arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/us-sbom-eo-14028-template.md

@@ -0,0 +1,253 @@
+# EO 14028 Secure-Software Self-Attestation + SBOM
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:us-sbom-eo-14028`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | PUBLIC / OFFICIAL / OFFICIAL-SENSITIVE (set via `default_classification` user-config) | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:us-sbom-eo-14028` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Two paragraphs: software being attested, SSDF practices attested, SBOM coverage, and submission status to the CISA Repository for Software Attestation and Artifacts.]
+
+---
+
+## 1. Producer / Software Information
+
+| Field | Value |
+|-------|-------|
+| **Software Producer (Vendor)** | [Organisation name] |
+| **Producer UEI / SAM Identifier** | [UEI from SAM.gov] |
+| **Software Product Name** | [Product name] |
+| **Product Version Attested** | [Version + build identifier] |
+| **Software Identifier (CPE / PURL / SWID)** | [Identifier] |
+| **Federal Customer (Agency)** | [Agency receiving the attestation] |
+| **Attestation Scope** | [Specific product / all products / version range] |
+| **Attestation Type** | [Self-attestation / Third-party assessment] |
+| **CISA Form Submission Date** | [YYYY-MM-DD] |
+
+---
+
+## 2. CISA Self-Attestation Form Fields
+
+Per OMB M-22-18 and M-23-16, complete each field of the CISA Secure Software Development Attestation Form.
+
+### Section 1 — Software Producer
+
+| Field | Value |
+|-------|-------|
+| Producer name | [Name] |
+| Producer address | [Address] |
+| Producer UEI | [UEI] |
+| Producer point of contact | [Name + email + phone] |
+| Signing official (CEO or designee) | [Name + title] |
+
+### Section 2 — Software Identification
+
+| Field | Value |
+|-------|-------|
+| Software product name | [Name] |
+| Software version(s) | [Version(s)] |
+| Software identifier (CPE / PURL / SWID) | [Identifier] |
+| Software type | [On-prem / Cloud-hosted / Embedded / Firmware] |
+
+### Section 3 — Federal Customer
+
+| Field | Value |
+|-------|-------|
+| Agency | [Agency] |
+| Contract / Order # | [Contract number] |
+| Agency point of contact | [Name + email] |
+
+### Section 4 — Attestation Statement
+
+[The signing official affirms that the software is developed in conformance with the secure development practices identified in Section 5 of this artefact, derived from NIST SSDF SP 800-218.]
+
+**Signing official**: [Name + title + date + signature]
+
+---
+
+## 3. Secure Development Practices Attested (NIST SSDF SP 800-218)
+
+Map attestation to the four NIST SSDF practice groups: Prepare the Organisation (PO), Protect the Software (PS), Produce Well-Secured Software (PW), Respond to Vulnerabilities (RV).
+
+### PO — Prepare the Organisation
+
+| SSDF Practice | Attested? | Evidence |
+|---------------|-----------|----------|
+| PO.1 Define Security Requirements for Software Development | [Yes / No / Partial] | [Evidence] |
+| PO.2 Implement Roles and Responsibilities | [Yes / No / Partial] | [Evidence] |
+| PO.3 Implement Supporting Toolchains | [Yes / No / Partial] | [Evidence] |
+| PO.4 Define and Use Criteria for Software Security Checks | [Yes / No / Partial] | [Evidence] |
+| PO.5 Implement and Maintain Secure Environments for Software Development | [Yes / No / Partial] | [Evidence] |
+
+### PS — Protect the Software
+
+| SSDF Practice | Attested? | Evidence |
+|---------------|-----------|----------|
+| PS.1 Protect All Forms of Code from Unauthorised Access and Tampering | [Yes / No / Partial] | [Evidence] |
+| PS.2 Provide a Mechanism for Verifying Software Release Integrity | [Yes / No / Partial] | [Evidence] |
+| PS.3 Archive and Protect Each Software Release | [Yes / No / Partial] | [Evidence] |
+
+### PW — Produce Well-Secured Software
+
