arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/ca-atip-template.md

@@ -0,0 +1,192 @@
+# Canada ATIP Reconciliation
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:ca-atip`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:ca-atip` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+[Two to three paragraphs describing the system's information holdings, the headline ATI Act exemption posture per holding, the Privacy Act §4–§8 disclosure footprint, the severance design for any hybrid public/protected views, and any open issues that block ATIP readiness.]
+
+## Information Holdings Inventory
+
+| Holding | Category (Public / Protected / Classified) | PIB ref | Owner | Lifecycle |
+|---------|--------------------------------------------|---------|-------|-----------|
+| [registrant identity record] | Protected B | [PIB number or NEW] | [ATIP coordinator] | [Live / Pilot / Design] |
+| [public-facing register entry] | Public | n/a | [Programme owner] | [Live] |
+| [investigative case file] | Protected B / Classified | [PIB number] | [investigative authority] | [Live] |
+| [audit trail / severance log] | Protected B | [PIB number or NEW] | [ATIP coordinator] | [Live] |
+| [aggregate analytics dataset] | Public / Protected (per field) | [PIB number or NEW] | [Analytics lead] | [Design] |
+
+> Categorise every dataset that surfaces in the data model. A holding without an explicit category is a launch blocker.
+
+## Access to Information Act Mapping
+
+| Holding | Exemption section | Justification | Severance applies |
+|---------|-------------------|---------------|-------------------|
+| [investigative case file] | §16(1)(c) law enforcement / investigations | [why the disclosure could reasonably be expected to be injurious to enforcement] | Yes |
+| [investigative case file — designated body) | §16.1 designated investigative bodies | [where the holding originates from a §16.1 body] | Yes |
+| [audit working paper] | §16.5 audits | [where audit working papers fall within §16.5] | Yes |
+| [protected disclosure complaint] | §16.6 protected disclosures | [PSDPA whistleblower context] | Yes |
+| [foreign-government correspondence] | §13 obtained in confidence | [identify originating government / international organisation] | Yes |
+| [federal-provincial briefing] | §14 federal-provincial affairs | [where disclosure could be injurious to FP affairs] | Yes |
+| [security-cleared briefing] | §15 international affairs / defence / national security | [identify which §15 head applies] | Yes |
+| [personal information element] | §19 (refers to Privacy Act) | [§19 is NOT blanket — test against §8(2) routine uses before invoking] | Yes |
+| [policy advice / option memo] | §21 advice and recommendations | [within §21(1)(a)/(b) and the 20-year sunset] | Partial |
+| [legal opinion] | §23 solicitor-client privilege | [identify the privilege; do not assert without basis] | Yes |
+| [Schedule II statute prohibition] | §24 statutory prohibitions | [identify the specific Schedule II provision] | Yes |
+
+> Per row, the justification must be specific enough for the OIC to follow on review under §30. Asserting §16 or §15 without specifying the head is a common defect.
+
+## Privacy Act §4–§8 Register
+
+| Activity | Section | Justification | Notes |
+|----------|---------|---------------|-------|
+| [collect legal name and address] | §4 | [collection relates directly to programme X — cite enabling statute] | [link to PIA element row] |
+| [collect identity directly from individual] | §5 | [direct collection where reasonably possible] | n/a |
+| [collect identity from CRA cross-reference] | §5(2) — exception to direct collection | [identify the exception relied on under §5(2)/(3)] | [link to PIA element row] |
+| [use for eligibility decisioning] | §7 — purpose of collection | [exact original purpose] | n/a |
+| [use for fraud analytics] | §7(a) — consistent use | [explain reasonable expectation by individual] | [requires consistent-use letter to TBS InfoSource] |
+| [disclose to other federal institution for joint programme] | §8(2)(a) — consistent use | [routine-use letter (a)] | [bilateral MOU reference] |
+| [disclose to investigative body under federal/provincial law] | §8(2)(e) — investigation | [routine-use letter (e); cite investigative authority] | [link to Information Sharing Agreement] |
+| [disclose to processor under contractual safeguards] | §8(2)(f) — agreement | [routine-use letter (f); cite agreement] | [cross-border? cross-reference `ca-cloud-residency`] |
+| [disclose to OPC on access request] | §8(2)(c) — compliance with order or to comply with rules of court | [where applicable] | n/a |
+| [disclose with consent of the individual] | §8(2)(b) — consent | [identify how consent is captured and revocable] | n/a |
+| [public-interest disclosure to a person whose interests it benefits] | §8(2)(m) — public interest | [Minister gives written notice to OPC under §8(5)] | [extraordinary; document rationale] |
+
+> Each §8(2)(a)–(m) letter must be matched to the actual disclosure scenario. Do not aggregate dissimilar disclosures under one row.
+
+## Severance Design
+
+The severance regime governs every transition from a Protected or Classified holding to a Public view, and from one user role to another within a Protected holding.
