arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/fr-algorithme-public-template.md

@@ -0,0 +1,162 @@
+# Public Algorithm Transparency Notice
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:fr-algorithme-public`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:fr-algorithme-public` | [PENDING] | [PENDING] |
+
+## Algorithm Inventory Summary
+
+| Algorithm | Category | Automated Decision | Affects Citizens | Published |
+|-----------|---------|-------------------|-----------------|-----------|
+| [Algorithm name] | [Allocation / Scoring / Filtering / Ranking] | [Fully / Partially / No] | [Yes / No] | ☐ |
+
+---
+
+## Legal Framework
+
+### Obligation Scope (Article L311-3-1 CRPA)
+
+Public administrations that issue individual decisions based wholly or in part on algorithmic processing must inform the citizen of:
+
+1. The existence of the algorithmic processing
+2. The main parameters of the algorithm
+3. The degree of influence each parameter has on the decision
+
+This obligation applies to all **individual decisions** that **significantly affect** the person concerned.
+
+| Scoping Question | Answer | Obligation Triggered |
+|-----------------|--------|---------------------|
+| Is the entity a public administration? | [Yes / No] | If yes, obligation may apply |
+| Does the system produce individual decisions? | [Yes / No] | If yes, continue assessment |
+| Are decisions made wholly or partly by algorithm? | [Yes / No] | If yes, obligation applies |
+| Do decisions significantly affect citizens? | [Yes / No] | If yes, proactive disclosure required |
+| Are there applicable sector-specific exceptions? | [Yes / No] | If yes, document exception |
+
+**Conclusion**: [Obligation applies / Partially applies / Does not apply — with rationale]
+
+---
+
+## Algorithm 1: [Algorithm Name]
+
+> Repeat this section for each algorithm subject to the transparency obligation.
+
+### 1.1 Algorithm Identification
+
+| Field | Value |
+|-------|-------|
+| Algorithm name | [Name] |
+| Algorithm ID | ALGO-[PROJECT_ID]-01 |
+| Responsible authority | [Ministry / Directorate / Agency] |
+| Contact point | [Email or web form for citizen enquiries] |
+| Implementation date | [YYYY-MM-DD] |
+| Last updated | [YYYY-MM-DD] |
+| Publication URL | [algorithmes.data.gouv.fr/[slug]] |
+
+### 1.2 Purpose and Context
+
+| Field | Description |
+|-------|------------|
+| Purpose | [What decision or recommendation does this algorithm produce?] |
+| Administrative context | [Which administrative process does it support?] |
+| Legal basis for the process | [Legislation or regulation authorising the decision] |
+| Decision type | [Individual decision / Recommendation / Scoring / Prioritisation] |
+| Fully automated? | [Yes — no human review / No — human decision-maker uses algorithm output] |
+| Volume | [Approximately N decisions per year] |
+
+### 1.3 Algorithm Description
+
+| Field | Description |
+|-------|------------|
+| Algorithm type | [Rule-based / Statistical model / Machine learning / Hybrid] |
+| Main logic | [Plain-language explanation of the algorithm's core logic — no jargon] |
+| Inputs | [List of data inputs: criteria, indicators, scores] |
+| Output | [Score / Classification / Decision / Ranked list] |
+| Output scale | [0–100 / A–D / Boolean] |
+
+### 1.4 Parameters and Their Influence
+
+Parameters are the variables the algorithm uses when computing its output. This section explains what each parameter is and how much influence it has on the result.
+
+| # | Parameter | Description | Data Source | Weight / Influence | Justification |
+|---|-----------|-------------|-------------|-------------------|---------------|
+| 1 | [Parameter name] | [What it measures] | [Source] | [High / Medium / Low / N%] | [Why this parameter is relevant] |
+| 2 | [Parameter name] | | | | |
+
+**Influence note**: [Explain how parameters combine — e.g. "The final score is the weighted sum of the three parameters above. Parameter 1 carries the most weight because..."]
