arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/CHANGELOG.md

@@ -0,0 +1,3554 @@
+# Changelog
+
+All notable changes to ArcKit will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [6.1.0] — 2026-06-30
+
+### Added
+
+- **TOGAF ADM and agent architecture overlays.** Added the community
+  `arckit-togaf-adm` and `arckit-agent-architecture` plugins, plus the
+  supporting doc types, templates, recipes, release wiring, and contributors
+  page coverage.
+
+## [6.0.0] — 2026-06-30
+
+### Added
+
+- **Single Claude Code marketplace repo.** Added release tooling and metadata
+  so `tractorjuice/arckit-claude` publishes the core plugin plus regional,
+  sector, tooling, and supplier overlays from one structured repo.
+
+### Changed
+
+- **Claude marketplace install path.** Updated user-facing documentation,
+  test-repo templates, and release guidance to prefer
+  `tractorjuice/arckit-claude` for Claude Code installs.
+
+## [5.15.2] — 2026-06-30
+
+### Fixed
+
+- **Discord invite links (#623).** Updated Discord invite links across the
+  documentation site.
+
+### Changed
+
+- **Health output documentation (#620).** Clarified that `/arckit:health`
+  writes `docs/health.json` as part of its normal reporting flow.
+- **Documentation site updates.** Added the ArcKit usage thank-you article and
+  GA4 site tag.
+
+## [5.15.1] — 2026-06-29
+
+### Added
+
+- **OpenCode extension metadata.** Added a description to the standalone
+  `arckit-opencode` extension manifest.
+
+### Fixed
+
+- **Codex hook runner resolution (#619).** Codex lifecycle hooks now resolve the
+  hook runner from `CODEX_PLUGIN_ROOT` or the installed plugin cache instead of
+  assuming Codex was started from the extension directory. The converter and
+  Codex tests now guard both bundled plugin hooks and generated standalone
+  config hooks against cwd-dependent runner paths.
+- **Self-Harness utility hardening (#617).** Hardened the Self-Harness support
+  utilities added in v5.15.0.
+- **Standalone extension release tags (#607).** Fixed extension release
+  publishing so standalone extension repos receive release tags consistently.
+- **Documentation site rendering.** Corrected SVG font-family syntax in the new
+  ArcKit Architects hero image.
+
+### Changed
+
+- **Documentation and article index updates.** Added the ArcKit Architects, OKF,
+  and Self-Harness articles, moved ArcKit Architects to the first article slot,
+  refreshed article indexes, `llms.txt`, sitemap metadata, getting-started
+  assistant coverage, and community footer links.
+- **Extension validation coverage (#608).** Added full extension suites to keep
+  generated targets aligned with the converter.
+
+## [5.15.0] — 2026-06-19
+
+### Added
+
+- **Self-Harness autoresearch implementation.** Added a Self-Harness enhanced
+  autoresearch program based on arXiv:2606.09498v1, plus tracer, weakness-miner,
+  harness-proposer, and harness-validator utilities for iterative harness
+  improvement.
+- **Open Knowledge Format interoperability.** Added `/arckit:export-okf` and
+  `/arckit:import-okf` plus shared OKF frontmatter helpers. Export writes copied
+  OKF-compatible Markdown bundles without mutating source ARC files. Import scans
+  OKF Markdown, writes `.arckit/tmp/okf-import-report.json`, and materializes
+  valid non-duplicate entries as `RSCH` review notes by default.
+- **Optional OKF source frontmatter stamping.** `provenance-stamp.mjs` can now
+  merge OKF metadata into native ARC artifacts when explicitly enabled with
+  `ARCKIT_OKF_FRONTMATTER=1` or `.arckit/config.json` containing
+  `{ "okfFrontmatter": true }`. Stamping is off by default and idempotent.
+
+### Changed
+
+- **OKF documentation coverage.** Updated remaining extension READMEs, getting
+  started docs, guide index, remote-control docs, MCP setup docs, and copied
+  dependency matrices so all current documentation surfaces mention the OKF
+  import/export workflow consistently.
+
+## [5.14.0] — 2026-06-17
+
+### Added
+
+- **Mistral Vibe CLI extension support (#598).** ArcKit now ships a Vibe
+  extension with converted ArcKit skills, Vibe agent TOML, bundled templates,
+  scripts, schemas, references, and MCP configuration. The generated payload is
+  published to the standalone
+  [`tractorjuice/arckit-vibe`](https://github.com/tractorjuice/arckit-vibe)
+  repository, matching the existing separate Codex, Gemini, OpenCode, Copilot,
+  and Paperclip extension repo model.
+
+## [5.13.2] — 2026-06-17
+
+### Fixed
+
+- **STALE-EXT scans `external/` recursively (#595).** `/arckit:health` now
+  includes files nested under project `external/` subdirectories and reports
+  their relative paths, instead of only checking direct children. Claude, Codex,
+  and Gemini session/context external-document listings use the same recursive
+  scan.
+- **Documentation site search metadata improved.** The generated site now ships
+  refreshed SEO metadata, cache headers, sitemap entries, and the AI CLI harness
+  article so search and social previews index the current documentation.
+- **External context supports subtitle/transcript files (#600).** Project
+  `external/` guidance, scaffolding, and project context handling now include
+  `.srt` and `.vtt` transcript files alongside PDFs, Word documents, Markdown,
+  images, CSV, and SQL references.
+- **Manifest auto-update tolerates legacy entries without `documentId` (#601).**
+  `hooks/update-manifest.mjs` now deduplicates existing manifest entries by
+  `documentId` when present and falls back to the entry path basename when
+  older `docs/manifest.json` rows omit `documentId`, avoiding non-blocking
+  PostToolUse warnings after `/arckit:principles` writes global artifacts.
+
+## [5.13.1] — 2026-06-11
+
+### Changed
+
+- **Claude Code minimum-version floor raised v2.1.156 → v2.1.172.** v2.1.172 fixed wildcard-domain `WebFetch` permission rules (`WebFetch(domain:*.gov.uk)`) that never matched subdomains on earlier clients — the exact shape ArcKit's security-hooks guide recommends for confining research-agent traffic in OFFICIAL-SENSITIVE deployments, so the floor makes that shipped guidance actually hold. v2.1.172 also carries the Claude Fable 5 runtime (GA in v2.1.170); ArcKit defaults to the latest model tier. Updated every floor reference: `version-check.mjs` (`MIN_CLAUDE_CODE_VERSION` + warning bullets), `CLAUDE.md`, `README.md`, `docs/guides/enterprise-scale.md` (`requiredMinimumVersion` example), `hooks/README.md`, and the repo/test-repo `.claude/settings.json` `minimumVersion` (#593).
+
+## [5.13.0] — 2026-06-10
+
+### Added
+
+- **arckit-uk-gcloud** (13th marketplace plugin) — Proprietary, Claude-Code-only supplier-side G-Cloud bid-authoring overlay: 11 commands (supplier-profile, service-design, sdd-lot1/2/3, declaration, pricing, security, gcloud-competitors, review, submission-pack), 8 doc-types (SUPP/SVCD/SDD/DECL/PRIC/SECA/GCMP/GCRV), 3 skills (gcloud-framework, cloud-security, sfia-skills), and the uk-gcloud-submission build recipe. Requires arckit core. Ported from the standalone gcloud-kit plugin. Not distributed to the non-Claude extension formats (proprietary).
+
+## [5.12.1] — 2026-06-10
+
+### Fixed
+
+- **Secret scanner no longer false-positives on code/IaC references to secrets**
+  (#590). The generic key-value rules in `secret-file-scanner.mjs` and
+  `secret-detection.mjs` matched any non-whitespace value, so legitimate
+  assignments that *reference* a secret rather than hardcoding it —
+  `secret = module.sm.secret_ids["x"]` (Terraform), `password = var.db_password`,
+  `api_key = process.env.API_KEY`, Pulumi `config.requireSecret(...)`, Kubernetes
+  `secretKeyRef.name`, CDK `Token.fromAsset(...)` — were blocked. A structural
+  reference guard now exempts values that are an identifier followed by a property
+  access, index, or call, or a `${...}`/`$(...)` interpolation. Literal/unquoted
+  secrets and provider token formats (`sk-`, `ghp_`, `AIza`, PEM, …) are still
+  caught. The two hooks' pattern libraries were realigned to be byte-identical and
+  are now covered by `tests/plugin/scanner-reference-guard.test.mjs`, which also
+  guards against future drift between them.
+
+## [5.12.0] — 2026-06-09
+
+### Added
+
+- **`arckit-fde` plugin (12th marketplace plugin)** — a lean, Claude Code only ArcKit
+  plugin with one command, `/arckit-fde:create`, that interviews the user and renders a
+  brandable, GitHub-Pages-ready Forward Deploy Engineering consulting website into `docs/`.
+  Clone-and-substitute templates (scalar `{{TOKEN}}`s plus `<!-- BEGIN/END -->` list
+  regions; brand colour via a single `:root` CSS custom property), `uk-public-sector` and
+  `generic` market presets, a saved `fde-site.config.yaml` for repeatable re-renders, and
+  discovery metadata (`llms.txt`, `sitemap.xml`, `robots.txt`, `.nojekyll`). Not wired into
+  the converter (Claude-only), no governance doc-types, no dependencies. Includes a
+  `scripts/tests/test-fde-templates.mjs` consistency guard and a launch article. The
+  officially-maintained command baseline is unchanged; `/arckit-fde:create` is a tooling
+  command.
+
+## [5.11.2] — 2026-06-08
+
+### Changed
+
+- **Generated non-Claude extension dirs moved under `extensions/`.** The five converter-output dirs (`arckit-codex`, `arckit-opencode`, `arckit-copilot`, `arckit-gemini`, `arckit-paperclip`) now live under `extensions/` instead of the repo root, decluttering the top level and mirroring the `plugins/` grouping used for Claude Code plugin sources. The dirs remain gitignored generated content (only hand-authored files per extension are tracked); `arckit-claude` is still the single source of truth — run `python scripts/converter.py` after pulling. Build tooling (`scripts/converter.py`, `scripts/bump-version.sh`, `scripts/push-extensions.sh`), packaging (`pyproject.toml` shared-data, CLI data-path resolution — installed wheel layout now `share/arckit/extensions/<ext>`), CI, tests and docs were updated accordingly. Published-extension repos and install commands are unchanged.
+
+## [5.11.1] — 2026-06-07
+
+Maintenance release — repository restructure and hygiene only. **Plugin content is unchanged**; installation and usage are identical to 5.11.0.
+
+### Changed
+
+- **Plugin sources moved under `plugins/`** (#585). All 11 Claude Code plugin source directories (`arckit-claude` + 10 community overlays) now live under `plugins/` (e.g. `plugins/arckit-claude/`); `marketplace.json` points each entry at `./plugins/<name>`. The generated, gitignored non-Claude extension dirs stay at the repo root. Release tooling, CI, tests and docs were updated accordingly.
+- **Generated distribution formats are no longer tracked** (#581). The five non-Claude extension dirs (`arckit-codex`, `arckit-opencode`, `arckit-copilot`, `arckit-gemini`, `arckit-paperclip`) are regenerated by `scripts/converter.py` and published to their own repos by `scripts/push-extensions.sh`, so their ~2,600 generated files are now gitignored rather than committed. `arckit-claude` is the single source of truth — run `python scripts/converter.py` after pulling.
+- Gitignored the `docs/superpowers/` dev-workflow process artefacts (#583); noted that `tools/wardley-lsp/` now lives in its own repository (#582).
+
+### Removed
+
+- **`docs/proposals/`** confidential partnership material removed from the public repo and gitignored (#584).
+
+## [5.11.0] — 2026-06-05
+
+### Added
+
+- **End-of-turn traceability nudge** (#578). The `Stop` hook (`session-learner.mjs`) now emits one gentle, non-blocking next-step suggestion via `hookSpecificOutput.additionalContext` when a session's commits leave a curated traceability-chain gap — `REQ`→no `TRAC` (`/arckit:traceability`), `STKE`→no `REQ` (`/arckit:requirements`), `REQ`→no `DATA` (`/arckit:data-model`), `ADR`→no `DIAG` (`/arckit:diagram`). It reacts to the just-finished turn, distinct from the SessionStart stale-artifact monitor and `/arckit:navigator`/`health`. Version-gated to Claude Code v2.1.163+ (older clients treat a `Stop` `additionalContext` as a hook error): `version-check.mjs` persists the detected client version to `.arckit/memory/.cc-version` at SessionStart and the nudge stays silent below the gate, on `StopFailure`, or when `ARCKIT_NO_NUDGE` is set. The decision logic is the pure, unit-tested `selectNudge` in `session-nudge.mjs`.
+- **Per-agent telemetry attribution** (#579). `telemetry.mjs` stamps `agent_id`/`agent_type` (Claude Code v2.1.145+) onto latency and MCP records when a tool runs inside a subagent, so the session summary and `docs/telemetry.json` now break tool activity down **by agent** (e.g. `arckit-research` vs the main thread). New pure `telemetry-rollup.mjs` (`summariseTelemetry`/`rollupTelemetry`) adds a `byAgent` breakdown and the `/arckit:pages` "Recent Sessions" panel surfaces the busiest subagent. `parent_agent_id` is not exposed to hooks, so activity is attributed per agent rather than reconstructing the dispatch tree.
+- **`minimumVersion` floor guidance** (#575). The below-floor `version-check.mjs` warning now recommends adding `"minimumVersion"` to `.claude/settings.json` so background auto-updates / `claude update` cannot drift below ArcKit's Claude Code floor — distinct from the org-only managed `requiredMinimumVersion`. Dogfooded in this repo and the test-repo scaffold.
+
+### Changed
+
+- **Documentation — Claude Code v2.1.161–v2.1.163 adoption** (#576). New "Fleet & Version Governance (managed settings)" section in the enterprise-scale guide (`requiredMinimumVersion`/`requiredMaximumVersion`, `pluginSuggestionMarketplaces`, `OTEL_RESOURCE_ATTRIBUTES`); the MCP guide notes the sub-1000 ms per-server `timeout` floor and that `claude mcp` now redacts secrets; the autoresearch guide documents `--fallback-model`; the security-hooks guide documents scoping research-agent `WebFetch` to approved domains; the custom-commands guide documents the `\$` literal-dollar escape; `/plugin list --enabled` noted in the install guide.
+- **Documentation — effort-tier accuracy** (#577). Corrected the `effort:` frontmatter description: `max` is supported on Opus 4.6/4.7/4.8 and `xhigh` is the tier Opus 4.7/4.8 add. Verified ArcKit's `effort: max` commands run as `max` on Opus 4.8 (no code change needed).
+
+## [5.10.0] — 2026-06-04
+
+### Added
+
+- **AU Federal visual-evidence enrichment** (derived from #569). The `arckit-au` Federal commands and templates now compose with ArcKit's existing architecture and evidence tooling — `/arckit:diagram`, `/arckit:dfd`, `/arckit:data-model`, `/arckit:servicenow`, `/arckit:risk`, `/arckit:traceability`, `/arckit:graph-report` and `/arckit:maturity-model` — via embedded enrichment handoffs and an "ArcKit Architecture Evidence Map" section in each command. A standard **Visual Evidence Decision Rule** is applied across all ten Federal templates: generate companion visuals only when the evidence has enough structure for real nodes and relationships; generate a clearly marked draft visual with `Pending Input` labels when evidence is partial but structurally useful; otherwise record a **Visual Evidence Gap** and list the minimum inputs needed. The guidance stays cross-sector (SOCI/OT is not made energy-specific). The `au-federal` recipe gains default visual/evidence targets (DIAG, DFD, ServiceNow, maturity, traceability) and a `graph-report` post-build hook, plus synthetic eval fixtures for the complete / partial / sparse evidence scenarios.
+- **`MMOD` (Maturity Model Assessment) doc-type registered.** The core `/arckit:maturity-model` command has always emitted `ARC-*-MMOD-*` document IDs, but `MMOD` was never registered in `config/doc-types.mjs` or the `/arckit:pages` allow-list, so maturity artefacts were not recognised by graph-inject or the documentation site. Registered as a regime-neutral `Governance` type (severity `HIGH`, matching sibling governance types such as `RISK` and `TRAC`).
+
+### Fixed
+
+- **`findRepoRoot` no longer mis-detects an unrelated `projects/` directory as the repo root** (#572). Hooks now treat a `projects/` directory as the ArcKit repo root only when it contains a numbered project entry (`NNN` / `NNN-…`, e.g. `000-global`), so an empty or unrelated `projects/` higher up the tree is ignored. Also normalises Windows path separators in `allow-plugin-internals` so the plugin-internals allowlist works on Windows. Adds a dedicated `findRepoRoot` unit test, wired into CI.
+
+### Changed
+
+- **All command cross-references standardised on the colon namespace `/arckit:<command>`** (~5,600 references across ~600 files). This matches the official Claude Code plugin invocation syntax (plugin skills use a `plugin-name:skill-name` namespace) and replaces the previous mixed convention where templates, guides, the README, scripts and several overlays used the non-runnable dot form `/arckit.<command>`. Wardley sub-commands correctly keep the dot before the sub-command (`/arckit:wardley.gameplay`). File paths and the Codex/OpenCode `arckit.<name>.md` filenames are unaffected; Codex (`$arckit-<command>`) and Copilot (`/arckit-<command>`) per-target forms are unchanged. `CLAUDE.md`, `AGENTS.md` and `CONTRIBUTING.md` are corrected (they had wrongly documented Claude and OpenCode as using the dot form). A CI guard (`scripts/standardise-colon.py --check`) now fails the build if a dot-form reference is reintroduced. Historical CHANGELOG entries and published articles are intentionally left as written.
+
+## [5.9.2] — 2026-06-03
+
+### Fixed
+
+- **`CMPT` and `TNDR` now sequence correctly in `generate-document-id.sh`** (#566). The bundled helper hardcoded `MULTI_INSTANCE_TYPES` without `CMPT` or `TNDR` (both added in 5.9.0), so `/arckit:competitors` and `/arckit:tenders` received document IDs with **no sequence number** (e.g. `ARC-001-CMPT-v1.0`) and collided on every run. The plugin copy (`arckit-claude/scripts/bash/`) — the one the plugin cache actually executes — had drifted from the already-fixed CLI copy (`scripts/bash/`), despite the script's own "keep in sync with `doc-types.mjs`" comment. Added `TNDR CMPT` after `DSCT` to match `config/doc-types.mjs MULTI_INSTANCE_TYPES` and regenerated the codex / copilot / opencode / gemini copies via the converter.
+
+### Changed
+
+- **Writer-subagent writes pre-authorised in the dev repo** (#566). The five writer subagents (`competitors` / `tenders` / `gov-reuse` / `datascout` / `grants`) hold `Write`/`Edit` but run non-interactively, so a gated `Write` is auto-denied — a subagent cannot surface an approval prompt. Added scoped `Write(//workspaces/arc-kit/projects/**)` + `Edit(...)` rules to `.claude/settings.json`. Least-privilege: the writers have no web/MCP tools and the orchestrator schema-validates payloads before they run, so this only authorises the boundary the reader/writer split already enforces.
+
+## [5.9.1] — 2026-06-03
+
+### Fixed
+
+- **All MCP-backed subagents can now reach their plugin MCP servers** (#564, #565). `/arckit:tenders` and `/arckit:competitors` (#564), and then every other MCP-backed agent (#565), were falling through to empty/degraded paths because their reader/research subagents could not call the bundled MCP servers. Two root causes, both required, confirmed against the Claude Code docs:
+  - **Tool-name prefix.** Plugin-bundled MCP tools surface at runtime as `mcp__plugin_arckit_<server>__<tool>`, but the agents' `tools:` allowlists used the bare `mcp__<server>__` form, which matches nothing in a subagent allowlist. Prefixed the tool names in 8 agents: `arckit-tenders-reader` (#564) plus `arckit-aws-research`, `arckit-azure-research`, `arckit-gcp-research`, `arckit-gov-code-search`, `arckit-gov-landscape`, `arckit-gov-reuse-reader`, `arckit-datascout-reader` (#565).
+  - **Deferred servers don't reach subagents.** A deferred (non-`alwaysLoad`) plugin MCP server is not injected into subagent context — only the main agent can load it on demand — so a subagent needs `alwaysLoad: true` to see it. Added `alwaysLoad` to `uk-tenders` (#564), `govreposcrape`, `google-developer-knowledge` and `datacommons-mcp` (#565), joining `aws-knowledge` / `microsoft-learn` which already had it. For the two keyed servers, a keyless user's session attempts the connection at startup; per the docs an auth failure marks the server failed and the session continues, bounded by the 5s connect timeout.
+- **Codex extension `sync-guides.mjs` drift** (#562). Re-synced the hand-maintained `sync-guides.mjs` between `arckit-claude` and `arckit-codex` — restored the NHS clinical-safety block and the `{{REPO_OWNER}}` substitution that had drifted out of the Codex copy.
+
+### Changed
+
+- **Per-page canonical / Open Graph metadata for arckit.org viewers** (#561), plus the `pages-template.html` head, so generated documentation sites and the article viewers emit correct canonical and OG tags.
+- **`/arckit:start` workflow-trigger note** corrected for the Claude Code v2.1.160 `workflow` → `ultracode` keyword rename (#522 item 59, #560).
+
+## [5.9.0] — 2026-06-02
+
+### Added
+
+- **`/arckit:competitors` — Competitor Landscape** (#556). Rival suppliers, awarded-value market share, head-to-head and concentration analysis from the same ~677,000 UK contracting processes as `/arckit:tenders`. Shares the `arckit-tenders-reader` subagent (same MCP reader, different orchestrator/writer lens). Outputs `CMPT` artefact; feeds into `risk` (supplier-concentration/single-supplier-dependency risk), `sobc` (market-context benchmark), `research` (award-evidence grounding), `score` (Company Experience evidence) — all regime-gated handoffs under `governance_framework: UK Gov`.
+- **Assurance wiring — TNDR/CMPT artefacts** (#556). Four existing commands now consume TNDR and/or CMPT artefacts as optional inputs: `risk` (supplier-concentration risk section), `sobc` (Economic Case market-context benchmarks), `research` (award-evidence grounding in the build-vs-buy analysis), `score` (Company Experience evidence in the vendor-evaluation scorecard). All wiring is regime-gated (UK Gov `governance_framework`) and added as optional `handoffs:` to the producing commands, plus `## Context` blocks in the consuming commands.
+- **`/arckit:tenders` — Procurement Market Intelligence** (#556). Award-value benchmarks, top suppliers, incumbency and concentration from ~677,000 UK contracting processes (Find a Tender Service, Contracts Finder, Public Contracts Scotland, Sell2Wales, eTendersNI). Three-tier reader/orchestrator/writer subagent split; reader allowlists 7 read-only tools; `query_sql` never allowlisted (prompt-injection surface). Outputs `TNDR` artefact; feeds into `sobc` (Economic Case benchmarks), `risk` (concentration risk), `research` (build-vs-buy context). Shares `arckit-tenders-reader` with `/arckit:competitors`.
+- **`uk-tenders` bundled MCP server** (#556). Keyless `http` MCP at `https://tenders.run.cns.me/mcp`, deferred (no `alwaysLoad`). 11 tools; 7 allowlisted by `arckit-tenders-reader`; `query_sql` documented-only and never allowlisted. Nightly refresh, best-effort single Cloud Run, no formal SLA — degrades gracefully. Data re-published under OGL v3.0.
+- **`TNDR` + `CMPT` doc-types** (#556). `TNDR` (Procurement Market Intelligence, regime UK) and `CMPT` (Competitor Landscape, regime UK) registered in `config/doc-types.mjs` and `commands/pages.md`. Both now live.
+
+## [5.8.0] — 2026-06-01
+
+### Added
+
+- **`arckit-au-energy` community overlay — first Australian sector overlay (11th marketplace plugin).** Adds the Australian Energy Sector overlay as a standalone sector plugin layered on the `arckit-au` jurisdiction baseline, mirroring how `arckit-uk-finance` / `arckit-uk-nhs` layer sectors on the UK baseline (rather than bundling the sector menu inside the jurisdiction overlay). Two commands — `au-aescsf` (AESCSF maturity assessment) and `au-energy-compliance` (AER ring-fencing, AEMC NER/NGR, AEMO interfaces, DERMS/DOE, CSIP-AUS, SOCI escalation) — plus the `au-energy` build recipe (22 targets, optional default-off `SERVICE_INVENTORY`). The recipe composes federal-layer targets (`AU_E8`, `AU_ISM`, `AU_OT`, `AU_SOCI`, `AU_PIA`, `AU_NDB`) from `arckit-au`, so the plugin manifest declares dependencies on **both** `arckit` core and `arckit-au` — the marketplace's first community→community plugin dependency. Doc types `AUAESCSF` + `AUENERGY` (regime AU, HIGH severity). Ships public synthetic evaluation fixtures (`tests/fixtures/au-energy/`) — an applicable DNSP case and a non-SOCI supplier negative case — with deterministic pytest coverage. Register/evidence-heavy energy review composes existing skills (`data-model`, `servicenow`, `dfd`, `diagram`, `risk`, `maturity-model`, `traceability`, `graph-report`) instead of a new inventory command. Original work by @royster70 (#549), repackaged from a stacked-on-#539 draft into a clean standalone sector plugin. Also corrected the `arckit-au` marketplace description from "8 commands" to "10 commands" (OT security + SOCI/CIRMP landed in #539).
+- **govreposcrape dependency-intelligence tools wired into the gov agents** (#550). Following the upstream expansion of the `govreposcrape` MCP server from 1 tool to 9, two of the new dependency-intelligence tools are now consumed by ArcKit:
+  - **`dependency_compare` → `/arckit:gov-reuse`.** The `arckit-gov-reuse-reader` subagent runs pairwise dependency-overlap between candidate repositories that share a capability and emits the results in a new optional `dependency_comparisons` array on the gov-reuse handoff schema. The orchestrator (`commands/gov-reuse.md`) uses overlap ≥ 60% to collapse near-duplicate / forked candidates — keeping the higher-scored repo as the primary recommendation and avoiding double-counting effort savings — and the writer renders a new **Dependency Overlap Analysis** section in the GOVR artefact. Reader budget capped at 3 `dependency_compare` calls / 5 comparison entries per dispatch.
+  - **`vulnerability_exposure` → `/arckit:gov-landscape`.** The `arckit-gov-landscape` agent now scans the domain's major organisations and dominant packages for known-CVE blast-radius (via the SBOM graph + live OSV.dev) and renders a new **Supply-Chain & Vulnerability Exposure** section (exposure by organisation, exposure by dominant package, end-of-life flags). Flagged as a landscape-level signal, not a per-repo audit — points users to `/arckit:secure` / `/arckit:risk` for adoption decisions.
+  - Both tools added to the respective agents' `tools:` frontmatter allowlists. `docs/MCP-CATALOGUE.md` updated to mark them as consumed (17 of 23 tools now wired). Non-Claude formats regenerated via `scripts/converter.py`.
+- **Cross-sector OT security and SOCI/CIRMP commands added to the `arckit-au` federal overlay** (#539), taking it to 10 commands. `au-ot-security` (ASD operational technology cyber security assessment for connected OT/ICS/SCADA environments) and `au-soci-cirmp` (SOCI Act Critical Infrastructure Risk Management Program governance + evidence pack). Both are general Australian critical-infrastructure capabilities — optional default-off `AU_OT` / `AU_SOCI` targets in the `au-federal` recipe — and are reused (not redefined) by the new `arckit-au-energy` overlay. Doc types `AUOT` + `AUSOCI` (regime AU, HIGH severity).
+
+### Fixed
+
+- **Windows validation paths** (#548). Normalised plugin-root path comparisons in `allow-plugin-internals.mjs` and the generated `arckit-codex-hook.mjs` (`\` → `/` before prefix-matching, a no-op on POSIX) so the `isUnderPluginRoot` gate works on Windows; imported `doc-types.mjs` via `pathToFileURL()` in the dual-registration validator so Node ESM dynamic import works on Windows absolute paths. Also ignores local `.agents/skills/` and `.claude/worktrees/` dev folders.