+
+### Field-Level Severance Rules
+
+| Field | View — Public | View — Protected | View — Classified | Exemption(s) cited |
+|-------|---------------|------------------|-------------------|--------------------|
+| [registrant legal name] | Reveal | Reveal | Reveal | n/a |
+| [registrant home address] | Mask | Reveal | Reveal | §19; Privacy Act §8 |
+| [foreign principal name] | Reveal | Reveal | Reveal | n/a |
+| [investigative officer identity] | Mask | Mask | Reveal | §16(1)(c); §15 |
+| [financial flow amount] | Banded | Reveal | Reveal | §20 third-party (where applicable) |
+| [risk score / triage outcome] | Mask | Mask | Reveal | §16(1)(c); §21 advice |
+| [free-text narrative] | Mask | Reveal with redaction | Reveal | §19; §16; §21 (per content) |
+
+### Severance Audit Log Schema
+
+| Field | Reviewer role | Exemption cited | Output |
+|-------|---------------|-----------------|--------|
+| [field name] | [ATIP analyst / delegated officer] | [§13 / §14 / §15 / §16 / §19 / §21 / §23 / §24 — specific head] | [redacted character count, justification reference, retained/deleted, version] |
+| [composite redaction] | [Senior ATIP analyst] | [multiple — list each head] | [linked justification memo ref] |
+| [late re-redaction on consultation] | [ATIP coordinator] | [as cited] | [reason for change; original release recall ref] |
+
+> Every redaction event must produce one row above. Severance without per-field audit trails will not withstand OIC review.
+
+### Re-Identification Risk Register
+
+| Risk | Likelihood | Impact | Mitigation | Residual |
+|------|------------|--------|------------|----------|
+| Public register cross-referenced with adjacent open data | [Low / Med / High] | [Low / Med / High] | [k-anonymity threshold; banded fields; suppression rules] | [Low / Med / High] |
+| Protected view metadata (timestamps, IDs) leaks through severance gaps | [Low / Med / High] | [Low / Med / High] | [strip metadata on export; review severance tooling output] | [Low / Med / High] |
+| Aggregate analytics enabling re-identification of small cohorts | [Low / Med / High] | [Low / Med / High] | [minimum cell size; differential-privacy noise where appropriate] | [Low / Med / High] |
+| Triangulation across release tranches | [Low / Med / High] | [Low / Med / High] | [tranche-aware severance; cumulative-disclosure ledger] | [Low / Med / High] |
+
+## ATIP Request Workflow
+
+1. **Intake** — request received via designated channel; identity verification; clarification dialogue where the request is broad.
+2. **Triage** — locate responsive records; categorise per Information Holdings Inventory; identify exemptions in play.
+3. **Consultation under §27** — notify affected third parties (other institutions, originating governments, third-party suppliers under §20) within statutory timelines.
+4. **Severance** — apply field-level severance rules; produce audit log entries per redaction.
+5. **Release** — issue release package or refusal; publication of refusals where institutional policy requires.
+6. **Complaint pathway** — OIC complaint under §30; institutional response; potential Federal Court review under §41.
+
+| Step | SLA | Owner | Notes |
+|------|-----|-------|-------|
+| Acknowledge receipt | Within 5 business days | ATIP coordinator | n/a |
+| Initial response | 30 days from receipt per §7 | ATIP analyst | clock starts at receipt of fee where applicable |
+| §9 extension notice (if required) | Before the 30-day clock expires | ATIP coordinator | written notice with reasons and stated timeline |
+| §27 third-party consultation | Within statutory window | ATIP analyst | [identify specific third parties] |
+| Severance and release | Per extended deadline | ATIP analyst + Senior reviewer | audit log per redaction |
+
+### Extension justification template (§9)
+
+| Field | Value |
+|-------|-------|
+| Original deadline | [YYYY-MM-DD] |
+| §9 head invoked | §9(1)(a) / (b) / (c) |
+| Reason | [e.g. large volume of records; consultations required; interferes unreasonably with operations] |
+| Extended deadline | [YYYY-MM-DD] |
+| Notice issued to requester | [YYYY-MM-DD] |
+| OIC notified (where extension > 30 days) | [YYYY-MM-DD or N/A] |
+
+## Annual Report Mapping
+
+| Reportable item | Source | Period | Reporting authority |
+|-----------------|--------|--------|---------------------|
+| ATI requests received, granted, refused, extended | Request tracker | Fiscal year | OIC + departmental ATI annual report to Parliament |
+| Privacy Act requests and complaints | Request tracker | Fiscal year | OPC + departmental Privacy annual report to Parliament |
+| Personal Information Banks and InfoSource updates | PIB register | Continuous | TBS InfoSource |
+| OIC investigations and findings | Complaints log | Fiscal year | OIC |
+| OPC investigations and findings | Complaints log | Fiscal year | OPC |
+| Material modifications triggering PIA refresh | Change log | On occurrence | TBS + OPC notification |
+
+## Open Issues
+
+| Item | Owner | Due | Status |
+|------|-------|-----|--------|
+| Resolve `<TBC>` exemption rationales | ATIP coordinator | [YYYY-MM-DD] | [Open / Closed] |
+| Update PIB entry in TBS InfoSource for new holdings | ATIP coordinator | [YYYY-MM-DD] | [Open / Closed] |
