arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/ca-ocap-template.md

@@ -0,0 +1,205 @@
+# Canada First Nations OCAP® Sovereignty Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:ca-ocap`
+>
+> 🪶 **OCAP® notice**: OCAP® is a registered trademark of the First Nations Information Governance Centre (FNIGC). The OCAP® principles describe a *relationship*, not a checklist. This template supports — but does not substitute for — direct engagement with FNIGC and the affected First Nation(s), Métis, and Inuit communities.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET | -->
+<!-- Note: OCAP-relevant artefacts may carry community-protected information that exceeds the federal classification scheme. Mark accordingly and capture the override in Open Items. -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:ca-ocap` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+[Two to three paragraphs describing the system, the Indigenous data in scope, the FNIGC pre-engagement status, the headline OCAP findings (or that this artefact is a planning scaffold awaiting engagement), and any open items. Name the affected First Nation(s), Métis Nation governing member(s), and Inuit population(s) in scope.]
+
+## FNIGC Pre-Engagement Confirmation
+
+| Item | Value |
+|------|-------|
+| Engagement booked or in progress? | [yes / no / in progress / N/A — explain] |
+| Date of engagement (if scheduled) | [YYYY-MM-DD] |
+| FNIGC engagement contact | [name, role, email] |
+| Community engagement contact(s) | [First Nation(s), Métis Nation governing member(s), Inuit organisation(s) — named contact per nation] |
+| Engagement nature | [scoping conversation / data-sharing-agreement workshop / governance review / other] |
+| Status | [CONFIRMED / IN PROGRESS / NOT CONFIRMED — PLANNING SCAFFOLD / N/A] |
+
+### Planning Scaffold Mode
+
+- [ ] Engagement NOT confirmed — assessment is a planning scaffold only. Subsequent sections are deferred until engagement.
+
+> **Gate behaviour**: If the box above is ticked, the remaining sections must be left as planning scaffolding only and the artefact header status set to `PLANNING SCAFFOLD — INCOMPLETE`. The architect must engage FNIGC and community representatives before completing this assessment.
+
+#### Engagement Letter Scaffold (used only when engagement is not confirmed)
+
+```text
+To: [FNIGC engagement coordinator]
+From: [Departmental ADM / accountable signatory]
+Subject: OCAP® pre-engagement request — [project / service name]
+
+[Department / agency] is designing [system / service] which will process [brief
+description of Indigenous data in scope]. Datasets in scope: [list].
+We request a pre-engagement conversation under the FNIGC OCAP® framework
+to scope [ownership / control / access / possession] arrangements before
+any system design is finalised.
+
+Proposed timeline: [date range].
+Departmental contacts: [accountable role + ATIP coordinator + privacy counsel].
+```
+
+## Indigenous Data Inventory
+
+| Dataset | First Nation(s) of origin | Data nature | Custodianship | Transfer history | Sensitivity |
+|---------|---------------------------|-------------|---------------|------------------|-------------|
+| [dataset name / ID] | [First Nation(s) named] | [administrative / statistical / traditional knowledge / biological / image / audio / video] | [community-held / co-held / federal-custodied — describe] | [origin and any prior transfers] | [community-protected / Protected B / Protected C / other — explain] |
+| [dataset name / ID] | [First Nation(s) named] | [as above] | [as above] | [as above] | [as above] |
+
+## OCAP Principles Mapping
+
+> Provide one mapping block per dataset listed in the Indigenous Data Inventory.
+
+### Dataset: [dataset name / ID]
+
+#### Ownership
+
+| Aspect | Statement |
+|--------|-----------|
+| Who holds collective ownership | [First Nation(s) / Métis Nation / Inuit organisation] |
+| How is ownership asserted | [community resolution, treaty reference, historical record] |
+| Supporting agreements | [DSA reference, MOU, treaty article] |
+
+#### Control
+
+| Aspect | Statement |
+|--------|-----------|
+| Decision authority — use | [governance body and decision rule] |
+| Decision authority — sharing | [governance body and decision rule] |
+| Decision authority — publication | [governance body and decision rule] |
+| Decision authority — deletion | [governance body and decision rule] |
+| Decision authority — secondary analysis | [governance body and decision rule] |
+| Veto rights | [community body holding veto; conditions] |
+
+#### Access
+
+| Aspect | Statement |
+|--------|-----------|
+| Who accesses | [named roles / institutions / researchers] |
+| On what terms | [purpose, time-limit, audit obligation] |
+| Access tiering | [public / community-only / restricted-research / individual-consent] |
+| Consent withdrawal mechanism | [process and SLA] |
+
+#### Possession
+
+| Aspect | Statement |
+|--------|-----------|
+| Physical custody | [where stored, in whose facility] |
+| Digital custody | [hosting jurisdiction, system, encryption posture] |
+| Backup arrangements | [community-side, federal-side, redundancy] |
+| Repatriation triggers | [event-based: project end, breach, withdrawal of consent] |
+
+## USAI Considerations (Métis data)
+
+> Apply only where Métis Nation populations are in scope. The Métis Nation OCAS / USAI principles (Utility, Self-Determination, Access, Inter-relationships) are distinct from OCAP and must NOT be conflated.