+
+### 1.5 Data Used
+
+| Data Type | Source | Personal Data | Legal Basis (if personal) | Retention |
+|-----------|--------|--------------|--------------------------|-----------|
+| [Data type] | [Source system / External DB / User-provided] | [Yes / No] | [Art. 6(1)(e) GDPR — public task] | [Period] |
+
+### 1.6 Citizen Rights and Recourse
+
+| Right | Mechanism |
+|-------|-----------|
+| Right to explanation | Citizen may request explanation of the algorithmic decision from [contact point] |
+| Right to human review | Citizen may request a human decision-maker review the algorithmic output — [process description] |
+| Right to contest | Citizen may contest the decision through [administrative appeal / judicial review] |
+| Right of access to personal data | GDPR Article 15 — contact [DPO] |
+| Response timeline | Administration must respond to explanation requests within [30 days] |
+
+---
+
+## GDPR Intersection
+
+[Complete if the algorithm processes personal data]
+
+| Issue | Assessment |
+|-------|-----------|
+| Personal data in algorithm inputs | [Yes / No — list data types] |
+| Legal basis for processing | [Art. 6(1)(e) — public task / Other] |
+| Automated decision-making under GDPR Art. 22 | [Fully automated individual decisions with legal/significant effects → Art. 22 applies] |
+| DPIA required (Art. 35) | [Yes / No — systematic processing, profiling, or vulnerable groups trigger DPIA] |
+| Data minimisation | [Only data strictly necessary for the decision purpose is used] |
+| Profiling | [Algorithm constitutes profiling as defined in GDPR Art. 4(4): Yes / No] |
+
+---
+
+## AI Act Intersection
+
+[Complete if the algorithm uses machine learning or AI techniques]
+
+| Issue | Assessment |
+|-------|-----------|
+| AI system in scope of EU AI Act | [Yes / No] |
+| High-risk category (Annex III) | [e.g. Annex III point 5 — access to essential public services / Other / Not applicable] |
+| Transparency obligations (Art. 13) | [If high-risk: technical documentation, instructions for use, logging] |
+| Human oversight requirement (Art. 14) | [If high-risk: human review capability required] |
+| Recommendation | [Run `/arckit:eu-ai-act` for full AI Act assessment] |
+
+---
+
+## Publication and Maintenance
+
+| Action | Status | Target Date |
+|--------|--------|-------------|
+| Notice drafted and reviewed by legal team | ☐ | |
+| Published on algorithmes.data.gouv.fr | ☐ | |
+| Published on the administration's own website | ☐ | |
+| Referenced in the administrative decision notification sent to citizens | ☐ | |
+| Review process defined for algorithm changes | ☐ | |
+| Contact point operational and responsive | ☐ | |
+
+---
+
+**Generated by**: ArcKit `/arckit:fr-algorithme-public` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/fr-anssi-carto-template.md

@@ -0,0 +1,196 @@
+# ANSSI Information System Cartography
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:fr-anssi-carto`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:fr-anssi-carto` | [PENDING] | [PENDING] |
+
+## Cartography Summary
+
+| Level | View | Components Identified | Sensitive Flows |
+|-------|------|-----------------------|-----------------|
+| Level 1 | Business (Métier) | [N processes, N data assets] | [N] |
+| Level 2 | Application (Applicatif) | [N applications, N services] | [N] |
+| Level 3 | System/Infrastructure | [N servers, N databases, N devices] | [N] |
+| Level 4 | Network (Réseau) | [N segments, N interconnections] | [N] |
+
+| Attack Surface Summary | Count |
+|----------------------|-------|
+| Internet-exposed entry points | [N] |
+| Privileged administration interfaces | [N] |
+| Third-party interconnections | [N] |
+| Unencrypted sensitive flows | [N] |
+
+---
+
+## Cartography Methodology
+
+This cartography follows the ANSSI guide "Cartographie du système d'information" (2021), which defines four reading levels to represent an information system at increasing levels of technical detail. Each level answers a different question for security analysis:
+
+| Level | Question answered | Audience |
+|-------|-------------------|---------|
+| Level 1 — Business | What business processes and data does the system support? | RSSI, management |
+| Level 2 — Application | Which applications and services implement those processes? | Architects, RSSI |
+| Level 3 — System | Which physical/virtual systems host those applications? | System administrators |
+| Level 4 — Network | How are those systems interconnected and with the outside? | Network administrators |
+
+---
+
+## Level 1 — Business View (Vue Métier)
+
+The business view identifies the essential values — the processes, information assets, and services that matter to the organisation.