+| SSDF Practice | Attested? | Evidence |
+|---------------|-----------|----------|
+| PW.1 Design Software to Meet Security Requirements and Mitigate Security Risks | [Yes / No / Partial] | [Evidence] |
+| PW.2 Review the Software Design to Verify Compliance with Security Requirements | [Yes / No / Partial] | [Evidence] |
+| PW.4 Reuse Existing, Well-Secured Software When Feasible | [Yes / No / Partial] | [Evidence] |
+| PW.5 Create Source Code by Adhering to Secure Coding Practices | [Yes / No / Partial] | [Evidence] |
+| PW.6 Configure Compilation, Interpreter, and Build Processes to Improve Executable Security | [Yes / No / Partial] | [Evidence] |
+| PW.7 Review and/or Analyse Human-Readable Code to Identify Vulnerabilities | [Yes / No / Partial] | [Evidence] |
+| PW.8 Test Executable Code to Identify Vulnerabilities and Verify Compliance | [Yes / No / Partial] | [Evidence] |
+| PW.9 Configure Software to Have Secure Settings by Default | [Yes / No / Partial] | [Evidence] |
+
+### RV — Respond to Vulnerabilities
+
+| SSDF Practice | Attested? | Evidence |
+|---------------|-----------|----------|
+| RV.1 Identify and Confirm Vulnerabilities on an Ongoing Basis | [Yes / No / Partial] | [Evidence] |
+| RV.2 Assess, Prioritise, and Remediate Vulnerabilities | [Yes / No / Partial] | [Evidence] |
+| RV.3 Analyse Vulnerabilities to Identify Their Root Causes | [Yes / No / Partial] | [Evidence] |
+
+---
+
+## 4. SBOM Metadata
+
+| Field | Value |
+|-------|-------|
+| **SBOM Format** | [CycloneDX 1.5 / SPDX 2.3] |
+| **Schema Version** | [Schema version] |
+| **Generation Tool** | [Tool name + version — e.g., Syft 0.NN / cdxgen / SPDX SBOM Generator] |
+| **Generation Method** | [Build-time / Source-analysis / Binary-analysis] |
+| **SBOM Identifier** | [URN / UUID] |
+| **SBOM Author** | [Name + organisation] |
+| **Generation Timestamp** | [YYYY-MM-DDTHH:MM:SSZ] |
+| **SBOM Hash** | [SHA-256 of the SBOM file] |
+| **SBOM Location** | [Repository URL / artefact reference] |
+
+---
+
+## 5. SBOM Minimum Elements Checklist (NTIA)
+
+Per the NTIA "Minimum Elements for a Software Bill of Materials" published July 2021.
+
+| NTIA Element | Required Value | Present? Y/N | Notes |
+|--------------|----------------|--------------|-------|
+| Supplier Name | [Vendor producing the component] | [Y/N] | [Notes] |
+| Component Name | [Component name] | [Y/N] | [Notes] |
+| Version of Component | [SemVer / vendor-specific version] | [Y/N] | [Notes] |
+| Other Unique Identifiers (e.g., PURL, CPE, SWID) | [PURL preferred] | [Y/N] | [Notes] |
+| Dependency Relationships | [Graph of upstream / downstream dependencies] | [Y/N] | [Notes] |
+| Author of SBOM Data | [Person / system generating the SBOM] | [Y/N] | [Notes] |
+| Timestamp (when SBOM was created) | [Generation timestamp] | [Y/N] | [Notes] |
+
+**Coverage Summary**:
+
+| Metric | Value |
+|--------|-------|
+| Total components in SBOM | [Count] |
+| Components with full NTIA element coverage | [Count + %] |
+| Components missing one or more NTIA elements | [Count + %] |
+| Direct dependencies | [Count] |
+| Transitive dependencies | [Count] |
+
+---
+
+## 6. Provenance Attestations
+
+| Field | Value |
+|-------|-------|
+| **SLSA Level Achieved** | [SLSA 1 / 2 / 3 / 4] |
+| **SLSA Provenance Format** | [in-toto Statement v1] |
+| **Provenance Signed By** | [Signing identity — Sigstore / GPG key ID] |
+| **Signature Verified** | [Yes — verification command + output] |
+| **Build Platform** | [GitHub Actions / Tekton Chains / Buildkit / other] |
+| **Build Trigger** | [Tag / commit SHA] |
+| **Builder Identity** | [Builder image + digest] |
+| **In-toto Attestation Chain** | [Chain reference — attesting layers: source, build, deploy] |
+
+[Reference the actual SLSA provenance document / in-toto attestation chain in `external/` or vendor portal.]