+| Confirm §27 third-party consultation list | ATIP analyst | [YYYY-MM-DD] | [Open / Closed] |
+| Validate severance tooling against audit log schema | Architecture lead | [YYYY-MM-DD] | [Open / Closed] |
+| Resolve re-identification risks marked High | Architecture lead | [YYYY-MM-DD] | [Open / Closed] |
+| Cross-reference data-model classification flags | Data architect | [YYYY-MM-DD] | [Open / Closed] |
+
+## External References
+
+### Document Register
+
+| Doc ID | Title | URL | Verified date |
+|--------|-------|-----|---------------|
+| CA-ATI-ACT | Access to Information Act (R.S.C., 1985, c. A-1) | <https://laws-lois.justice.gc.ca/eng/acts/A-1/> | [YYYY-MM-DD] |
+| CA-PRIV-ACT | Privacy Act (R.S.C., 1985, c. P-21) | <https://laws-lois.justice.gc.ca/eng/acts/P-21/> | [YYYY-MM-DD] |
+| CA-OIC | Office of the Information Commissioner of Canada — published guidance | <https://www.oic-ci.gc.ca/> | [YYYY-MM-DD] |
+| CA-OPC | Office of the Privacy Commissioner of Canada — published guidance | <https://www.priv.gc.ca/> | [YYYY-MM-DD] |
+| CA-TBS-ATI | TBS Directive on Access to Information Requests | <https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=18310> | [YYYY-MM-DD] |
+| CA-TBS-PIA | TBS Directive on Privacy Impact Assessment | <https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=18308> | [YYYY-MM-DD] |
+| CA-INFOSOURCE | TBS InfoSource — Personal Information Banks register | <https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/access-information/information-about-programs-information-holdings.html> | [YYYY-MM-DD] |
+
+### Citations
+
+| Citation | Doc ID | Section | Used in |
+|----------|--------|---------|---------|
+| [ATI-1] | CA-ATI-ACT | §7 — 30-day clock | ATIP Request Workflow |
+| [ATI-2] | CA-ATI-ACT | §9 — extensions | ATIP Request Workflow |
+| [ATI-3] | CA-ATI-ACT | §13 — obtained in confidence | Access to Information Act Mapping |
+| [ATI-4] | CA-ATI-ACT | §14 — federal-provincial affairs | Access to Information Act Mapping |
+| [ATI-5] | CA-ATI-ACT | §15 — international affairs / defence / national security | Access to Information Act Mapping |
+| [ATI-6] | CA-ATI-ACT | §16 / §16.1–§16.6 — law enforcement and investigations | Access to Information Act Mapping |
+| [ATI-7] | CA-ATI-ACT | §19 — personal information | Access to Information Act Mapping |
+| [ATI-8] | CA-ATI-ACT | §21 — advice and recommendations | Access to Information Act Mapping |
+| [ATI-9] | CA-ATI-ACT | §23 — solicitor-client privilege | Access to Information Act Mapping |
+| [ATI-10] | CA-ATI-ACT | §24 — statutory prohibitions (Schedule II) | Access to Information Act Mapping |
+| [ATI-11] | CA-ATI-ACT | §27 — third-party consultation | ATIP Request Workflow |
+| [ATI-12] | CA-ATI-ACT | §30 — OIC complaints | ATIP Request Workflow |
+| [PRIV-1] | CA-PRIV-ACT | §4 — collection authority | Privacy Act §4–§8 Register |
+| [PRIV-2] | CA-PRIV-ACT | §5 — direct collection (and §5(2)/(3) exceptions) | Privacy Act §4–§8 Register |
+| [PRIV-3] | CA-PRIV-ACT | §7 / §7(a) — use limited to purpose / consistent use | Privacy Act §4–§8 Register |
+| [PRIV-4] | CA-PRIV-ACT | §8(2)(a)–(m) — routine-use disclosure letters | Privacy Act §4–§8 Register |
+
+### Unreferenced Documents
+
+[List any documents read during generation but not cited, or "None".]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/ca-charter-template.md

@@ -0,0 +1,190 @@
+# Canada Charter Rights Design Review
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:ca-charter`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:ca-charter` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+[Two to three paragraphs describing the system, the Charter sections engaged (default for FITAA-class apps: s.2(b), s.2(d), s.7, s.8, s.15), the headline risks per right, the Oakes proportionality posture, the residual rating, and the DOJ counsel sign-off status. Note any open items — pending sign-offs, jurisprudence verification, or design changes required to clear residual risk.]
+
+## Charter Engagement Surface
+
+| Section | Engaged? (Y / N) | Justification |
+|---------|------------------|---------------|
+| s.2(a) — freedom of conscience and religion | [Y / N] | [One-paragraph reasoning. If N, state why religious-belief and conscience interests are not engaged.] |
+| s.2(b) — freedom of expression | [Y / N — default Y for FITAA-class apps] | [Identify chilling-effect surface: advocacy, journalism, academic inquiry, diaspora speech.] |
+| s.2(c) — freedom of peaceful assembly | [Y / N] | [Reasoning.] |
+| s.2(d) — freedom of association | [Y / N — default Y for FITAA-class apps] | [Identify disincentive surface: civil-society engagement, diaspora communities, political associations.] |
+| s.7 — life, liberty, security of the person | [Y / N — default Y for FITAA-class apps] | [Identify any deprivation: liberty effects of registration, security-of-person effects of disclosure.] |
+| s.8 — search and seizure | [Y / N — default Y for FITAA-class apps] | [Identify reasonable-expectation-of-privacy interests; reference the PIA personal-information inventory.] |