+
+| Dataset | Métis Nation in scope | USAI principle applied | Status |
+|---------|-----------------------|------------------------|--------|
+| [dataset / ID] | [Métis Nation governing member: e.g. MNO, MNS, MNA] | [Utility / Self-Determination / Access / Inter-relationships] | [Confirmed / In progress / Not applicable] |
+
+## ITK Principles Considerations (Inuit data)
+
+> Apply only where Inuit populations are in scope. ITK *National Inuit Strategy on Research* (NISR) and Inuit-Crown Partnership Committee guidance govern; OCAP and USAI do NOT substitute.
+
+| Dataset | Inuit population in scope | ITK principle applied | Status |
+|---------|---------------------------|-----------------------|--------|
+| [dataset / ID] | [Inuit Nunangat region: Inuvialuit / Nunavut / Nunavik / Nunatsiavut] | [NISR principle reference] | [Confirmed / In progress / Not applicable] |
+
+## Data Sharing Agreement Terms
+
+> Used where data is shared between the federal institution and a First Nation, Métis Nation governing member, or Inuit organisation.
+
+| Term | OCAP-aligned commitment | Status |
+|------|-------------------------|--------|
+| Indigenous co-signatory | [named community signatory present] | [In place / Pending] |
+| Purpose limitation | [explicit purpose, no broader use] | [In place / Pending] |
+| Time bound | [start / end dates with renewal trigger] | [In place / Pending] |
+| Revocability | [community right to withdraw with effect on data] | [In place / Pending] |
+| Audit rights | [community right to inspect access logs] | [In place / Pending] |
+| Sub-processor restrictions | [no onward processors without community consent] | [In place / Pending] |
+
+## Repatriation Plan
+
+> For data historically collected without informed consent, or data whose custodianship the community wishes to reclaim.
+
+| Dataset | Historical context | Return / Destroy decision | Method | Owner | Date |
+|---------|--------------------|---------------------------|--------|-------|------|
+| [dataset / ID] | [collected when, by whom, under what authority] | [Return / Destroy / Negotiated retention] | [format-portable export / secure destruction / negotiated co-custody] | [accountable role] | [YYYY-MM-DD] |
+
+## Co-Governance Arrangements
+
+| Body | Indigenous representation | Decision rule | Appeal pathway |
+|------|---------------------------|---------------|----------------|
+| [data-stewardship board / steering committee] | [number of seats / which nations / appointment process] | [consensus / majority / community-veto] | [escalation route — community → minister → independent review] |
+| [working group] | [as above] | [as above] | [as above] |
+
+## Risks and Mitigation Register
+
+| Risk | Likelihood | Impact | Mitigation | Residual |
+|------|------------|--------|------------|----------|
+| Misuse of traditional knowledge | [Low / Med / High] | [Low / Med / High] | [purpose-limitation; community veto on secondary use; audit] | [Low / Med / High] |
+| Secondary analysis without renewed consent | [Low / Med / High] | [Low / Med / High] | [secondary-use gate requires renewed community consent; cross-reference DSA] | [Low / Med / High] |
+| Breach of trust through unauthorised disclosure | [Low / Med / High] | [Low / Med / High] | [community-protected classification; access logging; breach-notification clause to community] | [Low / Med / High] |
+| UNDRIP Act misalignment | [Low / Med / High] | [Low / Med / High] | [Article 31 review; Crown alignment commitment; legal review] | [Low / Med / High] |
+| Treating "Indigenous data" as a single regime | [Low / Med / High] | [Low / Med / High] | [maintain distinct OCAP / USAI / ITK tracks; separate engagement contacts per nation] | [Low / Med / High] |
+| Conflict between federal classification and community protection | [Low / Med / High] | [Low / Med / High] | [community-protected override recorded in Document Control; Open Item raised] | [Low / Med / High] |
+
+## Open Items
+
+| Item | Owner | Due | Status |
+|------|-------|-----|--------|
+| Confirm FNIGC pre-engagement and lift planning scaffold flag | [accountable role] | [YYYY-MM-DD] | [Open / Closed] |
+| Resolve community-protected classification override | [DSO + ATIP coordinator] | [YYYY-MM-DD] | [Open / Closed] |
+| Complete USAI engagement with named Métis Nation governing member | [accountable role] | [YYYY-MM-DD] | [Open / Closed / N/A] |
+| Complete ITK engagement with named Inuit organisation | [accountable role] | [YYYY-MM-DD] | [Open / Closed / N/A] |
+| Sign Data Sharing Agreement with each affected nation | [accountable role + community signatory] | [YYYY-MM-DD] | [Open / Closed] |
+| Confirm UNDRIP Act Article 31 review by departmental legal | [Privacy Counsel] | [YYYY-MM-DD] | [Open / Closed] |
+
+## External References
+
+### Document Register
+
+| Doc ID | Title | URL | Verified date |
+|--------|-------|-----|---------------|