+
+### 1.1 Business Processes
+
+| ID | Process | Description | Criticality | Data Classification |
+|----|---------|-------------|-------------|---------------------|
+| P-01 | [Process name] | [Description] | [Critical / Important / Standard] | [Classification level] |
+| P-02 | [Process name] | [Description] | | |
+
+### 1.2 Essential Information Assets (Valeurs Métier)
+
+| ID | Asset | Type | Owner | Criticality |
+|----|-------|------|-------|-------------|
+| VM-01 | [Asset name] | [Data / Service / Process] | [Owner] | [Critical / Important / Standard] |
+| VM-02 | [Asset name] | | | |
+
+### 1.3 External Actors and Trusted Relationships
+
+| Actor | Type | Relationship | Trust Level |
+|-------|------|--------------|-------------|
+| [External organisation] | [Partner / Provider / Regulator / User] | [Nature of interaction] | [High / Medium / Low] |
+
+---
+
+## Level 2 — Application View (Vue Applicative)
+
+The application view maps business processes to applications, services, and data flows between them.
+
+### 2.1 Application Inventory
+
+| ID | Application | Purpose | Business Process | Criticality | Hosting |
+|----|------------|---------|-----------------|-------------|---------|
+| APP-01 | [Name] | [Description] | [P-xx] | [Critical / Important / Standard] | [Cloud / On-prem / SaaS] |
+| APP-02 | [Name] | | | | |
+
+### 2.2 Application Interdependencies
+
+| Source | Destination | Flow Type | Protocol | Data Classification | Authentication |
+|--------|-------------|-----------|----------|---------------------|----------------|
+| APP-01 | APP-02 | [Synchronous API / Async / File transfer] | [HTTPS / SFTP / etc.] | [Level] | [mTLS / OAuth2 / None] |
+
+### 2.3 External Services and SaaS
+
+| Service | Provider | Category | Data Shared | Contract Reference |
+|---------|---------|---------|-------------|-------------------|
+| [Service name] | [Provider] | [Identity / Email / Storage / Analytics] | [Data types] | [Contract ID] |
+
+---
+
+## Level 3 — System / Infrastructure View (Vue Système)
+
+The system view maps applications to physical or virtual infrastructure components.
+
+### 3.1 Server Inventory
+
+| ID | Hostname / Role | OS | Hosted Applications | Environment | Location | Criticality |
+|----|----------------|----|---------------------|-------------|---------|-------------|
+| SRV-01 | [Hostname] | [OS] | [APP-xx] | [Prod / Staging / Dev] | [DC / AZ / Region] | [Critical / Standard] |
+
+### 3.2 Database Inventory
+
+| ID | Database | DBMS | Data Owner | Classification | Encryption at Rest |
+|----|---------|------|------------|----------------|-------------------|
+| DB-01 | [Name] | [PostgreSQL / MySQL / etc.] | [Owner] | [Level] | [Yes / No] |
+
+### 3.3 Active Directory and Identity Infrastructure
+
+| Component | Role | Criticality | Admin Access Control |
+|-----------|------|-------------|---------------------|
+| [AD domain / IdP / PAM] | [Description] | [Critical] | [Description] |
+
+### 3.4 Sensitive Equipment
+
+| Equipment | Type | Purpose | Physical Location | Admin Interface Exposed |
+|-----------|------|---------|------------------|------------------------|
+| [Firewall / Load balancer / HSM] | | | | [Yes (internal only) / No] |
+
+---
+
+## Level 4 — Network View (Vue Réseau)
+
+The network view maps physical and logical network segments and interconnections.
+
+### 4.1 Network Segments
+
+| ID | Segment Name | VLAN / Range | Purpose | Security Zone | Systems |
+|----|-------------|-------------|---------|---------------|---------|
+| NET-01 | [Name] | [10.x.x.x/24] | [Production / DMZ / Admin / Dev] | [Internet-facing / Internal / Restricted] | [SRV-xx list] |
+
+### 4.2 External Interconnections
+
+| ID | Interconnection | Remote Party | Protocol | Encryption | Authentication | Direction |
+|----|----------------|-------------|---------|-----------|----------------|-----------|
+| INT-01 | [Name] | [Partner / Provider] | [MPLS / VPN / Internet] | [Yes / No] | [Certificate / PSK] | [In / Out / Both] |
+
+### 4.3 Internet Entry Points
+
+| Entry Point | Type | Protection | Exposed Services |
+|-------------|------|-----------|-----------------|
+| [IP / Domain] | [Website / API / VPN / Email] | [WAF / DDoS / Firewall rules] | [Port / service list] |
+
+### 4.4 Administration Channels
+
+| Administration Path | Access Method | MFA | Logging | Restricted to |
+|--------------------|---------------|-----|---------|--------------|
+| [Jump host / Bastion / Direct SSH] | [SSH / RDP / Web console] | [Yes / No] | [Yes / No] | [IP range / Role] |
+
+---
+
+## 5. Sensitive Flows Analysis
+
+Sensitive flows are data flows that cross trust boundaries, carry classified data, or represent privileged access paths.