+
+---
+
+## 7. Exception Request
+
+[If a secure development practice cannot be attested, an exception with a Plan of Action and Milestones (POA&M) is required per M-22-18 / M-23-16.]
+
+**Exception Required?**: [Yes / No]
+
+| Practice Not Attested | Reason | POA&M ID | Remediation Plan | Target Completion |
+|----------------------|--------|----------|------------------|-------------------|
+| [SSDF practice] | [Why cannot be attested] | [POA&M ID] | [Plan] | [YYYY-MM-DD] |
+
+---
+
+## 8. Cross-Reference to NIST 800-53 SR (Supply Chain Risk) Family
+
+| 800-53 Control | Mapping | Notes |
+|----------------|---------|-------|
+| SR-1 Policy and Procedures | [Cross-ref organisational SCRM policy] | [Notes] |
+| SR-2 Supply Chain Risk Management Plan | [Cross-ref SCRM plan] | [Notes] |
+| SR-3 Supply Chain Controls and Processes | [SSDF practices PO + PS] | [Notes] |
+| SR-4 Provenance | [SLSA provenance + in-toto] | [Notes] |
+| SR-5 Acquisition Strategies, Tools, and Methods | [Procurement contract clauses] | [Notes] |
+| SR-6 Supplier Assessments and Reviews | [Vendor security review] | [Notes] |
+| SR-8 Notification Agreements | [Vendor vulnerability-disclosure agreement] | [Notes] |
+| SR-11 Component Authenticity | [Signed artefacts; signature verification] | [Notes] |
+
+---
+
+## 9. Distribution
+
+| Recipient | Submission Method | Date | Reference |
+|-----------|-------------------|------|-----------|
+| CISA Repository for Software Attestation and Artifacts (RSAA) | [Form upload via repository.cisa.gov] | [YYYY-MM-DD] | [Submission ID] |
+| Agency Contracting Officer | [Contract delivery] | [YYYY-MM-DD] | [Contract / DO #] |
+| Agency CISO | [Email / portal] | [YYYY-MM-DD] | [Reference] |
+
+---
+
+## 10. References
+
+| Reference | Citation | URL |
+|-----------|----------|-----|
+| EO 14028 | Improving the Nation's Cybersecurity | <https://www.federalregister.gov/d/2021-10460> |
+| OMB M-22-18 | Enhancing the Security of the Software Supply Chain through Secure Software Development Practices | <https://www.whitehouse.gov/wp-content/uploads/2022/09/M-22-18.pdf> |
+| OMB M-23-16 | Update to Memorandum M-22-18 | <https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-16-Update-to-M-22-18-Enhancing-Software-Security-.pdf> |
+| CISA Self-Attestation Form | Secure Software Development Attestation Form | <https://www.cisa.gov/secure-software-attestation-form> |
+| NTIA Minimum Elements for SBOM | The Minimum Elements For a Software Bill of Materials | <https://www.ntia.doc.gov/files/ntia/publications/sbom_minimum_elements_report.pdf> |
+| NIST SP 800-218 | Secure Software Development Framework (SSDF) | <https://doi.org/10.6028/NIST.SP.800-218> |
+| SLSA | Supply-chain Levels for Software Artifacts | <https://slsa.dev/> |
+| CycloneDX | CycloneDX SBOM Standard | <https://cyclonedx.org/> |
+| SPDX | SPDX SBOM Standard | <https://spdx.dev/> |
+
+---
+
+## 11. Approvals
+
+| Role | Name | Signature | Date |
+|------|------|-----------|------|
+| Software Producer Signing Official | [Name + title] | [Signature] | [YYYY-MM-DD] |
+| Producer Security Officer | [Name] | [Signature] | [YYYY-MM-DD] |
+| Agency Contracting Officer | [Name] | [Signature] | [YYYY-MM-DD] |
+| Agency CISO (receipt) | [Name] | [Signature] | [YYYY-MM-DD] |
+
+---
+
+**Generated by**: ArcKit `/arckit:us-sbom-eo-14028` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/us-zero-trust-template.md

@@ -0,0 +1,234 @@
+# CISA Zero Trust Maturity Assessment (v2.0)
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:us-zero-trust`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time per _partials/RENDERING.md. -->
+<!-- Classification line MUST be: -->
+<!-- | Classification | PUBLIC / OFFICIAL / OFFICIAL-SENSITIVE (set via `default_classification` user-config) | -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:us-zero-trust` command | PENDING | PENDING |
+
+---
+
+## Executive Summary
+
+[Two to three paragraphs: scope of the assessment, current overall maturity, target overall maturity (Advanced is the OMB M-22-09 end-state expectation by FY2024 across all pillars), top three uplift priorities, and the estimated effort to reach target.]