+
+### Changed
+
+- **Removed references to the retired `tractorjuice/arckit-book` repository** (#536/#554). The repo is no longer available, so the README link 404'd. Dropped the "ArcKit Book" section from `README.md` and repointed the `.devin/wiki.json` authoritative-overview note at `CLAUDE.md` + `README.md` (the live canonical sources). Historical CHANGELOG entries recording the original move (#324/#325) left intact.
+- Documentation: noted Claude Code v2.1.157's "workflow" keyword trigger on the start guide (#552); split the homepage stat cards into Jurisdictions / Sectors / Agents (#547).
+
+## [5.7.0] — 2026-05-29
+
+### Fixed
+
+- **US regime registration** (#545, #546). `regime: 'US'` was declared on 10 doc-types (FedRAMP/FISMA/NIST 800-53/CISA Zero Trust/ICAM/AI RMF/PIA/SBOM) but `'US'` was missing from the exported `REGIMES` array and `REGIME_LABELS` in `arckit-claude/config/doc-types.mjs`. The sole consumer, `hooks/graph-inject.mjs`, iterates `REGIMES` directly, so US compliance artefacts were silently dropped from the "Compliance Artifact Presence" listing and never scored in the readiness scorecard despite validating on disk. Added `'US'` + `US: 'USA Federal'`. Same failure class as the CA omission fixed in #441.
+- **`arckit-uk-finance` restored to extension conversion** (#546). `scripts/converter.py` `PLUGIN_SOURCES` omitted `arckit-uk-finance`, so its four `uk-fs-*` commands were absent from all five non-Claude extensions (Codex/OpenCode/Gemini/Copilot/Paperclip) from v5.3.0 onward. Added it and regenerated every extension. Also mirrored the eight `uk-fs` templates into `.arckit/templates/` (CLI package data — `arckit init` users had missed them) and removed a stray tracked `arckit-uk-finance/templates/.gitkeep` the converter was copying into extension dirs as noise.
+- Refreshed stale overlay-enumeration lists in the test suite (`tests/plugin/test_template_consistency.py`, `tests/paperclip/test_commands_json.py`, `tests/codex/test_codex_extension.py`) to include the `us` / `uk-finance` / `uk-nhs` overlays.
+
+### Added
+
+- **Regime-registration guard test** (`scripts/tests/test-regime-registration.mjs`, wired into CI `lint-markdown.yml`). Asserts every declared doc-type `regime:` is present in both `REGIMES` and `REGIME_LABELS` — the invariant whose absence let the US gap (and the earlier CA gap) ship silently.
+
+## [5.6.0] — 2026-05-29
+
+### Changed
+
+- **Minimum Claude Code version bumped to v2.1.156** (from v2.1.144). The new floor pulls in two Opus 4.8-era improvements ArcKit now depends on: the **v2.1.156** fix for Opus 4.8 thinking blocks being modified and causing API errors (relevant to `/arckit:*` commands and the research agents that use extended thinking), and **v2.1.154** which shipped Opus 4.8 GA plus the `defaultEnabled` plugin manifest field (below). Updated in `arckit-claude/hooks/version-check.mjs`, `README.md` (install note, "Why v2.1.156?" callout, requirements line), `CLAUDE.md` (monitors floor note), and `docs/getting-started.html`.
+- **Opus 4.7 → Opus 4.8 documentation refresh** (items 43/44 of #522). `CLAUDE.md` now describes the `effort:` `xhigh` tier as covering Opus 4.7 and 4.8 (4.8 defaults to `high`) and the `/fast` backing model as Opus 4.8 as of v2.1.154 (was 4.7 on v2.1.142–v2.1.153). The `start.md` getting-started guide's token-constrained recommendation updated from "Opus 4.6 or 4.7" to "Opus 4.7 or 4.8" across all distribution copies. (Historical feature-gate references to Opus 4.7 in the README "Why?" callouts and `version-check.mjs` are intentionally left as-is — they record which version first shipped 4.7's `xhigh`/`/context`.)
+
+### Added
+
+- **`defaultEnabled: false` on all 9 community overlays** (`arckit-uae`, `arckit-fr`, `arckit-ca`, `arckit-eu`, `arckit-at`, `arckit-au`, `arckit-us`, `arckit-uk-finance`, `arckit-uk-nhs`). Adopts the Claude Code v2.1.154 plugin manifest field so installing the marketplace surfaces the overlays without auto-enabling all nine. Users now opt in to only the jurisdiction or sector they need; core `arckit` stays default-enabled. Formalises the "install only what you need" model already documented in `CLAUDE.md`. Addresses item 42 of #522.
+
+### Fixed
+
+- **UK accessibility target corrected from WCAG 2.1 AA to WCAG 2.2 AA.** UK public sector bodies are now monitored against WCAG 2.2 AA — GDS has tested against 2.2 since October 2024, and the *Public Sector Bodies (Websites and Mobile Applications) Accessibility (Amendment) (EU Exit) Regulations 2022* (SI 2022/1097) replaced the fixed WCAG version reference with a rolling reference to "the latest published version of WCAG" (currently 2.2). The `/arckit:service-assessment` command (GDS Service Standard Point 5 evidence checks) and several core templates were still hard-coded to "WCAG 2.1 AA", causing generated UK artefacts to cite the superseded standard. Updated: `service-assessment` (5 references), `backlog` command, and the `requirements`, `sow`, `research-findings`, `platform-design`, and `backlog` templates, plus the NHS example on `docs/use-cases.html`. Non-Claude formats regenerated via `scripts/converter.py`.
+  - **Jurisdictional overlays intentionally left unchanged** (verified against current 2026 mandates): France `fr-dinum` correctly maps RGAA 4.1.2 → WCAG **2.1** AA (RGAA 5 / 2.2 expected end-2026, not yet in force); Canada `ca-gc-digital-standards` correctly anchors WCAG **2.1** AA via CAN/ASC-EN 301 549:2024; Australia `au-dss` already targets WCAG **2.2** AA (Digital Experience Policy, 1 Jan 2025).
+
+## [5.5.0] — 2026-05-28
+
+### Brand reposition
+
+Significant identity refresh. No functional changes to commands, agents, hooks, or recipes — purely brand surfaces, assets, and positioning copy.
+
+### Changed
+
+- **Tagline**: "Enterprise Architecture Governance & Vendor Procurement Toolkit" → **"The Enterprise Architecture Governance Harness"**. Drops the loaded "Toolkit" category and elevates "Harness" — the structural metaphor that better matches how ArcKit actually behaves (it harnesses an AI assistant against a template-driven governance frame). Updated across every brand surface: root `README.md`, plugin `plugin.json`, marketplace `marketplace.json`, Gemini extension JSON, Codex / Copilot / OpenCode / Paperclip READMEs, `CLAUDE.md`, `docs/llms.txt`, `docs/index.html` (meta description + OG + Twitter + JSON-LD + footer + hero), all 10 docs `*.html` pages, all 6 start guides, the published article on government code discovery, the FDE pitch deck, the business plan, the CLI `__init__.py` docstring + `TAGLINE` constant + Typer help text, and the SDG repo scaffold script.
+- **Category positioning**: "Architecture · Vendor Procurement · Compliance" → **"Strategy · Architecture · Delivery · Assurance"**. Reflects the actual 71-command surface, where procurement is one cluster of ~6 commands among seven; the new four-bucket framing makes Strategy (principles/SOBC/risk/Wardley/roadmap/story/framework), Architecture (ADRs/diagrams/HLD-DLD/data-mesh-contract/platform-design/data-model/backlog/servicenow), Delivery (devops/mlops/finops/operationalize/pages/presentation), and Assurance (analyze/conformance/traceability/health/navigator/maturity-model + all compliance commands) each load-bear an equivalent share of the surface. Procurement (sow, dos, evaluate, score, gcloud-*) is preserved as functional content — the SOW command, plan-template Gantt phases, procurement guide, use-case index entry — but no longer leads positioning.
+
+### Added
+
+- **New logo family — Bracket-B2**. Replaces the previous arc-with-three-nodes "arc-kit" mark. Built from three semantic elements that depict an AI harness: angle brackets `⟨ ⟩` (harness frame / prompt structure), inner caret `^` (prompt indicator), linchpin cursor (teal terminal anchors flanking a navy centre pin — the AI output baseline). Selected from six concept directions explored under `docs/assets/concepts/` (Bracket A/B/C, Linchpin A/B, Hybrid) and three Bracket-B grafts (B1 anchor-nodes / B2 linchpin-cursor / B3 linchpin-fan). Full asset family in production paths: `ArcKit_Mark_Light/Dark.svg`, `ArcKit_Logo_Horizontal_Light/Dark.svg`, `ArcKit_Logo_Stacked_Light/Dark.svg`, `arckit-banner-light/dark.svg`, `og-card.svg`, `favicon.svg` (large, navy 96-radius tile), `favicon-small.svg` (16/32 stripped variant).
+- **Dark banner** — `arckit-banner-dark.svg` was missing from the library entirely. Added.
+- **OG card** — `docs/assets/og-card.svg` 1200×630 hero with the new mark, wordmark, tagline, and four-bucket subtitle. Replaces `docs/og-image.png` content so the existing `https://arckit.org/og-image.png` URL serves the new design without breaking inbound shares.
+- **Favicon set** — `favicon.svg`, `favicon-512.png`, `favicon-192.png`, `favicon-32.png`, `favicon-16.png`, plus a simplified `favicon-small.svg` for the 16/32 sizes. Wired into all 10 docs `*.html` pages via `<link rel="icon">` block placed after each page's canonical link.
+- **Render script** — `scripts/render-brand-pngs.py` (uses `cairosvg`) regenerates all 22 PNG exports from the SVG sources. Run after any SVG edit to keep raster exports in sync.
+- **Concept directory retained** — `docs/assets/concepts/` (six initial concept thumbnails + three B-grafts + `v2/` full Bracket-B2 family pre-promotion) kept in-repo as design source-of-truth for future iteration.
+- **Brand-motif documentation** — `docs/assets/README.md` "Brand motif" section rewritten to describe the Bracket-B2 design and its colour-role assignments (`#0B1F33` navy for structure, `#1ED3C6` teal for the AI/active layer).
+
+### Changed (external)
+
+- GitHub repo description updated via `gh repo edit` to match the new tagline.
+- **Not done by this release**: GitHub social-preview image. The repo's social-preview image is not exposed via `gh` CLI or REST API. Upload `docs/assets/og-card.png` manually at GitHub → Settings → General → Social preview.
+
+## [5.4.0] — 2026-05-27
+
+### Fixed
+
+- **`desktop_notifications` SessionStart hook no longer raises `plugin option "desktop_notifications" isnt set` on fresh installs.** The `${user_config.desktop_notifications}` argv substitution in `arckit-claude/hooks/hooks.json` aborts the hook when the user has never set the field, even with a `"default": "false"` declared in the userConfig (the default does not propagate through argv substitution on at least some Claude Code versions). The hook now reads the value from the `CLAUDE_PLUGIN_OPTION_DESKTOP_NOTIFICATIONS` env var — the documented parallel access path — which degrades cleanly to `undefined` when the field is unset. Opt-in behaviour for users who set `desktop_notifications: "true"` is unchanged.
+- **`/arckit:pages` now surfaces NHS clinical-safety artefacts**. Marcus Baw's `SAFETY.md` / `SAFETY-CASE.md` / `HAZARD-LOG.md` files (and their `clinical-safety/deployment/` companions from `/arckit:uk-nhs-dcb0160`) deliberately do not carry the `ARC-` prefix, so they were skipped by the manifest scanner in `arckit-claude/hooks/sync-guides.mjs`. The scanner now picks up any `.md` file in `projects/{NNN}/clinical-safety/` and `projects/{NNN}/clinical-safety/deployment/` under category `Clinical Safety`, using the file's first heading as the title. Marcus's filenames are preserved verbatim — only the manifest entry is added.
+
+### Added
+
+- **`arckit-uk-nhs` community plugin** — second **sector-specific** ArcKit overlay (following [`arckit-uk-finance`](#530--2026-05-27) which shipped in v5.3.0; jurisdiction overlays continue to cover legal territories). 4 commands covering NHS clinical safety (`uk-nhs-dcb0129` manufacturer, `uk-nhs-dcb0160` deployer), NHS DTAC v3 (`uk-nhs-dtac`), and UK MDR 2002 + EU MDR 2017/745 software-as-medical-device classification (`uk-mdr-classification`). Adopts [Dr Marcus Baw's SAFETY.md spec](https://github.com/pacharanero/SAFETY.md) verbatim for DCB0129/0160 file naming and YAML-frontmatter hazard log (3-file output: `SAFETY.md`, `SAFETY-CASE.md`, `HAZARD-LOG.md` inside `projects/{NNN}/clinical-safety/`). Closes part of #424.
+- **`uk-nhs-clinical-safety` build recipe** (44 targets across 8 build waves) — composes with the UK SaaS baseline rather than replacing it (NHS digital products still need TCoP, Secure by Design, DPIA, ATRS).
+- **2 new doc-type codes** registered in `arckit-claude/config/doc-types.mjs`: `NHSDTAC`, `NHSMDR`. Both regime `UK`, category `Compliance`, severity `HIGH`. Dual-registered in `arckit-claude/commands/pages.md` allow-list per existing dual-registration pattern.
+- **Spec doc and decision log** at [`docs/superpowers/specs/2026-05-19-uk-nhs-overlay-design.md`](docs/superpowers/specs/2026-05-19-uk-nhs-overlay-design.md) — every locked decision traces back to its source; §0 written specifically for Marcus Baw to review before committing as proposed domain co-maintainer.
+
+### Changed
+
+- **Top-level command count** moves from **139** to **143** (71 official + 72 community-contributed). Community count: `arckit-uae` 12 + `arckit-fr` 12 + `arckit-ca` 12 + `arckit-eu` 7 + `arckit-at` 3 + `arckit-au` 8 + `arckit-us` 10 + `arckit-uk-finance` 4 + `arckit-uk-nhs` 4 = 72.
+- **`scripts/bump-version.sh`** — added `arckit-uk-nhs` to jurisdictions loop and to verification output.
+- **`scripts/converter.py`** — added `arckit-uk-nhs` to `PLUGIN_SOURCES`. All extension formats (Codex Extension, Codex Skills, OpenCode CLI, Gemini CLI, Copilot, Paperclip) now include the 4 NHS commands.
+- **`.claude-plugin/marketplace.json`** — added 10th plugin entry for `arckit-uk-nhs` (alongside `arckit-uk-finance` from v5.3.0).
+
+### Notes for Marcus Baw
+
+Marcus's SAFETY.md / SAFETY-CASE.md / HAZARD-LOG.md files deliberately do NOT carry the `ARC-` prefix or a doc-type code — they pass through the `validate-arc-filename` hook untouched and are cross-referenced by relative path (`clinical-safety/SAFETY-CASE.md`) rather than document ID. This preserves his spec's "convention over configuration" principle while keeping the files inside an ArcKit project subdirectory so multi-project monorepos work. The Document Control block prepended to each file is the only addition to his spec.
+
+## 5.3.0 — 2026-05-27
+
+### Added
+
+- **`arckit-uk-finance` community plugin** — first sector-specific overlay. Jurisdictional overlays cover countries (UAE, France, Canada, EU, Austria, Australia, USA federal civilian); sector overlays cover industry verticals. Four commands for architects at established UK PSPs / EMIs / PIs scaling regulated payment operations: SCA-RTS exemption design (`uk-fs-sca-rts`, `FSSCA`), EMI/PI safeguarding assessment (`uk-fs-safeguarding`, `FSSAFE`, CRITICAL severity flag), FCA Consumer Duty board report (`uk-fs-consumer-duty`, `FSCD`), Critical Third Parties dependency assessment (`uk-fs-ctp-dependency`, `FSCTP`). Recipe: `uk-fs-payments` (multi-wave payment system modernization). Ships EXPERIMENTAL; help-wanted call open for a UK FS domain co-maintainer (regulatory counsel / MLRO / Head of Architecture background welcome). See spec: `docs/superpowers/specs/2026-05-26-arckit-uk-finance-overlay-design.md`. See plan: `docs/superpowers/plans/2026-05-26-arckit-uk-finance-overlay.md`.
+- Four new doc-types registered in `arckit-claude/config/doc-types.mjs`: `FSSCA` (SCA-RTS), `FSSAFE` (Safeguarding), `FSCD` (Consumer Duty), `FSCTP` (Critical Third Parties).
+- New recipe `uk-fs-payments.yaml` in `arckit-claude/skills/arckit-build/recipes/`.
+- Five user-facing guides in `docs/guides/uk-fs-*.md` (one per-command + one overlay-level maintenance guide with citation register).
+- Site integration: UK Finance sector card on landing page (`docs/index.html`), accordion section in guides (`docs/guides.html`), filter option and 4 command rows on commands page (`docs/commands.html`).
+
+## 5.1.0 — 2026-05-23
+
+### Added
+
+- **`arckit-us`** community plugin — USA Federal Civilian Overlay with 10 commands (`us-fisma-categorization`, `us-nist-800-53`, `us-fedramp-ssp`, `us-fedramp-readiness`, `us-zero-trust`, `us-icam`, `us-ai-rmf`, `us-ai-impact`, `us-privacy-pia`, `us-sbom-eo-14028`) and the `us-federal` recipe. See [`arckit-us/CHANGELOG.md`](arckit-us/CHANGELOG.md).
+- 10 new doc-type codes registered in `arckit-claude/config/doc-types.mjs`: `FIPS199`, `NIST`, `FRSSP`, `FRRR`, `ZTA`, `ICAM`, `AIRMF`, `AIIA`, `USPIA`, `SBOM`.
+- 11 central guides under `docs/guides/us-*.md` (10 per-command + 1 overlay-level maintenance guide with citation register).
+- USA section in `docs/guides.html`, `docs/commands.html`, `docs/index.html`.
+
+### Changed
+
+- All 8 plugin manifests now at lockstep `5.1.0` (was 5.0.5).
+- Community overlay count: 6 → 7. Total command count: 125 → 135 (71 official + 64 community).
+- `scripts/bump-version.sh` jurisdiction loop now includes `us`; verification block now includes `arckit-au` and `arckit-us` (the `arckit-au` addition fixes a pre-existing verification gap).
+- `scripts/converter.py` `AGENT_CONFIG` extended with `arckit-us` source.
+
+### Statutory currency note
+
+This release ships the USA overlay against the **post-EO-14110-revocation** policy landscape: OMB M-24-10 (use of AI) and OMB M-25-21 (acquisition of AI) are the active AI assurance mandates, FedRAMP completed the Rev 5 transition in 2024, and OMB M-22-18 / M-23-16 secure-software attestation has been active since 2024.
+
+## [5.0.5] - 2026-05-23
+
+### Fixed
+
+- `owm-to-mermaid.mjs` no longer mis-parses `evolve` lines whose quoted component name contains an embedded number (#508). The target-evolution regex is now anchored at end-of-line, so `evolve "Foo (Project 003)" 0.74` is converted faithfully instead of truncating the name and dropping the real target.
+- `owm-to-mermaid.mjs` now passes inline `(build)` / `(buy)` / `(outsource)` decorators through to the Mermaid output (#508), alongside the existing `(inertia)` support. Authors no longer need to add trailing standalone `build "<Name>"` / `buy "<Name>"` / `outsource "<Name>"` directives to get sourcing decorators on the converted Mermaid map.
+- `/arckit:health` now flags **DRAFT staleness** and **overdue reviews** — the two signals the session-start `stale-artifact-scan` monitor was already reporting (#509). Adds two detection rules: `STALE-DRAFT` (MEDIUM, status=DRAFT unchanged for > 30 days by default, configurable via `STALE_DRAFT_DAYS=N`) and `REVIEW-OVERDUE` (HIGH, Document Control `Next Review Date` in the past on non-DRAFT/SUPERSEDED/ARCHIVED artifacts). The monitor's draft threshold moves from 14 days to 30 to match. Both surfaces now agree on the same set of artifacts.
+
+## [5.0.4] - 2026-05-22
+
+### Added
+
+- **Opt-in OWM label tidying** for `/arckit:wardley`. New `--tidy-owm` flag rewrites the canonical ` ```wardley ` (OnlineWardleyMaps) block's component `label [x, y]` offsets so labels do not overlap when rendered at <https://create.wardleymaps.ai>. Backed by `owm-tidy.mjs` — a sibling of the mermaid `wardley-tidy.mjs` that reuses the same placement engine with the OnlineWardleyMaps renderer geometry (recovered from `tractorjuice/onlinewardleymaps`). Opt-in by design: the OWM block is the author-edited source of truth and OWM is an interactive drag editor, so it is never rewritten by a silent hook (unlike the Mermaid `wardley-beta` block). Collision-free authored offsets are kept; only overlapping or untuned labels move.
+
+## [5.0.3] - 2026-05-22
+
+### Added
+
+- **Auto-tidy Wardley Map labels** (#506). New `tidy-wardley-labels` PostToolUse hook rewrites Mermaid `wardley-beta` component-label offsets after every Write/Edit, so clustered components no longer collide into an unreadable pile. Backed by a pure, deterministic placement engine that projects the map to pixels, generates 32 candidate slots per label, scores each against a weighted collision penalty, places the most-constrained labels first, and converges to an idempotent result.
+
+### Documentation
+
+- New articles: the v5 plugin-split token budget (#502) and the Wardley label-tidy placement algorithm (#500, #506). Per-article `sitemap.xml` and `llms.txt` entries backfilled (#503, #504, #505).
+
+## [5.0.2] - 2026-05-19
+
+### Added
+
+- **`desktop_notifications` userConfig flag + `notify-stale-artifacts` SessionStart hook** (#497). Opt-in `terminalSequence` (Claude Code v2.1.141+) desktop notifications when stale ArcKit artefacts are detected at session start. Stacks OSC 9 (iTerm2 / Windows Terminal / WezTerm / ConEmu) and OSC 777 (urxvt / Ghostty / Warp) escapes; terminals silently drop unsupported codes per the documented allowlist. Complements (does not replace) the existing `stale-artifact-scan` background monitor.
+- **"What it costs" README section** (#499). Documents the measured plugin footprint from `claude plugin details arckit`: ~10,042 always-on tokens per session plus on-invoke costs tiered (Lightweight <2K, Standard 2–7K, Heavy 7–15K, Research-heavy 15–25K, Specialist >25K).
+
+### Changed
+
+- **All 6 community-overlay READMEs** (`arckit-uae`, `arckit-fr`, `arckit-ca`, `arckit-eu`, `arckit-at`, `arckit-au`) now call out the v2.1.143 plugin dependency enforcement: `claude plugin disable arckit` surfaces a disable-chain hint instead of silently breaking the overlay (#497).
+
+### Fixed
+
+- **32 AU community-plugin guide files** under `arckit-{codex,copilot,opencode,paperclip}/docs/guides/au-*.md` are now tracked. They had been generated by `scripts/converter.py` and pushed to the published extension repos via `push-extensions.sh`, but stayed untracked in the monorepo, causing 32 "new" files at every release (#498).
+- **Runtime cache `.gitignore` cleanup** (#498). `.arckit/memory/.last-session`, `.arckit/memory/.telemetry.jsonl`, and `docs/telemetry.json` are now gitignored — closes the loose end from the #494 close discussion. `.last-session` was previously tracked one commit deep; `git rm --cached` untracks it while leaving the file on disk for the running hook.
+
+## [5.0.1] - 2026-05-19
+
+### Changed
+
+- **Minimum Claude Code version bumped to v2.1.144** (from v2.1.139). Adopts items 1, 3, 5, 8 from #495 — see `arckit-claude/CHANGELOG.md` for the full plugin entry.
+
+### Fixed
+
+- `CLAUDE.md` and `README.md` agent-count corrected from "13 agents" to **16 agents** (10 single-tier + 6 reader/writer subagents). Discovered during the #495 item 10 subagent-slug audit.
+
+## [5.0.0] - 2026-05-18
+
+### BREAKING
+
+- **Community overlays moved to separate plugins**. The monolithic `arckit` plugin shipped 117 commands (71 core + 46 community). v5.0.0 splits community commands into six per-jurisdiction marketplace plugins: `arckit-uae` (12 commands + 2 recipes), `arckit-fr` (12), `arckit-ca` (12 + 1 recipe), `arckit-eu` (7), `arckit-at` (3), and `arckit-au` (8 + 1 recipe — new in v5.0.0). Users now install only the jurisdictions they need. Total surface: 125 commands across 7 plugins.
+  - **Migration:** after upgrading, install the community plugins you previously used. A one-shot SessionStart banner reads `.arckit/manifest.json` and prints the exact `claude plugin install ...` command for your project. Acknowledge with `touch .arckit/v5-migration-acked`.
+  - **Token savings:** UK-only users save ~5K tokens per SessionStart system reminder (estimate — to be replaced with measured figures in Task 16).
+  - **No functional change** for users who install all 6 plugins — the full 117-command surface is intact, just spread across plugins.
+
+### Added
+
+- `scripts/check_recipes.py` — CI gate validating every recipe's structure and dep references.
+- `scripts/check_doctype_collisions.py` — CI gate asserting every doc-type code in `arckit-claude/config/doc-types.mjs` is unique.
+- `scripts/tag-plugins.sh` — creates native `<plugin>--vX.Y.Z` tags per release (idempotent).
+- `arckit-claude/hooks/v5-migration-banner.mjs` — one-shot SessionStart hook suggesting per-jurisdiction installs based on prior project artefacts.
+- 6 new plugin directories: `arckit-uae/`, `arckit-fr/`, `arckit-ca/`, `arckit-eu/`, `arckit-at/`, `arckit-au/`, each with their own `plugin.json`, `README.md`, `VERSION`, `commands/`, `templates/`, and (where applicable) `recipes/`.
+- **`arckit-au`** Australian Federal / DISP-supplier overlay — 8 commands (`au-e8-posture`, `au-pia`, `au-dss`, `au-ism-controls`, `au-ndb-playbook`, `au-pspf`, `au-ai-assurance`, `au-disp-attestation`), 8 templates, and the `au-federal` recipe (35 targets, 9 waves). 8 new doc-type codes registered in `arckit-claude/config/doc-types.mjs` (`AUE8`, `AUISM`, `AUPIA`, `AUNDB`, `AUDSS`, `AUPSPF`, `AUAIA`, `AUDISP`). Adds `AU` regime; also adds `CA` retroactively (CA shipped doc-types in v4.15.0 but was missing from `REGIMES`). Domain co-maintainer: @royster70. Supersedes #441.
+
+### Changed
+
+- `arckit-build` skill: new three-tier recipe lookup precedence — project override → core plugin → sibling community plugins via glob.
+- `scripts/converter.py` walks all 6 plugin source dirs and merges into one extension output per non-Claude format. Non-Claude extensions stay monolithic per the v5 design.
+- `scripts/bump-version.sh` updates 6 plugin manifests + `marketplace.json` (all `.plugins[]` entries) instead of just one.
+- `docs/RELEASING.md` updated with multi-plugin release flow.
+- `CONTRIBUTING.md` adds a two-part PR rule for new doc-types (command in community plugin, doc-type registration in core).
+
+### Note on doc-types
+
+All doc-type codes remain in `arckit-claude/config/doc-types.mjs` — community plugins ship commands and recipes only. This keeps `validate-arc-filename.mjs` single-sourced.
+
+### Note on plugin dependencies (Claude Code v2.1.110+)
+
+All 6 community plugins (`arckit-uae`, `arckit-fr`, `arckit-ca`, `arckit-eu`, `arckit-at`, `arckit-au`) declare an exact (`=`) dependency on the `arckit` core plugin. Installing any community plugin auto-installs core; uninstalling with `--prune` cleans it up. The exact pin keeps the 6 plugins shipping as a coherent set — `scripts/bump-version.sh` updates `.version` and `.dependencies[arckit].version` in lockstep on every release.
