shifted, an Executive Regulation that has been gazetted, or a Cabinet Resolution that supersedes a referenced instrument, please open an issue with the source URL and the verified date. The maintenance document's citation register will be updated and the affected commands re-tested.
+
+---
+
+**Generated by**: ArcKit overlay documentation
+**ArcKit Version**: [VERSION]
+**Companion**: [`uae-overlay-maintenance.md`](./uae-overlay-maintenance.md)

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/uae-pdpl.md

@@ -0,0 +1,73 @@
+# UAE PDPL Compliance Playbook
+
+> **Guide Origin**: Community | **ArcKit Version**: [VERSION]
+
+`/arckit:uae-pdpl` generates a UAE Personal Data Protection Law compliance assessment under Federal Decree-Law No. 45 of 2021. Covers DPIA, lawful-basis register, data-subject-rights procedure, cross-border transfer log, and breach notification playbook. Anchored on the UAE Data Office statutory framework.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Requirements (`ARC-<id>-REQ-v1.0.md`) | Processing activities and personal-data flows |
+| Data requirements (`ARC-<id>-DR-v1.0.md`) | Personal-data categories collected |
+| Data model (`ARC-<id>-DMOD-v1.0.md`) | Personal-data entities and relationships |
+
+---
+
+## Command
+
+```bash
+/arckit:uae-pdpl <project ID or service description>
+```
+
+Output: `projects/<id>/ARC-<id>-PDPL-v1.0.md`
+
+---
+
+## Assessment Structure
+
+| Section | Contents |
+|---------|----------|
+| Scope | Personal-data flows, controllers, processors, data subjects |
+| Lawful Basis Register | Per-processing lawful basis (consent, contract, legal obligation, vital interest, public interest, legitimate interest) |
+| Data Subject Rights Procedure | Access, rectification, erasure, restriction, portability, objection workflow and SLAs |
+| DPIA | High-risk processing screen, risk identification, mitigations, residual risk |
+| Cross-Border Transfers | Adequacy decisions, contractual safeguards, derogations, transfer log |
+| Breach Notification Playbook | Detection, triage, UAE Data Office notification timing, data-subject notification |
+| Penalties | Informational summary of PDPL sanctions tier |
+| External References | Decree-Law 45/2021, Executive Regulation status, Data Office guidance |
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Inventory | Personal-data flows, lawful basis | `/arckit:requirements`, `/arckit:data-model` |
+| Classification | Smart Data sensitivity tags | `/arckit:uae-classification` |
+| PDPL | Compliance assessment + DPIA | `/arckit:uae-pdpl` |
+| Sharing | Per-share lawful-basis mapping | `/arckit:uae-data-sharing` |
+| Risk | Surface DPIA gaps to risk register | `/arckit:risk` |
+
+---
+
+## Review Checklist
+
+- Lawful basis recorded for every processing activity (no "TBD").
+- Data subject rights workflow has named owner and SLA.
+- DPIA screen completed; high-risk processing has documented mitigations.
+- Cross-border transfers logged with adequacy / safeguard mechanism.
+- Breach playbook names the UAE Data Office notification window.
+- DPIA outputs handed off to the project risk register.
+- Smart Data Classification Register reconciled against PDPL-relevant datasets.
+
+---
+
+## Key Notes
+
+- **Executive Regulation**: PDPL Executive Regulation is flagged as `[NEEDS VERIFICATION]` in the overlay maintenance log — confirm current status before publication.
+- **Cross-border**: Default position is sovereign UAE residency for Confidential and above; transfers require explicit derogation.
+- **Run order**: Best executed after `/arckit:uae-classification` so PDPL-relevant datasets are already tagged.
+- **Community-contributed**: Output should be reviewed by qualified DPO / federal compliance counsel before reliance.