+| s.15 — equality | [Y / N — default Y for FITAA-class apps] | [Identify protected-ground populations subject to differential impact.] |
+
+## s.2 Analysis
+
+### s.2(a) — Freedom of Conscience and Religion
+
+| Engagement | Risk | Mitigation | Residual |
+|------------|------|------------|----------|
+| [Religious-belief interests engaged by, e.g., classification of religious advocacy as registrable activity] | [Suppression of religious expression; differential burden on religious communities] | [Carve-out / threshold / process safeguard] | [Low / Med / High] |
+
+### s.2(b) — Freedom of Expression
+
+| Engagement | Risk | Mitigation | Residual |
+|------------|------|------------|----------|
+| [Chilling effect on advocacy / journalism / academic inquiry] | [Self-censorship; reduced public-interest reporting; advocacy withdrawal] | [Journalism / academic exemption; threshold tests; appeal route] | [Low / Med / High] |
+| [Public-register disclosure of speech-adjacent activity] | [Reputational harm; over-disclosure beyond transparency objective] | [Severance rules; minimum-data-on-public-register principle] | [Low / Med / High] |
+
+### s.2(c) — Freedom of Peaceful Assembly
+
+| Engagement | Risk | Mitigation | Residual |
+|------------|------|------------|----------|
+| [Registration capturing convening / event organisation] | [Disincentive to legitimate assembly] | [Threshold / exemption / appeal] | [Low / Med / High] |
+
+### s.2(d) — Freedom of Association
+
+| Engagement | Risk | Mitigation | Residual |
+|------------|------|------------|----------|
+| [Disincentive to civil-society or diaspora engagement] | [Withdrawal of legitimate association; chilling of community organising] | [Carve-outs; identity-verification minimisation; appeal route] | [Low / Med / High] |
+| [Differential impact on diaspora communities] | [Disproportionate registration burden on particular national-origin groups] | [Substantive-equality review; differential-impact monitoring] | [Low / Med / High] |
+
+## s.7 Analysis
+
+| Engagement | Deprivation | Procedural Safeguard | Residual |
+|------------|-------------|----------------------|----------|
+| [Liberty interest engaged by registration obligation backed by penal consequences] | [Risk of penal sanction for non-registration; impact on freedom of movement / employment] | [Notice; right to representation; appeal to independent decision-maker; principles of fundamental justice per *Carter*] | [Low / Med / High] |
+| [Security of person engaged by disclosure of registrant identity in sensitive contexts] | [Risk of harassment, threats, or transnational repression following disclosure] | [Threat-assessment screen; protective-disclosure carve-out; severance to protected register] | [Low / Med / High] |
+
+## s.8 Analysis
+
+| Engagement | Reasonable Expectation of Privacy Analysis | Warrant or Production-Order Interface | Residual |
+|------------|--------------------------------------------|----------------------------------------|----------|
+| [Collection of registrant / foreign-principal personal information] | [REP analysis under *Hunter v Southam*: subjective expectation, objective reasonableness, totality of the circumstances] | [Production-order workflow; warrant requirement for any compelled access beyond statutory authority] | [Low / Med / High] |
+| [Investigative back-end interfaces with RCMP / CSIS] | [Heightened REP for investigative metadata; *R v Spencer* line on subscriber identifiers] | [Severance audit per `ca-atip`; warrant or production-order required for compelled disclosure] | [Low / Med / High] |
+| [Cross-reference to PIA personal-information inventory] | [REP analysis grounded in PIA-classified data elements] | [Lawful-authority chain per Privacy Act §4–§8] | [Low / Med / High] |
+
+## s.15 Analysis
+
+| Protected Ground | Differential Impact | Substantive-Equality Test | Residual |
+|------------------|---------------------|----------------------------|----------|
+| Race, national or ethnic origin, colour | [Disproportionate registration burden on specific diaspora communities] | [Distinction creating disadvantage; perpetuation of pre-existing disadvantage; not merely formal equality] | [Low / Med / High] |
+| Religion | [Targeting of religious advocacy / community structures] | [Substantive impact on religious communities; not formal neutrality] | [Low / Med / High] |
+| Sex, gender identity, sexual orientation | [Differential exposure / harassment risk on disclosure] | [Substantive impact across gendered patterns of advocacy and online harassment] | [Low / Med / High] |
+| Age | [Younger / older user-experience burden of registration] | [Substantive accessibility test] | [Low / Med / High] |
+| Mental or physical disability | [Accessibility of registration channels; cognitive burden of compliance] | [WCAG / accommodation duty; substantive-equality lens, not formal lens] | [Low / Med / High] |
+| Analogous grounds (e.g. citizenship, immigration status) | [Differential impact on permanent residents, foreign nationals, refugees] | [Court-recognised analogous-ground test] | [Low / Med / High] |
+
+## Oakes Proportionality Analysis
+
+> Run the four-step test for **each engaged right**. Partial analysis is a common review failure.