+
+| Flow ID | Source | Destination | Data | Classification | Encrypted | Risk |
+|---------|--------|-------------|------|----------------|-----------|------|
+| FL-01 | [Component] | [Component] | [Data type] | [Level] | [Yes / No] | [High / Medium / Low] |
+
+---
+
+## 6. Attack Surface Summary
+
+| Attack Vector | Entry Point | Protection in Place | Residual Exposure |
+|--------------|-------------|--------------------|--------------------|
+| External web | [URL / IP] | [WAF, CDN, firewall] | [Low / Medium / High] |
+| VPN / remote access | [VPN endpoint] | [MFA, certificate] | |
+| Third-party interconnections | [INT-xx] | [Encryption, auth] | |
+| Supply chain (SaaS) | [Service] | [Contract, access control] | |
+| Physical | [DC / Office] | [Badge, CCTV] | |
+
+---
+
+## 7. Recommendations
+
+| Priority | Finding | Recommendation | Owner | Target Date |
+|---------|---------|----------------|-------|-------------|
+| 🔴 High | [e.g. Admin interface exposed to internet] | [Restrict to bastion host only] | [Role] | [Date] |
+| 🟠 Medium | | | | |
+| 🟡 Low | | | | |
+
+---
+
+**Generated by**: ArcKit `/arckit:fr-anssi-carto` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/fr-anssi-template.md

@@ -0,0 +1,190 @@
+# ANSSI Security Posture Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:fr-anssi`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:fr-anssi` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+| Hygiene Measure Theme | Total Measures | Implemented | Partial | Not Implemented |
+|----------------------|----------------|-------------|---------|-----------------|
+| Know and manage your assets | 5 | — | — | — |
+| Manage user and admin accounts | 8 | — | — | — |
+| Authenticate and control access | 7 | — | — | — |
+| Secure workstations and mobile devices | 7 | — | — | — |
+| Protect your network | 7 | — | — | — |
+| Secure your servers and applications | 5 | — | — | — |
+| Manage vulnerabilities and updates | 3 | — | — | — |
+| **Total** | **42** | — | — | — |
+
+| Cloud Recommendations | Status |
+|----------------------|--------|
+| ANSSI cloud security recommendations (2021) | [Applicable / Not applicable] |
+| Cloud provider trust level | [SecNumCloud / EU-qualified / Other] |
+
+---
+
+## 1. Scope and Applicable Guides
+
+| Element | Description |
+|---------|------------|
+| System studied | [Name and brief description] |
+| Assessment boundary | [What is included / excluded] |
+| Deployment environment | [Cloud / On-premise / Hybrid] |
+| Primary ANSSI guide | Guide d'hygiène informatique (2017 edition, 42 measures) |
+| Supplementary guides | [List applicable ANSSI technical guides] |
+| Regulatory context | [OIV / OSE / Public sector / Private — affects applicability of measures] |
+
+---
+
+## 2. ANSSI Guide d'Hygiène Informatique — 42 Measures
+
+**Status codes**: ✅ Implemented | ⚠️ Partial | ❌ Not implemented | N/A Not applicable
+
+### Theme 1 — Know and Manage Your Assets
+
+| # | Measure | Status | Gap / Evidence |
+|---|---------|--------|---------------|
+| 1 | Establish and maintain an up-to-date inventory of all hardware assets | | |
+| 2 | Establish and maintain an up-to-date inventory of all software assets | | |
+| 3 | Define and use naming conventions for accounts and machines | | |
+| 4 | Identify a technical contact responsible for each software product | | |
+| 5 | Produce and maintain a network map | | |
+
+### Theme 2 — Manage User and Admin Accounts
+
+| # | Measure | Status | Gap / Evidence |
+|---|---------|--------|---------------|
+| 6 | Limit the number of accounts with administrative privileges | | |
+| 7 | Define a strong password policy for all accounts | | |
+| 8 | Change default credentials on all equipment | | |
+| 9 | Prefer individual accounts over shared accounts | | |
+| 10 | Revoke inactive accounts promptly | | |
+| 11 | Define and apply a user access management process (joiners/movers/leavers) | | |
+| 12 | Separate privileged administrator accounts from daily-use accounts | | |
+| 13 | Do not grant local administrator rights to standard users | | |
+
+### Theme 3 — Authenticate and Control Access
+
+| # | Measure | Status | Gap / Evidence |
+|---|---------|--------|---------------|
+| 14 | Authenticate all users before granting access to information systems | | |