+
+## [4.22.0] - 2026-05-17
+
+### Added
+
+- **New build recipe: `uae-agentic-transformation`**. Focused 24-month playbook for the 23 April 2026 UAE Cabinet framework targeting 50% of federal services on agentic AI by April 2028. Distinct from the broader `uae-federal-ai` recipe — ADRs reshaped around agentic architecture (orchestration framework, human-in-the-loop boundaries, foundation-model selection, observability for autonomous decisions, kill-switch / rollback), `UAE_ZERO_BUREAUCRACY` positioned as the framework-mandated process-redesign artefact, `PLAN` + `ROADMAP` timeboxed to the 24-month window with the 50%-portfolio target. Includes all 12 UAE community commands plus core ArcKit governance; uses canonical doc-type codes from `config/doc-types.mjs`. 49 targets.
+
+## [4.21.0] - 2026-05-15
+
+### Added
+
+- **PostCompact hook re-injects project context** (#475). Companion to `keep-coding-instructions: true` — static command bodies were already preserved across `/compact`, but dynamic filesystem-derived state (active projects, ARC-* artefacts, external docs, global policies) was lost. The new `postcompact-rehydrate.mjs` hook closes that gap by reusing `buildProjectContext` from the existing context-injection builder.
+- **Effort tier captured + surfaced** (#471). `session-learner.mjs` and `telemetry.mjs` now read the session's effort tier from hookInput `effort.level` or `$CLAUDE_EFFORT` (Claude Code v2.1.133+); recorded per-event in the telemetry JSONL, per-session in `sessions.md` and `docs/telemetry.json`. The `/arckit:pages` dashboard's Session Telemetry panel gains an "Effort mix" row and a per-session effort chip.
+- **Autoresearch explicit stop conditions** (#474). The optimisation loop now self-terminates on score-target hit (`best >= 9.5`), iteration budget (`iter >= 30`), or double-plateau detection. No more loop-forever — token budget bounded by default; thresholds tunable inline.
+- **Cross-reference linter** (#464). `scripts/check_references.py` validates `${CLAUDE_PLUGIN_ROOT}` paths, `handoffs[].command` slugs, and `${user_config.KEY}` keys against disk. Wired into `.github/workflows/lint-markdown.yml`.
+- **MCP catalogue** (#465). Documentation listing the 5 bundled MCP servers, what they're for, and how each plugs into the relevant ArcKit command. Closes #442 item 15.
+
+### Changed
+
+- **Hook config migrated to `args: string[]` exec form** (#467). All 16 entries in `arckit-claude/hooks/hooks.json` use the v2.1.139 exec form (`command: "node"` + `args: ["..."]`) instead of the legacy shell-string. The harness now execs `node <path>` directly, eliminating shell-quoting and metacharacter pitfalls in `${CLAUDE_PLUGIN_ROOT}`-substituted paths.
+- **PostToolUse hooks set `continueOnBlock: true`** (#470). The 4 observational PostToolUse entries (`update-manifest`, `provenance-stamp` ×2, `telemetry`) can no longer derail the user's turn if they ever emit `decision: block`. Block-as-gate semantics retained for the genuine PreToolUse / UserPromptSubmit guards.
+- **Minimum Claude Code version bumped to v2.1.139** (from v2.1.129). Required by the `args` exec form and `continueOnBlock`. Also picks up v2.1.133 subagent skill discovery fix (relevant to ArcKit's 13 agents) and v2.1.136 SessionStart env staleness fix.
+- **Docs: `/fast` Opus 4.7 default + `MCP_TOOL_TIMEOUT` env var** (#473). CLAUDE.md captures the v2.1.142 `/fast` default change. New "Optional: MCP per-request timeout" section in `docs/guides/mcp-servers.md` recommends `MCP_TOOL_TIMEOUT=300000` for corporate networks with TLS-inspecting proxies; one-line cross-references added to each of the 3 cloud-research guides.
+- **AGENTS.md repository guidelines** (#463). New top-level `AGENTS.md` documenting the agent-development conventions used in this repo.
+
+### Site
+
+- **Launch ArcKit FDE** (#460), nav/footer link to FDE (#458), GOV.UK Design System credit removed from footers (#459), opening-paragraph polish + "agentic AI" positioning (#461, #462).
+
+## [4.20.3] - 2026-05-11
+
+### Fixed
+
+- **Plugin `monitors` key wrapped under `experimental` block** (#453). Claude Code v2.1.129 moved the `monitors` (and `themes`) keys under a top-level `experimental` block in plugin manifests. ArcKit's `stale-artifact-scan` background monitor was declared at the top level and would not load on v2.1.129+ clients. The manifest is now compliant with the new schema.
+- **`validate-arc-filename` hook now soft-blocks via `{decision, reason}` JSON** (#454). The unknown-doc-type-code rejection path previously used `process.exit(2)` + stderr, surfacing as a hard permission error visible only to the user. The model received nothing actionable and could not self-correct. Migrated to the modern soft-block pattern (already used by `score-validator.mjs`) so Claude is told the rejection reason — including the offending filename, the valid-codes list, and an explicit "rename and retry" instruction — and can self-correct on the next turn without human intervention.
+
+### Changed
+
+- **Minimum Claude Code version bumped to v2.1.129** (from v2.1.121). Required by the `monitors`-under-`experimental` migration above. Also picks up the v2.1.129 fix to `ENABLE_PROMPT_CACHING_1H` (which was silently downgrading the 1-hour prompt cache TTL back to 5 minutes on earlier versions). The SessionStart version-check hook and the README/CLAUDE.md/PLATFORM-COMPARISON.md docs all reflect the new floor.
+
+## [4.20.2] - 2026-05-11
+
+### Changed
+
+- **Wardley Mermaid rendering now targets Mermaid 11.15.0.** Generated ArcKit pages load `mermaid@11.15.0`, picking up the latest `wardley-beta` fixes for unquoted hyphenated component names and Wardley label text handling. Wardley guidance and templates now describe `wardley-beta` as available from Mermaid 11.14.0 onward while continuing to quote non-simple names for cross-version compatibility.
+
+## [4.20.0] - 2026-05-10
+
+### Added
+
+- **Codex plugin bundle with lifecycle hooks.** `arckit-codex/` now ships a Codex plugin manifest, MCP config, hook wiring, and a native hook runner for context injection, prompt secret checks, file guardrails, MCP approval policy, artifact graph context, provenance stamping, manifest maintenance, and Stop-session memory.
+- **Codex marketplace metadata and CI.** Adds `.agents/plugins/marketplace.json` pointing at the standalone `tractorjuice/arckit-codex` repo, plus a focused Codex plugin workflow that checks hook syntax, CLI syntax, and Codex extension tests.
+- **Codex schemas and validators.** The Codex bundle now includes deterministic handoff schemas, scoring rubrics, `validate-handoff.mjs`, and `owm-to-mermaid.mjs` so research and Wardley workflows work in standalone extension installs.
+
+### Changed
+
+- **Extension generation now preserves Codex-native behavior.** The converter generates Codex plugin metadata, Codex MCP config, hook-enabled `config.toml`, hyphen-safe skill names, rewritten template override paths, and refreshed standalone extension assets.
+- **Release tooling now fails on extension push errors.** `scripts/push-extensions.sh` now treats commit or push failures as real failures instead of reporting a false success.
+
+### Fixed
+
+- **Codex CLI project scaffolding now installs hooks and validators.** `arckit init --ai codex` copies `.codex/hooks/`, `.arckit/schemas/`, and `.arckit/scripts/validate-handoff.mjs`, and keeps `.codex/agents/**` and `.codex/hooks/**` unignored.
+
+## [4.19.2] - 2026-05-07
+
+### Changed
+
+- **`/arckit:wardley` now invokes a vendored OWM → wardley-beta converter instead of regenerating Mermaid syntax by hand.** Adds `arckit-claude/scripts/owm-to-mermaid.mjs` (363 lines, kebab-cased). The script originated as `tests/mermaid-wardley/convert.mjs` in this repo (PRs #339, #340, #341, #344), was untracked in #348, and evolved at `tractorjuice/wardleymap_math_model` with explicit-block pipeline handling and evolution-stage quoting before being re-vendored here. The wardley command's "Mermaid Wardley Map (Enhanced)" section (previously 30 lines of fragile syntax-translation rules) is replaced with a three-step procedure: write OWM to a temp file, run `node ${CLAUDE_PLUGIN_ROOT}/scripts/owm-to-mermaid.mjs <file>`, paste stdout verbatim into the `<details>` block. Sourcing decorators (`build`/`buy`/`outsource`/`inertia`) flow from OWM directives the converter already reads. Hand-rolled `wardley-beta` was brittle — the parser eagerly tokenises hyphens as `->`, treats bare numeric words (`NIS 2031`) as numeric literals, and matches keywords (`label`, `evolve`, `pipeline`) at any word boundary. The converter sidesteps all of these by emitting every name as a double-quoted STRING.
+
+### Notes
+
+- Claude-only this release. Non-Claude extensions (Codex / Gemini / OpenCode / Copilot) of `/arckit:wardley` reference `${CLAUDE_PLUGIN_ROOT}/scripts/owm-to-mermaid.mjs`, which gets path-rewritten by `scripts/converter.py` but the script itself is not yet copied to those extensions (the converter currently propagates `scripts/{bash,python}` only). Follow-up patch will widen the converter's copy list to include `arckit-claude/scripts/`.
+
+## [4.19.1] - 2026-05-07
+
+### Fixed
+
+- **Auto-allow hook now matches `gov-reuse` tempfiles.** The v4.18.1 broadened regex in `allow-plugin-internals.mjs` accepted tempfile patterns like `/tmp/grants-handoff*.json` and `/tmp/datascout-handoff-energy.json`, but its agent-name segment `[a-z][a-z0-9]*` excluded hyphens — so `/tmp/gov-reuse-handoff*.json` (and any future hyphenated agent name) failed to match, triggering a permission prompt for every per-capability dispatch in `/arckit:gov-reuse`. Widened to `[a-z][a-z0-9-]*` to allow hyphens in the agent name while still rejecting paths starting with hyphen, hidden files, and other negative cases. Verified against 18 path patterns including `/tmp/gov-reuse-handoff-appointment-booking.json`, `/tmp/aws-research-handoff.json`, `/tmp/gov-code-search-handoff.json` (positive) and `/etc/passwd`, `/tmp/-handoff.json`, hidden files (negative).
+
+## [4.19.0] - 2026-05-07
+
+### Added
+
+- **`/arckit:gov-reuse` reader/orchestrator/writer split** (Claude Code plugin only — non-Claude extensions remain at the prior single-tier shape until a follow-up release). Third command after `/arckit:datascout` (v4.16.0) and `/arckit:grants` (v4.18.0) to adopt the three-tier subagent pattern. Reader (`arckit-gov-reuse-reader`, `WebFetch` + `mcp__govreposcrape__search_uk_gov_code` only — no Write/Edit/Bash/Agent/WebSearch) searches govreposcrape per capability and fetches GitHub repo evidence. Orchestrator validates each reader payload via `validate-handoff.mjs`, scores deterministically from the YAML rubric, assigns a reuse strategy band (`Fork` / `Library` / `Reference` / `None`) by score thresholds (`>= 80 / 60-79 / 40-59 / < 40`) with licence overrides for AGPL/Proprietary/Unlicensed → forced `None`. Writer (`arckit-gov-reuse-writer`, `Read`/`Write`/`Edit` only) renders the GOVR artefact and spawns one tech-note per Fork or Library candidate.
+- **Gov-reuse handoff schema** (`arckit-claude/schemas/gov-reuse-handoff.schema.json`). 19 licence types in the allowlist, 22 languages, 28 framework hints, 15 installation methods. No `score`, `rank`, or `recommended_strategy` field — there is nowhere for a judgement to land.
+- **Gov-reuse scoring rubrics** (`arckit-claude/schemas/scoring-rubrics/gov-reuse-{generic,uk-gov}.yaml`). 5 weighted criteria summing to 100: `license_compatibility` 25 / `code_quality` 20 / `documentation` 20 / `tech_stack_alignment` 20 / `activity_maintenance` 15. UK-Gov overlay bumps OGL above MIT/Apache and adds a `trusted_org_bonus` (alphagov, NHSDigital, dfe-digital, hmrc-digital, ministryofjustice, ONSdigital, etc.) applied additively to the `code_quality` per-criterion score before weighting.
+- **CI coverage for gov-reuse schema.** New `tests/plugin/test_validate_gov_reuse_handoff.mjs` runs 2 valid + 5 reject fixtures (extra-property, oversized-summary, off-allowlist licence, injection-inflated-score, injection-extra-language) through the shared `validate-handoff.mjs`. Wired into `.github/workflows/lint-markdown.yml`.
+
+### Removed
+
+- Single-tier `arckit-claude/agents/arckit-gov-reuse.md` (Claude plugin only). The orchestrator role moved to the slash command body; reader and writer live in their own subagent files.
+
+## [4.18.2] - 2026-05-07
+
+### Added
+
+- **`inject-agent-context.mjs` PreToolUse hook** — closes the gap where ArcKit subagents dispatched via the `Agent` tool ran without project context. UserPromptSubmit hooks fire only on real user prompts, so any orchestrator-style subagent whose body assumed "the ArcKit Project Context hook has already detected all projects, artifacts" silently lost that context when invoked indirectly. The new PreToolUse hook (matcher: `Agent`) builds the same context block as `arckit-context.mjs` and prepends it to `tool_input.prompt` via `updatedInput` (the only PreToolUse return-field that propagates into the dispatched subagent's context — `additionalContext` stays in the parent thread). Scoped to `arckit-*` subagent_types; skips reader/writer subagents (their schema-validated JSON payloads must stay clean) and skips general-purpose / Plan / Explore / claude-code-guide / etc. (no spam).
+- **`project-context-builder.mjs`** — extracted the project-scanning logic from `arckit-context.mjs` into a shared module so both the UserPromptSubmit hook and the new PreToolUse hook produce identical context blocks.
+
+## [4.18.1] - 2026-05-07
+
+### Fixed
+
+- **Auto-allow hook now matches per-bucket grants tempfiles.** `allow-plugin-internals.mjs` previously only matched `/tmp/datascout-handoff*.json` and `/tmp/arckit-{name}-handoff*.json`, but at runtime the LLM names per-funder-category dispatch tempfiles like `/tmp/grants-handoff-open-data.AbCdEf.json` (suffixing the bucket name for traceability across multiple Bash invocations). The regex now broadens to `(?:arckit-)?[a-z][a-z0-9]*-handoff(?:-[a-z][a-z0-9-]*)?...`, accepting an optional `arckit-` prefix and an optional hyphenated qualifier between `-handoff` and the random tail. Read auto-allow remains scoped to /tmp and read-only.
+
+## [4.18.0] - 2026-05-07
+
+### Added
+
+- **`/arckit:grants` reader/orchestrator/writer split.** Second command (after `/arckit:datascout` in v4.16.0) to adopt the three-tier subagent pattern documented in `arckit-claude/agents/READER-PATTERN.md`. The reader (`arckit-grants-reader`, WebSearch+WebFetch only, no Write/Edit/Bash/Agent) fetches programme evidence per `funder_category` bucket; the orchestrator (in the slash-command body, since plugin subagents cannot dispatch further subagents) validates the reader's JSON via `validate-handoff.mjs`, scores deterministically from a YAML rubric, then dispatches the writer (`arckit-grants-writer`, Read+Write+Edit only) which renders the GRNT artefact and one tech-note per scored programme.
+- **Grants handoff schema** (`arckit-claude/schemas/grants-handoff.schema.json`). 15-value `funder_type` allowlist, allowlist enums for organisation type / sector / geography / application status / complexity. No `score`, `rank`, or `recommendation` field — there is nowhere for a judgement to land in the schema even if the reader is overridden.
+- **Grants scoring rubrics** (`arckit-claude/schemas/scoring-rubrics/grants-{generic,uk-gov}.yaml`). Six criteria summing to 100: `eligibility_fit` 35 (composite of organisation type / sector overlap / TRL band) / `funding_size_fit` 20 / `timing_fit` 15 (status + deadline proximity) / `complexity_burden` 10 / `historic_traction` 10 / `match_funding_burden` 10. UK-Gov overlay adds `funder_type_bonus` (UKRI / Innovate UK / NIHR / DSIT / DASA preferred) and `geography_bonus` (uk-wide preferred) as additive adjustments to the eligibility_fit per-criterion score before weighting.
+- **CI coverage for the grants schema.** New `tests/plugin/test_validate_grants_handoff.mjs` (mirrors the datascout validator test) runs 2 valid + 5 reject fixtures (extra-property, oversized-field, off-allowlist funder_type, injection-inflated-score, injection-extra-org-type) through the shared `validate-handoff.mjs`. Wired into `.github/workflows/lint-markdown.yml`.
+
+### Removed
+
+- Single-tier `arckit-claude/agents/arckit-grants.md` and the stale generated extension agent files (`arckit-codex/agents/arckit-grants.{md,toml}`, `arckit-copilot/agents/arckit-grants.agent.md`, `arckit-gemini/agents/arckit-grants.md`, `arckit-opencode/agents/arckit-grants.md`). The orchestrator role lives in `arckit-claude/commands/grants.md` from this release onward.
+
+## [4.17.1] - 2026-05-06
+
+### Fixed
+
+- **`/arckit:pages` now enumerates data-source profiles** introduced in v4.17.0. Wired the new `data-sources/{provider-slug}-profile.md` files through `sync-guides.mjs` (manifest scan + count + llms.txt entries), `pages-template.html` (sidebar section + search index category), and `commands/pages.md` (KPI table + manifest schema docs).
+
+## [4.17.0] - 2026-05-06
+
+### Added
+
+- **Datascout spawns per-source profile files.** `/arckit:datascout` now produces one `projects/{P}-{NAME}/data-sources/{provider-slug}-profile.md` per scored data source (in addition to the main DSCT artefact), mirroring the `Spawned Knowledge` pattern from `/arckit:research`. Each profile carries the full reader-extracted evidence with citation links, the deterministic weighted score breakdown, and the project requirement IDs that pointed to that source. Re-running datascout on the same project applies merge rules (preserving narrative prose, replacing factual evidence + scores with the current run, appending project references). New template at `arckit-claude/templates/data-source-profile-template.md`.
+
+## [4.16.6] - 2026-05-06
+
+### Fixed
+
+- **Telemetry now collects in plugin-only test repos.** `telemetry.mjs` and `session-learner.mjs` were silently exiting when `.arckit/` didn't exist — but plugin-only installs (test repos that use `extraKnownMarketplaces` and never run `arckit init`) only have `projects/`. Both hooks now treat either directory as a valid "ArcKit project" indicator and create `.arckit/memory/` on demand for the first telemetry write.
+
+## [4.16.5] - 2026-05-06
+
+### Fixed
+
+- **Auto-allow hook now matches `${CLAUDE_PLUGIN_ROOT}` literal in commands** (was previously only matching the resolved absolute path; the orchestrator emits the env-var form which Claude Code passes through unexpanded to the hook).
+- **Auto-allow `Read` of `/tmp/datascout-handoff*.json` tempfiles** so the orchestrator can re-inspect its own validator payloads without per-file prompts.
+- **Forbid orchestrator from writing ad-hoc helper scripts.** LLM was hallucinating `dsct-score.mjs`, `dsct-build-writer-input.mjs`, etc. — added an explicit guardrail. All scoring math and payload assembly happens directly in conversation; the only bundled executables are the validator and `scripts/bash/*.sh` helpers.
+
+## [4.16.4] - 2026-05-06
+
+### Fixed
+
+- **Auto-allow hook for plugin-internal Read/Bash now actually fires.** v4.16.2 registered `allow-plugin-internals.mjs` under `PermissionRequest`, but that event only fires for some tools and only when a permission dialog is about to show. Switched to `PreToolUse` with `permissionDecision: "allow"` in `hookSpecificOutput` — the documented pattern for blanket auto-allow on built-in Read/Bash. The datascout slash command's plugin-internal `Read`s and `Bash` invocations of bundled scripts now auto-approve.
+
+## [4.16.3] - 2026-05-06
+
+### Fixed
+
+- **Datascout orchestrator moved from agent file to slash command.** Earlier 4.16.x releases placed orchestration in a subagent that dispatched reader/writer subagents — but Claude Code plugins forbid nested subagent dispatch (*"Subagents cannot spawn other subagents"*), so users hit *"Agent tool unavailable"* errors. Resolution: orchestration moved to `arckit-claude/commands/datascout.md` (the slash command runs in the main thread where `Agent` works). Reader and writer subagents and all security allowlists unchanged. `arckit-claude/agents/arckit-datascout.md` deleted.
+
+## [4.16.2] - 2026-05-06
+
+### Added
+
+- `arckit-claude/hooks/allow-plugin-internals.mjs` — `PermissionRequest` hook that auto-approves the plugin's own internal Read/Bash patterns (any file under `${CLAUDE_PLUGIN_ROOT}/`, plus invocations of the bundled validator and `scripts/bash/*.sh` helpers). Stops the per-session permission prompts that the datascout orchestrator (and any future helper-script-using command) was triggering; non-plugin Read/Bash still falls through to the normal prompt.
+
+## [4.16.1] - 2026-05-06
+
+### Fixed
+
+- **datascout: validator no longer requires `npm install` in plugin cache.** Rewrote `validate-handoff.mjs` as a pure-Node JSON Schema 2020-12 partial validator with zero npm dependencies, and removed `ajv` / `ajv-formats` from runtime deps. v4.16.0 had them in `package.json` but the plugin marketplace doesn't run `npm install`, so users hit `Error: Cannot find module 'ajv'` on first `/arckit:datascout` run. Also drops the orchestrator's "ajv-missing → legacy single-agent fallback" path, which had been surfacing a confusing secondary error about `.arckit/templates/`.
+
+## [4.16.0] - 2026-05-06
+
+### Security
+
+- **datascout reader/orchestrator/writer split (#442 item 1).** `arckit-datascout` is now a three-tier agent: a reader subagent fetches external content with allowlist `WebSearch/WebFetch/MCP/Read` only (no `Write`/`Bash`/`Agent`), an orchestrator validates each reader's output against a JSON Schema and scores deterministically using a YAML rubric, and a writer subagent holds the only `Write` tool. Falls back to legacy single-agent mode when ajv is not installed. New files: `arckit-claude/agents/arckit-datascout-{reader,writer}.md`, `arckit-claude/agents/READER-PATTERN.md`, `arckit-claude/schemas/datascout-handoff.schema.json`, `arckit-claude/schemas/scoring-rubrics/{generic,uk-gov}.yaml`, `arckit-claude/scripts/validate-handoff.mjs`. New deps: `ajv` ^8, `ajv-formats` ^3.
+
+### Added
+
+- `arckit-claude/agents/READER-PATTERN.md` — reference doc for applying the three-tier split to other research agents.
+- `arckit-claude/scripts/validate-handoff.mjs` — shared Node + ajv validator for any future handoff schema.
+
+- **Prompt-injection hardening across all 10 research agents (#442).** Adopts patterns from `anthropics/financial-services` reference plugins:
+  - **Tools allowlist (item 18).** Every research agent (`research`, `datascout`, `grants`, `aws-research`, `azure-research`, `gcp-research`, `gov-reuse`, `gov-code-search`, `gov-landscape`, `framework`) migrated from `disallowedTools: ["Edit"]` (denylist) to explicit `tools:` allowlist. New tools added to the Claude Code harness in future versions no longer auto-grant to existing agents. MCP entries enumerated per server (glob unsupported in plugin agent frontmatter — verified against current Claude Code docs).
+  - **Guardrails section (item 1, partial).** Each agent body now opens with `## Guardrails` covering three primitives: untrusted-input boundary (web/MCP results never executed as instructions), citation discipline (every figure traceable to a URL or `[UNSOURCED]`), and human-decision boundary (named accountable officer per agent — SRO for research, bid director for grants, architecture board for cloud-research, etc.). The third financial-services primitive — write-tool isolation — defers to the future reader/orchestrator/writer split (#442 item 1, full).
+  - **`What you produce` output contract.** Each agent body now front-loads its deliverable spec — "Given X, you deliver: 1, 2, 3" — replacing the scattered output description that previously lived inside `Your Core Responsibilities` and the Process steps.
+  - **`Toolchain` trailing index.** Each agent body now ends with a flat list of templates, helper scripts, MCP servers, external tools, and related ArcKit commands — the equivalent of financial-services' `Skills this agent uses` adapted to ArcKit's reality (our agents don't dispatch sub-skills).
+  - **Converter:** `tools` added to `CLAUDE_ONLY_AGENT_FIELDS` so the allowlist strips cleanly when generating Codex/OpenCode/Gemini/Copilot/Paperclip extensions (which have their own tool models). `Guardrails`, `What you produce`, and `Toolchain` body sections propagate unchanged to all 6 downstream formats.
+  - **CLAUDE.md:** corrected outdated guidance — `tools` is now a valid plugin agent frontmatter field (allowlist), with `disallowedTools` applied first then the allowlist resolved against what remains.
+
+## [4.15.2] - 2026-05-05
+
+Documentation-only patch.
+
+### Fixed
+
+- **Citation traceability now covers MCP queries and web fetches (#283, #437).** `arckit-claude/references/citation-instructions.md` previously only covered files under `external/`, `policies/`, `vendors/`, leaving the External References section empty for the 10 research agents (`gov-reuse`, `research`, `datascout`, `aws-research`, `azure-research`, `gcp-research`, `gov-code-search`, `gov-landscape`, `grants`, `framework`) whose evidence is mostly MCP-sourced or web-fetched. The same Document Register / Citations / Unreferenced Documents tables now cover three source types: **Document** (unchanged), **MCP Query** (per-server prefix `GRSC` / `AWSK` / `MSL` / `GDK` / `DC` plus `Q`-index, one row per unique query), and **Web URL** (`WEB-N`, one row per unique fetched URL). WebSearch remains exploratory and does not produce citations. Two new categories added: `Reuse Evidence` and `Market Evidence`. No template changes — the existing 5-column structure is reused; only the per-cell semantics extend. No agent file changes — all 10 research agents already point at `citation-instructions.md` via a shared one-line directive. Extension copies regenerated by `scripts/converter.py`.
+
+## [4.15.1] - 2026-05-05
+
+Documentation-only patch.
+
+### Documentation
+
+- **Remote Control + push notifications adoption (#426, closes #369).** Adds a "Long runs: Remote Control + push notifications" section to the six research-heavy command guides (`research`, `datascout`, `aws-research`, `azure-research`, `gcp-research`, `grants`) — each tailored to that command's typical decision points. Adds a "Phone pings via Remote Control" subsection to `autoresearch.md`, sibling to the existing Monitor guidance, oriented at overnight runs paired with `ENABLE_PROMPT_CACHING_1H=1`. Adds a "Remote Control + push notifications (user-facing)" section to `CLAUDE.md` under the Monitor Tool docs, including pairing with the `stale-artifact-scan` monitor. Floor reference correctly states v2.1.121 (current minimum) covers the v2.1.110 RC requirement.
+
+## [4.15.0] - 2026-05-05
+
+Ships the Canada Federal Overlay alongside the v4.14.0 platform-capability adoption from earlier the same day.
+
+### Added
+
+- **Canada Federal Overlay (community)** — 12 new `ca-*` commands covering FITAA, PIA, ATIP, AIA, Charter, ITSG-33, SOIA, GC sovereign cloud residency, GC Digital Standards, Official Languages Act, federal procurement (PSPC + PSAB), and First Nations OCAP®.
+- 12 new templates (`.arckit/templates/ca-*-template.md` plus plugin mirrors).
+- 12 new guides (`docs/guides/ca-*.md` plus plugin mirrors).
+- 12 new type codes registered in `arckit-claude/config/doc-types.mjs`: `FITAA`, `PIA`, `ATIP`, `AIA`, `CHRT`, `ITSG`, `SOIA`, `CACR`, `DIGSTD`, `OLA`, `PROC`, `OCAP`.
+- `ca-federal-fitaa` build recipe with execution chains and Mermaid flow diagrams.
+- Codex / OpenCode / Copilot / Paperclip extension formats regenerated.
+
+### Changed
+
+- Total command count: 104 → 116 (70 official + 46 community).