+
+### Right: s.2(b) — Freedom of Expression
+
+| Step | Question | Answer |
+|------|----------|--------|
+| Pressing and substantial objective | What is the objective the limit serves, and is it pressing and substantial in a free and democratic society? | [Objective + evidence of substantiality] |
+| Rational connection | Is the means rationally connected to the objective? | [Yes / No — explain] |
+| Minimal impairment | Does the design impair the right as little as reasonably possible? | [Identify the least-restrictive alternatives considered and why this design is at the minimum-impairment frontier] |
+| Proportional effects | Do the salutary effects outweigh the deleterious effects on the right-holder? | [Reasoning] |
+
+### Right: s.2(d) — Freedom of Association
+
+| Step | Question | Answer |
+|------|----------|--------|
+| Pressing and substantial objective | [As above for the association limit] | [Answer] |
+| Rational connection | [As above] | [Answer] |
+| Minimal impairment | [As above] | [Answer] |
+| Proportional effects | [As above] | [Answer] |
+
+### Right: s.7 — Life, Liberty, Security of the Person
+
+| Step | Question | Answer |
+|------|----------|--------|
+| Pressing and substantial objective | [As above] | [Answer] |
+| Rational connection | [As above] | [Answer] |
+| Minimal impairment | [As above] | [Answer] |
+| Proportional effects | [As above] | [Answer] |
+
+### Right: s.8 — Search and Seizure
+
+| Step | Question | Answer |
+|------|----------|--------|
+| Pressing and substantial objective | [As above for the search / production-order regime] | [Answer] |
+| Rational connection | [As above] | [Answer] |
+| Minimal impairment | [As above] | [Answer] |
+| Proportional effects | [As above] | [Answer] |
+
+### Right: s.15 — Equality
+
+| Step | Question | Answer |
+|------|----------|--------|
+| Pressing and substantial objective | [As above for the differential-impact effect] | [Answer] |
+| Rational connection | [As above] | [Answer] |
+| Minimal impairment | [As above] | [Answer] |
+| Proportional effects | [As above] | [Answer] |
+
+## Mitigation Register
+
+| Charter Risk | Mitigation | Owner | Status | Residual |
+|--------------|------------|-------|--------|----------|
+| s.2(b) chilling effect on advocacy / journalism | [Journalism / academic exemption + appeal route] | [Service Owner] | [Open / Closed] | [Low / Med / High] |
+| s.2(d) disincentive to diaspora civil-society engagement | [Carve-outs + identity-verification minimisation] | [Service Owner] | [Open / Closed] | [Low / Med / High] |
+| s.7 liberty effect of penal-backed registration | [Notice + representation + appeal to independent decision-maker] | [Departmental Justice Counsel] | [Open / Closed] | [Low / Med / High] |
+| s.7 security-of-person effect of disclosure | [Threat-assessment screen + protective severance] | [DSO + Service Owner] | [Open / Closed] | [Low / Med / High] |
+| s.8 over-collection beyond statutory authority | [Lawful-authority chain per PIA + warrant interface for compelled access] | [Privacy Counsel] | [Open / Closed] | [Low / Med / High] |
+| s.15 differential impact on protected groups | [Substantive-equality monitoring + targeted accommodation] | [Service Owner + DOJ Counsel] | [Open / Closed] | [Low / Med / High] |
+
+## DOJ Counsel Sign-Off Block
+
+> Charter design review without named counsel sign-off is a draft, not an artefact. Constitutional matters route to DOJ HQ.
+
+| Role | Counsel | Date | Conditions |
+|------|---------|------|------------|
+| Departmental Justice Counsel | [name] | [YYYY-MM-DD] | [conditions / open items / further analysis required] |
+| DOJ HQ Constitutional Advisor (where the risk warrants) | [name] | [YYYY-MM-DD] | [conditions / open items] |
+| ATIP coordinator (s.8 / privacy-adjacent matters) | [name] | [YYYY-MM-DD] | [conditions / open items] |
+| Departmental Security Officer (s.7 security-of-person) | [name] | [YYYY-MM-DD] | [conditions / open items] |
+| ADM accountable | [name] | [YYYY-MM-DD] | [conditions / open items] |
+
+## External References
+
+### Document Register
+
+| Doc ID | Title | URL | Verified date |
+|--------|-------|-----|---------------|
+| CA-CHARTER | Canadian Charter of Rights and Freedoms (Constitution Act, 1982, Part I) | <https://laws-lois.justice.gc.ca/eng/const/page-12.html> | [YYYY-MM-DD] |
+| CA-OAKES | *R v Oakes* [1986] 1 SCR 103 | <https://scc-csc.lexum.com/scc-csc/scc-csc/en/item/117/index.do> | [YYYY-MM-DD] |
+| CA-HUNTER | *Hunter v Southam* [1984] 2 SCR 145 | <https://scc-csc.lexum.com/scc-csc/scc-csc/en/item/5274/index.do> | [YYYY-MM-DD] |
+| CA-SPENCER | *R v Spencer* [2014] 2 SCR 212 | <https://scc-csc.lexum.com/scc-csc/scc-csc/en/item/14233/index.do> | [YYYY-MM-DD] |
+| CA-CARTER | *Carter v Canada (AG)* [2015] 1 SCR 331 | <https://scc-csc.lexum.com/scc-csc/scc-csc/en/item/14637/index.do> | [YYYY-MM-DD] |
+| CA-DOJ-CHARTER-STMT | DOJ Charter Statements guidance | <https://www.justice.gc.ca/eng/csj-sjc/pl/charter-charte/index.html> | [YYYY-MM-DD] |
+
+### Citations
+
+| Citation | Doc ID | Section | Used in |
+|----------|--------|---------|---------|
+| [CHARTER-1] | CA-CHARTER | s.1 — reasonable limits, justification under Oakes | Oakes Proportionality Analysis |
+| [CHARTER-2] | CA-CHARTER | s.2 — fundamental freedoms | s.2 Analysis |
+| [CHARTER-3] | CA-CHARTER | s.7 — life, liberty, security of the person | s.7 Analysis |
+| [CHARTER-4] | CA-CHARTER | s.8 — search and seizure | s.8 Analysis |
+| [CHARTER-5] | CA-CHARTER | s.15 — equality | s.15 Analysis |
+| [OAKES-1] | CA-OAKES | Four-step proportionality test | Oakes Proportionality Analysis |
+| [HUNTER-1] | CA-HUNTER | Reasonable expectation of privacy | s.8 Analysis |
+| [SPENCER-1] | CA-SPENCER | Subscriber-identifier REP in digital contexts | s.8 Analysis |
+| [CARTER-1] | CA-CARTER | Principles of fundamental justice under s.7 | s.7 Analysis |
+| [DOJ-CS-1] | CA-DOJ-CHARTER-STMT | Charter Statement methodology and counsel-engagement guidance | DOJ Counsel Sign-Off Block |
+
+### Unreferenced Documents
+
+[List any documents read during generation but not cited, or "None".]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/ca-cloud-residency-template.md

@@ -0,0 +1,173 @@
+# Canada Sovereign Cloud Residency Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:ca-cloud-residency`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:ca-cloud-residency` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+[Two to three paragraphs describing the system, the system-level categorisation (UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET), the residency expectation at rest / in transit / in processing, the sovereign cloud option recommended (AWS Canada / Azure Canada / Google Cloud Canada / SSC-brokered / hybrid), the CLOUD-Act exposure posture and the named risk acceptance, the exit-portability cadence, and any pending Protected B authorisations or sub-processor flags. Note any conditions imposed by the security authority on go-live.]