+
+---
+
+## 1. Scope
+
+| Field | Value |
+|-------|-------|
+| **System / Programme** | [Name] |
+| **Agency** | [Agency] |
+| **Assessment Date** | [YYYY-MM-DD] |
+| **In-Scope Environments** | [Cloud / On-prem / Hybrid; named CSPs and data centres] |
+| **Out-of-Scope** | [Anything explicitly excluded] |
+| **Assessment Lead** | [Name + role] |
+| **OMB M-22-09 Target Date** | [Original FY2024 — current re-baselined date if any] |
+
+---
+
+## 2. Five-Pillar Scoring Matrix
+
+Score current and target maturity for each of the five CISA ZTMM pillars.
+
+| Pillar | Traditional | Initial | Advanced | Optimal | Current | Target |
+|--------|-------------|---------|----------|---------|---------|--------|
+| **Identity** | [Description] | [Description] | [Description] | [Description] | [Stage] | [Stage] |
+| **Devices** | [Description] | [Description] | [Description] | [Description] | [Stage] | [Stage] |
+| **Networks** | [Description] | [Description] | [Description] | [Description] | [Stage] | [Stage] |
+| **Applications & Workloads** | [Description] | [Description] | [Description] | [Description] | [Stage] | [Stage] |
+| **Data** | [Description] | [Description] | [Description] | [Description] | [Stage] | [Stage] |
+
+### Pillar Stage Reference
+
+- **Traditional**: Manual processes, perimeter-centric, broad implicit trust.
+- **Initial**: Some automation; basic visibility; least-privilege beginning.
+- **Advanced**: Risk-informed adaptive controls; broad telemetry; automated policy enforcement.
+- **Optimal**: Continuous adaptive risk-and-trust evaluation across all pillars; dynamic policy.
+
+---
+
+## 3. Cross-Cut Scoring Matrix
+
+CISA ZTMM v2.0 cross-cutting capabilities applied across all five pillars.
+
+| Cross-Cut | Traditional | Initial | Advanced | Optimal | Current | Target |
+|-----------|-------------|---------|----------|---------|---------|--------|
+| **Visibility & Analytics** | [Description] | [Description] | [Description] | [Description] | [Stage] | [Stage] |
+| **Automation & Orchestration** | [Description] | [Description] | [Description] | [Description] | [Stage] | [Stage] |
+| **Governance** | [Description] | [Description] | [Description] | [Description] | [Stage] | [Stage] |
+
+---
+
+## 4. Maturity Heatmap Summary
+
+| Dimension | Current Overall | Target Overall | Gap |
+|-----------|-----------------|----------------|-----|
+| Identity | [Stage] | [Stage] | [Gap] |
+| Devices | [Stage] | [Stage] | [Gap] |
+| Networks | [Stage] | [Stage] | [Gap] |
+| Applications & Workloads | [Stage] | [Stage] | [Gap] |
+| Data | [Stage] | [Stage] | [Gap] |
+| Visibility & Analytics | [Stage] | [Stage] | [Gap] |
+| Automation & Orchestration | [Stage] | [Stage] | [Gap] |
+| Governance | [Stage] | [Stage] | [Gap] |
+
+**Overall Current Maturity**: [Stage] · **Overall Target Maturity**: [Advanced — OMB M-22-09]
+
+---
+
+## 5. Pillar-Specific Findings
+
+### 5.1 Identity
+
+**Current State**: [Describe IdP, MFA posture, account lifecycle, phishing-resistant authenticator coverage, privileged access management.]
+
+**Uplift Opportunities**:
+
+- [ ] Adopt phishing-resistant MFA (PIV / FIDO2 WebAuthn) for all users.
+- [ ] Continuous identity-risk evaluation tied to step-up authentication.
+- [ ] Just-in-time privileged access with full session recording.