+
+## [4.14.0] - 2026-05-05
+
+Adopts Claude Code v2.1.117–v2.1.128 high-value capabilities (#427). Plugin minimum bumped to **v2.1.121**; plugin auto-update applies the new floor on next `claude plugin update`.
+
+### Added
+
+- **MCP `alwaysLoad` on `aws-knowledge` and `microsoft-learn` (#428, v2.1.121+).** Skips tool-search deferral so research commands see the MCP tools on turn 1 of `/arckit:aws-research` and `/arckit:azure-research`. Removes a discovery round-trip per session.
+- **PostToolUse `hookSpecificOutput.updatedToolOutput` on `provenance-stamp.mjs` and `update-manifest.mjs` (#429, v2.1.121+).** The model now sees a one-line summary of what each silent file-mutating hook did — effort requested vs. effective (with downgrade reason if any), manifest sync confirmation. Closes a long-standing visibility gap; the auditable downgrade signal that issue #407 was filed for is now in-band, not just stamped on disk.
+- **Session telemetry — `telemetry.mjs` hook + session-learner aggregation (#430, v2.1.84 / v2.1.119+).** Captures `duration_ms` for every tool call, `mcp__govreposcrape__*` calls (server, tool, sanitised args), and `TaskCreated` agent spawns. Aggregated into a one-line `**Telemetry:**` summary on every `sessions.md` entry — p50/p95 latency, top-3 agents, MCP call counts.
+- **Dashboard surface for telemetry (#431).** Two new panels on the Architecture Governance Dashboard — *Session Telemetry* (aggregate KPIs across last 10 sessions) and *Recent Sessions* (last 5 with detail). Fed by `docs/telemetry.json` written by `session-learner.mjs` when `docs/` exists.
+- **Community-recipes call article (#425).** "Wanted: Community Recipes" published at `docs/articles/` with hero PNG.
+
+### Changed
+
+- **Documented Claude Code minimum bumped from v2.1.117 to v2.1.121 (#430).** `version-check.mjs` SessionStart hook updated; warning copy lists the four new feature dependencies (`alwaysLoad`, `updatedToolOutput`, `duration_ms`, `claude plugin tag`).
+- **Release flow uses `claude plugin tag --dry-run` (#428, v2.1.118+).** Validates plugin/marketplace version agreement before `git tag` runs — catches version drift across the 15 version files. `claude plugin prune --dry-run` also documented for orphaned-dependency cleanup.
+- **`scripts/converter.py` filters `alwaysLoad` from generated Codex `config.toml` (#428).** Claude-only MCP fields no longer leak into other extensions; introduces a `CLAUDE_ONLY_MCP_FIELDS` set for future Claude-only keys.
+- **Session housekeeping (#419).** Memory log cleanup, plugin enablement, and `.gitignore` refinement.
+
+## [4.13.1] - 2026-05-03
+
+Same-day follow-up to v4.13.0. All additive enhancements to the build harness.
+
+### Added
+
+- **`uae-federal-ai` recipe (#414).** Third built-in recipe for UAE Cabinet agentic AI decree compliance: 48 targets, all 12 UAE community commands, integrated research wave.
+- **Research wave on `uk-saas` and `uk-mod-sovereign` (#417).** Default-on per-project research targets (RESEARCH, AWS, Azure, GCP, GOV_REUSE for UK only, DATASCOUT optional). Both recipes now ship 38 targets each.
+- **`ORG_RESEARCH` upstream target (#417, #414 amendment).** New first-wave target on all three built-in recipes. Researches the target organisation once per repo, output to `projects/000-global/research/`, shared across every project.
+
+### Documentation
+
+- `/arckit:build` listed in `commands.html`, `guides.html`, and `DEPENDENCY-MATRIX.md` (#416).
+- `sitemap.xml`, `llms.txt`, and `getting-started.html` refreshed for v4.13.0+ (#415).
+- Getting-started recipe-count banner updated to reflect the post-research-wave shape.
+
+## [4.13.0] - 2026-05-03
+
+### Added
+
+- **`/arckit:build` parallel build harness (#410).** New plugin skill and slash command for end-to-end ArcKit artefact generation. Reads a YAML recipe, dispatches one subagent per target per wave in parallel, commits each wave as one atomic git commit, and persists progress to `projects/{P}/.arckit/state.json` for resumability. Ships two built-in recipes: `uk-saas` (31 targets) and `uk-mod-sovereign` (32 targets). Custom recipes go in `.arckit/recipes/{name}.yaml`. Claude Code only — depends on parallel Agent tool dispatch which other targets do not support.
+- **Provenance stamping hook (#409).** `provenance-stamp.mjs` injects a machine-readable `## Build Provenance` block into every ArcKit artefact, recording build recipe / wave / target plus requested vs effective effort levels. Auditable trail for governance reviewers.
+- **Build harness launch article (#411).** New essay at `docs/articles/2026-05-03-build-harness-parallel-architecture-generation.md` with hero image. Surfaced on `articles.html` and `index.html`.
+- **`uk-mod-sovereign` recipe.** Sovereign / air-gapped variant for MOD and accredited environments. Replaces civilian SbD with MOD Secure by Design, adds JSP 936 AI assurance, drops Service Standard assessment, rewrites all eight ADR topics for sovereign deployment.
+
+### Fixed
+
+- **CLAUDE.md ADR/DIAG path documentation (#408).** The project structure tree now shows ADRs in `decisions/` and diagrams in `diagrams/` subfolders, matching what `/arckit:adr` and `/arckit:diagram` actually produce.
+
+## [4.12.3] - 2026-05-01
+
+### Fixed
+
+- **`/arckit:traceability` actually now reports correct coverage (#389).** Previous v4.12.2 attempt fixed regex namespace collisions but the actual bug was elsewhere: `formatTraceability` reads `node.reqIds` for every non-REQ artifact to build the coverage `refMap`, but `node.reqIds` is only assigned by `scanAllArtifacts` when the caller passes `withNodeMetadata: true`. The traceability recipe did not request that flag, so `reqIds` was always `undefined` and `refMap` always empty. Verified end-to-end against the issue's reproduction repo: coverage now reports 41 of 53 requirements (77%) with proper citation lists per requirement.
+
+## [4.12.2] - 2026-05-01
+
+### Fixed
+
+- **`/arckit:traceability` reported 0% coverage on legacy projects with 1-2 digit REQ IDs (#389).** The v4.12.1 fix loosened the REQ-doc heading extractor but kept the universal `REQ_ID_PATTERN` strict at `\d{3}` to avoid namespace collisions with non-REQ artifacts. Side-effect: cross-references like `BR-1, FR-3, NFR-SEC-7` in `RSCH` / `RISK` / `STKE` / `SOBC` / `WARD` / UAE-overlay compliance assessments were not extracted, so `node.reqIds` came back empty and `formatTraceability` reported zero coverage even when 14 sibling artifacts genuinely cited the requirements. Universal scanner now also accepts `\d{1,3}`.
+- **`templates/azure-research-template.md`** — Azure Security Benchmark "Backup & Recovery (BR)" row renamed to `BCK-N` to remove the namespace collision with Business-Requirement IDs. Previously `BR-1, BR-2, BR-3` in the ASB control table would, after the loose-pattern fix, be picked up as REQ cross-references. AWS and GCP research templates checked and confirmed clean (no equivalent collisions).
+
+### Known limitations
+
+- `templates/fr-anssi-carto-template.md` line 144 still uses `INT-01` for network-interconnection IDs, which collides with the REQ Integration namespace. Currently affects only French ANSSI cartography artifacts. Will be addressed in a follow-up.
+
+## [4.12.1] - 2026-05-01
+
+### Fixed
+
+- **Templates aligned to 3-digit REQ IDs** — `requirements-template.md`, `traceability-matrix-template.md`, `hld-review-template.md`, and `jsp-936-template.md` previously used `BR-1` / `FR-1` / `NFR-P-1` placeholder form. 24 of 27 surveyed test-repo REQ documents already use 3-digit zero-padded form (`BR-001`); only the most recent 3 followed the templates literally and broke the hook. Templates now consistently use the 3-digit form. Affects all template copies (`arckit-claude`, `.arckit`, and the five extension templates regenerated by `scripts/converter.py`). `azure-research-template.md` (Azure Security Benchmark `BR-N` namespace) and `fr-anssi-carto-template.md` (`INT-NN` network-interconnection IDs) were intentionally left unchanged — different namespaces (#386).
+- **`hooks/hook-utils.mjs`** — `extractRequirementDetails` heading regex now accepts 1-3 digit numeric suffixes (`### BR-1:`, `#### FR-12:`, `### BR-001:`). Previously hardcoded `\d{3}`, which silently dropped requirements from any REQ document using non-padded IDs — leaving `/arckit:traceability` with an empty graph and forcing the manual fallback. The universal `REQ_ID_PATTERN` scanner stays strict at `\d{3}` to avoid false positives in non-REQ artifacts that use the same prefix in a different namespace (#386).
+- **`hooks/graph-inject.mjs`** — `formatTraceability` now emits a diagnostic message when no requirements can be extracted from a project that has artifacts, instead of returning `null` silently. The hook bail-out is now visible in the prompt context so the failure mode looks like a hook problem rather than a missing hook (#386).
+- **`hooks/graph-inject.mjs`** — `DR-\d{3}` data-requirement detector loosened to `DR-\d{1,3}` so the "missing data-model" recommendation correctly fires for projects with shorter `DR-N` IDs.
+
+## [4.12.0] - 2026-05-01
+
+### Added
+
+- **Document Map + Dashboard graph health rollups (#383).** The `/arckit.pages` dashboard now visualises the same health/coverage/compliance signals that `/arckit.navigator` and `/arckit.graph-report` compute, sourced from a shared rollup module so there is no duplicate scan.
+  - **`arckit-claude/hooks/graph-rollups.mjs`** — new shared module exporting `tagNodeHealth()`, `computeAllProjectRollups()`, and the canonical `HIGH_SEVERITY_TYPES` / `ESSENTIAL_TYPES` / `CONTEXTUAL_TYPES` / `STALE_THRESHOLD_DAYS` constants used by both `graph-inject.mjs` and `sync-guides.mjs`.
+  - **`manifest.json` enrichments** (written by `sync-guides`):
+    - `dependencyGraph.nodes[*].health = { stale, draft, orphan, ageDays }` per node.
+    - `manifest.projectHealth` block with per-project coverage %, compliance readiness %, density, recommendations (top 3), stale/draft/orphan counts.
+  - **Document Map** tints nodes by health (stale = red border, draft = amber dashed, orphan = existing dashed); legend extended with three health swatches; tooltip shows a `⚠ Stale (151d) · Draft` row when any flag is set.
+  - **New "Project Health & Next Steps" dashboard panel** renders one card per project with coverage / compliance gauges, health badges, and the top 3 recommended commands.
+  - **`docs/llms.txt`** gains an opt-in `## Project status` section — one line per project with coverage %, compliance %, draft/stale/orphan counts, and the top recommended next command. Lets external agents fetch llms.txt and answer "where is this repo at" without scraping the dashboard.
+
+### Changed
+
+- **`graph-inject.mjs` constants extracted** to `graph-rollups.mjs` (no behaviour change). All `/arckit.navigator`, `/arckit.graph-report`, `/arckit.health`, `/arckit.analyze`, `/arckit.traceability` outputs are byte-stable.
+- **`sync-guides.mjs`** now passes `{ withNodeMetadata: true }` to `scanAllArtifacts` so dependency-graph nodes carry version, owner, classification, and `reqIds`. Manifest size grows roughly 50–60% on typical projects (e.g. 80 KB → 127 KB for a 38-artifact project).
+- **Hooks guide** (`docs/guides/hooks.md` + `arckit-claude/docs/guides/hooks.md`) refreshed: the per-command `*-scan.mjs` rows that were superseded in v4.11.0 are now replaced with a single `graph-inject` row listing all seven matchers; `graph-rollups.mjs` added to the Utility Files table; `sync-guides` description updated to mention the new manifest enrichments.
+
+### Internal
+
+- All seven `pages-template.html` copies (plugin + `.arckit/templates/` + 5 generated extension copies) propagated via `python scripts/converter.py` after the plugin source change. The `.arckit/templates/` CLI fallback was 10 days behind the plugin source and has been re-synced.
+
+### Breaking changes
+
+None. Manifest schema is additive — older dashboard JS that does not read `dependencyGraph.nodes[*].health` or `manifest.projectHealth` continues to render correctly. Non-Claude distributions (Codex / Copilot / OpenCode / Gemini / Paperclip) ship the new template but do not run the hook, so `manifest.projectHealth` is absent and the new panel renders nothing — no regression. Wiring those distributions into the rollup is a separate piece of work.
+
+## [4.11.0] - 2026-05-01
+
+### Added
+
+- **`/arckit.navigator` (Live, Utility)** — project-level GPS that surfaces coverage against the essential ArcKit baseline, flags DRAFT / stale / orphan artifacts, and recommends the next slash command to run. Read-only diagnostic; no files written. Driven by the new `graph-inject` hook.
+- **`/arckit.graph-report` (Live, Utility)** — governance metrics dashboard across every working project under `projects/`. Reports coverage by category, cross-reference density, compliance readiness, and project comparison. Read-only diagnostic; no files written.
+- **`graph-inject.mjs` hook** (`arckit-claude/hooks/graph-inject.mjs`) — single graph-builder pass that consolidates what used to be five per-command scan hooks (`search-scan`, `impact-scan`, `traceability-scan`, `health-scan`, `governance-scan`). Search / impact / traceability / health / analyze commands now consume the unified graph.
+- **`graph-utils` v2** (`arckit-claude/hooks/graph-utils.mjs`) — additive opts for the graph-builder API: `withNodeMetadata`, `withContent`, `withPreview`. Backward compatible — existing callers continue to work without change; the new opts are opt-in only.
+- New guides: `docs/guides/navigator.md`, `docs/guides/graph-report.md` (mirrored to `arckit-claude/guides/`).
+
+### Changed
+
+- **Hook architecture consolidation.** `/arckit.search`, `/arckit.impact`, `/arckit.traceability`, `/arckit.health`, and `/arckit.analyze` migrated from per-command scan hooks onto the unified `graph-inject` pipeline. Net effect: one graph build per session instead of five separate scans, simpler maintenance, identical user-visible output.
+- Officially-maintained baseline: 68 → **70 commands**. Community-contributed overlays unchanged at 34 (EU 7 + FR 12 + AT 3 + UAE 12). Total commands available across all tiers: 104.
+
+### Internal
+
+- 8 PRs merged earlier today: #360, #362, #363, #364, #365, #366, #367, plus replacement PRs #377 (search) and #378 (matrix doc). All source code already on `main` before this docs/release follow-up.
+
+### Breaking changes
+
+None. All hook migrations are output-equivalent; the new commands are additive.
+
+## [4.10.1] - 2026-04-30
+
+### Changed
+
+- **UAE Federal Overlay reclassified from official-baseline to community-contributed.** The 12 `uae-*` commands shipped earlier today as part of the officially-maintained baseline (68 → 80). Within hours the maintainer reclassified them to community-contributed; v4.10.1 lands the corrective metadata. Officially-maintained baseline returns to 68; community-contributed overlays grow from 21 (EU + FR + AT) to 33; total commands available across all tiers stays at 101.
+
+  Reason: solo CODEOWNERS at the official tier is not a sustainable maintenance posture for fast-moving UAE federal regulatory text without a UAE domain co-maintainer. The official-tier citation-accuracy SLA (quarterly review across the federal corpus, regression sweep across 47 reference repositories, output that an architect can hand to counsel without a paragraph of caveats) needs more than one pair of eyes on regulatory text that is still settling. The community marker is the responsible reading frame; recruiting a UAE domain co-maintainer remains the v4.11 priority. Once one joins, the overlay becomes a candidate for official-tier promotion in a future release.
+
+  What changed (metadata only):
+  - `[COMMUNITY]` prefix added to the `description:` frontmatter on all 12 `uae-*` command files (matching the `eu-*`, `fr-*`, `at-*` pattern).
+  - Inline warning banner added immediately after the YAML frontmatter on each command body, listing UAE Cabinet / PDPL / IAS / Cybersecurity Council as the citation authorities to verify against.
+  - `Template Origin: Community` set on all 24 `uae-*` template files (12 in `arckit-claude/templates/`, 12 in `.arckit/templates/`).
+  - `EXPERIMENTAL` status tag in place of `LIVE` on the two UAE guides on `docs/guides.html`, and on the 12 UAE rows on `docs/commands.html` (`data-status="experimental"`, prefixed `[COMMUNITY]` descriptions, matching the existing 21 community rows).
+  - README "UAE Federal Overlay" section heading changed from "(Official Baseline)" to "(Community-contributed)" with updated banner copy; `docs/index.html`, `docs/articles.html`, and the launch and decree articles in `docs/articles/` updated to community framing.
+  - `arckit-claude/config/doc-types.mjs` UAE block comment updated to reflect community-contributed status with co-maintainer recruiting note.
+  - `.github/CODEOWNERS` UAE block comment updated to flag community-contributed status with promotion gated on co-maintainer commitment.
+
+  What did NOT change (fully backwards-compatible):
+  - All 12 command names (`/arckit.uae-*`).
+  - All UAE doc-type codes (`PDPL`, `IAS`, `SDC`, `NCSP`, `UPS`, `ZBUR`, `DREC`, `DSHR`, `NPRA`, `AICH`, `AAUT`, `UPRC`).
+  - All frontmatter `handoffs:` chains.
+  - All template structures and section bodies.
+  - The Document Control conditional rendering rules and the `<!-- DOC-CONTROL-HEADER -->` marker mechanism.
+  - The Smart Data classification ladder rendering when `governance_framework: UAE Federal` and `classification_scheme: UAE Smart Data` are set.
+  - The canonical chain across the 12 commands.
+  - The dual-registration test (`scripts/tests/test-doc-types-dual-registration.mjs`).
+  - The `arckit migrate-classification` one-time CLI helper.
+
+## [4.10.0] - 2026-04-30
+
+### Added
+
+- 12-command UAE Federal Overlay as official baseline (68 → 80 commands):
+  - Federal data + security: `uae-classification`, `uae-pdpl`, `uae-ias`, `uae-cloud-residency`
+  - Federal identity: `uae-uaepass`
+  - Cabinet instruments: `uae-zero-bureaucracy`, `uae-digital-records`, `uae-data-sharing`, `uae-priorities-alignment`
+  - AI governance: `uae-ai-charter`, `uae-ai-autonomy-tier`
+  - Procurement: `uae-procurement`
+- New `classification_scheme` plugin userConfig (UK or UAE Smart Data).
+- `arckit migrate-classification` one-time CLI helper for migrating existing artefacts from UK ladder to UAE Smart Data.
+- Dual-registration CI test catching `doc-types.mjs`/`pages.md` drift.
+- New guide `docs/guides/uae-overlay.md` and maintenance doc `docs/guides/uae-overlay-maintenance.md`.
+
+### Changed
+
+- `governance_framework` userConfig description extended to recommend `UAE Federal` as a third value.
+- All ~83 templates per directory: Document Control table replaced with `<!-- DOC-CONTROL-HEADER -->` marker resolved at command-execution time.
+
+### Breaking changes
+
+None. Non-UAE projects produce byte-identical Document Control output to v4.9.4.
+
+### Deferred to v4.11 / v5.0
+
+- Bilingual Arabic / English (`uae-translate`).
+- Federal Mandate doc-types category (currently the four Cabinet instruments sit under `Governance`).
+- Sector overlays (ADHICS, Dubai ISR) as community contributions.
+
+## [4.9.4] - 2026-04-28
+
+### Docs
+
+- Added `arckit-claude/docs/guides/custom-commands.md` (mirrored to `docs/guides/custom-commands.md`) — authoring guide for contributors adding new `/arckit.*` commands. Covers the converter fan-out from the plugin source to six target formats, frontmatter reference, the `$ARGUMENTS` placeholder rewriting table, template-handling differences between Paperclip (embedded) and other targets (verbatim copy), a worked `/arckit.sla` example, the commands/skills/agents/hooks decision table, and a testing checklist. Indexed in `docs/README.md` under a new Contributing subsection. Authored by @Yumstezy (#111, #357)
+
+### Fixed
+
+- `arckit-claude/hooks/allow-mcp-tools.mjs` now auto-allows `mcp__govreposcrape__` tool calls. Four of the five bundled MCPs were already in the auto-allow list — govreposcrape was missing, so every `/arckit.gov-reuse`, `/arckit.gov-code-search`, and `/arckit.gov-landscape` run was hitting a permission dialog on every tool call (#215, #358)
+- `scripts/converter.py` no longer recreates `arckit-paperclip/scripts/bash` and `arckit-paperclip/scripts/python` on every run. PR #353 deleted these script directories in favor of the TS-native `src/lib/arckit.ts`, but the converter's `copy_extension_files` loop kept blindly copying them back. New `copy_scripts_to_extension` flag (defaults `True`) on `AGENT_CONFIG` is set to `False` for paperclip; other extensions are unaffected (#356)
+
+## [4.9.3] - 2026-04-28
+
+### Added
+
+- `/arckit.pages` dashboard now surfaces HTML deck artifacts (e.g. `ARC-001-DECK-v1.0.html`) alongside markdown documents in project artifact lists. New `DECK` doc-type code registered in `arckit-claude/config/doc-types.mjs` and the `sync-guides` hook (#354)
+
+### Changed
+
+- `arckit-paperclip` plugin restructured to align with the Paperclip TS plugin authoring-guide spec. Helper bash and python scripts replaced by `src/lib/arckit.ts` library; `manifest.ts`, `command-tools.ts`, `utility-tools.ts`, and `worker.ts` simplified accordingly. Net `-2,507` LOC across the plugin, removes script-execution surface, unblocks future TS-native tool additions (#353)
+- `arckit-claude/.claude-plugin/plugin.json` declares `"$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json"` for editor autocomplete and IDE-side validation. Recognised by `claude plugin validate` since Claude Code v2.1.120; forward-compatible because Claude Code ignores `$schema` at load time, so no minimum-version bump (#215, #355)
+
+## [4.9.2] - 2026-04-24
+
+### Changed
+
+- Documented minimum Claude Code version bumped from v2.1.112 to **v2.1.117**. The v2.1.117 release fixes Opus 4.7's `/context` calculation to use the model's native 1M window (was 200K, causing ArcKit's long deep-research and synthesis sessions to autocompact prematurely) and loads agent frontmatter `mcpServers` for `--agent` sessions (lets research agents declare their own MCP surface). Also pulls in the v2.1.116 `gh` rate-limit hint surfacing (benefits 10 research agents and govreposcrape callers), faster MCP startup with multiple stdio servers, and the WebFetch hang fix on very large HTML pages. Updated: `arckit-claude/hooks/version-check.mjs` (`MIN_CLAUDE_CODE_VERSION`), README "Why" blocks, and `mcp-servers.md` prerequisites in plugin + 5 extension dirs (#215, #352)
+- `/guides` page now lists all 110 guides; articles page font and hero colour fixed (#350)
+
+### Postmortem context
+
+The v2.1.117 floor independently clears all three Claude Code regressions described in [Anthropic's April 23 postmortem](https://www.anthropic.com/engineering/april-23-postmortem) (effort default lowered Mar 4 – Apr 7, thinking-cache clearing bug Mar 26 – Apr 10 fixed in v2.1.101, "≤25 words between tool calls" verbosity rule Apr 16 – Apr 20 fixed in v2.1.116). Users on v2.1.117+ are clear of all three. ArcKit users who saw thin or context-disconnected outputs from `/arckit.requirements`, `/arckit.research`, `/arckit.sobc`, or `/arckit.autoresearch` between Mar 26 and Apr 20 should re-run on v2.1.117+ for restored quality.
+
+## [4.9.1] - 2026-04-22
+
+### Fixed
+
+- `/arckit.wardley` and `/arckit.wardley.value-chain` quoting rule now treats any whitespace-separated pure-digit word as non-simple, forcing quotes on names like `NIS 2031 FDI Outcomes Reporting`, `ISO 27001 Controls`, `Windows 11 Deployment`, and `Log4j 2024 CVE`. The mermaid `wardley-beta` parser tokenises bare numeric words as numeric literals and fails rendering with `Expecting token of type '[' but found '2031'` (#349)
+- `validate-wardley-math.mjs` Stop-hook now runs a 4th check against `mermaid` / `wardley-beta` blocks: scans `component` / `anchor` / `evolve` / `pipeline` / `->` lines, strips quoted and decorator segments, and blocks Stop on any remaining bare-digit word — catches regressions before the rendered page errors (#349)
+
+### Changed
+
+- `docs/guides/enterprise-scale.md` now copied into the 4 extension directories (`arckit-codex`, `arckit-copilot`, `arckit-opencode`, `arckit-paperclip`) that were missing it (converter catch-up) (#349)
+
+## [4.9.0] - 2026-04-21
+
+### Added
+
+- OWM → Mermaid `wardley-beta` conversion fidelity suite: `tests/mermaid-wardley/test-fidelity.mjs` parses every Wardley map in `swardley/WARDLEY-MAP-REPOSITORY`, converts via `convert.mjs`, re-parses, and reports component / anchor / link retention, `|Δε|`, `|Δν|`, pooled drift distribution. Methodology modelled on `tractorjuice/wardleymap_math_model/skills/wardley-map-workspace/compare_all_25.py`. Current result: 100% component / anchor / link retention, `|Δε|` = 0 exactly across 4,905 matched pairs (#339)
+
+### Fixed
+
+- Wardley converter now handles OWM's hybrid `pipeline X [min, max] { 1-D children }` syntax and `evolve` names containing `/.X`. Real-world parse rate 144/147 → 146/147 (the remaining failure is an upstream source-data typo unfixable at the converter layer) (#340)
+- Wardley command guidance (`/arckit.wardley`, `/arckit.wardley.value-chain`) plus converter adopt **conditional quoting** based on the `wardley-beta` grammar's `NAME_WITH_SPACES` terminal. Quote names that fall outside `[A-Za-z][A-Za-z0-9_()&]*(?:[ \t]+[A-Za-z(][A-Za-z0-9_()&]*)*` — hyphens, dots, slashes, leading digits — or whose first word matches / prefixes a reserved keyword (`labelling`, `marketplace`, `evolved`, `build release cycle`). Previously-unquoted hyphenated names like `Real-Time Data Processing` or `GPT-4 LLM Service` broke rendering because Mermaid's lexer read the `-` as the start of `->` (#341)
+- Wardley converter preserves `label [x, y]` offsets from OWM sources across all three emission sites (top-level components, explicit pipeline-block children, auto-injected pipeline children). Previously every label was silently dropped — 20 lost in `sustainability/introduction example` alone. Respects the three `wardley-beta` grammar rules found along the way: label offsets must be integers (rounded at emission), `anchor` doesn't accept `label` (dropped silently), and `label` must precede decorators on a component line (#344)
+
+### Changed
+
+- Pages-template CDN bumped `mermaid@11.4.1` → `mermaid@11.14.0` across all six `pages-template.html` files (plugin + 5 extensions + `.arckit/templates/`). Mermaid 11.14.0 (2026-04-01) ships the `wardley-beta` diagram type, so generated `docs/index.html` pages now render Wardley maps inline (#337)
+- Test suite `tests/mermaid-wardley/` moves from the `pkg.pr.new/mermaid@7147` pre-release build to official `mermaid@^11.14.0`. No behaviour drift — 18/18 synthetic fixtures + 144/147 real-world maps pass, same as pre-release (#338)
+
+### Companion
+
+- Published [`tractorjuice/wardley-maps-mermaid`](https://github.com/tractorjuice/wardley-maps-mermaid) — a public mirror of `swardley/WARDLEY-MAP-REPOSITORY` with each of the 147 maps converted to Mermaid `wardley-beta` alongside the OWM source. All 147 render cleanly under Mermaid 11.14.0. Includes `tools/convert.mjs` + `tools/regenerate.mjs` for local regeneration. Content licensed CC-BY-SA 4.0 matching upstream
+
+## [4.8.0] - 2026-04-20
+
+### Added (Community-contributed)
+
+> ⚠️ The 3 Austrian regulatory commands below are a seed contribution. The verification pass in #333 resolved the majority of `[NEEDS VERIFICATION]` markers with domain-authoritative citations (NISG BGBl. I Nr. 94/2025, VO 2023/2495 thresholds, three-tier CERT reporting, §107 BVergG accessibility). Remaining flagged items (DSB enforcement positions, Land competence boundaries, command-prompt internals) should still be reviewed by an Austrian practitioner (DPO / CISO / Vergabejurist) before external reliance. See #304 for the overlay design.