+
+## Workload Categorisation
+
+> Pull the system-level categorisation from `ARC-<id>-ITSG-*.md` if present. Otherwise, score Confidentiality (C), Integrity (I), and Availability (A) per the TBS *Standard on Security Categorization* injury-based matrix and aggregate to a system-level categorisation using the high-water mark.
+
+| Asset | Confidentiality (L/M/H) | Integrity (L/M/H) | Availability (L/M/H) | Aggregate (L/M/H) | Protected Level |
+|-------|--------------------------|-------------------|----------------------|---------------------|-----------------|
+| [Asset 1 — e.g. citizen application records] | [score + injury rationale] | [score + injury rationale] | [score + injury rationale] | [aggregate] | [UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET] |
+| [Asset 2 — e.g. analytic data lake] | [score] | [score] | [score] | [aggregate] | [level] |
+| [Asset 3 — e.g. cryptographic key material] | [score] | [score] | [score] | [aggregate] | [level] |
+
+**System-level categorisation**: [high-water mark across the inventory] — [one-paragraph rationale, with a pointer to the ITSG SoA if it has been generated]
+
+## Residency Requirement Statement
+
+> Capture residency for data at rest, in transit, and in processing. Note backup and DR location requirements. Surface policy-derived constraints (Privacy Act §8, lawful-authority drivers) and data-class-derived constraints (Indigenous data per `ca-ocap`, Cabinet confidence, classified material).
+
+| Requirement | Source | Constraint | Notes |
+|-------------|--------|------------|-------|
+| Data at rest in Canada | [TBS Direction § / `NFR-LOC-*` / `DR-*` / `PIA-*`] | [In-Canada region only / Encrypted at rest with BYOK / HYOK] | [exception envelope, if any] |
+| Data in transit through Canadian network paths | [Source] | [No transit through foreign network points-of-presence / TLS 1.3+ end-to-end] | [interconnect plan reference] |
+| Data in processing on Canadian compute | [Source] | [In-region compute only / no cross-border managed-service backhaul] | [list any managed services flagged for backhaul] |
+| Backup residency | [Source] | [In-Canada / cross-region within Canada / out-of-country prohibited] | [backup window and recovery point] |
+| Disaster recovery location | [Source] | [Secondary Canadian region required / hot-warm-cold posture] | [RTO / RPO from REQ NFR-AVL] |
+| Indigenous-data handling (if applicable) | [`ca-ocap` / DR-* / Crown-Indigenous policy] | [OCAP principles applied; processing rights restricted] | [data-sovereignty rights holder named] |
+| Personal-information residency | [PIA / Privacy Act §8 / DR-*] | [Privacy Act §8 routine use cited; cross-border transfer disclosed in PIA] | [routine-use reference] |
+
+## Sovereign Cloud Options Matrix
+
+> For each option, name the region(s), the current Protected B authorisation status with verification date, the foreign-government access exposure, the cost band relative to the cheapest in-Canada option, and any managed-services availability gaps.
+
+| Provider | Region | Protected B Authorisation Status (as of [YYYY-MM-DD]) | CLOUD-Act / Foreign-Access Exposure | Cost Band | Managed-Services Gaps |
+|----------|--------|-------------------------------------------------------|--------------------------------------|-----------|------------------------|
+| AWS Canada | Central — Montréal (`ca-central-1`) | [Authorised / Conditional / Pending — verification date] | US-incorporated CSP — US CLOUD Act applies; FISA-702 / EO-12333 reach for US-collected metadata | [$ / $$ / $$$ relative to cheapest] | [services available in US regions but absent from `ca-central-1`] |
+| AWS Canada | West — Calgary (`ca-west-1`) | [GA / Limited GA / Pending — verification date; federal authorisation scope to confirm] | Same CLOUD-Act posture as `ca-central-1` | [band] | [services lagging `ca-central-1`] |
+| Azure Canada | Canada Central — Toronto | [status — verification date] | US-incorporated CSP — CLOUD Act applies; entity-level legal process risk | [band] | [services lagging US regions] |
+| Azure Canada | Canada East — Quebec City | [status — verification date] | Same CLOUD-Act posture as Canada Central | [band] | [services lagging Canada Central] |
+| Google Cloud Canada | Montréal (`northamerica-northeast1`) | [status — verification date] | US-incorporated CSP — CLOUD Act applies | [band] | [services lagging GCP US regions] |
+| Google Cloud Canada | Toronto (`northamerica-northeast2`) | [status — verification date] | Same CLOUD-Act posture as Montréal | [band] | [services lagging Montréal] |
+| SSC-brokered | Multi-CSP under SSC vehicles (e.g. `EN578-191593/H/ZF` and successors) | [Inherited authorisation envelope where SSC has issued the broker-level ATO] | Inherited from underlying CSP; CLOUD Act exposure unchanged | [band] | [scope limited to brokered services on the published catalogue] |
+
+**Recommended option**: [Provider + Region] — [one-paragraph rationale tying the recommendation to the categorisation, the residency requirement statement, the CLOUD-Act risk acceptance, and the cost band]. **Named risk accepter** for residual CLOUD-Act exposure: [role + name + ADR reference].