+- [Other]
+
+### 5.2 Devices
+
+**Current State**: [Describe device inventory, EDR coverage, device-health attestation, BYOD posture.]
+
+**Uplift Opportunities**:
+
+- [ ] Real-time device-health attestation as a condition of access (NIST SP 800-207 §2.1).
+- [ ] EDR on 100% of endpoints per EO 14028.
+- [ ] Mobile-device management (MDM) integration with policy decision point.
+- [Other]
+
+### 5.3 Networks
+
+**Current State**: [Describe segmentation strategy, east-west encryption posture, micro-segmentation maturity, software-defined perimeter adoption.]
+
+**Uplift Opportunities**:
+
+- [ ] Micro-segmentation per workload identity.
+- [ ] Encrypt all east-west traffic (mTLS / SMB encryption / IPsec).
+- [ ] Replace VPN with identity-aware proxy / service-mesh ingress.
+- [Other]
+
+### 5.4 Applications & Workloads
+
+**Current State**: [Describe workload identity, secrets management, application-layer authentication, runtime protection.]
+
+**Uplift Opportunities**:
+
+- [ ] Workload identity per service (SPIFFE / X.509 SVIDs).
+- [ ] Secrets management via vault with short-lived dynamic credentials.
+- [ ] Runtime application self-protection (RASP) / web application firewall (WAF).
+- [Other]
+
+### 5.5 Data
+
+**Current State**: [Describe data classification, encryption-at-rest, DLP, data-access monitoring.]
+
+**Uplift Opportunities**:
+
+- [ ] Automated data classification at ingest.
+- [ ] Encryption with FIPS 140-3 validated modules; customer-managed keys for high-impact data.
+- [ ] Data-access analytics (UEBA on data plane).
+- [Other]
+
+---
+
+## 6. Cross-Cut Findings
+
+### 6.1 Visibility & Analytics
+
+**Current State**: [SIEM coverage, telemetry pipelines, UEBA, dashboards.]
+
+**Uplift Opportunities**:
+
+- [ ] Unified telemetry across identity, device, network, application, data planes.
+- [ ] ML-driven anomaly detection.
+- [Other]
+
+### 6.2 Automation & Orchestration
+
+**Current State**: [SOAR adoption, automated incident response, policy-as-code maturity.]
+
+**Uplift Opportunities**:
+
+- [ ] Automated response playbooks for top-N incident types.
+- [ ] Policy-as-code with version control and CI gates.
+- [Other]
+
+### 6.3 Governance
+
+**Current State**: [Policy ownership, audit cadence, control attestation maturity.]
+
+**Uplift Opportunities**:
+
+- [ ] Continuous control monitoring with OSCAL.
+- [ ] Quarterly ZT maturity re-assessment integrated into ConMon.
+- [Other]
+
+---
+
+## 7. Prioritised Uplift Roadmap
+
+| Initiative | Pillar(s) | Target Stage | Estimated Effort (FTE-months) | Dependencies | Owner | Target Date |
+|------------|----------|--------------|-------------------------------|--------------|-------|-------------|
+| Roll out phishing-resistant MFA | [Identity] | [Advanced] | [N] | [PIV / FIDO2 IdP capability] | [Identity team] | [YYYY-MM-DD] |
+| Deploy EDR enterprise-wide | [Devices] | [Advanced] | [N] | [EDR procurement; FedRAMP-authorised] | [SecOps] | [YYYY-MM-DD] |
+| Micro-segmentation pilot | [Networks] | [Advanced] | [N] | [Service-mesh selection] | [Platform team] | [YYYY-MM-DD] |
+| Workload-identity pilot (SPIFFE) | [Apps & Workloads] | [Advanced] | [N] | [Service-mesh] | [Platform team] | [YYYY-MM-DD] |
+| Data classification automation | [Data] | [Advanced] | [N] | [Classifier tooling; data inventory] | [Data team] | [YYYY-MM-DD] |
+| Telemetry unification | [Visibility] | [Advanced] | [N] | [SIEM / data-lake selection] | [SOC] | [YYYY-MM-DD] |
+
+---
+
+## 8. Alignment to OMB M-22-09 End-State
+
+| OMB M-22-09 Action | Status | Notes |
+|--------------------|--------|-------|
+| Enforce phishing-resistant MFA for federal staff and contractors | [Implemented / In progress / Planned] | [Notes] |
+| Encrypt all DNS requests + HTTP traffic | [Implemented / In progress / Planned] | [Notes] |