+
+- `/arckit.at-dsgvo` — [COMMUNITY] assess Austrian DSG / DSGVO obligations — Datenschutzbehörde patterns, §§12–13 DSG image processing, ELGA/GTelG health, §96a ArbVG employee monitoring, age 14 consent
+- `/arckit.at-nisg` — [COMMUNITY] assess Austrian NISG (idF BGBl. I Nr. 94/2025 — NIS2 transposition) — Essential/Important designation, three-tier CERT reporting (Sectoral → CERT.at → GovCERT), KSÖ, AT sectoral authorities
+- `/arckit.at-bvergg` — [COMMUNITY] generate Austrian BVergG 2018 procurement documentation — Oberschwellen/Unterschwellen (€221K / €443K / €5,538K per VO 2023/2495), ANKÖ, Bestbieterprinzip, BVwG review
+- `/arckit.fr-irn` — [COMMUNITY] structure an IRN (Indice de Résilience Numérique) self-assessment following the aDRI framework — 8 resilience pillars × 5 organisational layers. References the official methodology at gitlab.com/digitalresilienceinitiative/adri-irn rather than reproducing scoring criteria (CC BY-NC-ND 4.0 licence incompatible with ArcKit's MIT licence; living standard that evolves actively). Generates `ARC-{id}-IRN-v1.0.md` with scoring scaffold, pre-populated context from existing project artifacts, and clear handoff to the official aDRI evaluation grid (#322)
+
+Registered 3 new doc type codes (ATDSG, ATNISG, BVERGG) in both `arckit-claude/config/doc-types.mjs` and `arckit-claude/commands/pages.md` (dual-registration pattern established in #317). @gtonic added as Austrian domain maintainer; CODEOWNERS lines for `at-*` staged but left commented pending explicit acceptance.
+
+### Fixed
+
+- Extensions: propagate the `.guide-status.community` CSS rule to `pages-template.html` so community-contributed guides render with the correct visual marker in the generated dashboard (#327)
+- `sync-guides` hook: register the 18 EU/FR community guide stems so `/arckit.pages` includes them when syncing guide cards into the dashboard
+- AT DSG template drift: `arckit-claude/templates/at-dsgvo-template.md` was left at the 220-line seed after #333 enriched only the `.arckit/` copy, which would have served plugin and extension users the pre-verification template. Mirrored the enriched `.arckit/` copy into `arckit-claude/` and re-ran `scripts/converter.py` to propagate to the 4 extension copies
+
+### Docs
+
+- Added @gtonic as a code contributor and Austrian domain maintainer in `docs/contributors.html` (hero stat 8 → 9, Community Impact refreshed to include Austrian regulatory coverage) (#328)
+- Moved the architecture book, research, and plan content out to a dedicated `tractorjuice/arckit-book` repo and updated pointers in `wiki.json` accordingly (#324, #325)
+- Added `.devin/wiki.json` to steer DeepWiki generation
+- Added a Star History chart to `README.md` above Quick Start, with cache-buster query to keep the badge fresh
+- Tidied `docs/superpowers/`: deleted shipped plans/specs and added a README explaining the directory's purpose (#326)
+- Added design spec and implementation plan for consolidating the dual artifact-type registry (`arckit-claude/config/doc-types.mjs` + the `/arckit.pages` allow-list) into a single source of truth — design only, not yet implemented
+
+## [4.7.2] - 2026-04-19
+
+### Added
+
+- `## Key References` tables in all 18 EU/French community commands pointing to authoritative regulatory sources (EUR-Lex, ANSSI, CNIL, EDPB, ENISA, MITRE), following the existing pattern used by official ArcKit commands (#321)
+- 36 new usage guides (18 commands × 2 locations: `docs/guides/` + `arckit-claude/docs/guides/`) for the EU/FR community commands, all carrying `Guide Origin: Community` to preserve provenance. Each guide follows the standard ArcKit guide format: inputs table, syntax, document structure, one-page workflow, review checklist (#321)
+- `tests/plugin/test_template_consistency.py` — parametrised test asserting every command-referenced template exists in both `arckit-claude/templates/` and `.arckit/templates/`, and that the two directories stay in sync (#321)
+- `tests/plugin/test_commands_structure.py` — `STRICT_COMMANDS` set covering the 18 community commands; enforces presence of `## User Input`, `## Instructions`, `## Success Criteria`, `## Example Usage`, labelled code fences, and no trailing spaces (#321)
+- Spec and implementation plan for adding a dedicated community-commands table to `docs/commands.html` (not yet implemented)
+
+### Fixed
+
+- Multiple stale command-count references across `docs/`: `commands.html` hero stat, `<h2>` heading, meta tags, schema, and filter UI all showed `67` instead of the correct baseline of `68` (the `/arckit.grants` row was also missing from the main table and has been added). `docs/getting-started.html` updated from "67 commands" to "68 commands" in 5 locations
+- Internal inconsistency in `docs/DEPENDENCY-MATRIX.md`: REQ fan-in was listed as "36 commands" in one place and "37 commands" in another (list contains 37); stakeholders fan-out was listed as both "22 commands" and "23 commands" (list contains 23). Corrected to match the actual lists
+- Stale historical reference "all 40 commands across 16 tiers" in `docs/WORKFLOW-DIAGRAMS.md` updated to 68
+
+### Changed
+
+- `README.md` and `docs/DEPENDENCY-MATRIX.md` updated to document the 18 EU/FR community commands: README adds a `### Phase 14.5: Compliance Assessment (EU and French Government)` workflow section (top-line count stays at 68 — community counted separately per policy); DEPENDENCY-MATRIX adds a `2026-04-19` changelog entry with dependency graph and typical compliance paths (#321)
+- Regenerated extension artefacts for the 18 community commands via `scripts/converter.py`: Paperclip `src/data/commands.json` refreshed to include new Key References; 90 community guide files copied into extension directories (`arckit-codex/docs/guides/`, `arckit-copilot/docs/guides/`, `arckit-gemini/docs/guides/`, `arckit-opencode/docs/guides/`, `arckit-paperclip/docs/guides/`)
+
+## [4.7.1] - 2026-04-19
+
+### Fixed
+
+- `/arckit.pages` was silently omitting the 18 v4.7.0 community-contributed type codes (RGPD, NIS2, AIACT, DORA, CRA, DSA, DATAACT, CNIL, SECNUM, MARPUB, DINUM, EBIOS, ANSSI, CARTO, DR, ALGO, PSSI, REUSE) from the rendered dashboard. The `update-manifest.mjs` hook correctly recorded the artifacts in `docs/manifest.json` (it reads from `arckit-claude/config/doc-types.mjs`), but the `/arckit.pages` prompt has its own hardcoded "Only include these known artifact types" allow-list at `arckit-claude/commands/pages.md:198` that was missing the new codes. Added all 18 to the table grouped by category, plus a note pointing back to `doc-types.mjs` as the single source of truth (#317)
+
+### Documentation
+
+- `arckit-claude/config/doc-types.mjs` — added a prominent `⚠️ DUAL REGISTRATION REQUIRED` warning at the top so future contributors know to update both `doc-types.mjs` and `pages.md` when adding new type codes (#317)
+
+## [4.7.0] - 2026-04-19
+
+### Added (Community-contributed)
+
+> ⚠️ The 18 EU and French regulatory commands below are community-contributed and have not yet been validated against current ANSSI / CNIL / EU regulatory text. Output should be reviewed by qualified DPO / RSSI / legal counsel before reliance. Citations may lag the current source — verify before use. Domain maintainer: [@thomas-jardinet](https://github.com/thomas-jardinet) — auto-requested for review on `eu-*` / `fr-*` changes via `.github/CODEOWNERS`.
+
+- `/arckit.eu-rgpd` — [COMMUNITY] generate GDPR (EU 2016/679) compliance assessment for EU/EEA data processing — member-state-neutral, covers all DPAs, cross-border transfers, breach notification
+- `/arckit.eu-nis2` — [COMMUNITY] assess NIS2 Directive compliance obligations for EU member state operators of essential services and important entities
+- `/arckit.eu-ai-act` — [COMMUNITY] assess EU AI Act (Regulation 2024/1689) compliance, risk classification, and conformity requirements
+- `/arckit.eu-dora` — [COMMUNITY] assess DORA (EU 2022/2554) compliance for financial sector entities operating in the EU
+- `/arckit.eu-cra` — [COMMUNITY] assess EU Cyber Resilience Act (Regulation 2024/2847) for products with digital elements
+- `/arckit.eu-dsa` — [COMMUNITY] assess EU Digital Services Act (Regulation 2022/2065) for online intermediaries, platforms, and VLOPs
+- `/arckit.eu-data-act` — [COMMUNITY] assess EU Data Act (Regulation 2023/2854) for connected products, data holders, and DAPS
+- `/arckit.fr-secnumcloud` — [COMMUNITY] assess SecNumCloud 3.2 qualification for French sovereign cloud procurement and OIV/OSE obligations
+- `/arckit.fr-marche-public` — [COMMUNITY] generate French public procurement documentation aligned with code de la commande publique, UGAP catalogue, and DINUM standards
+- `/arckit.fr-dinum` — [COMMUNITY] assess French digital administration standards: RGI, RGAA, RGESN, RGS, and DINUM doctrine cloud de l'État
+- `/arckit.fr-rgpd` — [COMMUNITY] French CNIL-specific GDPR layer: cookies, HDS, age 15, CNIL référentiels — supplements `/arckit.eu-rgpd`
+- `/arckit.fr-ebios` — [COMMUNITY] EBIOS Risk Manager 5-workshop study following the ANSSI methodology
+- `/arckit.fr-anssi` — [COMMUNITY] assess compliance with the ANSSI Guide d'hygiène informatique (42 measures) and cloud recommendations
+- `/arckit.fr-anssi-carto` — [COMMUNITY] ANSSI-methodology IS cartography across business / application / system / network levels
+- `/arckit.fr-dr` — [COMMUNITY] Diffusion Restreinte handling compliance (II 901/SGDSN/ANSSI)
+- `/arckit.fr-algorithme-public` — [COMMUNITY] public algorithm transparency notice (Article L311-3-1 CRPA)
+- `/arckit.fr-pssi` — [COMMUNITY] generate an Information System Security Policy (PSSI) per ANSSI/RGS
+- `/arckit.fr-code-reuse` — [COMMUNITY] public code reuse assessment (code.gouv.fr, SILL, EUPL) before building
+
+### Added
+
+- `.github/CODEOWNERS` — establishes domain ownership; `@thomas-jardinet` is auto-requested for review on changes to `eu-*` / `fr-*` commands and templates. Repo owner `@tractorjuice` remains final approver via the default `*` rule.
+- README — new "EU & French Regulatory Compliance (Community)" section listing all 18 commands with maintainer credit (#316)
+- `docs/contributors.html` — new card for `@thomas-jardinet` (Code Contributor + Domain Maintainer EU & FR); contributor count 7 → 8 (#316)
+
+### Fixed
+
+- `validate-arc-filename.mjs` PreToolUse hook was blocking every Write call from the new EU and FR commands with exit code 2 ("Unknown document type code"). Registered all 18 codes (RGPD, NIS2, AIACT, DORA, CRA, DSA, DATAACT, CNIL, SECNUM, MARPUB, DINUM, EBIOS, ANSSI, CARTO, DR, ALGO, PSSI, REUSE) in `arckit-claude/config/doc-types.mjs` — the single source of truth that all 6 ArcKit hooks import for display names and categorisation. The 7 EU commands shipped via #314 had been broken at the hook layer until #316 hotfixed them (#316)
+
+## [4.6.13] - 2026-04-19
+
+### Fixed
+
+- `stale-artifact-scan` monitor exited 1 mid-loop in real ArcKit repos. Two bundled fixes in `arckit-claude/scripts/bash/detect-stale-artifacts.sh`: (a) dropped an unused `source common.sh` line that was leaking `errexit + pipefail` into the monitor and aborting the script the first time a `grep | sed | tr` pipeline returned no match; (b) made the Document Control `Status` grep robust to `**markdown bold**` and anchored it so it no longer accidentally matches `| status |` rows in entity-attribute tables further down the file. Net effect: monitor now exits 0 and surfaces both review-overdue *and* DRAFT-unchanged artifacts (the latter were silently skipped before) (#307)
+
+## [4.6.12] - 2026-04-18
+
+### Fixed
+
+- Plugin manifest rejected by Claude Code v2.1.114 with `userConfig.*.type` and `userConfig.*.title` validation errors. Added the newly-required `title` and `type: "string"` fields to all five `userConfig` entries in `arckit-claude/.claude-plugin/plugin.json`. Without this fix the plugin fails to install on Claude Code v2.1.114+ (#302)
+
+## [4.6.11] - 2026-04-18
+
+### Added
+
+- `keep-coding-instructions: true` on 5 long-running commands (`requirements`, `research`, `sobc`, `datascout`, `framework`) — persists the command's instructions across `/compact` so Claude Code doesn't drop the template and traceability rules mid-run. Requires Claude Code v2.1.94+; the converter already strips the field for non-Claude extensions (Phase 1 work, now activated) (#215, #301)
+
+## [4.6.10] - 2026-04-18
+
+### Added
+
+- Plugin `monitors` manifest key (Claude Code v2.1.105+) with a `stale-artifact-scan` monitor that runs at session start. The monitor (`arckit-claude/scripts/bash/detect-stale-artifacts.sh`) scans `projects/` for ARC-*.md artifacts whose Document Control `Next Review Date` is overdue or whose `Status: DRAFT` is 14+ days old, emitting one notification per stale file (capped at 10). Silent in non-ArcKit repos (#215, #300)
+- Autoresearch guide documents the built-in `Monitor` tool (v2.1.98+) for streaming overnight autoresearch progress from a second session without blocking the experiment loop (#215, #300)
+
+## [4.6.9] - 2026-04-18
+
+### Added
+
+- SessionStart version check now warns when the Claude Code client is below the documented minimum (v2.1.112). Detection prefers `$CLAUDE_CODE_VERSION` env var and falls back to `spawnSync('claude', ['--version'])` with a 2s timeout. Warning lists features lost on older clients (userConfig, hook `if:`, skill `paths:`, Opus 4.7 `xhigh`/Auto mode). Silent on detection failure (#215, #299)
+
+## [4.6.8] - 2026-04-18
+
+### Added
+
+- Plugin `userConfig` (Claude Code v2.1.83+) — plugin prompts at enable time for `GOOGLE_API_KEY` / `DATA_COMMONS_API_KEY` (both sensitive, stored in system keychain) plus org defaults (`organisation_name`, `default_classification`, `governance_framework`). `.mcp.json` uses `${user_config.KEY}` placeholders; the converter rewrites these to `${KEY}` shell env vars for Codex/Gemini/OpenCode/Copilot targets (#215, #298)
+
+### Changed
+
+- Existing users enabling v4.6.8+ in Claude Code will be prompted once for MCP API keys and org defaults; existing `GOOGLE_API_KEY` / `DATA_COMMONS_API_KEY` shell env vars continue to work for non-plugin contexts (Codex / Gemini / OpenCode / Copilot).
+
+## [4.6.7] - 2026-04-18
+
+### Added
+
+- `docs/llms.txt` — LLM-friendly site index for arckit.org following the [llmstxt.org](https://llmstxt.org/) standard. Indexes the homepage, getting started, command/guide catalogue, DDaT role guides, use cases, and source distributions. Added to `sitemap.xml`.
+- `/arckit.pages` now generates `docs/llms.txt` in downstream ArcKit project repositories alongside `index.html` and `manifest.json`. Uses `raw.githubusercontent.com` URLs for project markdown artifacts and relative paths for the site-local dashboard and guides. Hand-curated `docs/llms.txt` files (without the ArcKit generation marker) are preserved across re-runs.
+- Document `ENABLE_PROMPT_CACHING_1H=1` (Claude Code v2.1.108+) recommendation in MCP setup and autoresearch guides for long ArcKit workflows and overnight optimisation runs (#215)
+- Phase 1 adoption of Claude Code v2.1.84+ plugin capabilities (#215, #297):
+  - `paths:` globs on all 4 plugin skills (`architecture-workflow`, `mermaid-syntax`, `plantuml-syntax`, `wardley-mapping`) for sharper auto-activation on ArcKit artifact patterns
+  - `if:` conditions (v2.1.85+) on `validate-arc-filename`, `score-validator`, and `update-manifest` hooks to narrow triggering to `projects/**` writes and avoid unnecessary Node process spawns
+  - `CLAUDE.md` documents new command frontmatter (`keep-coding-instructions`, `xhigh` effort value), agent frontmatter (`initialPrompt`), skill frontmatter (`paths:`), and hook `if:` field with permission rule syntax examples
+
+### Changed
+
+- Bump minimum Claude Code version to v2.1.112 to unlock Opus 4.7 `xhigh` effort tier and Auto mode for deep-research agents and synthesis commands (#215)
+- `scripts/converter.py` extends Claude-only-field stripping for non-Claude targets: commands drop `keep-coding-instructions` and `paths`; agents drop `initialPrompt`, `maxTurns`, and `disallowedTools` in addition to `effort`; reference skills copied to extension dirs have `paths:` stripped post-copy (#215, #297)
+
+## [4.6.6] - 2026-04-09
+
+### Added
+
+- Managed agent deployment — deploy any of the 10 ArcKit agents as Claude Managed Agents via the Anthropic API (`scripts/managed-agents/arckit-agent.py`) (#282)
+- 3 MCP servers registered on managed agents with `always_allow` permission (AWS Knowledge, Microsoft Learn, govreposcrape)
+- 4 custom skills uploaded to managed agents (architecture-workflow, mermaid-syntax, plantuml-syntax, wardley-mapping)
+
+### Changed
+
+- Bump minimum Claude Code version to v2.1.97 (#215)
+
+## [4.6.5] - 2026-04-08
+
+### Fixed
+
+- Pages dashboard not showing global project documents from subdirectories (research, diagrams, decisions, wardley-maps, data-contracts, reviews)
+
+## [4.6.4] - 2026-04-07
+
+### Added
+
+- `/arckit.grants` command (68th command) — research UK government grants, charitable funding, and accelerator programmes with eligibility scoring (#277)
+- `arckit-grants` agent (10th agent) — autonomous web research across UKRI, Innovate UK, NIHR, DSIT, DASA, Wellcome, Nesta, Health Foundation, 360Giving/GrantNav, and accelerators
+- `GRNT` document type for grants research reports (Research category, `research/` subdirectory)
+- Grants template with project funding profile, per-grant eligibility scoring, comparison table, recommended strategy, and citation traceability
+
+## [4.6.3] - 2026-04-06
+
+### Added
+
+- Document version badges in pages sidebar — every document shows its version (e.g., v1.0) with an inline dropdown selector when multiple versions of the same document exist
+- Citation traceability for external documents — inline citation markers (`[DOC-CN]`) and structured "External References" section with Document Register, Citations, and Unreferenced Documents tables (#158, #207)
+- Shared citation instructions file referenced by all 43 commands and 7 research agents
+
+## [4.6.2] - 2026-04-05
+
+### Added
+
+- Mermaid `wardley-beta` test suite — 98% pass rate on 147 real-world maps, ArcKit syntax 100% valid (#271)
+- Hooks documentation guide (`docs/guides/hooks.md`) across all distribution formats
+- Paperclip plugin scaffolding with TypeScript source, bash/python scripts, and VERSION file
+
+### Fixed
+
+- Resolve 6 hook bugs and add hooks documentation (#271)
+- Add `name` field to generated Codex agent `.toml` files — Codex CLI requires a non-empty name (#269)
+- Flatten `[agents.roles.X]` to `[agents.X]` in Codex `config.toml` to prevent `roles` being misinterpreted as a malformed agent role (#269)
+- Bump minimum Claude Code version to v2.1.90 across all documentation
+
+## [4.6.1] - 2026-03-28
+
+### Fixed
+
+- Trim all 4 skill descriptions to under 250 characters for Claude Code v2.1.86 context cap (#215)
+
+## [4.6.0] - 2026-03-24
+
+### Changed
+
+- All 9 agents now use `model: inherit` instead of hardcoded `sonnet` — agents use whatever model the user is running (Opus users get Opus, Sonnet users get Sonnet)
+- Added `effort: high` to 10 commands: analyze, dfd, diagram, gcloud-clarify, gcloud-search, impact, principles, principles-compliance, servicenow, story (58 of 67 commands now have effort set)
+- Autoresearch: `effort:` and `model:` are now tuneable parameters alongside prompt text
+- Autoresearch: plateau threshold increased from 5 to 15 consecutive discards
+- Autoresearch: results.tsv now tracks effort and model columns
+
+### Fixed
+
+- Preserve accented characters in `slugify()` function — use locale-aware `[:alnum:]` instead of `[a-z0-9]`
+
+## [4.5.3] - 2026-03-24
+
+### Fixed
+
+- Update agent count from 6 to 9 in README, plugin README, and remote-control guides
+- Update MCP server count from 4 to 5 in plugin README (add govreposcrape)
+- Update automation hook count from 4 to 5 in README
+- Update Copilot prompt file and agent counts in README
+- Merge optimised gov agent prompts (gov-reuse 9.4, gov-code-search 8.8, gov-landscape 8.6)
+
+## [4.5.2] - 2026-03-23
+
+### Fixed
+
+- Add govreposcrape MCP server to Gemini extension
+- Update command count from 64 to 67 across all docs, HTML pages, plugin manifests, and extension configs
+- Update agent count from 6 to 9 and hook count from 4 to 5 in docs
+
+## [4.5.0] - 2026-03-23
+
+### Added
+
+- **govreposcrape MCP server** — Semantic search over 24,500+ UK government repositories (no API key required)
+- `/arckit.gov-reuse` command and agent — Discover reusable UK government code before building from scratch
+- `/arckit.gov-code-search` command and agent — Search UK government repositories using natural language queries
+- `/arckit.gov-landscape` command and agent — Map the UK government code landscape for a domain
+- Government Code Reuse Check step in `/arckit.research` agent — adds "Reuse Government Code" as 5th build-vs-buy option
+- Government Code for Data Integration step in `/arckit.datascout` agent — discovers existing API client libraries
+- Government Implementation Patterns step in AWS, Azure, and GCP research agents — checks for government precedent
+- Document type codes: GOVR (Government Reuse Assessment), GCSR (Government Code Search Report), GLND (Government Landscape Analysis)
+- GOVR, GCSR, GLND added to `/arckit.pages` artifact type list
+
+## [4.4.0] - 2026-03-21
+
+### Added
+
+- Wardley map mathematical model metrics in commands and autoresearch
+- Git worktree isolation for autoresearch
+- Autoresearch guide for self-improving command prompts
+- Rate limit display in statusline
+
+### Fixed
+
+- Sync guides between arckit-claude and docs directories
+
+## [4.3.1] - 2026-03-18
+
+### Added
+
+- Mermaid `wardley-beta` dual output for Wardley map commands — generates both OWM syntax and Mermaid diagram blocks
+- Mermaid wardley-beta examples added to mapping references
+- Mermaid viewing guidance added to wardley and value chain guides
+- Claude Code v2.1.78 agent frontmatter support (`effort`, `maxTurns`, `disallowedTools`) and `StopFailure` hook
+- Mermaid special character escaping guidance for diagram command
+
+### Fixed
+
+- Missing component declaration for pipeline parent in Mermaid example
+
+## [4.3.0] - 2026-03-16
+
+### Added
+
+- `/arckit.wardley.value-chain` command — Decompose user needs into value chains
+- `/arckit.wardley.doctrine` command — Assess organizational doctrine maturity (4 phases, 40+ principles)
+- `/arckit.wardley.gameplay` command — Analyze strategic plays from 60+ gameplay patterns with D&D alignment
+- `/arckit.wardley.climate` command — Assess 32 climatic patterns across 6 categories
+- Wardley reference files enriched from 3 Wardley Mapping books (doctrine, gameplays, climatic patterns)
+- 4 new document types: WVCH, WDOC, WGAM, WCLM
+- 4 new document templates and usage guides
+
+### Fixed
+
+- `wardley.md` hook reference corrected from `python3 .py` to `node .mjs`
+
+## [4.2.11] - 2026-03-16
+
+### Added
+
+- Systems thinking foundations in framework command: Ashby's Law of Requisite Variety, Conant-Ashby Good Regulator Theorem, Gall's Law, and Conway's Law integrated into agent guidance, template, and quality checks
+- Version check SessionStart hook: compares local plugin version against latest GitHub release and notifies users when an update is available
+
+## [4.2.10] - 2026-03-15
+
+### Added
+
+- Add GitHub issue forms for bugs, features, and questions (#171)
+
+### Fixed
+
+- Correct 9 dependency matrix discrepancies from audit (#170)
+- Wrap mermaid.run() in try-catch to prevent page crash on bad diagrams (#172)
+
+## [4.2.4] - 2026-03-11
+
+### Fixed
+
+- Moved STORY doc type from Other to Planning category
+
+## [4.2.3] - 2026-03-11
+
+### Fixed
+
+- Deduplicated cross-reference edges in dependency graph
+
+## [4.2.2] - 2026-03-11
+
+### Fixed
+
+- Dependency map always shows 000-global documents when filtering by project
+
+## [4.2.1] - 2026-03-11
+
+### Fixed
+
+- Dependency map grid layout wrapping, null property crashes, and filtered hidden files from manifest
+
+## [4.2.0] - 2026-03-11
+
+### Added
+
+- Interactive dependency map visualization in pages dashboard with SVG rendering, category-layered layout, hover/click interactions, project filtering, and orphan detection