+
+## GC Cloud Brokering Service Path
+
+> SSC brokering scaffolds the departmental authorisation but does not transfer the departmental ATO obligation. Capture the steps and the role split.
+
+| Step | SSC Role | Departmental Role | Artefact |
+|------|----------|-------------------|----------|
+| Service intake and eligibility | [SSC brokering team confirms vehicle coverage and CSP availability] | [Departmental architect submits intake] | [Intake form / SSC reference number] |
+| Inheritance assessment | [SSC publishes the inherited ATO components and the residual scope] | [Departmental security authority confirms the inherited boundary] | [Inheritance memo] |
+| Departmental authorisation | [SSC supports evidence requests] | [Departmental Authorising Official issues the system ATO over the inherited components] | [Departmental ATO letter] |
+| Operate and re-authorise | [SSC re-publishes inherited components on its cycle] | [Departmental security authority operates the system within the inherited envelope and re-authorises on the published cycle] | [Continuous monitoring + re-authorisation memo] |
+
+## Foreign Subprocessor Analysis
+
+> Cloud Service Provider supply-chain residency. Walk the published sub-processor lists and flag any whose primary jurisdiction sits outside Canada.
+
+| CSP | Service | Sub-processor | Jurisdiction | Notes |
+|-----|---------|---------------|--------------|-------|
+| [CSP 1] | [Service — e.g. observability, ML inference, CDN] | [Sub-processor entity] | [Country / state of incorporation] | [Material exposure — data plane / control plane / metadata only] |
+| [CSP 2] | [Service] | [Sub-processor] | [Jurisdiction] | [Notes] |
+| [CSP 3] | [Service] | [Sub-processor] | [Jurisdiction] | [Notes] |
+| [CSP 4] | [Service — bundled third party] | [Sub-processor] | [Jurisdiction] | [Notes] |
+
+## Exit / Portability Plan
+
+> Numbered runbook plus a per-asset table. The plan must be rehearsed on a published cadence — exit on paper is not exit.
+
+1. **Trigger inventory** — list the events that initiate exit (categorisation upgrade, supplier flag, contract termination, sovereignty-policy change).
+2. **Bulk export** — name the export tooling per workload, the staging location (in-Canada object storage, departmental SAN), and the transfer window.
+3. **State replication** — describe how warm state (databases, queues, in-flight workflows) is replicated to the destination during cutover.
+4. **Format portability** — confirm the stored formats are portable (Parquet / ORC / Avro for analytics; OCI for containers; standard SQL dumps for relational state) and flag any proprietary lakehouse or managed-service formats that need transformation.
+5. **Identity and IAM cutover** — re-root the trust chain to the destination IdP; revoke source-tenant credentials.
+6. **Operational-runbook rebuild** — identify runbooks coupled to source-CSP-specific tooling and rebuild them on the destination.
+7. **Dry-run cadence** — schedule and rehearse the exit at least annually; capture the actual time-to-exit and update the budget.
+
+| Exit Asset | Format | Tooling | Dry-run Cadence |
+|------------|--------|---------|------------------|
+| [Application database] | [Postgres dump / Parquet snapshot] | [Tool — e.g. AWS DMS / Azure DMS / native pg_dump] | [Annual / Semi-annual] |
+| [Analytics lake] | [Parquet / ORC] | [Spark export job / Glue / Synapse export] | [Cadence] |
+| [Container images] | [OCI tarball] | [skopeo / oras / native registry export] | [Cadence] |
+| [Object storage] | [Native objects + manifest] | [aws s3 sync / azcopy / gsutil] | [Cadence] |
+| [IAM / identity] | [SCIM export + IdP claim mapping doc] | [SCIM bridge / IdP export] | [Cadence] |
+
+## Cross-Border Transfer Analysis
+
+> Where federal data crosses the border, document the transfer, cite the lawful authority, and note CLOUD-Act exposure even for workloads operationally hosted in Canada.