+| Inventory every device authorised + operated; treat as untrusted | [Implemented / In progress / Planned] | [Notes] |
+| Reliable asset + vulnerability management; EDR per CISA OMB guidance | [Implemented / In progress / Planned] | [Notes] |
+| Categorize data by sensitivity; encrypt accordingly | [Implemented / In progress / Planned] | [Notes] |
+| Application security testing throughout SDLC | [Implemented / In progress / Planned] | [Notes] |
+
+---
+
+## 9. References
+
+| Reference | Citation | URL |
+|-----------|----------|-----|
+| CISA ZTMM v2.0 | Zero Trust Maturity Model v2.0 | <https://www.cisa.gov/zero-trust-maturity-model> |
+| OMB M-22-09 | Moving the U.S. Government Toward Zero Trust Cybersecurity Principles | <https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf> |
+| NIST SP 800-207 | Zero Trust Architecture | <https://doi.org/10.6028/NIST.SP.800-207> |
+| EO 14028 | Improving the Nation's Cybersecurity | <https://www.federalregister.gov/d/2021-10460> |
+
+---
+
+## 10. Approvals
+
+| Role | Name | Signature | Date |
+|------|------|-----------|------|
+| Assessment Lead | [Name] | [Signature] | [YYYY-MM-DD] |
+| CISO | [Name] | [Signature] | [YYYY-MM-DD] |
+| CIO | [Name] | [Signature] | [YYYY-MM-DD] |
+
+---
+
+**Generated by**: ArcKit `/arckit:us-zero-trust` command
+**Generated on**: [DATE]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/vendor-profile-template.md

@@ -0,0 +1,88 @@
+# Vendor Profile: {VENDOR_NAME}
+
+> **Template Origin**: Official | **ArcKit Version**: [VERSION] | **Command**: `/arckit:research`
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| 1.0 | {DATE} | ArcKit AI | Initial creation from `/arckit:research` agent | PENDING | PENDING |
+
+---
+
+## Overview
+
+{One-paragraph vendor summary}
+
+## Products & Services
+
+{Relevant product lines}
+
+## Pricing Model
+
+{Pricing structure — CAPEX/OPEX/subscription}
+
+## UK Government Presence
+
+- G-Cloud listed: {yes/no/unknown}
+- DOS listed: {yes/no/unknown}
+- UK data centres: {yes/no/details}
+
+## Government Award History
+
+> Sourced from UK procurement notices (UK Tenders MCP, re-published under OGL v3.0) when a `/arckit:tenders` or `/arckit:competitors` run has supplied award data. **Awarded value is not actual spend** — use as market-context and experience evidence, not as a cost figure. `{unknown}` until tender evidence is available.
+
+- Total awarded value (UK gov contracts): {£value / unknown}
+- Award count: {N / unknown}
+- Date range: {earliest–latest / unknown}
+- Top buyers: {comma-separated list / unknown}
+- Incumbency: {note any buyer where this vendor holds a dominant share of awarded value / unknown}
+- Sample awards: one bullet per award — {title — buyer, £value, award date (notice URL)}; `{none on record}` if absent
+
+## Strengths
+
+{Bulleted strengths}
+
+## Weaknesses
+
+{Bulleted weaknesses}
+
+## Projects Referenced In
+
+{List of ArcKit projects where this vendor was evaluated}
+
+## External References
+
+> This section provides traceability from generated content back to source documents.
+> Follow citation instructions in the project's citation reference guide.
+
+### Document Register
+
+| Doc ID | Filename | Type | Source Location | Description |
+|--------|----------|------|-----------------|-------------|
+| *None provided* | — | — | — | — |
+
+### Citations
+
+| Citation ID | Doc ID | Page/Section | Category | Quoted Passage |
+|-------------|--------|--------------|----------|----------------|
+| — | — | — | — | — |
+
+### Unreferenced Documents
+
+| Filename | Source Location | Reason |
+|----------|-----------------|--------|
+| — | — | — |
+
+---
+
+**Generated by**: ArcKit `/arckit:research` agent
+**Generated on**: {DATE}
+**ArcKit Version**: {VERSION}
+**Project**: {PROJECT_NAME}
+**Model**: {AI_MODEL}