+| 15 | Enable multi-factor authentication for all remote access and admin accounts | | |
+| 16 | Apply the principle of least privilege for all accounts | | |
+| 17 | Limit access to data and applications to authorised users only | | |
+| 18 | Restrict physical access to sensitive systems | | |
+| 19 | Log and monitor all authentication events | | |
+| 20 | Protect the confidentiality and integrity of remote maintenance sessions | | |
+
+### Theme 4 — Secure Workstations and Mobile Devices
+
+| # | Measure | Status | Gap / Evidence |
+|---|---------|--------|---------------|
+| 21 | Apply a configuration baseline to all workstations | | |
+| 22 | Enable full-disk encryption on all laptops and mobile devices | | |
+| 23 | Protect workstations with endpoint detection capability | | |
+| 24 | Control the use of removable media | | |
+| 25 | Disable autorun on all workstations | | |
+| 26 | Implement an email filtering solution | | |
+| 27 | Implement a web content filtering solution | | |
+
+### Theme 5 — Protect Your Network
+
+| # | Measure | Status | Gap / Evidence |
+|---|---------|--------|---------------|
+| 28 | Segment the network and isolate sensitive systems | | |
+| 29 | Filter inbound and outbound network flows | | |
+| 30 | Use encrypted protocols for all sensitive communications | | |
+| 31 | Secure Wi-Fi access points | | |
+| 32 | Limit exposure of administration interfaces to the internet | | |
+| 33 | Deploy an intrusion detection capability | | |
+| 34 | Collect and centralise security logs | | |
+
+### Theme 6 — Secure Servers and Applications
+
+| # | Measure | Status | Gap / Evidence |
+|---|---------|--------|---------------|
+| 35 | Apply a hardened configuration baseline to all servers | | |
+| 36 | Disable unused services and ports on all systems | | |
+| 37 | Supervise privileged access to production systems | | |
+| 38 | Implement backup and recovery procedures | | |
+| 39 | Test backup recovery regularly | | |
+
+### Theme 7 — Manage Vulnerabilities and Updates
+
+| # | Measure | Status | Gap / Evidence |
+|---|---------|--------|---------------|
+| 40 | Keep all software and firmware up to date | | |
+| 41 | Subscribe to CERT-FR security advisories | | |
+| 42 | Define and apply a vulnerability management process | | |
+
+---
+
+## 3. ANSSI Cloud Security Recommendations (2021)
+
+[Complete if the system uses cloud services — IaaS, PaaS, SaaS, or hybrid]
+
+### 3.1 Cloud Provider Assessment
+
+| Criterion | Recommendation | Status |
+|-----------|---------------|--------|
+| Provider qualification | Prefer SecNumCloud-qualified providers for sensitive data | |
+| Data location | EU-only hosting for data subject to French law | |
+| Extraterritorial law exposure | Assess US CLOUD Act / China MLSA applicability | |
+| Encryption key management | Customer-managed keys (BYOK) preferred | |
+| Incident response SLA | Provider must notify within contractual timeframe | |
+| Exit strategy | Data portability and reversibility contractually guaranteed | |
+
+### 3.2 Cloud Architecture Security
+
+| Requirement | Status | Gap |
+|-------------|--------|-----|
+| Shared responsibility model documented | | |
+| Identity and access management in cloud follows least privilege | | |
+| Cloud configuration hardening applied (CIS Benchmarks or equivalent) | | |
+| Cloud activity logging enabled and sent to SIEM | | |
+| API access secured with strong authentication | | |
+| Secrets management solution in place (no credentials in code) | | |
+
+---
+
+## 4. Gap Analysis and Remediation Plan
+
+| Measure / Recommendation | Status | Priority | Owner | Target Date |
+|--------------------------|--------|---------|-------|-------------|
+| [Measure description] | ❌ | 🔴 High | [Role] | [Date] |
+
+**Priority levels**:
+
+- 🔴 High: deploy before go-live or within 30 days
+- 🟠 Medium: deploy within 90 days
+- 🟡 Low: deploy within 12 months
+
+### 4.1 Summary Score
+
+| Metric | Count |
+|--------|-------|
+| Measures fully implemented | [N] / 42 |
+| Measures partially implemented | [N] / 42 |
+| Measures not implemented | [N] / 42 |
+| Cloud recommendations applicable | [N] |
+| Cloud recommendations implemented | [N] |
+
+---
+
+**Generated by**: ArcKit `/arckit:fr-anssi` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]