+
+### Fixed
+
+- Explicit UTF-8 encoding on all Python file I/O operations to prevent encoding issues on non-English systems
+
+## [4.1.1] - 2026-03-11
+
+### Added
+
+- `/arckit.search` command for keyword, type, and requirement ID search across all project artifacts with pre-processing hook
+- `/arckit.score` command for structured vendor scoring with JSON storage, comparison, sensitivity analysis, and audit trail
+- `/arckit.impact` command for blast radius analysis and reverse dependency tracing
+- GitHub Copilot extension (`arckit-copilot/`) — new distribution format with `.prompt.md` files and custom agents
+- GitHub Copilot tab added to `docs/index.html` and `getting-started.html`
+- Session learner skill for capturing and replaying session insights
+
+## [4.0.2] - 2026-03-08
+
+### Added
+
+- `/arckit.framework` command for transforming architecture artifacts into a structured, reusable framework (agent-delegating)
+- `/arckit.glossary` command for generating comprehensive project glossary with terms, definitions, and cross-references
+- `/arckit.maturity-model` command for generating capability maturity model with current-state assessment and improvement roadmap
+- Missing guides for `dfd`, `health`, and `init` commands
+- `dfd` command added to DEPENDENCY-MATRIX with row and column
+
+### Fixed
+
+- Framework command referenced wrong template filename (`framework-template.md` → `framework-overview-template.md`)
+- Stale command counts (53 → 57) across all docs, guides, commands.html, and extension copies
+- Stale agent counts (5 → 6) in MCP servers and remote control guides
+
+## [2.22.6] - 2026-03-05
+
+### Changed
+
+- Add .worktrees/ to gitignore
+
+## [2.22.5] - 2026-03-01
+
+### Fixed
+
+- **Template status line showed ambiguous Version label** — renamed `**Version**: [VERSION]` to `**ArcKit Version**: [VERSION]` on the status blockquote line across all 50 templates so AI correctly fills the ArcKit version instead of the document version
+- **Tech-note and vendor-profile templates missing status line** — added the `> **Template Status**: Live | **ArcKit Version**: [VERSION] | **Command**: ...` blockquote to align with the other 48 templates
+- **Health command always writes docs/health.json** — ensures dashboard integration works even when docs directory already exists
+
+## [2.22.4] - 2026-03-01
+
+### Fixed
+
+- **Traceability hook missed FR and NFR requirements** — heading regex only matched h3 (`###`) but the requirements template uses h4 (`####`) for FR, NFR, INT, and DR sections (plugin fix, see plugin CHANGELOG for details)
+
+---
+
+## [2.22.0] - 2026-03-01
+
+### Added
+
+- **Centralized doc type config** — `arckit-claude/config/doc-types.mjs` is the single source of truth for all 49 document type codes, replacing duplicated data across 5+ files
+- **Research subdirectory routing** — research types (RSCH, AWRS, AZRS, GCRS, DSCT) are now multi-instance and auto-route to `research/` with sequence numbers
+- **GAPS and VEND doc type codes** — Gap Analysis (Governance) and Vendor Evaluation (Procurement)
+
+### Fixed
+
+- **Command filename mismatches** — HLD→HLDR, DLD→DLDR, `data-mesh-contracts/`→`data-contracts/`
+- **Inconsistent categories** — DSCT (Discovery), PLAT (Architecture), DFD (Architecture) standardized across all hooks
+
+### Changed
+
+- **Research agents use inline filenames** — removed `generate-document-id.py` calls from 5 agents; PreToolUse hook handles filename correction
+- **Multi-instance types updated** — `generate-document-id.sh` and `.py` (both copies) now list all 10 multi-instance types
+
+---
+
+## [2.21.0] - 2026-03-01
+
+### Added
+
+- **Traceability pre-processor hook** — automatically extracts requirements from project artifacts and computes coverage metrics before the traceability command runs
+
+---
+
+## [2.20.5] - 2026-02-28
+
+### Fixed
+
+- **Hooks false-positive on unrelated commands** — smart guards prevent pages/health hooks firing when other commands mention them in body text
+
+---
+
+## [2.20.4] - 2026-02-28
+
+### Fixed
+
+- **Pages command ignores hook stats** — removed all tools from allowed-tools and strengthened hook output to prevent AI from reading manifest
+
+---
+
+## [2.20.3] - 2026-02-28
+
+### Fixed
+
+- **Hooks fail via Skill tool** — removed redundant regex guards from pages and health hooks
+
+---
+
+## [2.20.2] - 2026-02-28
+
+### Fixed
+
+- **ANAL files missing from pages manifest** — fixed category mismatch and prevented AI from overwriting hook-generated manifest
+
+---
+
+## [2.20.1] - 2026-02-28
+
+### Fixed
+
+- **Analysis report type code** — standardized `ANLZ` → `ANAL` across all commands and guides
+
+---
+
+## [2.20.0] - 2026-02-28
+
+### Added
+
+- **Health pre-processor hook** — `/arckit:health` fully handled by hook (20-50+ Read tool calls → zero)
+
+---
+
+## [2.19.0] - 2026-02-28
+
+### Added
+
+- **Pages pre-processor hook** — `/arckit:pages` fully handled by hook (~310 tool calls → zero)
+
+---
+
+## [2.18.0] - 2026-02-28
+
+### Added
+
+- **Guide sync hook** — `/arckit:pages` guide sync via native fs hook instead of Read+Write tool calls
+
+---
+
+## [2.17.0] - 2026-02-28
+
+### Added
+
+- **Tiered deviation classification** for conformance assessment — GREEN/YELLOW/RED tiers overlay on PASS/FAIL, classifying FAIL findings by actionability (#95)
+- **Conversational gathering rules** (max 2 rounds) on 15 commands (#94)
+- **STANDALONE/SUPERCHARGED degradation** for cloud research commands (#93)
+
+---
+
+## [2.16.0] - 2026-02-28
+
+### Added
+
+- **Quality checklist** — shared `references/quality-checklist.md` with 10 common checks and 47 per-type checks for artifact verification before write (#92)
+- **`argument-hint` frontmatter** on all 53 plugin commands
+
+---
+
+## [2.15.1] - 2026-02-28
+
+### Fixed
+
+- Markdown lint CI now recurses into subdirectories correctly
+- Suppress MD038 false positive for intentional space-in-code-span in DEPENDENCY-MATRIX.md
+
+---
+
+## [2.15.0] - 2026-02-28
+
+### Added
+
+- **Markdown linting CI** — `.markdownlint-cli2.jsonc` config + `.github/workflows/lint-markdown.yml` enforcing consistent markdown formatting; auto-fix of 39K+ violations across 571 files
+
+### Fixed
+
+- Markdown formatting across all templates, commands, guides, agents, and documentation files
+
+---
+
+## [2.14.0] - 2026-02-28
+
+### Added
+
+- **Handoffs frontmatter** — 16 plugin commands declare `handoffs:` for machine-readable workflow navigation; converter renders as `## Suggested Next Steps` in Codex/OpenCode/Gemini output
+- **Release automation** — `generate-release-notes.sh` + GitHub Actions workflow for automatic releases on tag push
+- **Version automation** — `bump-version.sh` updates all version files in one command
+
+### Changed
+
+- **Config-driven converter** — `scripts/converter.py` refactored to use `AGENT_CONFIG` dictionary and PyYAML for frontmatter parsing
+
+---
+
+## [2.13.2] - 2026-02-28
+
+### Fixed
+
+- **Node.js hooks** — rewrote all 7 plugin hooks from Python to Node.js (.mjs) for Windows compatibility (#86)
+- Version bump across all distribution formats
+
+---
+
+## [2.13.1] - 2026-02-27
+
+### Fixed
+
+- **Cross-platform commands & agents** — removed bash-only patterns from 7 commands and 5 agents, replacing with Glob/Read/Write tool instructions and Python scripts for full Windows compatibility
+- Regenerated all Codex/OpenCode/Gemini formats via converter
+- Version bump across all distribution formats
+
+---
+
+## [2.13.0] - 2026-02-27
+
+### Added
+
+- **NCSC VMS, Cyber Action Plan & Cyber Profession** — `/arckit:secure` updated with VMS enrollment (CAF C2, Section 6.1), Cyber Action Plan Alignment (Section 9.4), and Government Cyber Security Profession (Section 11)
+- **Structured vulnerability management** — `/arckit:operationalize` Section 11 expanded with vulnerability scanning (VMS integration), remediation SLAs, and patch management subsections
+- **Critical Vulnerability Remediation runbook** (6.7) — new runbook in `/arckit:operationalize` for critical CVEs and VMS alerts
+
+### Changed
+
+- GovS 007 mapping updated for principles 5 and 8 in `/arckit:secure`
+- Handover checklist and NCSC guidance include VMS items in `/arckit:operationalize`
+- Version bump across all distribution formats
+
+---
+
+## [2.12.3] - 2026-02-26
+
+### Changed
+
+- **Pages header: Repository icon** — replaced text link with GitHub icon next to theme toggle
+- **Pages header: version badge** — ArcKit version displayed in header menu
+- Version bump across all distribution formats
+
+---
+
+## [2.12.2] - 2026-02-26
+
+### Fixed
+
+- **Pages template: GitHub Pages fallback** (#80) — tries relative paths first, falls back to `raw.githubusercontent.com` for GitHub Pages
+- Version bump across all distribution formats
+
+---
+
+## [2.12.1] - 2026-02-26
+
+### Changed
+
+- **Pages template: relative paths instead of GitHub raw URLs** (#79) — site now works on any static hosting provider
+- **Pages command: hosting-agnostic language** (#79) — updated from "GitHub Pages" to generic "documentation site"
+- **Pages error handling: safe DOM methods** (#79) — simplified to generic "Document not found" message
+- Version bump across all distribution formats
+
+---
+
+## [2.12.0] - 2026-02-26
+
+### Added
+
+- **STALE-EXT detection rule for `/arckit:health`** (#77) — flags external files newer than project artifacts with command recommendations
+- **External file detection hooks** (#77) — SessionStart hook auto-detects new external files; context hook flags them as **NEW**
+- **PlantUML Syntax Reference skill** (`plantuml-syntax`) (#78) — 10 reference files with C4-PlantUML layout conflict rules
+- **Format-specific syntax loading in `/arckit:diagram`** (#78) — loads PlantUML or Mermaid references based on selected format
+- **Mermaid ERD syntax rules** (#78) — prevents invalid `PK_FK` key type
+
+### Changed
+
+- Version bump across all distribution formats
+
+---
+
+## [2.11.0] - 2026-02-26
+
+### Added
+
+- **Mermaid Syntax Reference skill** (`mermaid-syntax`) — 30 official Mermaid syntax reference files covering all 23 diagram types plus configuration and theming
+- `/arckit.start` onboarding command with project detection and workflow routing
+- 10 Mermaid-generating commands now read type-specific syntax references before generating Mermaid code
+
+### Changed
+
+- Getting Started guide now covers both `/arckit.start` and `/arckit.init` in a single combined guide
+- GitHub Pages Getting Started section updated with `/arckit.start` and `/arckit.init` steps
+- `/arckit.pages` command — added 5 missing guides to category and status tables
+- Moved `c4-diagram-reference.md` to `skills/mermaid-syntax/references/c4-layout-science.md`
+- Version bump across all distribution formats
+
+---
+
+## [2.10.0] - 2026-02-25
+
+### Added
+
+- **DDaT Role Guides** (#75) — 18 role-based guides mapping ArcKit commands to UK Government DDaT Capability Framework roles (Architecture, Chief Digital and Data, Product and Delivery, Data, IT Operations, Software Development)
+- "Roles" nav link in GitHub Pages template with dedicated roles index page
+- `roleGuides` array in manifest.json for role guide discovery
+
+### Changed
+
+- Version bump across all distribution formats
+
+---
+
+## [2.9.0] - 2026-02-25
+
+### Added
+
+- `/arckit.conformance` command for architecture conformance assessment — validates ADR decisions against designs, checks architecture drift, tracks technical debt, and enforces custom constraint rules (#55)
+
+### Changed
+
+- Version bump across all distribution formats
+
+---
+
+## [2.8.8] - 2026-02-25
+
+### Fixed
+
+- **Markdown escaping for `<` and `>` in generated documents** (#67) — added instruction to all 49 document-generating commands and 5 agents to space-separate less-than/greater-than comparisons (e.g., `< 3 seconds` instead of `<3 seconds`) so markdown renderers don't misinterpret them as HTML tags or emoji
+
+### Changed
+
+- Version bump across all distribution formats
+
+---
+
+## [2.8.7] - 2026-02-25
+
+### Added
+
+- **PlantUML rendering in Pages** — pages template renders PlantUML code blocks as SVG diagrams via PlantUML server, with interactive pan/zoom, dark mode, and fullscreen support
+
+### Changed
+
+- Version bump across all distribution formats
+
+---
+
+## [2.8.6] - 2026-02-25
+
+### Fixed
+
+- **Mermaid label compatibility for presentations** (#73, #70) — ASCII-only, no-hyphens, no-special-characters rules for Mermaid labels
+- **Diagram command UX** (#71, #65) — ask both questions in single prompt, clarified skip rules
+
+### Added
+
+- **Mermaid Compatibility section** in presentation guide
+- **Plugin setup guide and Productivity Guide** synced to OpenCode extension
+
+### Changed
+
+- Version bump across all distribution formats (CLI, plugin, Gemini extension, OpenCode extension, marketplace)
+
+---
+
+## [2.8.5] - 2026-02-24
+
+### Added
+
+- **PlantUML C4 output format for `/arckit.diagram`** (#65) — C4 diagram types now offer PlantUML C4 as an alternative to Mermaid
+- **Platform support documentation** (#71) — README and docs note Linux as primary platform, devcontainer/WSL2 for Windows
+- **Pages template support for `/arckit:customize`** (#72)
+
+### Changed
+
+- Version bump across all distribution formats (CLI, plugin, Gemini extension, OpenCode extension, marketplace)
+
+---
+
+## [2.8.4] - 2026-02-24
+
+### Added
+
+- **Interactive zoom/pan for Mermaid diagrams** — scroll to zoom, drag to pan, double-click to zoom in, toolbar controls (zoom-in, zoom-out, reset, fullscreen), keyboard shortcuts (`+`/`-`/`0`/`f`/`Escape`), and touch pinch-to-zoom via svg-pan-zoom library
+- **Diagram fullscreen mode** — expand any diagram to a full-screen overlay with `f` key or toolbar button
+- **Accessible diagram controls** — focusable viewports with ARIA labels, keyboard navigation, always-visible controls on mobile/touch devices
+
+### Changed
+
+- Version bump across all distribution formats (CLI, plugin, extension, marketplace)
+
+---
+
+## [2.8.3] - 2026-02-20
+
+### Added
+
+- **Dark mode for pages template** — CSS-variable-driven dark theme with sun/moon toggle in header, system preference detection (`prefers-color-scheme`), and localStorage persistence
+- **Auto-sync guides from plugin** — `/arckit.pages` now copies all guides from the plugin to `docs/guides/` before scanning, ensuring repos always have the latest guides
+- **4 missing guides synced to plugin** — `artifact-health`, `c4-layout-science`, `knowledge-compounding`, `security-hooks`
+
+### Changed
+
+- Replaced ~35 hardcoded colour values in pages template with semantic CSS variables
+- Mermaid diagrams switch between default/dark theme based on mode
+- SVG donut chart text colour reads from CSS variable for dark mode compatibility
+- Version bump across all distribution formats (CLI, plugin, extension, marketplace)
+
+---
+
+## [2.8.2] - 2026-02-20
+
+### Added
+
+- **Health dashboard panel in `/arckit.pages`** — pages template loads `docs/health.json` (when present) and renders an Artifact Health panel with severity bars, findings-by-type breakdown, and a per-project Health column with traffic-light colours
+- **`JSON=true` flag for `/arckit.health`** — writes machine-readable `docs/health.json` for dashboard integration alongside the console report
+
+### Fixed
+
+- **All 64 guides now listed in pages command** — added 19 missing guides to category/status tables and corrected status discrepancies (sow/evaluate/customize → live, pages → alpha per README)
+
+### Changed
+
+- Version bump across all distribution formats (CLI, plugin, extension, marketplace)
+
+---
+
+## [2.8.1] - 2026-02-20
+
+### Added
+
+- **Vendor profiles & tech notes in `/arckit.pages`** — pages command and HTML template now discover, index, and display vendor profiles (`vendors/*-profile.md`) and tech notes (`tech-notes/*.md`) with search, dashboard metrics, Knowledge column, and sidebar navigation (#62)
+
+### Changed
+
+- Version bump across all distribution formats (CLI, plugin, extension, marketplace)
+
+---
+
+## [2.8.0] - 2026-02-20
+
+### Added
+
+- **Knowledge compounding from research** — `/arckit.research` now spawns standalone vendor profiles (`vendors/`) and tech notes (`tech-notes/`) from research findings; use `--no-spawn` to skip (#59, thanks @DavidROliverBA)
+- **`/arckit.health` command** (51st command) — scans projects for stale research, forgotten ADRs, unresolved review conditions, orphaned artifacts, missing traceability, and version drift (#60, thanks @DavidROliverBA)
+- **Security hooks** — three new hooks for secret and sensitive file protection: prompt secret detection, file content scanning, and sensitive file path blocking (#56, thanks @DavidROliverBA)
+- **C4 layout science for `/arckit.diagram`** — research-backed layout reference template (Sugiyama algorithm, tier-based ordering, edge crossing targets) and 6-criterion diagram quality gate (#57, thanks @DavidROliverBA)
+
+### Changed
+
+- Version bump across all distribution formats (CLI, plugin, extension, marketplace)
+
+---
+
+## [2.7.1] - 2026-02-20
+
+### Added
+
+- **Wardley Map validation Stop hook** — per-command Stop hook on `/arckit.wardley` validates generated maps for stage-evolution alignment, coordinate ranges, and OWM syntax consistency against Component Inventory tables before finalizing
+
+### Changed
+
+- Version bump across all distribution formats (CLI, plugin, extension, marketplace)
+
+---
+
+## [2.7.0] - 2026-02-19
+
+### Added
+
+- **UK Government Cyber Security Standard integration** — `/arckit.secure` template now includes GovAssure Status, Secure by Design Confidence Rating, and CSS Exception Register sections (#13)
+- **GovS 007: Security alignment** — `/arckit.secure` template now includes GovS 007 Alignment Summary with principle-to-CAF mapping and named security roles (SSRO, DSO, SIRO) (#14)
+- **National Data Strategy reference guide** — new `docs/guides/national-data-strategy.md` mapping NDS 5 missions and 4 pillars to ArcKit commands (#15)
+- **Government Data Quality Framework reference guide** — new `docs/guides/data-quality-framework.md` mapping DQF 5 principles, 6 dimensions, and maturity model to ArcKit artefacts (#16)
+- **UK Government Codes of Practice reference guide** — new `docs/guides/codes-of-practice.md` mapping Rainbow of Books (Magenta, AQuA, Rose, Commercial Playbooks) to ArcKit commands (#17)
+- **New `/arckit.presentation` command** — generates MARP-format slide decks from existing project artifacts for governance boards, stakeholder briefings, and gate reviews; supports 4 focus modes (Executive, Technical, Stakeholder, Procurement) with configurable slide counts (#32)
+- **Data Commons MCP integration for `/arckit.datascout`** — datascout agent now uses Data Commons MCP tools to discover and validate UK statistical data before web research (#40)
+- **Pinecone MCP integration for `/arckit.wardley`** — wardley command now searches the Wardley Mapping book corpus via Pinecone for strategic context and case studies (#43)
+- New templates, guides, and reference materials for all above features
+
+### Changed
+
+- Converter output synced across all distribution formats (Codex, OpenCode, Gemini)
+- Version bump across all distribution formats (CLI, plugin, extension, marketplace)
+
+---
+
+## [2.6.0] - 2026-02-17
+
+### Added
+
+- **SessionStart hook for version injection** — new `hooks/arckit-session.sh` fires once at session start, injecting the ArcKit plugin version into Claude's context and exporting `ARCKIT_VERSION` as an environment variable; also detects whether a `projects/` directory exists
+- **OpenCode CLI support** — 4th distribution format via `arckit init --ai opencode`; adds `arckit-opencode/` extension directory, `.opencode/commands/` for CLI usage, `scripts/converter.py` generates OpenCode markdown alongside Codex and Gemini formats, 48 commands + 5 agents + MCP servers (AWS Knowledge, Microsoft Learn, Google Developer Knowledge)
+
+### Changed
+
+- **Removed per-command VERSION file reads from 46 commands** — commands no longer instruct Claude to read `${CLAUDE_PLUGIN_ROOT}/VERSION`; the version is now provided via `{ARCKIT_VERSION}` from the SessionStart hook context, eliminating a redundant Read tool call on every command invocation
+- Version bump across all distribution formats (CLI, plugin, extension, marketplace)
+
+---
+
+## [2.5.1] - 2026-02-17
+
+### Changed
+
+- **Removed `generate-document-id.sh` calls from 29 commands** — replaced bash script invocations with inline document ID format strings (e.g., `ARC-{PROJECT_ID}-REQ-v{VERSION}`); the PreToolUse hook now auto-corrects ARC filenames, making script calls redundant
+
+---
+
+## [2.5.0] - 2026-02-17
+
+### Added
+
+- **UserPromptSubmit hook for project context** — new `arckit-context.sh` hook automatically detects all projects, artifacts, external documents, and global policies before any `/arckit:` command runs, injecting structured context via `systemMessage`
+
+### Changed
+
+- **Refactored 39 commands to use hook-provided context** — removed boilerplate directory scanning, `ARC-*-TYPE-*.md` glob patterns, verbose external docs blocks, and `list-projects.sh` calls; replaced with compact hook-aware references (net -1,071 lines, 66% boilerplate reduction)
+
+---
+
+## [2.4.5] - 2026-02-15
+
+### Added
+
+- **New `/arckit.dfd` command** — Data Flow Diagram (DFD) generation with multi-instance support, document control, and DFD-specific templates across all distribution formats (plugin, Codex, Gemini extension)
+- **DFD multi-instance document type** — `DFD` added to `generate-document-id.sh` for sequential numbering (ARC-001-DFD-001, ARC-001-DFD-002, etc.)
+
+### Changed
+
+- **Explicit VERSION file path in all commands and agents** — all 49 commands and 5 agents now reference `${CLAUDE_PLUGIN_ROOT}/VERSION` instead of bare `VERSION`, ensuring the ArcKit version is always read from the plugin's authoritative file regardless of project state
+
+---
+
+## [2.4.4] - 2026-02-12
+
+### Fixed
+
+- **Windows cp1252 encoding fix** — added explicit `encoding='utf-8'` to all file I/O operations in `arckit init` to prevent `UnicodeEncodeError` on Windows when writing files containing Unicode box-drawing characters (fixes #49)
+
+---
+
+## [2.4.3] - 2026-02-11
+
+### Added
+
+- **Data Commons MCP server for Gemini extension** — added `datacommons-mcp` to the Gemini extension MCP configuration
+
+### Changed
+
+- Version bump to 2.4.3 across all distribution formats
+
+---
+
+## [2.4.1] - 2026-02-10
+
+### Added
+
+- **Gemini CLI native extension** (`arckit-gemini/`) — install via `gemini extensions install https://github.com/tractorjuice/arckit-gemini` for zero-config experience with automatic updates and bundled MCP servers
+  - Published as separate repo [`tractorjuice/arckit-gemini`](https://github.com/tractorjuice/arckit-gemini), generated by `scripts/converter.py`
+  - Extension manifest (`gemini-extension.json`) with MCP servers (AWS Knowledge, Microsoft Learn via mcp-remote) and optional Google API Key setting
+  - Context file (`GEMINI.md`) with extension paths, document control standard, and project structure reference
+  - All 48 commands with paths rewritten to `~/.gemini/extensions/arckit/`
+
+### Fixed
+
+- **Gemini extension workspace sandbox fix**: Extension commands now instruct the model to use `run_shell_command` (e.g., `cat`, `bash`) for accessing extension files at `~/.gemini/extensions/arckit/`, since Gemini CLI's `read_file` tool is restricted to the project workspace. Also rewrites `Read` instructions to `cat` commands in extension TOML output.
+- **CLI/Codex path resolution bug**: `${CLAUDE_PLUGIN_ROOT}` references in generated Codex Markdown files are now rewritten to `.arckit` (project-local paths). Previously these paths were never resolved, breaking template and script references for Codex users.
+
+### Changed
+
+- **CLI is now Codex-only**: Removed Gemini CLI from the CLI package. Gemini users should use the native extension instead (`gemini extensions install https://github.com/tractorjuice/arckit-gemini`). Running `arckit init --ai gemini` now prints a redirect message pointing to the extension.