arckit_cli-6.1.1.data/data/share/arckit/docs/guides/uae-priorities-alignment.md

@@ -0,0 +1,82 @@
+# UAE National Priorities Alignment Playbook
+
+> **Guide Origin**: Community | **ArcKit Version**: [VERSION]
+
+`/arckit:uae-priorities-alignment` generates a National Priorities Alignment Statement under the UAE Federal Government Guide to Aligning Digital Government Projects with National Priorities. Captures reuse-vs-build justification, capability-reuse register (UAE Pass, FedNet, etc.), and strategy alignment to NIS 2031 / AI 2031 / Digital Economy Strategy / We the UAE 2031.
+
+---
+
+## Inputs
+
+| Artefact | Purpose |
+|----------|---------|
+| Requirements (`ARC-<id>-REQ-v1.0.md`) | Project scope and outcomes |
+| SOBC (`ARC-<id>-SOBC-v*.md`) | Strategic case and benefits |
+| ADRs (`ARC-<id>-ADR-*.md`) | Material decisions to date |
+| Prior UAE artefacts (CLAS, PDPL, IAS, CRES, UPASS, ZBUR, DREC, DSHR if present) | Reuse and compliance posture inputs |
+
+---
+
+## Command
+
+```bash
+/arckit:uae-priorities-alignment <project ID or service name>
+```
+
+Output: `projects/<id>/ARC-<id>-NPRA-v1.0.md`
+
+---
+
+## Statement Structure
+
+| Section | Contents |
+|---------|----------|
+| Strategic Alignment Matrix | Project → NIS 2031 / AI 2031 / Digital Economy Strategy / We the UAE 2031 |
+| Reuse-vs-Build Justification | Per major capability, reuse path considered and chosen rationale |
+| Capability Reuse Register | UAE Pass, FedNet, federal registers, shared services in use |
+| Resource-Efficiency Calculation | Cost / time / FTE saved through reuse vs build |
+| Feasibility & Pilot Plan | Phased delivery and decision points |
+| External References | Federal Government Guide citations |
+
+---
+
+## Federal Capability Register (typical reuse candidates)
+
+| Capability | Owner | Use case |
+|------------|-------|----------|
+| UAE Pass | TDRA | Identity / authentication / e-signature |
+| FedNet | TDRA | Federal connectivity |
+| Federal data registers | Various ministries | Authoritative source for citizen / business data |
+| Sovereign cloud (Core42 / Azure UAE / FedNet) | Various | Hosting |
+| Shared service platforms | Various | Common government services |
+
+---
+
+## One-Page Workflow
+
+| Phase | Key Activities | ArcKit Commands |
+|-------|----------------|-----------------|
+| Foundations | Compliance and design baseline | `/arckit:uae-pdpl`, `/arckit:uae-classification`, `/arckit:uae-ias` |
+| Alignment | National-priorities statement | `/arckit:uae-priorities-alignment` |
+| Business case | Reuse + alignment into SOBC | `/arckit:sobc` |
+| Reuse design | Detail UAE Pass integration | `/arckit:uae-uaepass` |
+
+---
+
+## Review Checklist
+
+- Strategic alignment matrix references all four national strategies.
+- Reuse considered for every major capability before "build" is chosen.
+- Capability Reuse Register lists each federal capability used (or explicitly considered and rejected).
+- Resource-efficiency calculation is quantitative.
+- Pilot / phased plan has named gates and approvals.
+- Reuse outputs feed UAE Pass integration design and SOBC.
+
+---
+
+## Key Notes
+
+- **Reuse default**: Federal Government Guide expects "reuse first, build last" — every "build" decision needs documented justification.
+- **Run late**: This artefact synthesises the UAE-specific stack — run after the upstream UAE commands so it can cite their outputs.
+- **SOBC integration**: Output is designed to flow directly into the Strategic Outline Business Case via `/arckit:sobc`.
+- **Community-contributed**: Output should be reviewed by qualified federal strategy / compliance counsel before reliance.