+| CA-OCAP | First Nations Principles of OCAP® — FNIGC | <https://fnigc.ca/ocap-training/take-the-course/the-first-nations-principles-of-ocap/> | [YYYY-MM-DD] |
+| CA-FNIGC | First Nations Information Governance Centre — homepage and guidance | <https://fnigc.ca/> | [YYYY-MM-DD] |
+| CA-UNDRIP-ACT | United Nations Declaration on the Rights of Indigenous Peoples Act (S.C. 2021, c. 14) | <https://laws-lois.justice.gc.ca/eng/acts/U-2.2/> | [YYYY-MM-DD] |
+| CA-UNDRIP-AP | UNDRIP Act Action Plan (Department of Justice) | <https://www.justice.gc.ca/eng/declaration/index.html> | [YYYY-MM-DD] |
+| CA-USAI | Métis Nation OCAS / USAI principles — Métis Nation Council | <https://www2.metisnation.ca/> | [YYYY-MM-DD] |
+| CA-ITK-NISR | Inuit Tapiriit Kanatami — National Inuit Strategy on Research | <https://www.itk.ca/national-inuit-strategy-on-research/> | [YYYY-MM-DD] |
+| CA-PRIV-ACT | Privacy Act (R.S.C., 1985, c. P-21) | <https://laws-lois.justice.gc.ca/eng/acts/P-21/> | [YYYY-MM-DD] |
+
+### Citations
+
+| Citation | Doc ID | Section | Used in |
+|----------|--------|---------|---------|
+| [OCAP-1] | CA-OCAP | Ownership principle | OCAP Principles Mapping — Ownership |
+| [OCAP-2] | CA-OCAP | Control principle | OCAP Principles Mapping — Control |
+| [OCAP-3] | CA-OCAP | Access principle | OCAP Principles Mapping — Access |
+| [OCAP-4] | CA-OCAP | Possession principle | OCAP Principles Mapping — Possession |
+| [UNDRIP-1] | CA-UNDRIP-ACT | Article 31 — cultural heritage and intellectual property | Risks and Mitigation Register |
+| [UNDRIP-2] | CA-UNDRIP-ACT | Crown commitment to align federal law | Executive Summary |
+| [USAI-1] | CA-USAI | USAI principles applicable to Métis data | USAI Considerations |
+| [ITK-1] | CA-ITK-NISR | NISR principles applicable to Inuit data | ITK Principles Considerations |
+| [FNIGC-1] | CA-FNIGC | OCAP® trademark and engagement protocol | FNIGC Pre-Engagement Confirmation |
+
+### Unreferenced Documents
+
+[List any documents read during generation but not cited, or "None".]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/ca-ola-template.md

@@ -0,0 +1,171 @@
+# Canada Official Languages Act Review
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:ca-ola`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:ca-ola` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+[Two to three paragraphs describing the service, the OLA posture across Parts IV, V, and VI, the active-offer mechanism, the Translation Bureau pipeline maturity, and any "translation lag" risks identified. Note OQLF acknowledgement where the service has Quebec exposure, and flag any open items that block launch or substantive release.]
+
+## Service Description
+
+| Item | Value |
+|------|-------|
+| Department / agency | [name] |
+| Service / programme | [name] |
+| Description | [what the service does, in plain language] |
+| Owner | [accountable role] |
+| Operator | [internal team / contractor / processor] |
+| Audience | [Canadian public / federal employees / clients of programme X / regional populations] |
+| Lifecycle stage | [Concept / Design / Build / Pilot / Live / Modification] |
+| Bilingual designation basis | [significant demand / public-travel / head-office / designated bilingual office / Schedule reference] |
+
+## Service Surface Inventory
+
+| Surface | Channel | Audience | Bilingual posture | Active offer mechanism |
+|---------|---------|----------|-------------------|------------------------|
+| [Public-facing screen — landing page] | Web | Canadian public | Bilingual (EN + FR equivalent) | Bilingual greeting and language toggle on first paint |
+| [Forms — service intake] | Web | Canadian public | Bilingual | Toggle persists; both languages release-gated |
+| [Notifications — email/SMS] | Email/SMS | Service clients | Bilingual | Language preference captured at intake; both content tracks maintained |
+| [Error messages] | All | All users | Bilingual | Equivalent severity wording in both languages |
+| [Public registers — open data] | Web | Canadian public | Bilingual | Field labels and metadata in both languages |
+| [Accessibility statement] | Web | Canadian public | Bilingual | Linked from every page footer |
+| [Printed correspondence] | Mail | Service clients | Bilingual | Cover page bilingual; body in user's language of choice |
+| [IVR scripts] | Phone | Service clients | Bilingual | Greeting in both official languages before menu |
+| [Social media] | Social | Canadian public | Bilingual | Each post released in both languages simultaneously |
+| [Internal admin console — example] | Web | Departmental staff | [Bilingual / EN-only with justification] | n/a (internal — Part V applies) |
+
+> Any unilingual surface must carry a written justification (audience exclusively in one official language, demonstrably no significant demand, etc.) and the justification must be reviewed at every refresh.