+- Deleted `.gemini/` directory from the repo (49 files) — project-local Gemini commands are no longer distributed via the CLI
+- `scripts/converter.py` now generates 2 output formats: Codex Markdown (`.codex/`) and Gemini extension TOML (`arckit-gemini/`), with path rewriting for each target
+- Removed `.gemini` from `pyproject.toml` shared-data
+- Updated all documentation (README, CLAUDE.md, docs/index.html, upgrading guides) to reflect Codex-only CLI
+
+---
+
+## [2.3.1] - 2026-02-09
+
+### Fixed
+
+- Pass directory argument to `--next-num` in multi-instance commands (wardley, diagram, data-mesh-contract) to prevent unbound variable crash
+- Added guard in `generate-document-id.sh` to give a clear error message when directory is missing
+- Replace Mermaid `gitGraph` with `flowchart` in devops template — gitGraph has limited renderer support and fails with "No diagram type detected" errors in GitHub/VS Code
+- Added diagram guidelines to devops command to prevent gitGraph usage in generated documents
+
+---
+
+## [2.2.1] - 2026-02-09
+
+### Fixed
+
+- Added explicit `list-projects.sh --json` step to 9 commands (stakeholders, requirements, adr, sow, roadmap, strategy, dpia, platform-design, data-mesh-contract) to prevent wrong script paths in plugin-based repos
+
+---
+
+## [2.2.0] - 2026-02-09
+
+### Added
+
+- **Wardley Mapping skill** in plugin (`skills/wardley-mapping/`) for conversational Wardley Mapping with interactive AskUserQuestion guidance
+- 5 shared reference files: evolution stages, doctrine, gameplay patterns, climatic patterns, and mapping examples
+- Enhanced `/arckit:wardley` command reads shared reference files for deeper doctrine, gameplay, and climatic pattern analysis
+
+## [2.1.9] - 2026-02-08
+
+### Added
+
+- Interactive configuration using AskUserQuestion for 8 key commands (backlog, diagram, plan, adr, dpia, sow, sobc, roadmap)
+- Commands now prompt users for key decision points before generating documents
+- Questions are automatically skipped when users specify preferences via command arguments
+
+### Changed
+
+- Unified CLI and plugin version numbers (both now 2.1.9)
+
+## [2.0.0] - 2026-02-07
+
+### Added
+
+- **New Command: `/arckit.customize`**: Copy templates for customization (46th ArcKit command)
+  - Copy individual templates: `/arckit.customize requirements`
+  - Copy all templates: `/arckit.customize all`
+  - List available templates: `/arckit.customize list`
+  - Default templates in `.arckit/templates/` (refreshed by `arckit init`)
+  - User customizations in `.arckit/templates-custom/` (preserved across updates)
+  - Commands automatically check for custom templates first, falling back to defaults
+  - Common use cases: organization-specific document control, compliance sections, approval workflows
+- **Template Customization Support**: All 35 document-generating commands now support template overrides
+  - Two-tier template system: defaults + user customizations
+  - Added "Tip" note to each command pointing to `/arckit.customize`
+- **Init Script Improvements**: `arckit init` now creates `.arckit/templates-custom/` directory with README explaining customization workflow
+- **New Command: `/arckit.strategy`**: Synthesise strategic artifacts into executive-level Architecture Strategy document (45th ArcKit command)
+  - Reads and synthesises: principles (M), stakeholders (M), wardley (R), roadmap (R), sobc (R), risk (O)
+  - Creates single coherent strategic narrative for executives
+  - Includes strategic vision, drivers, principles summary, current/target state, themes, investment, risks, KPIs
+  - Unique among ArcKit commands: requires TWO mandatory inputs (principles AND stakeholders)
+  - Template: `.arckit/templates/architecture-strategy-template.md`
+  - Guide: `docs/guides/strategy.md`
+- **New Command: `/arckit.trello`**: Export product backlog to Trello boards (44th ArcKit command)
+  - Reads JSON output from `/arckit.backlog FORMAT=json`
+  - Creates Trello board with sprint-based lists (Product Backlog + per-sprint + In Progress + Done)
+  - Creates priority labels (Must Have=red, Should Have=orange, Could Have=yellow)
+  - Creates type labels (Epic=purple, Story=blue, Task=green)
+  - Creates cards with GDS user story format descriptions, requirements traceability
+  - Adds acceptance criteria as checklists on each card
+  - Rate-limit-aware (100 req/10s Trello limit)
+  - Requires `TRELLO_API_KEY` and `TRELLO_TOKEN` environment variables
+- **New Guide**: `docs/guides/trello.md` with prerequisites, credential setup, board structure, and troubleshooting
+- **Multi-AI Support**: Trello command available for Gemini CLI (`.gemini/commands/arckit/trello.toml`) and Codex CLI (`.codex/prompts/arckit/trello.md`)
+
+- **Converter Codex Generation**: `scripts/converter.py` now generates both Gemini TOML and Codex Markdown from Claude commands
+  - Added `generate_codex()` function alongside existing Gemini generation
+  - Agent-delegating commands (research, datascout, aws-research, azure-research) have full agent prompts inlined for both formats
+  - Codex prompts use YAML frontmatter with `description` field and keep `$ARGUMENTS` syntax
+  - Single `python scripts/converter.py` run produces 92 files (46 Gemini + 46 Codex)
+
+### Changed
+
+- **Claude Code Plugin Migration**: Claude Code distribution migrated from CLI to standalone plugin (`arckit-claude/`). Claude Code users should install via `/plugin marketplace add tractorjuice/arc-kit` instead of `arckit init --ai claude`
+- **CLI `--ai claude` Redirect**: CLI `--ai claude` option now shows redirect message to plugin marketplace installation
+- **Plugin MCP Hook Removed**: Removed redundant SessionStart hook that checked for already-bundled MCP servers (AWS Knowledge + Microsoft Learn)
+- **Test Repo Migration**: All 22 test repos migrated from synced command/agent/template files to plugin marketplace
+- **Codex Prompt Sync**: All 46 Codex prompts regenerated from Claude source of truth
+  - 5 previously missing commands added: `aws-research`, `customize`, `datascout`, `strategy`, `trello`
+  - All 41 existing prompts updated with latest content (external docs scanning, doc control blocks, doc type codes)
+  - Removed `tags` field from YAML frontmatter (unused by Codex CLI)
+- **Gemini TOML Sync**: All 46 Gemini TOMLs regenerated with latest Claude command content
+- **Template References**: 8 commands now explicitly reference their templates with user override support:
+  - `/arckit.analyze` → `analysis-report-template.md`
+  - `/arckit.dos` → `dos-requirements-template.md`
+  - `/arckit.evaluate` → now references both `evaluation-criteria-template.md` and `vendor-scoring-template.md`
+  - `/arckit.jsp-936` → `jsp-936-template.md`
+  - `/arckit.mod-secure` → `mod-secure-by-design-template.md`
+  - `/arckit.plan` → `project-plan-template.md`
+  - `/arckit.principles-compliance` → `principles-compliance-assessment-template.md`
+  - `/arckit.service-assessment` → `service-assessment-prep-template.md`
+- **Document Control Standardization**: 17 commands now include the standard "Auto-Populate Document Control Fields" block with Generate Document ID, Populate Required Fields, Revision History, and Generation Metadata Footer:
+  - `/arckit.ai-playbook`, `/arckit.analyze`, `/arckit.atrs`, `/arckit.backlog`
+  - `/arckit.data-mesh-contract`, `/arckit.diagram`, `/arckit.dld-review`
+  - `/arckit.dos`, `/arckit.evaluate`, `/arckit.gcloud-clarify`, `/arckit.gcloud-search`
+  - `/arckit.hld-review`, `/arckit.mod-secure`, `/arckit.plan`
+  - `/arckit.roadmap`, `/arckit.strategy`, `/arckit.wardley`
+- **Document Type Code Standardization**: Fixed 5 mismatches between commands and templates:
+  - `backlog`: BLOG → BKLG (template aligned to command)
+  - `dld-review`: DLD → DLDR (template aligned to command)
+  - `hld-review`: HLD → HLDR (template aligned to command)
+  - `mod-secure`: SECD → SECD-MOD (template aligned to command)
+  - `roadmap`: ROADMAP → ROAD (template aligned to command)
+- **Document Type Name Fixes**: 8 commands had incorrect or copy-pasted DOCUMENT_TYPE_NAME values:
+  - `tcop`, `sow`, `traceability`, `secure`: Had "Business and Technical Requirements" (copy-paste from requirements)
+  - `ai-playbook`, `dos`, `gcloud-search`, `roadmap`: Mismatched between command and template
+- **Hardcoded Version Fixes**: `roadmap-template.md` and `architecture-strategy-template.md` had hardcoded `v1.0` instead of `v[VERSION]`
+- **Duplicate Footer Removal**: `sobc.md` had both standardized doc control block AND old "Populate Metadata Footer" block with wrong command reference
+- **Pages Command**: Updated doc type codes (BLOG→BKLG, ROADMAP→ROAD, HLD→HLDR, DLD→DLDR), added STRAT, AWRS, AZRS, DSCT types
+- **Cross-Codebase Consistency**: Updated ~85 files across commands, templates, guides, migration scripts, README, docs/index.html, COMMANDS.md, Codex prompts, and Gemini TOMLs to use correct doc type codes
+- **docs/manifest.json**: Added 10 missing templates to manifest (now 45 total)
+- **DEPENDENCY-MATRIX.md**: Added strategy row/column to Tier 3.5 Strategic Planning, added trello row/column to Tier 7.5 Backlog Export
+- Updated command count to 46 (was 45)
+
+### Removed
+
+- **Claude CLI Directories**: `.claude/commands/` and `.claude/agents/` directories removed from CLI distribution (now exclusively in `arckit-claude/`)
+- **`--ai claude` CLI Option**: Removed as a valid init target (redirects to plugin installation instructions)
+- **Orphan Template**: Removed `uk-gov-tcop-template.md` (duplicate of `tcop-review-template.md`)
+- **Orphaned Codex Subdirectory**: Removed 12 files from `.codex/prompts/arckit/` (obsolete naming convention; all prompts now at `.codex/prompts/arckit.*.md`)
+
+---
+
+## [1.3.0] - 2026-02-03
+
+### Added
+
+- **External Document Support**: Standardized external document intake across all 39 commands and 4 agents
+  - Commands auto-discover and consume user-provided files (vendor HLDs, policy docs, pen test reports, RFPs, audit reports, existing schemas, architecture diagram images)
+  - Three standard locations: `projects/{project}/external/`, `projects/{project}/vendors/{vendor}/`, `projects/000-global/policies/`
+  - Command-specific extraction guidance for each document type
+  - Non-blocking: external docs enhance output quality but are never required
+  - Generated documents include "External References" table citing consumed external docs
+  - 6 command groups: Vendor (6), Policy & Governance (11), User Specification (8), Research (5), Operational (9), No Changes (4)
+
+- **External References Table**: Added to all corresponding templates in `.arckit/templates/`
+  - Populated when external docs are used, shows "None provided" otherwise
+  - Columns: Document, Type, Source, Key Extractions, Path
+
+- **Standard Directories**: CLI and scripts updated to create external document directories
+  - `arckit init` creates `projects/000-global/policies/` directory
+  - `create-project.sh` creates `external/` subdirectory in each numbered project
+  - `.gitkeep` files ensure directories are tracked by git
+
+- **v20 Test Repository**: `arckit-test-project-v20-uae-moi-ipad` (private) for UAE MOI IPAD Framework
+
+### Changed
+
+- **Dynamic Version Placeholders**: All 44 template metadata lines now use `[VERSION]` placeholder instead of hardcoded version numbers
+  - Template metadata line: `> **Template Status**: [status] | **Version**: [VERSION] | **Command**: [command]`
+  - Commands read the `VERSION` file at generation time and populate the placeholder
+  - Eliminates version drift when bumping ArcKit version — only `VERSION` file needs updating
+
+- **Command Version Fallbacks**: Updated all 13 commands with version fallbacks from `1.0.0` to current version
+  - Commands that read VERSION file now have accurate fallback values
+
+- **Converter Improvements** (`scripts/converter.py`): Enhanced agent-delegating command handling for Gemini TOML generation
+
+- **CLAUDE.md**: Added v20 test repo to table and sync loop, added directory creation to sync script
+
+### Fixed
+
+- Stale `1.0.0` version fallbacks in 13 command files (should have been updated in 1.2.0)
+- Hardcoded `1.0.0` version in all 44 template metadata lines (now dynamic `[VERSION]` placeholder)
+- External document sections incorrectly nested inside "Detect Version" steps in 3 commands (story, adr, platform-design)
+
+---
+
+## [1.2.0] - 2026-02-03
+
+### Added
+
+- **Autonomous Agent System**: Research-heavy commands now delegate to autonomous agents (`.claude/agents/`) that run in isolated context windows via the Task tool
+  - `arckit-research` agent for technology research, vendor evaluation, build vs buy, TCO analysis
+  - `arckit-datascout` agent for data source discovery, API catalogue search, scoring
+  - `arckit-aws-research` agent for AWS service research via AWS Knowledge MCP
+  - `arckit-azure-research` agent for Azure service research via Microsoft Learn MCP
+- **Agent documentation**: CLAUDE.md updated with agent system architecture, file structure, and when to create agents
+- **CLI agent support**: `arckit init` now copies `.claude/agents/` directory to new projects
+
+### Changed
+
+- **Command refactoring**: `/arckit.research`, `/arckit.datascout`, `/arckit.aws-research`, `/arckit.azure-research` slash commands refactored to thin wrappers that delegate to agents with fallback to direct execution
+- **Template updates**: Research templates updated with document control footer
+- **All command guides**: Updated with agent delegation notes
+- **README.md**: Added agent architecture to Supported AI Agents section, fixed missing example links (stakeholders, risk, sobc, azure-research, aws-research, gcloud-search), fixed broken platform-design v8 link, corrected Wardley Maps/ServiceNow/Diagrams prose references
+- **docs/index.html**: Matching example link fixes, updated Multi-AI Support section with agent information
+- **COMMANDS.md**: Updated command reference
+
+### Fixed
+
+- Broken platform-design v8 example link (pointed to non-existent `gaap-ecosystem-analysis.md` instead of `ARC-001-GAAP-v1.0.md`)
+- Wardley Maps prose incorrectly referenced v1-m365 and v9-cabinet-office (neither has Wardley maps)
+- ServiceNow prose incorrectly referenced v7-nhs and v1-m365 (neither has ServiceNow files)
+- Diagrams prose incorrectly referenced v2-hmrc and v6-patent (neither has diagram folders)
+- Missing example links for 6 commands across README.md and docs/index.html
+
+---
+
+## [1.1.0] - 2026-02-01
+
+### Added
+
+- **New Command: `/arckit.datascout`**: Data source discovery command (43rd ArcKit command)
+  - Discovers external data sources (APIs, datasets, open data portals, commercial providers) to fulfil project requirements
+  - Data needs extraction from DR/FR/INT/NFR requirements
+  - Dynamic category detection (Geospatial, Financial, Company, Demographics, Weather, Health, Transport, Energy, Education, Property, Identity, Crime, Reference)
+  - Weighted evaluation scoring (Requirements Fit 25%, Data Quality 20%, License & Cost 15%, API Quality 15%, Compliance 15%, Reliability 10%)
+  - UK Government open data prioritisation (data.gov.uk, ONS, NHS Digital, Companies House, OS Data Hub, Environment Agency, Land Registry, Police API)
+  - TCoP Point 10 compliance (Make Better Use of Data)
+  - Gap analysis for unmet data needs
+  - Data model impact assessment (new entities, attributes, sync strategy)
+  - Requirements traceability (every DR-xxx mapped to a source or flagged as gap)
+  - Bidirectional with data-model command
+- **New Template**: `datascout-template.md` for data source discovery outputs
+- **New Guide**: `docs/guides/datascout.md` with usage documentation
+
+### Changed
+
+- Updated command count to 43 (was 42)
+- Updated DEPENDENCY-MATRIX.md with datascout row/column
+- Updated WORKFLOW-DIAGRAMS.md with datascout node in all 5 workflow paths
+- Updated critical paths in DEPENDENCY-MATRIX.md to include datascout after requirements
+
+---
+
+## [1.0.4] - 2026-01-31
+
+### Added
+
+- **v18-smart-meter test project**: UK Smart Meter Data Consumer Mobile App added to test repos
+- **Example links**: Added v17-fuel-prices and v18-smart-meter example links across README command tables (principles, stakeholders, requirements, risk, data-model, research, plan, dpia, diagram, backlog, azure-research, aws-research, secure, pages)
+
+### Changed
+
+- **Pages template header**: Replaced left-title/centre-stats/right-meta header with G-Cloud Kit navigation style — brand link on left, nav links (stats, GitHub, ArcKit) on right using BEM class naming
+- **Pages command**: Rewrote Step 3 to mandate reading `pages-template.html` as the source of truth before generating `docs/index.html` — previously the template was an optional fallback buried at the bottom of the command, causing the AI to generate HTML from scratch instead of using the template
+- **Mobile responsiveness**: Added hamburger navigation with backdrop overlay, reduced heading font sizes on mobile, fixed TOC overlay on small screens
+- **MCP configuration**: Renamed `mcp.json` to `.mcp.json` (dotfile convention), added to test repo sync
+- **DEPENDENCY-MATRIX.md**: Aligned tier descriptions with actual command dependencies
+- **CLAUDE.md**: Added note about re-running `/arckit.pages` after template changes
+
+### Fixed
+
+- Multiple layout issues in `docs/index.html` (mobile navigation, TOC overlay, heading sizes)
+
+---
+
+## [1.0.3] - 2026-01-29
+
+### Added
+
+- **New Command: `/arckit.aws-research`**: AWS-specific technology research using AWS Knowledge MCP server
+  - Requires AWS Knowledge MCP server (mandatory prerequisite)
+  - Uses official AWS documentation via MCP tools (`search_documentation`, `read_documentation`, `get_regional_availability`, `list_regions`, `recommend`)
+  - AWS service recommendations mapped to requirements
+  - AWS Well-Architected Framework assessment (6 pillars including Sustainability)
+  - AWS Security Hub / Foundational Security Best Practices mapping
+  - UK Government compliance (G-Cloud, eu-west-2 London region, NCSC principles)
+  - Real-time regional availability checks for eu-west-2
+  - Cost estimates with optimization recommendations
+  - CloudFormation/CDK/Terraform implementation templates
+  - AWS CodePipeline examples
+- **New Template**: `aws-research-template.md` for AWS research outputs
+- **New Guide**: `docs/guides/aws-research.md` with usage documentation
+
+### Changed
+
+- Updated command count to 42 (was 41)
+
+---
+
+## [1.0.2] - 2026-01-29
+
+### Added
+
+- **New Command: `/arckit.azure-research`**: Azure-specific technology research using Microsoft Learn MCP server
+  - Requires Microsoft Learn MCP server (mandatory prerequisite)
+  - Uses official Microsoft documentation via MCP tools (`microsoft_docs_search`, `microsoft_docs_fetch`, `microsoft_code_sample_search`)
+  - Azure service recommendations mapped to requirements
+  - Azure Well-Architected Framework assessment (5 pillars)
+  - Azure Security Benchmark mapping (12 control domains)
+  - UK Government compliance (G-Cloud, UK regions, NCSC principles)
+  - Cost estimates with optimization recommendations
+  - Bicep/Terraform implementation templates
+  - Azure DevOps pipeline examples
+- **New Template**: `azure-research-template.md` for Azure research outputs
+- **New Guide**: `docs/guides/azure-research.md` with usage documentation
+
+### Changed
+
+- Updated command count to 41 (was 40)
+
+---
+
+## [1.0.1] - 2026-01-28
+
+### Added
+
+- **Migration Guide**: New `docs/guides/migration.md` with comprehensive documentation for file migration
+- **Research Subdirectory**: Multi-instance research documents now stored in `research/` directory
+- **Auto-migrate Principles**: Migration script automatically migrates principles from legacy `.arckit/memory/` location
+
+### Changed
+
+- **Migration Script Enhancements**:
+  - Add `--global` flag to migrate only 000-global directory
+  - Handle root-level ADR, diagram, wardley, and research files
+  - Add alternative filename mappings (tcop-assessment.md, hld.md, dld.md, digital-marketplace-dos.md)
+  - Handle `procurement/` subdirectory files
+  - Fix nullglob bug causing incorrect sequence numbers
+  - Add version-suffixed traceability file handling
+
+- **Pages Command Updates**:
+  - Add `reviews`, `wardleyMaps`, `dataContracts`, `research` arrays to manifest
+  - Support new subdirectory structure in navigation
+
+- **Templates**:
+  - Reverted Power-Interest grids to ASCII format (Mermaid quadrantChart had readability issues)
+  - Reverted Risk matrices to ASCII 5×5 format
+
+### Fixed
+
+- Fixed `v8-cabinet-office-genai` → `v9-cabinet-office-genai` typo in documentation
+- Added missing v7-nhs-appointment and v16-doctors-appointment to public repos list
+
+---
+
+## [1.0.0] - 2026-01-28
+
+### Release Highlights
+
+**ArcKit reaches 1.0.0** - This release marks ArcKit as production-ready for enterprise architecture governance workflows.
+
+### What's Included
+
+- **40 Slash Commands**: Complete toolkit for architecture governance, vendor procurement, and design review
+- **UK Government Compliance**: TCoP, Service Standard, Secure by Design, AI Playbook, ATRS, JSP 936
+- **HM Treasury Frameworks**: Green Book (SOBC), Orange Book (Risk Management)
+- **Multi-AI Support**: Claude Code, OpenAI Codex CLI, Gemini CLI
+- **Template-Driven Generation**: Comprehensive templates for all document types
+- **Traceability Chain**: Stakeholders → Goals → Requirements → Design → Tests
+
+### Stability
+
+- All 14 Live-status commands extensively tested across 16 test repositories
+- 18 Beta-status commands feature-complete and actively refined
+- 4 Alpha-status commands working with limited testing
+- 5 Experimental commands for early adopters
+
+---
+
+## [0.2.0] - 2026-01-28
+
+### Changed
+
+- **BREAKING: Standardized Document Filenames**: All 40 commands now output files using Document ID pattern
+  - Format: `ARC-{PROJECT_ID}-{TYPE}-v{VERSION}.md` (e.g., `ARC-001-REQ-v1.0.md`)
+  - Multi-instance types (ADR, DIAG, WARD, DMC): `ARC-{PROJECT_ID}-{TYPE}-{NUM}-v{VERSION}.md`
+  - Unified output locations with subdirectories: `decisions/`, `diagrams/`, `wardley-maps/`, `data-contracts/`, `reviews/`
+  - Architecture principles now use `ARC-000-PRIN-v1.0.md` (000 = global document)
+
+- **Updated `generate-document-id.sh`**: Added `--filename` and `--next-num` flags
+  - `--filename`: Returns ID with `.md` extension
+  - `--next-num DIR`: Auto-determines next sequence number for multi-instance types
+
+- **Updated `create-project.sh`**: Project README now documents new filename patterns
+  - JSON output includes new filename patterns
+  - Creates subdirectories for multi-instance types
+
+- **Updated `common.sh`**: `create_project_dir()` now creates all subdirectories
+
+### Added
+
+- **`migrate-filenames.sh`**: Migration script for existing projects
+  - Renames old filenames to new Document ID pattern
+  - Creates backups before changes
+  - Supports `--dry-run`, `--all`, `--force` options
+
+### Removed
+
+- **Duplicate guide**: Removed `docs/guides/wardley-mapping.md` (duplicate of `wardley.md`)
+
+### Type Code Reference
+
+| Command | Type Code | Output Pattern |
+|---------|-----------|----------------|
+| requirements | REQ | `ARC-{PID}-REQ-v1.0.md` |
+| stakeholders | STKE | `ARC-{PID}-STKE-v1.0.md` |
+| risk | RISK | `ARC-{PID}-RISK-v1.0.md` |
+| sobc | SOBC | `ARC-{PID}-SOBC-v1.0.md` |
+| principles | PRIN | `ARC-000-PRIN-v1.0.md` |
+| adr | ADR | `ARC-{PID}-ADR-{NUM}-v1.0.md` |
+| diagram | DIAG | `ARC-{PID}-DIAG-{NUM}-v1.0.md` |
+| wardley | WARD | `ARC-{PID}-WARD-{NUM}-v1.0.md` |
+| data-model | DATA | `ARC-{PID}-DATA-v1.0.md` |
+| research | RSCH | `ARC-{PID}-RSCH-v1.0.md` |
+| traceability | TRAC | `ARC-{PID}-TRAC-v1.0.md` |
+| ... | ... | See full list in CLAUDE.md |
+
+---
+
+## [0.11.2] - 2026-01-26
+
+### Added
+
+- **Dynamic Version in Commands**: 29 commands now read VERSION file and update template metadata
+  - Generated documents automatically show current ArcKit version
+  - Template status remains static (Live/Beta/Alpha/Experimental)
+
+- **Template Metadata**: All 41 templates now include status/version blockquote
+  - Format: `> **Template Status**: [status] | **Version**: [version] | **Command**: [command]`
+  - Status indicates maturity: Live (14), Beta (18), Alpha (4), Experimental (5)
+
+- **New Templates**: Added templates for 5 commands that previously generated inline
+  - `analysis-report-template.md` for `/arckit.analyze`
+  - `project-plan-template.md` for `/arckit.plan`
+  - `dos-requirements-template.md` for `/arckit.dos`
+  - `gcloud-clarify-template.md` for `/arckit.gcloud-clarify`
+  - `gcloud-requirements-template.md` for `/arckit.gcloud-search`
+
+### Changed
+
+- **Pages Template**: Moved "On this page" (TOC) from right side to left side of content
+  - Better reading flow with navigation on left
+  - Content remains left-aligned
+
+### Removed
+
+- **Unused Templates**: Removed 5 internal speckit templates not referenced by any commands
+  - plan-template.md, checklist-template.md, tasks-template.md, spec-template.md, agent-file-template.md
+
+### Fixed
+
+- **Legacy Template Paths**: Fixed arckit.secure.md and arckit.tcop.md using old `.specify/templates/` paths
+
+---
+
+## [0.11.1] - 2026-01-24
+
+- **GitHub Pages Manifest**: Added `docs/manifest.json` for programmatic document index access
+  - Lists all guides, templates, and documentation
+  - Enables future document viewer integration
+
+### Changed
+
+- **Template Footer Standardization**: All 36 templates now use consistent footer format
+  - Standard fields: Generated by, Generated on, ArcKit Version, Project, Model
+  - Updated: adr-template, dpia-template, platform-design-template, roadmap-template, story-template
+
+- **Documentation**: Updated CLAUDE.md with standard footer format specification
+  - Added footer format to Document Control Standard section
+  - Updated test repo count to 16
+
+### Fixed
+
+- Inconsistent footer formats across templates (some used bullet lists, some had no footer)
+
+---
+
+## [0.11.0] - 2026-01-23
+
+### Added
+
+- **Enhanced `arckit init`**: New flags and documentation copying
+  - `--all-ai` flag: Install commands for all AI assistants (Claude, Gemini, Codex)
+  - `--minimal` flag: Skip copying docs and guides for lightweight install
+  - Now copies `docs/guides/` with command usage documentation
+  - Now copies `docs/README.md` as documentation index
+  - Now copies `DEPENDENCY-MATRIX.md` for command dependencies
+  - Now copies `WORKFLOW-DIAGRAMS.md` for visual workflows
+
+- **New Command**: `/arckit.pages` (40th ArcKit command) - Generate GitHub Pages documentation site
+  - **Auto-Discovery**: Scans repository for all known ArcKit artifacts across all projects
+  - **Document Categories**: Discovery, Planning, Architecture, Governance, Compliance, Operations, Procurement, Diagrams, Decisions
+  - **Mermaid Support**: Auto-renders all Mermaid diagrams (flowcharts, sequence, C4, ERD, Gantt, state, class)
+  - **GOV.UK Styling**: Professional government design system (GOV.UK Frontend 5.13.0)
+  - **Manifest Generation**: Creates `docs/manifest.json` for programmatic access to document index
+  - **Hash-Based Routing**: Shareable URLs to specific documents (`#projects/001-name/requirements.md`)
+  - **Mobile Responsive**: Works on all screen sizes with collapsible sidebar
+  - **Lazy Loading**: Documents fetched on demand with in-memory caching
+  - **Template**: `pages-template.html` - Full HTML/CSS/JS single-page application
+  - **Guide**: `docs/guides/pages.md` - Usage guide with workflow and setup instructions
+  - **Workflow Position**: Tier 12: Documentation Publishing (utility command)
+  - **Use Cases**: Project documentation portals, architecture documentation sites, stakeholder communication
+
+- **Command Guides**: Added 21 comprehensive guides for complete command coverage
+  - All 40 commands now have dedicated playbooks in `docs/guides/`
+  - Each guide includes: inputs, command usage, outputs, workflow position, review checklist, key principles
+  - Guides for: ai-playbook, analyze, atrs, backlog, data-mesh-contract, devops, dld-review, dos, dpia, evaluate, finops, gcloud-clarify, gcloud-search, hld-review, jsp-936, mlops, mod-secure, operationalize, pages, platform-design, servicenow
+
+### Changed
+
+- **Documentation Site**: Enhanced `docs/index.html` with interactive features
+  - Added Mermaid.js for workflow diagram rendering
+  - Made Command and Status columns sticky for better navigation
+  - Reduced table row height with tighter padding
+  - Expanded example links to show multiple test projects per command
+  - Changed workflow diagram to vertical layout for better readability
+
+- **Dependency Matrix**: Updated to include pages command
+  - Added pages column with Recommended (R) dependencies on all document-producing commands
+  - Added Tier 12: Documentation Publishing
+  - Total commands: 40
+
+### Fixed
+
+- Mermaid diagram syntax for cross-subgraph connections
+- DOS and G-Cloud commands status changed to experimental
+- Missing example links in command reference tables
+
+## [0.10.0] - 2026-01-21
+
+### Added
+
+- **New Command**: `/arckit.finops` (39th ArcKit command) - Create FinOps strategy for cloud financial management
+  - **Cost Visibility**: Tagging strategy, cost allocation, reporting cadence, dashboards
+  - **Cost Optimization**: Rightsizing, reserved instances/savings plans, spot instances, storage tiering
+  - **Commitment Management**: RI/SP inventory, utilization tracking, purchase recommendations
+  - **Showback/Chargeback**: Allocation methodology, unit economics, internal billing processes
+  - **Budgeting & Forecasting**: Budget types, alert thresholds, forecasting methodology
+  - **Anomaly Detection**: Alert configuration, investigation workflow, escalation matrix
+  - **Governance**: Cloud policies, approval workflows, exception processes
+  - **Sustainability**: Carbon footprint visibility, green region preferences, sustainable practices
+  - **UK Government Context**: Cabinet Office spend controls, Treasury Green Book, G-Cloud tracking
+  - **Template**: `finops-template.md` (800+ lines) with 16 comprehensive sections
+  - **Workflow Position**: Run AFTER /arckit.devops (Tier 8: Operations)
+  - **Use Cases**: Cloud cost management, FinOps maturity assessment, cost optimization initiatives
+
+- **New Command**: `/arckit.operationalize` (36th ArcKit command) - Create operational readiness pack for production services
+  - **SRE Best Practices**: SLIs, SLOs, error budgets, golden signals monitoring
+  - **Support Model**: Tiered support (L1/L2/L3), escalation procedures, on-call rotations
+  - **Runbook Library**: 6 detailed runbooks (startup, shutdown, backup/restore, incident response, scaling, failover)
+  - **DR/BCP**: Disaster recovery procedures, business continuity planning, RTO/RPO targets
+  - **Operational Handover**: Knowledge transfer, training materials, handover checklists
+  - **UK Government Context**: Service Standard operations alignment, NCSC CAF operational security
+  - **Template**: `operationalize-template.md` (1,000+ lines) with 17 comprehensive sections
+  - **Workflow Position**: Run AFTER /arckit.servicenow (Tier 8: Operations)
+  - **Use Cases**: Production readiness, operations handover, SRE implementation, support model design
+
+- **New Command**: `/arckit.devops` (35th ArcKit command) - Create comprehensive DevOps strategy
+  - **CI/CD Pipeline Design**: Build automation, testing strategy, quality gates, artifact management
+  - **Infrastructure as Code**: Terraform/Pulumi/CloudFormation patterns, module structure, state management
+  - **Container Strategy**: Docker, container registries, image scanning, orchestration (Kubernetes/ECS)
+  - **GitOps**: ArgoCD/Flux patterns, deployment strategies (blue-green, canary, rolling)
+  - **DevSecOps**: Shift-left security, SAST/DAST/SCA integration, compliance as code
+  - **Developer Experience**: Local development, devcontainers, inner loop optimization, self-service
+  - **DORA Metrics**: Deployment frequency, lead time, MTTR, change failure rate tracking
+  - **UK Government Context**: Cloud First (TCoP Point 5), open standards, Digital Marketplace compatibility
+  - **Template**: `devops-template.md` (1,200+ lines) with 17 comprehensive sections
+  - **Workflow Position**: Run AFTER /arckit.servicenow (Tier 8: Operations)
+
+- **New Command**: `/arckit.mlops` (34th ArcKit command) - Create MLOps strategy for AI/ML projects
+  - **Model Lifecycle**: Training, serving, monitoring, retirement workflows
+  - **Training Pipeline**: Experiment tracking, hyperparameter optimization, model versioning
+  - **Feature Engineering**: Feature stores, data versioning, feature quality checks
+  - **Model Registry**: Model storage, metadata, approval workflow, promotion stages
+  - **Model Monitoring**: Data drift, concept drift, performance degradation, fairness monitoring
+  - **Retraining Strategy**: Automated triggers, champion-challenger deployment, rollback procedures
+  - **LLM/GenAI Operations**: Prompt management, guardrails, token monitoring, RAG pipelines
+  - **Responsible AI**: Bias detection, explainability (SHAP/LIME), human oversight mechanisms
+  - **UK Government Context**: AI Playbook principles, ATRS compliance, JSP 936 for MOD projects
+  - **Template**: `mlops-template.md` (1,100+ lines) with 15 comprehensive sections
+  - **Workflow Position**: Run AFTER /arckit.devops for AI projects (Tier 8: Operations)
+
+- **New Command**: `/arckit.platform-design` (33rd ArcKit command) - Design multi-sided platforms using Platform Design Toolkit (PDT) methodology
+  - **8 PDT Canvases**: Ecosystem Canvas, Entity-Role Portraits, Motivations Matrix, Transactions Board, Learning Engine Canvas, Platform Experience Canvas, MVP Canvas, Platform Design Canvas
+  - **Platform Economics**: Transaction cost reduction analysis (search, information, negotiation, coordination, enforcement costs)
+  - **Network Effects**: Same-side, cross-side, data, and learning network effects for defensibility
+  - **Auto-Population**: Extracts stakeholders → entity portraits, requirements → platform capabilities, Wardley maps → build vs buy, principles → governance
+  - **Ecosystem Mapping**: Supply side, demand side, supporting entities with Mermaid relationship diagrams
+  - **Entity Portraits**: 3-5 detailed portraits with context, performance pressures, goals, gains (pain relievers, gain creators)
+  - **Motivations Matrix**: Cross-entity synergies and conflicts with mitigation strategies
+  - **Transactions Board**: 10-20 transactions with cost analysis, data flows, platform services that reduce each cost
+  - **Learning Engine**: 5+ services that help ecosystem participants improve (data sources, feedback loops, network learning effects)
+  - **Platform Experience**: 2+ journey maps (onboarding, transaction, touchpoints, emotions, business model, unit economics)
+  - **MVP Canvas**: Assumption-risk matrix, minimum feature set, liquidity bootstrapping strategy, validation metrics
+  - **Liquidity Bootstrapping**: Solves chicken-and-egg problem (seed supply, incentivize demand, staged rollout, validation strategy)
+  - **UK Government Context**: Government as a Platform (GaaP), TCoP Point 8 (share/reuse/collaborate), Digital Marketplace integration
+  - **Template**: `platform-design-template.md` (1,800+ lines) with all 8 canvases, comprehensive PDT methodology
+  - **Guide**: `docs/guides/platform-design.md` - What is PDT, when to use, 8 canvas explanations, GaaP context, examples, common pitfalls
+  - **Workflow Position**: Run AFTER /arckit.requirements (Tier 3.5: Strategic Planning), BEFORE detailed design (Tier 4)
+  - **Use Cases**: Government as a Platform services, data marketplaces, multi-sided platforms, NHS appointment booking, training marketplaces
+  - **Based on**: Platform Design Toolkit v2.2.1 from Boundaryless.io (CC-BY-SA license)
+
+### Changed
+
+### Fixed
+
+### Removed
+
+## [0.9.1] - 2025-11-12
+
+### Added
+
+- **Document Control Standard**: New reference in `docs/templates/document-control.md` plus README cross-links so every command references the same metadata expectations (Document ID, classification, review cadence, distribution, revision history, etc.).