+
+| Transfer | Direction | Authority Cited | Justification |
+|----------|-----------|-----------------|---------------|
+| [Transfer 1 — e.g. CDN egress to US edge POP] | [Outbound to US] | [Privacy Act §8 routine use ref / contractual TIA] | [Operational rationale + residual exposure note] |
+| [Transfer 2 — e.g. observability backhaul] | [Outbound to US managed observability] | [Authority] | [Justification + mitigation, e.g. data minimisation, hashing] |
+| [Transfer 3 — e.g. foreign administrative access (CSP support staff)] | [Logical access from foreign jurisdiction] | [Authority — SSC contract clause / TBS Direction] | [Just-in-time access + audit + key-custody mitigations] |
+| [Transfer 4 — CLOUD-Act-driven exposure, in-Canada operation] | [Latent legal exposure even with no operational outbound] | [Documented acceptance — named accepter] | [Risk acceptance rationale and ADR reference] |
+
+## Operational Topology
+
+| Region | Availability Zone(s) | Network Path | Encryption-in-Transit | Peering / Interconnect |
+|--------|----------------------|--------------|-----------------------|------------------------|
+| [Primary — e.g. `ca-central-1`] | [AZs in scope] | [Private link / transit gateway / VPN] | [TLS 1.3 / mTLS / IPsec / MACsec where applicable] | [Direct Connect / ExpressRoute / Cloud Interconnect — bandwidth + redundancy] |
+| [Secondary — e.g. `ca-west-1` or Canada East] | [AZs] | [Path] | [Posture] | [Interconnect — DR-only / active-active] |
+| [Edge / CDN] | [N/A or named PoPs] | [Path] | [Posture] | [Peering] |
+| [Backup / DR target] | [Cross-region within Canada AZ list] | [Replication path — async / sync / snapshot ship] | [Posture] | [Dedicated link or public path] |
+
+**Encryption key custody**: [BYOK / HYOK / external key store / CSP-managed]. **Key store location**: [In-Canada HSM / cloud-native KMS / on-premises HSM with cloud bridge]. **Identity trust root**: [In-Canada IdP / federated to a foreign tenant — flag if foreign]. **Privileged-access provenance**: [Just-in-time access only / no foreign-jurisdiction administrative access / break-glass procedure documented].
+
+## Shared Responsibility Matrix
+
+> Capture which residency control sits with the CSP, with SSC under brokering, and with the department. The matrix is the single source of truth for "who answers to TBS for this control" — overlap is acceptable, gaps are findings.
+
+| Control Area | CSP Responsibility | SSC Responsibility (if brokered) | Departmental Responsibility |
+|--------------|--------------------|-----------------------------------|------------------------------|
+| Physical region location | [In-Canada region operation] | [Vehicle scope confirmation] | [Region selection in deployment IaC] |
+| Encryption at rest | [Native KMS availability] | [Inherited KMS configuration baseline] | [BYOK / HYOK rotation, key custody, deletion] |
+| Encryption in transit | [TLS termination at CSP boundary] | [N/A or shared baseline] | [End-to-end TLS, mTLS between services] |
+| Sub-processor management | [CSP publishes sub-processor list and notice cadence] | [SSC tracks broker-scoped sub-processors] | [Departmental review against PIA and DPIA] |
+| Foreign administrative access | [CSP support staff access controls] | [SSC contractual clauses] | [Just-in-time approval, audit, and review] |
+| Cross-border transfer logging | [CSP region selection and routing] | [Broker-level auditing] | [Privacy Act §8 routine-use register] |
+
+## Open Items
+
+| ID | Description | Owner | Due Date | Status |
+|----|-------------|-------|----------|--------|
+| OI-1 | [Outstanding sovereign-cloud option choice / pending Protected B authorisation / unresolved sub-processor flag / exit dry-run schedule / authorisation condition] | [Role] | [YYYY-MM-DD] | [Open / In Progress / Closed] |
+| OI-2 | [item] | [owner] | [date] | [status] |
+
+## External References
+
+### Document Register
+
+| Doc ID | Title | URL | Verified date |
+|--------|-------|-----|---------------|
+| CA-TBS-CLOUD | TBS Direction on the Secure Use of Commercial Cloud Services | <https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32600> | [YYYY-MM-DD] |
+| CA-GC-CAS | Government of Canada Cloud Adoption Strategy | <https://www.canada.ca/en/government/system/digital-government/digital-government-innovations/cloud-services.html> | [YYYY-MM-DD] |
+| CA-ITSP-50-103 | CSE ITSP.50.103 Guidance on Security Categorization of Cloud-Based Services | <https://cyber.gc.ca/en/guidance/itsp50103-guidance-security-categorization-cloud-based-services> | [YYYY-MM-DD] |
+| CA-SSC-BROKER | SSC Cloud Brokering Service | <https://www.canada.ca/en/shared-services/services/it-modernization/cloud-services.html> | [YYYY-MM-DD] |
+| CA-PRIV-ACT | Privacy Act (R.S.C., 1985, c. P-21) — §8 routine uses | <https://laws-lois.justice.gc.ca/eng/acts/p-21/> | [YYYY-MM-DD] |
+
+### Citations
+
+| Citation | Doc ID | Section | Used in |
+|----------|--------|---------|---------|
+| [TBS-CLOUD-1] | CA-TBS-CLOUD | Residency expectations at Protected B and above | Residency Requirement Statement |
+| [TBS-CLOUD-2] | CA-TBS-CLOUD | CSP risk-management and assurance posture | Sovereign Cloud Options Matrix |
+| [GC-CAS-1] | CA-GC-CAS | Cloud-first / public-cloud-by-default posture and exceptions | Workload Categorisation |
+| [ITSP-50-103-1] | CA-ITSP-50-103 | Categorisation of cloud-based services and inheritance | Workload Categorisation |
+| [SSC-BROKER-1] | CA-SSC-BROKER | Cloud brokering steps and inherited ATO components | GC Cloud Brokering Service Path |
+| [PRIV-ACT-1] | CA-PRIV-ACT | Privacy Act §8 routine-use authority for cross-border transfers | Cross-Border Transfer Analysis |
+
+### Unreferenced Documents
+
+[List any documents read during generation but not cited, or "None".]