+
+## Part IV — Communications with and Services to the Public
+
+| Surface | Bilingual obligation rationale | Active-offer mechanism | Bilingual capacity at time of service | Status |
+|---------|--------------------------------|------------------------|----------------------------------------|--------|
+| [Landing page] | Significant demand (Schedule reference) | Bilingual greeting + persistent toggle | 24/7 EN/FR via translated content | [Compliant / Gap / Remediation in progress] |
+| [Service intake form] | Public-travel / national service | Bilingual greeting + form labels | Real-time validation in both languages | [Compliant / Gap] |
+| [IVR — first contact] | Designated bilingual office | "Bonjour / Hello" opening before menu | Bilingual agents available during service hours | [Compliant / Gap] |
+| [Counter / in-person] | Designated bilingual office | Bilingual signage + verbal greeting | Bilingual staff present at all times of service | [Compliant / Gap] |
+| [Public register] | Significant demand | Bilingual UI + field metadata | Both languages release-gated | [Compliant / Gap] |
+
+> **Active offer is a verb, not a checkbox.** A passive bilingual sign does not satisfy the obligation — the greeting, the screen, the IVR opening, and the written initiation must all extend the offer before the user has to ask.
+
+## Part V — Language of Work
+
+| Tool / system | Region | Designated language posture | Supervision language | Status |
+|---------------|--------|------------------------------|----------------------|--------|
+| [Service-delivery tooling — example] | National Capital Region | Both EN and FR fully available | Bilingual supervision | [Compliant / Gap] |
+| [HR / staffing system] | National Capital Region | Both EN and FR fully available | Bilingual supervision | [Compliant / Gap] |
+| [Internal admin console] | New Brunswick (officially bilingual) | Both EN and FR fully available | Bilingual supervision | [Compliant / Gap] |
+| [Helpdesk tooling] | Bilingual-designated parts of other regions | Both EN and FR fully available | Bilingual supervision available | [Compliant / Gap] |
+| [Reporting / analytics system] | Unilingual regions | Single language acceptable; document audience | n/a | [Compliant / Gap] |
+
+> The right to work in the official language of choice in designated bilingual regions extends to the tools and the supervision experience, not only to the spoken or written language at the workstation.
+
+## Part VI — Federal Language Obligations
+
+| Obligation | Programme touchpoint | Mitigation | Status |
+|------------|----------------------|------------|--------|
+| Equitable participation of English- and French-speaking Canadians | [Recruitment / staffing data captured by this system] | [Equity reporting to OCHRO; bias review of any automated screening] | [Compliant / Gap] |
+| Non-discrimination on language grounds | [Eligibility, scoring, or routing logic] | [Logic review for language-correlated proxies; appeal route documented] | [Compliant / Gap] |
+| Staffing impact — bilingual designation | [HR positions supported by this system] | [Bilingual designation captured per position; capacity tracking] | [Compliant / Gap] |
+| Career development support | [Training / promotion pathways supported] | [Equal access in both languages; second-language training reflected in workflows] | [Compliant / Gap] |
+
+## Equivalent Quality Assessment
+
+| Surface | Content depth | Usability | Response time | Release cadence | Status |
+|---------|---------------|-----------|---------------|------------------|--------|
+| [Landing page] | Identical content in both languages | Equivalent UX in both languages | Same SLA in both languages | Both released simultaneously | [Compliant / Gap] |
+| [Service intake form] | Identical fields and help text | Equivalent error handling | Same processing time | Both released simultaneously | [Compliant / Gap] |
+| [Notifications] | Identical message body | Equivalent layout | Same dispatch cadence | Both released simultaneously | [Compliant / Gap] |
+| [Public register] | Identical record schema | Equivalent search experience | Same query latency | Both released simultaneously | [Compliant / Gap] |
+| [IVR] | Identical menu structure | Equivalent prompt clarity | Equivalent wait time | Both updated simultaneously | [Compliant / Gap] |
+
+> "Translation will follow" releases violate the OLA. Release-gating in both languages is the only durable enforcement.
+
+## Translation Pipeline
+
+| Content class | Lead time | Cadence | Owner | Release-gate |
+|---------------|-----------|---------|-------|--------------|
+| Web content (standard) | [N business days] | [Weekly / on-demand] | [Content owner + Translation Bureau] | Hold release until both languages signed off |
+| Forms and labels | [N business days] | [Per-release] | [Content owner + Translation Bureau] | Both languages in same deployment unit |
+| Notifications and templates | [N business days] | [Per-template change] | [Service owner + Translation Bureau] | Both templates validated before activation |
+| Error messages | [N business days] | [Per-release] | [Engineering + Translation Bureau] | Both released with the same change set |
+| Public registers — schema and labels | [N business days] | [Per-schema change] | [Data owner + Translation Bureau] | Both released simultaneously |
+| Social media | [Same-day] | [Per-post] | [Communications team] | Each post in both languages at publish time |
+| Printed correspondence | [N business days] | [Per-template change] | [Service owner + Translation Bureau] | Both versions on file before send |
+
+> Predictable cadence beats ad-hoc engagement. Build the Translation Bureau lead time into the delivery plan; do not absorb it as a release-time delay.
+
+## OQLF Acknowledgement
+
+| Surface | Quebec exposure | OQLF consideration | Federal supremacy note |
+|---------|-----------------|--------------------|------------------------|
+| [Public-facing service in Quebec] | Material Quebec audience | OQLF *Charter of the French Language* applies to suppliers and contractors operating in Quebec | Federal supremacy holds for the federal entity; document the supplier-side OQLF obligation |
+| [Service hosted/operated in Quebec] | Service hosted on Quebec infrastructure | OQLF may apply to the hosting supplier and to communications with Quebec residents | Federal entity is bound by the OLA; Quebec-based suppliers are concurrently bound by OQLF |
+| [Procurement and contracting in Quebec] | Suppliers in Quebec | OQLF applies to supplier internal operations and consumer-facing materials | Federal entity is not bound by OQLF, but supplier obligations affect deliverable language posture |
+| [Marketing and engagement in Quebec] | Quebec audience | OQLF advertising and signage rules apply to suppliers placing federal communications | Document the parallel obligation in the supplier brief |
+
+> OQLF does not bind federal entities directly, but it does bind their Quebec-based suppliers and contractors. The acknowledgement is a documentation duty, not a compliance duty under federal law.
+
+## Risk and Mitigation Register
+
+| Risk | Likelihood | Impact | Mitigation | Residual |
+|------|------------|--------|------------|----------|
+| Complaint to the Commissioner of Official Languages on Part IV (services) | [Low / Med / High] | [Low / Med / High] | [Active offer evidenced; bilingual capacity at time of service; release-gating in both languages] | [Low / Med / High] |
+| Court remedy under Part X | [Low / Med / High] | [Low / Med / High] | [Documented compliance regime; redress procedure in place; Commissioner consultation history] | [Low / Med / High] |
+| "Translation lag" release violating equal quality | [Low / Med / High] | [Low / Med / High] | [Both-languages release-gate; deployment unit holds both content tracks] | [Low / Med / High] |
+| Internal tooling Part V invisibility | [Low / Med / High] | [Low / Med / High] | [Tooling EN/FR availability audited per region; supervision language captured per role] | [Low / Med / High] |
+| OQLF supplier non-compliance in Quebec | [Low / Med / High] | [Low / Med / High] | [Supplier brief includes OQLF clauses; supplier audit on Quebec-facing deliverables] | [Low / Med / High] |
+| Reputational risk from public unilingual release | [Low / Med / High] | [Low / Med / High] | [Communications playbook gates social media in both languages; incident playbook on inadvertent unilingual release] | [Low / Med / High] |
+
+## Open Items
+
+| Item | Owner | Due | Status |
+|------|-------|-----|--------|
+| [Translation Bureau lead time confirmation per content class] | [Service owner] | [YYYY-MM-DD] | [Open / Closed] |
+| [Active-offer signage refresh on legacy surfaces] | [Service owner] | [YYYY-MM-DD] | [Open / Closed] |
+| [Part V audit of internal tooling in designated regions] | [Operations lead] | [YYYY-MM-DD] | [Open / Closed] |
+| [OQLF supplier clauses inserted into Quebec procurement] | [Procurement lead] | [YYYY-MM-DD] | [Open / Closed] |
+| [Bill C-13 phasing-in provisions tracked via Order in Council] | [Privacy / OLA counsel] | [YYYY-MM-DD] | [Open / Closed] |
+
+## External References
+
+### Document Register
+
+| Doc ID | Title | URL | Verified date |
+|--------|-------|-----|---------------|
+| CA-OLA | Official Languages Act (R.S.C., 1985, c. 31 (4th Supp.)) | <https://laws-lois.justice.gc.ca/eng/acts/O-3.01/> | [YYYY-MM-DD] |
+| CA-C13 | An Act for the Substantive Equality of Canada's Official Languages (S.C. 2023, c. 15) | <https://laws-lois.justice.gc.ca/eng/annualstatutes/2023_15/> | [YYYY-MM-DD] |
+| CA-TBS-OL | TBS Policy on Official Languages | <https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=26160> | [YYYY-MM-DD] |
+| CA-OL-REG | Directive on the Implementation of the Official Languages (Communications with and Services to the Public) Regulations | <https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32522> | [YYYY-MM-DD] |
+| CA-COL | Commissioner of Official Languages — published guidance | <https://www.clo-ocol.gc.ca/> | [YYYY-MM-DD] |
+
+### Citations
+
+| Citation | Doc ID | Section | Used in |
+|----------|--------|---------|---------|
+| [OLA-1] | CA-OLA | Part IV — Communications with and Services to the Public | Part IV — Communications with and Services to the Public |
+| [OLA-2] | CA-OLA | Part V — Language of Work | Part V — Language of Work |
+| [OLA-3] | CA-OLA | Part VI — Participation of English-speaking and French-speaking Canadians | Part VI — Federal Language Obligations |
+| [OLA-4] | CA-OLA | Part VII — Advancement of English and French | Risk and Mitigation Register |
+| [OLA-5] | CA-OLA | Part X — Court Remedy | Risk and Mitigation Register |
+| [C13-1] | CA-C13 | Substantive equality amendments to the OLA | Executive Summary; Part VI |
+| [TBS-OL-1] | CA-TBS-OL | Active offer expectations | Part IV — Communications with and Services to the Public |
+| [OL-REG-1] | CA-OL-REG | Significant demand and public-travel rules | Service Surface Inventory; Part IV |
+| [COL-1] | CA-COL | Commissioner's complaint and audit guidance | Risk and Mitigation Register |
+
+### Unreferenced Documents
+
+[List any documents read during generation but not cited, or "None".]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/ca-pia-template.md

@@ -0,0 +1,193 @@
+# Canada Privacy Impact Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:ca-pia`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | UNCLASSIFIED / Protected A / Protected B / Protected C / CONFIDENTIAL / SECRET / TOP SECRET | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:ca-pia` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+[Two to three paragraphs describing the programme, the personal information involved, the lawful authority for collection, the headline privacy risks and residual posture, and the OPC notification decision. Note any open lawful-authority items or PIB-registration gaps.]
+
+## Programme / System Description
+
+| Item | Value |
+|------|-------|
+| Department / agency | [name] |
+| Programme / service | [name] |
+| Description | [what the system does, in plain language] |
+| Owner | [accountable role] |
+| Operator | [internal team / contractor / processor] |
+| Subject populations | [Canadian residents / federal employees / clients of programme X / etc.] |
+| Lifecycle stage | [Concept / Design / Build / Pilot / Live / Modification] |
+
+### Personal Information Lifecycle (textual)
+
+1. **Collect** — channel(s) and source(s) of personal information.
+2. **Use** — internal processing, decision-making, analytics.
+3. **Disclose** — recipients (internal Canadian gov, other jurisdictions, processors).
+4. **Retain** — retention schedule reference and storage jurisdiction.
+5. **Dispose** — destruction method and verification.
+
+## Lawful Authority
+
+| Authority cited | Section | Justification | Coverage |
+|-----------------|---------|---------------|----------|
+| [Enabling statute or regulation] | [section] | [why this collection is necessary for the programme] | [collection / use / disclosure activities covered] |
+| Privacy Act | §4 | Collection limited to information that relates directly to an operating programme or activity of the institution | Collection |
+| Privacy Act | §5 | Collection directly from the individual where reasonably possible | Collection |
+| [TBC] | [TBC] | [If unclear: BLOCKER for OPC notification — resolve before launch] | [TBC] |
+
+> ⚠️ Collection without statutory authority is not lawful. Any `<TBC>` row above is a launch blocker.
+
+## Personal Information Inventory
+
+| Element | Source | Purpose | Sensitivity | Retention | Disclosure recipients | PIB ref |
+|---------|--------|---------|-------------|-----------|-----------------------|---------|
+| [e.g. legal name] | [individual / partner agency] | [delivery of programme X] | [Protected A / B / C] | [retention schedule] | [internal team / partner agency] | [PIB number or NEW] |
+| [contact details] | [individual] | [communications / notification] | [Protected A] | [retention schedule] | [internal team] | [PIB number] |
+| [identifiers — SIN if applicable] | [individual / CRA] | [authentication / cross-reference] | [Protected B] | [retention schedule] | [internal team only] | [PIB number] |
+| [sensitive categories — health / immigration / etc.] | [individual / partner agency] | [eligibility determination] | [Protected B / C] | [retention schedule] | [internal team / OPC on access request] | [PIB number] |
+
+> Register or update the PIB entry in TBS InfoSource for every element above. Mark `NEW` where a new PIB is required.
+
+## Necessity and Proportionality
+
+### Pressing and Substantial Objective
+
+| Question | Answer |
+|----------|--------|
+| What is the programme objective? | [statement] |
+| Why is it pressing and substantial? | [evidence: statutory mandate, ministerial direction, public-interest rationale] |
+| What is the cost of not acting? | [evidence] |
+
+### Rational Connection
+
+| Question | Answer |
+|----------|--------|
+| How does collecting this personal information advance the objective? | [reasoning] |
+| Are there evidence-based alternatives that do not require this collection? | [yes / no — explain] |
+
+### Minimal Impairment
+
+| Question | Answer |
+|----------|--------|
+| Is each element the minimum needed? | [yes / no per element — link to inventory] |
+| Are less intrusive alternatives available (aggregation, de-identification, sampling)? | [yes / no — explain] |
+| Can collection be deferred to point of need rather than upfront? | [yes / no — explain] |
+
+### Proportional Effects
+
+| Question | Answer |
+|----------|--------|
+| What are the benefits to the public / subjects / institution? | [statement] |
+| What are the privacy intrusions? | [statement] |
+| Do the benefits outweigh the intrusion? | [yes / no — reasoning] |
+
+## Privacy Risks and Mitigations
+
+| Risk | Likelihood | Impact | Mitigation | Residual |
+|------|------------|--------|------------|----------|
+| Unauthorised disclosure of Protected B/C data | [Low / Med / High] | [Low / Med / High] | [encryption at rest and in transit; access control; audit logging] | [Low / Med / High] |
+| Function creep — use beyond stated purpose | [Low / Med / High] | [Low / Med / High] | [purpose limitation in records of decision; consistent-use analysis under §7] | [Low / Med / High] |
+| Inaccurate data leading to adverse decisions | [Low / Med / High] | [Low / Med / High] | [§6(2) accuracy duty; correction procedure; manual review on edge cases] | [Low / Med / High] |
+| Cross-border processing without adequate safeguards | [Low / Med / High] | [Low / Med / High] | [contractual safeguards; cross-reference `ca-cloud-residency`; data-localisation where required] | [Low / Med / High] |
+| PIB not registered or out of date | [Low / Med / High] | [Low / Med / High] | [register / update PIB entry as part of this PIA] | [Low / Med / High] |
+
+Cross-reference `risk` for the project-level continuation of these entries.
+
+## Transfers and Disclosures
+
+| Recipient | §7 / §8 basis | Routine use letter (§8(2) only) | Cross-border flag | Notes |
+|-----------|---------------|--------------------------------|-------------------|-------|
+| [internal programme team] | §7 — purpose of collection | n/a | No | [notes] |
+| [other federal institution] | §8(2)(a) — consistent use | (a) | No | [notes] |
+| [investigative body] | §8(2)(e) — law enforcement / investigation | (e) | No | [notes] |
+| [processor in foreign jurisdiction] | §8(2)(f) — agreement | (f) | Yes — cross-reference `ca-cloud-residency` | [notes] |
+| [in compelling-circumstances disclosure] | §8(2)(m) — public interest / individual benefit | (m) | [Yes / No] | [notes] |
+
+> Each §8(2) letter (a)–(m) must be matched to the actual disclosure scenario. Do not aggregate dissimilar disclosures under one row.
+
+## Individual Rights
+
+| Right | Procedure | Channel | SLA | Owner |
+|-------|-----------|---------|-----|-------|
+| §12 access to own personal information | [request intake → identity verification → retrieval → release with severance where required] | [ATIP portal / paper / email] | 30 days, extendable per §15 | ATIP coordinator |
+| §13 PIB registration in TBS InfoSource | [register / update PIB entry; publish summary in InfoSource] | TBS InfoSource | At launch and on substantial modification | ATIP coordinator |
+| Correction and annotation | [correction request → assessment → correction or annotation per §12(2)] | [ATIP portal / paper] | [SLA] | ATIP coordinator |
+| Complaint to OPC | [individual files complaint with OPC; institution responds to OPC investigation] | OPC complaint channel | Per OPC SLA | ATIP coordinator + Privacy Counsel |
+
+## OPC Notification Trigger Analysis
+
+| Trigger | Decision | Justification | Date notified or N/A |
+|---------|----------|---------------|----------------------|
+| New programme involving personal information | [NOTIFY / N/A] | [reasoning] | [YYYY-MM-DD or N/A] |
+| Substantial modification (new data, new purpose, new recipient) | [NOTIFY / N/A] | [reasoning] | [YYYY-MM-DD or N/A] |
+| New cross-border processing arrangement | [NOTIFY / N/A] | [reasoning] | [YYYY-MM-DD or N/A] |
+| Automated decision-making touching personal information | [NOTIFY / N/A — also trigger `ca-aia`] | [reasoning] | [YYYY-MM-DD or N/A] |
+| Sensitive categories (health, immigration, criminal record, biometrics) | [NOTIFY / N/A] | [reasoning] | [YYYY-MM-DD or N/A] |
+
+> The TBS Directive on PIA requires notification at least 30 days before launch for new programmes or substantial modifications. Plan accordingly — OPC consultation is not a sign-off formality.
+
+## PIA Approval Chain
+
+| Role | Approver | Date | Conditions |
+|------|----------|------|------------|
+| ATIP coordinator | [name] | [YYYY-MM-DD] | [conditions / open items] |
+| Privacy counsel | [name] | [YYYY-MM-DD] | [conditions / open items] |
+| Departmental Security Officer | [name] | [YYYY-MM-DD] | [conditions / open items] |
+| ADM accountable | [name] | [YYYY-MM-DD] | [conditions / open items] |
+| Head of institution | [name] | [YYYY-MM-DD] | [conditions / open items] |
+| OPC notification | [date sent] | [YYYY-MM-DD] | [response received / pending] |
+| TBS notification | [date sent] | [YYYY-MM-DD] | [response received / pending] |
+
+## Action Tracker
+
+| Action | Owner | Due | Status |
+|--------|-------|-----|--------|
+| Resolve `<TBC>` lawful-authority entries | [Privacy Counsel] | [YYYY-MM-DD] | [Open / Closed] |
+| Register / update PIB in TBS InfoSource | [ATIP coordinator] | [YYYY-MM-DD] | [Open / Closed] |
+| Submit OPC pre-launch notification (≥30 days before launch) | [ATIP coordinator] | [YYYY-MM-DD] | [Open / Closed] |
+| Cross-border safeguards — see `ca-cloud-residency` | [Architecture lead] | [YYYY-MM-DD] | [Open / Closed] |
+| Trigger `ca-aia` if automated decision-making is in scope | [Architecture lead] | [YYYY-MM-DD] | [Open / Closed] |
+
+## External References
+
+### Document Register
+
+| Doc ID | Title | URL | Verified date |
+|--------|-------|-----|---------------|
+| CA-PRIV-ACT | Privacy Act (R.S.C., 1985, c. P-21) | <https://laws-lois.justice.gc.ca/eng/acts/P-21/> | [YYYY-MM-DD] |
+| CA-TBS-PIA | TBS Directive on Privacy Impact Assessment | <https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=18308> | [YYYY-MM-DD] |
+| CA-OPC | Office of the Privacy Commissioner of Canada — published guidance | <https://www.priv.gc.ca/> | [YYYY-MM-DD] |
+| CA-INFOSOURCE | TBS InfoSource — Personal Information Banks register | <https://www.canada.ca/en/treasury-board-secretariat/services/access-information-privacy/access-information/information-about-programs-information-holdings.html> | [YYYY-MM-DD] |
+| CA-PRIV-REG | Privacy Regulations | <https://laws-lois.justice.gc.ca/eng/regulations/SOR-83-508/> | [YYYY-MM-DD] |
+
+### Citations
+
+| Citation | Doc ID | Section | Used in |
+|----------|--------|---------|---------|
+| [PRIV-1] | CA-PRIV-ACT | §4 — collection limited to relevant information | Lawful Authority |
+| [PRIV-2] | CA-PRIV-ACT | §5 — collection directly from individual where possible | Lawful Authority |
+| [PRIV-3] | CA-PRIV-ACT | §6(2) — accuracy duty | Privacy Risks and Mitigations |
+| [PRIV-4] | CA-PRIV-ACT | §7 — use limited to purpose / consistent use | Transfers and Disclosures |
+| [PRIV-5] | CA-PRIV-ACT | §8 — disclosure restrictions | Transfers and Disclosures |
+| [PRIV-6] | CA-PRIV-ACT | §8(2)(a)–(m) — routine-use disclosure letters | Transfers and Disclosures |
+| [PRIV-7] | CA-PRIV-ACT | §12 — right of access | Individual Rights |
+| [PRIV-8] | CA-PRIV-ACT | §13 — PIB registration | Individual Rights |
+| [TBS-PIA-1] | CA-TBS-PIA | Notification requirement (≥30 days before launch) | OPC Notification Trigger Analysis |
+| [TBS-PIA-2] | CA-TBS-PIA | PIA approval chain | PIA Approval Chain |
+
+### Unreferenced Documents
+
+[List any documents read during generation but not cited, or "None".]