+- **Guides**: Added roadmap and ADR playbooks under `docs/guides/` to document the new workflows released in 0.9.0 and highlight where document control fits in those processes.
+
+### Changed
+
+- **Template Alignment**: All Markdown templates in `.arckit/templates/` now share the canonical Document Control table and revision history format, with doc-specific fields (e.g., ADR Number, Financial Years) appended below the standard block.
+- **Command Updates**: Claude/Codex/Gemini instructions explicitly reference the new standard, require `generate-document-id.sh`, and ensure commands populate metadata before writing body content.
+- **Dynamic Version Metadata**: `/arckit.sobc` and `/arckit.service-assessment` prompts (for every agent) read `.arckit/VERSION` so generated artifacts always show the current ArcKit release.
+- **Docs Refresh**: README, docs index, workflow diagrams, dependency matrix, and command references updated to advertise v0.9.1 as the latest release.
+
+### Fixed
+
+- **Version Drift**: Removed remaining hardcoded `v0.9.0` strings so prompts either reference `.arckit/VERSION` or historical sections only.
+
+## [0.9.0] - 2025-01-06
+
+### Added
+
+- **New Command**: `/arckit.data-mesh-contract` (32nd ArcKit command) - Create federated data product contracts for mesh architectures
+  - **ODCS Compliance**: Open Data Contract Standard v3.0.2 with full YAML export
+  - **10 Core Sections**: Fundamentals, Schema, Data Quality, SLA, Access Methods, Security, Governance, Consumer Obligations, Pricing, Infrastructure
+  - **Auto-Population**: Extracts entities from data-model.md (→ objects), DR-xxx requirements (→ quality rules), NFR-xxx (→ SLA targets), stakeholders (→ ownership roles)
+  - **Schema Management**: Semantic versioning (MAJOR.MINOR.PATCH), breaking change policy with 90-day notice, backward compatibility guarantees
+  - **Data Quality**: ODCS-compatible automated rules (null_check, uniqueness, referential_integrity, regex, range) executable by data quality engines
+  - **SLA Commitments**: Availability (99.9%), response time (p95 <200ms), freshness (<5min), retention policies
+  - **Access Methods**: REST API, GraphQL, SQL query, data lake, event streams with authentication, rate limits, consumer onboarding
+  - **GDPR Compliance**: PII inventory, legal basis, data subject rights, cross-border transfers, DPIA integration, audit logging
+  - **Federated Governance**: Change management (minor 7-day notice, major 90-day notice), quarterly reviews, deprecation policy
+  - **Consumer Obligations**: Attribution, usage constraints, quality feedback, security requirements
+  - **UK Government Context**: Technology Code of Practice alignment, National Data Strategy pillars, Data Quality Framework (5 dimensions)
+  - **Template**: `data-mesh-contract-template.md` (1,100+ lines) with 16 sections, ODCS YAML export, comprehensive guidance
+  - **Guide**: `docs/guides/data-mesh-contract.md` - What is data mesh, domain ownership, data as product, computational governance
+  - **Workflow Position**: Run AFTER /arckit.data-model (entities → objects) and /arckit.requirements (DR-xxx → quality rules)
+  - **Use Cases**: Data mesh architectures, federated data ownership, data product management, multi-domain data sharing, self-serve analytics
+
+- **New Command**: `/arckit.dpia` (30th ArcKit command) - Generate Data Protection Impact Assessment for UK GDPR Article 35 compliance
+  - **ICO 9-Criteria Screening**: Automated assessment (evaluation, automated decisions, monitoring, sensitive data, large scale, dataset matching, vulnerable subjects, innovative tech, rights prevention)
+  - **Auto-Population**: Extracts entities, PII, special category data from data-model.md; processing purposes from requirements.md; data subjects from stakeholder-drivers.md
+  - **Risk Assessment**: Focus on impact on individuals (privacy harm, discrimination, physical harm, financial loss), not organizational risk
+  - **Likelihood × Severity Matrix**: Remote/Possible/Probable × Minimal/Significant/Severe = Low/Medium/High risk
+  - **Risk Register Integration**: Bidirectional links with DPIA-xxx risk IDs in risk register
+  - **Mitigation Extraction**: Links security controls from secure-by-design-assessment.md as DPIA mitigations
+  - **Data Subject Rights**: Implementation checklist for SAR, rectification, erasure, portability, objection, restriction, automated decision-making
+  - **Children's Data Assessment**: Age verification, parental consent, best interests, child-friendly privacy notices
+  - **AI/ML Assessment**: Algorithmic bias, explainability, human oversight, links to ai-playbook and ATRS
+  - **ICO Prior Consultation**: Automatic flagging when residual high risks require ICO consultation before processing
+  - **International Transfers**: Safeguards assessment (SCCs, BCRs, adequacy decisions)
+  - **Template**: `dpia-template.md` (1,000+ lines) with 16 sections following ICO guidance
+  - **Legal Context**: UK GDPR Article 35 REQUIRES DPIAs for high-risk processing; failure to conduct when required can result in ICO enforcement
+  - **Workflow Position**: Run AFTER /arckit.data-model (needs data inventory), BEFORE /arckit.research (must assess privacy risks before tech selection)
+  - **Use Cases**: Health data processing, AI/ML systems, large-scale profiling, children's services, vulnerable groups, cross-border transfers
+
+- **New Command**: `/arckit.principles-compliance` (31st ArcKit command) - Assess project compliance with architecture principles
+  - **Dynamic Principle Extraction**: Extracts ALL principles from architecture-principles.md (supports 5, 10, 20+ principles - never assumes fixed count)
+  - **RAG Status System**: Four-level assessment (🟢 GREEN: Fully compliant | 🟠 AMBER: Partial compliance | 🔴 RED: Non-compliant | ⚪ NOT ASSESSED: Insufficient evidence)
+  - **Evidence-Based Assessment**: All RAG statuses must link to specific file:section:line references from project artifacts
+  - **Validation Gates**: Each principle's validation checklist assessed individually with PASS/FAIL/N/A status
+  - **Comprehensive Evidence Search**: Requirements coverage, design evidence (HLD/DLD), implementation artifacts, compliance assessments (TCoP, Secure by Design), validation results
+  - **Gap Identification**: For AMBER/RED principles - specific gaps with impact, severity, remediation plan, responsible owner, target date
+  - **Exception Management**: Time-bound waivers with CTO/CIO approval workflow, expiry dates, quarterly review process
+  - **Point-in-Time Assessment**: Run at project gates (Discovery, Alpha, Beta, Live) and quarterly for ongoing compliance monitoring
+  - **Gate Decision Support**: Overall recommendation (❌ BLOCK / ⚠️ CONDITIONAL APPROVAL / ✅ PROCEED) with prioritized action plan
+  - **Template**: `principles-compliance-assessment-template.md` (340+ lines) with executive summary, compliance scorecard, detailed assessments, exception register
+  - **Integration**: Feeds into /arckit.analyze and /arckit.service-assessment for comprehensive quality/compliance checks
+  - **Use Cases**: Project gate reviews, quarterly compliance audits, architecture governance, demonstrating principles adoption, identifying architecture drift
+  - **Workflow Position**: Run AFTER design reviews when evidence exists, BEFORE major project gates for go/no-go decisions
+
+- **New Command**: `/arckit.story` (29th ArcKit command) - Generate comprehensive project story with timeline analysis
+  - **Timeline Analysis**: 4 visualization types (Gantt chart, linear flowchart, detailed table, phase duration pie chart)
+  - **Timeline Metrics**: Project duration, velocity, phase analysis, critical path identification
+  - **Complete Timeline**: All events from git log or file modification dates with days-from-start
+  - **8 Narrative Chapters**: Foundation → Business Case → Requirements → Research → Procurement → Design → Delivery → Compliance
+  - **Traceability Demonstration**: End-to-end chains with Mermaid diagrams showing stakeholder → goals → requirements → stories → sprints
+  - **Governance Achievements**: Showcase compliance (TCoP, Service Standard, NCSC CAF), risk management, decision rationale
+  - **Strategic Context**: Wardley Map insights, build vs buy decisions, vendor selection rationale
+  - **Lessons Learned**: Pacing analysis, timeline deviations, recommendations for future projects
+  - **Comprehensive Appendices**: Artifact register, chronological activity log, DSM, command reference, glossary
+  - **Template**: `story-template.md` (1,200+ lines) with timeline-first approach
+  - **Use Cases**: Project milestones, completion reporting, stakeholder communication, portfolio reporting, demonstrating ArcKit governance value
+
+### Changed
+
+- **LICENSE**: Updated copyright holder from "GitHub" to "Mark Craddock"
+- **Project README template**: Now documents all 30 commands (previously only 8)
+  - Added Phase 15: Project Story & Reporting with `/arckit.story` command
+  - Added 10 organized categories: Project Planning, Core Workflow, Vendor Procurement, Design Review, Architecture Diagrams, Sprint Planning, Service Management, Traceability & Quality, UK Government Compliance, Security Assessment
+  - Improves command discoverability for new ArcKit projects
+- **DEPENDENCY-MATRIX.md**: Added story command as Tier 11 (final reporting tier)
+  - All dependencies are optional (O) - scans whatever artifacts exist
+  - Added to all 5 critical paths as final reporting step
+  - 29×29 matrix now complete
+- **WORKFLOW-DIAGRAMS.md**: Added story command to all 5 workflow diagrams
+  - Added as gold/yellow box (Tier 11: Reporting)
+  - Updated legend to include gold boxes for reporting tier
+  - Story command is final step in all workflow paths
+
+### Removed
+
+- **Obsolete documentation files** (7 files, ~123KB):
+  - `PUSH-TO-GITHUB.md` - Initial push instructions (no longer needed)
+  - `OPENAI-INTEGRATION-PLAN.md` - Planning doc (implemented in .codex/)
+  - `UI-IMPLEMENTATION-PLAN.md` - Future planning (not current priority)
+  - `arckit-backlog-command-design.md` - Design doc (command implemented)
+  - `gds-service-assessment-command-design.md` - Design doc (command implemented)
+  - `ARTICLE.md` - Marketing article draft
+  - `GITHUB-DISCUSSION-POST.md` - Discussion post draft
+
+## [0.8.3] - 2025-11-02
+
+### Fixed
+
+- **Command Template Synchronization**: Ensured all 28 commands are synchronized across Claude Code, Codex CLI, and Gemini CLI platforms
+  - Fixed missing dependency checks in command templates
+  - Validated all M/R/O dependencies are properly enforced
+
+### Changed
+
+- **Documentation Cleanup**: Removed completed dependency gap analysis files
+  - Removed `DEPENDENCY-GAPS-SUMMARY.md` (Phase 1-2 fixes complete)
+  - Removed `DEPENDENCY-MATRIX-GAPS.md` (all critical gaps resolved)
+  - Updated `README.md` to remove gap file references
+  - Updated `CHANGELOG.md` to note Phase 1-2 completion
+  - Updated `CLAUDE.md` developer documentation
+  - Gap analysis preserved in git history (commits 4a3f631, 5da8a62, 561902d)
+
+- **Test Repository Updates**: All 10 arckit-test-project repositories synchronized with v0.8.3
+  - Updated all commands, templates, and scripts
+  - Pushed WORKFLOW-DIAGRAMS.md with Phase 2 R-level dependency visualizations
+  - Removed obsolete gap analysis files
+  - Repository rename: arckit-test-project-v8-cabinet-office-genai → v9-cabinet-office-genai
+
+## [0.8.2] - 2025-11-01
+
+### Fixed
+
+- **Dependency Matrix Accuracy**: Corrected 4 critical (M-level) dependency errors
+  - `dos` now correctly requires principles (M) - ensures evaluation framework aligned with architecture governance
+  - `evaluate` now correctly requires principles (M) - ensures vendor scoring criteria match organizational standards
+  - `hld-review` now correctly requires principles (M) - validates design decisions against documented principles
+  - `dld-review` now correctly requires principles (M) - ensures implementation adheres to architectural standards
+
+- **High-Priority Dependencies**: Added 9 recommended (R-level) dependencies to improve quality
+  - `plan` now recommends stakeholders (R), requirements (R), principles (R), sobc (R), risk (R) - creates realistic timelines based on project scope
+  - `principles` now recommends gcloud-search (R) for G-Cloud procurement - ensures search criteria align with principles
+  - `stakeholders` now recommends research (R), dos (R) - better procurement strategy and vendor requirements
+  - `data-model` now recommends research (R) - data modeling informed by vendor research and technology choices
+  - `service-assessment` now recommends plan (R) - validates timelines and delivery approach
+
+- **Artifact Summary Counts**: Corrected consumer counts in dependency matrix
+  - `principles.md` consumer count: 10 → 14 commands (added dos, gcloud-search, service-assessment)
+  - `stakeholders.md` consumer count: 7 → 9 commands (added research, dos, service-assessment)
+
+### Added
+
+- **Comprehensive Dependency Documentation** (3 new documents):
+  - `DEPENDENCY-MATRIX.md` (191 lines) - 28×28 Dependency Structure Matrix showing all command dependencies
+    - Matrix legend (M=Mandatory, R=Recommended, O=Optional)
+    - 10-tier dependency hierarchy (Tier 0: Foundation → Tier 10: Compliance)
+    - 5 critical paths (Standard, UK Gov, UK Gov AI, MOD Defence, MOD Defence AI)
+    - Artifact fan-in/fan-out analysis (requirements.md consumed by 22 commands)
+    - Design notes explaining dependency rationale
+    - All critical and high-priority dependencies implemented (Phase 1-2 complete)
+  - `WORKFLOW-DIAGRAMS.md` (431 lines) - Visual workflow diagrams for all 5 project paths
+    - Mermaid flowcharts showing decision gates and command flows
+    - Standard Project workflow (12 steps)
+    - UK Government Project workflow (16 steps)
+    - UK Government AI Project workflow (15 steps)
+    - MOD Defence Project workflow (16 steps)
+    - MOD Defence AI Project workflow (17 steps)
+
+### Changed
+
+- **Command Template Enforcement**: Updated 4 command templates to enforce critical dependencies
+  - `.claude/commands/arckit.dos.md` - Added principles (M) check with guidance
+  - `.claude/commands/arckit.evaluate.md` - Added principles (M) check with guidance
+  - `.claude/commands/arckit.hld-review.md` - Added principles (M) check with guidance
+  - `.claude/commands/arckit.dld-review.md` - Added principles (M) check with guidance
+
+### Why This Matters
+
+The dependency matrix work ensures ArcKit commands are executed in the correct order, preventing:
+
+- **Quality Issues**: Running evaluate without principles means vendor scoring isn't aligned with organizational standards
+- **Rework**: Running hld-review/dld-review without principles means design decisions may violate governance
+- **Incomplete Analysis**: Running plan without requirements means timelines don't reflect actual scope
+- **Procurement Failures**: Running dos without stakeholders means vendor requirements don't address real needs
+
+The comprehensive dependency documentation provides:
+
+- **Clear Guidance**: 5 workflow diagrams showing exactly which commands to run for different project types
+- **Traceability**: Complete dependency chain from foundation commands to final compliance assessments
+- **Quality Assurance**: Artifact fan-in analysis shows requirements.md consumed by 22 commands (highest)
+
+This release completes the dependency analysis initiative (Issue #9) with:
+
+- Phase 1: 4 critical (M-level) fixes ✅
+- Phase 2: 9 high-priority (R-level) enhancements ✅
+- Phase 3: 26 optional (O-level) enhancements (future work)
+
+## [0.8.1] - 2025-11-01
+
+### Fixed
+
+- **Installation compatibility**: Added fallback path for system-wide pip installs
+  - Resolves issues when ArcKit installed globally vs in virtual environment
+  - Improved template and script discovery across different installation methods
+
+## [0.8.0] - 2025-11-01
+
+### Added
+
+- **Enterprise document control system**: Complete version control and document management
+  - Document metadata (version, status, approvers, classification)
+  - Comprehensive change log tracking
+  - Version control best practices
+  - Distribution and access control
+  - Applied to all generated documents
+
+- **Enhanced backlog template**: Updated with document control metadata
+
+### Fixed
+
+- **Package distribution**: Added .arckit directory to package distribution
+  - Templates and scripts now properly included in pip/uv installs
+  - Fixed missing templates issue in fresh installations
+
+- **Script paths**: Corrected script paths in all command files
+  - Scripts now reference correct `/scripts/` directory
+  - Improved script execution reliability
+
+### Changed
+
+- **Repository organization**: Consolidated scripts to root /scripts directory
+  - Removed duplicate root templates directory
+  - Cleaner repository structure
+  - Improved maintainability
+
+## [0.7.0] - 2025-10-31
+
+### Added
+
+- **`/arckit.jsp-936` command**: MOD JSP 936 AI assurance documentation generator
+  - Comprehensive JSP 936 (Dependable Artificial Intelligence in Defence) compliance documentation
+  - 5 Ethical Principles assessment: Human-Centricity, Responsibility, Understanding, Bias & Harm Mitigation, Reliability
+  - AI ethical risk classification using likelihood × impact matrix (1-5 scale)
+  - 5 Risk Classification Levels (Critical/Severe/Major/Moderate/Minor) with approval pathways
+  - 8 AI Lifecycle Phases: Planning, Requirements, Architecture, Algorithm Design, Model Development, V&V, Integration & Use, Quality Assurance
+  - Governance structure documentation (RAISOs, Ethics Managers, Independent Assurance)
+  - Approval pathways (2PUS/Ministerial → Defence-Level JROC/IAC → TLB-Level)
+  - Human-AI teaming strategy (human-in-loop, human-on-loop, human-out-of-loop models)
+  - AI-specific security threats and controls (adversarial examples, data poisoning, model extraction, model inversion, backdoors, drift)
+  - Supplier assurance for third-party AI components
+  - Continuous monitoring and re-assessment plan (drift detection, retraining triggers, annual review)
+  - Comprehensive compliance matrix (27 JSP 936 requirements)
+  - Output: `.arckit/jsp-936/jsp-936-assessment.md`
+
+- **docs/guides/jsp-936.md**: Comprehensive 1,000+ line user guide
+  - JSP 936 framework overview (5 principles, 5 risk levels, 8 lifecycle phases, governance)
+  - When to run JSP 936 assessment (Discovery/Alpha/Beta/Live phases)
+  - AI component types identified (7 categories: ML models, AI algorithms, autonomous systems, decision support, NLP, computer vision, generative AI)
+  - Ethical risk assessment methodology (likelihood × impact matrix)
+  - Five ethical principles deep dive (requirements, assessment approach)
+  - Human-AI teaming models explained (HIL/HOL/HOOL with examples)
+  - AI-specific security threats (6 categories with mitigations)
+  - Continuous monitoring and re-assessment requirements
+  - Approval pathways for each risk classification
+  - Integration with other ArcKit commands
+  - Common JSP 936 patterns (image classification, decision support, autonomous vehicles, LLMs)
+  - JSP 936 compliance checklist
+  - FAQs (mandatory assessment, timelines, roles, COTS AI, JSP 440 relationship, risk escalation, monitoring, human control)
+  - Example scenarios (satellite imagery analysis, predictive maintenance, autonomous drone)
+  - Additional resources (MOD references, UK Government AI guidance, international standards)
+
+- **`.arckit/templates/jsp-936-template.md`**: Complete JSP 936 assessment template
+  - Executive summary structure
+  - AI system inventory with detailed component cataloging
+  - Ethical risk assessment matrices for each AI component
+  - Five ethical principles compliance sections
+  - Eight AI lifecycle phase documentation structures
+  - Governance and approval tracking
+  - Human-AI teaming strategy documentation
+  - Secure by Design evidence structure
+  - Supplier assurance section
+  - Continuous monitoring plan
+  - JSP 936 compliance matrix (27 requirements)
+  - 10 appendices (risk methodology, checklists, model cards, bias reports, V&V reports, security tests, training materials, dashboards)
+
+### Changed
+
+- **Command count**: 27 → 28 commands
+- **README.md**:
+  - Added `/arckit.jsp-936` to Security Assessment commands table
+  - Added JSP 936 information to MOD Projects section
+  - Added JSP 936 example usage
+  - Added MOD JSP 936 AI Assurance to Built-in UK Government Support list
+- **docs/index.html**: To be updated with JSP 936 command (28 commands)
+- **Version**: Updated from v0.6.0 to v0.7.0
+
+### Why This Matters
+
+JSP 936 (Dependable Artificial Intelligence in Defence), published November 2024, establishes the UK Ministry of Defence's mandatory framework for safe and responsible adoption of AI/ML systems. Defence projects using AI must complete JSP 936 assessments to receive approval at the appropriate level (2PUS/Ministerial for Critical, Defence-Level for Severe/Major, TLB-Level for Moderate/Minor).
+
+Without JSP 936 compliance, defence AI projects face:
+
+- Approval blockages (no deployment without JSP 936 assessment)
+- Ethical risks unidentified until late stages
+- Unclear accountability for AI decisions
+- Inadequate bias testing and harm mitigation
+- Missing security controls for AI-specific threats
+- No continuous monitoring or drift detection
+
+The `/arckit.jsp-936` command automates the creation of comprehensive JSP 936 compliance documentation, guiding project teams through:
+
+- Systematic identification of all AI/ML components
+- Ethical risk classification using MOD's likelihood × impact methodology
+- Assessment against all 5 ethical principles (Human-Centricity, Responsibility, Understanding, Bias & Harm Mitigation, Reliability)
+- Documentation for all 8 AI lifecycle phases
+- Human-AI teaming strategy design
+- AI-specific security threat assessment
+- Continuous monitoring and re-assessment planning
+
+This command ensures MOD AI projects have the documentation required for approval while embedding best practices for responsible AI throughout the lifecycle.
+
+## [0.6.0] - 2025-10-30
+
+### Added
+
+- **`/arckit.backlog` command**: Product backlog generation from ArcKit artifacts
+  - Automatically converts requirements to GDS-format user stories ("As a... I want... So that...")
+  - Multi-factor prioritization (MoSCoW + risk + value + dependencies)
+  - Groups stories into epics (from Business Requirements)
+  - Generates technical tasks from NFRs and infrastructure needs
+  - Creates sprint plan with capacity balancing (60% features, 20% technical, 15% testing, 5% buffer)
+  - Respects dependencies (auth before features, database before operations)
+  - Maintains traceability matrix (requirements → stories → sprints)
+  - Exports to multiple formats: markdown, CSV (Jira/Azure DevOps), JSON (API integration)
+  - Time savings: 75%+ reduction (4-6 weeks manual → 3-5 days)
+  - Output: `projects/{project-dir}/backlog.md` (+ optional CSV/JSON)
+
+- **docs/guides/backlog.md**: Comprehensive 700+ line guide
+  - GDS user story format and best practices
+  - Multi-factor prioritization explained (algorithms and examples)
+  - Sprint planning and capacity allocation strategies
+  - Velocity calibration and story point estimation
+  - Backlog management best practices (refinement schedule, DoD)
+  - Real-world example (NHS Appointment Booking with 8 sprints)
+  - Dependency management and risk-based prioritization
+  - Tool integration (Jira, Azure DevOps, GitHub Projects)
+  - Common issues and solutions
+  - FAQs and tips for success
+
+- **arckit-backlog-command-design.md**: 15,000+ word design specification
+  - Research findings from GDS Service Manual on user stories and backlog management
+  - Conversion algorithms (FR→Story, NFR→Task, BR→Epic)
+  - Multi-factor prioritization algorithm (weighted scoring)
+  - Sprint planning algorithm with dependency checking
+  - Story point estimation guidelines (Fibonacci 1-13)
+  - Template structures and output formats
+  - Integration with other ArcKit commands
+  - Success criteria and future enhancements
+
+- **`.arckit/templates/backlog-template.md`**: Complete backlog template
+  - Executive summary structure
+  - Epic breakdown format
+  - User story template (GDS format)
+  - Sprint plan structure
+  - Appendices (traceability, dependencies, DoD)
+
+### Changed
+
+- **Command count**: 26 → 27 commands
+- **README.md**: Added `/arckit.backlog` as Phase 10 (Sprint Planning), renumbered subsequent phases
+- **docs/index.html**: To be updated with backlog command in phase sections
+- **Version**: Updated from v0.5.0 to v0.6.0 across all files
+
+### Why This Matters
+
+Product backlog creation is one of the most time-consuming tasks when transitioning from design (Alpha) to implementation (Beta). Teams spend 4-6 weeks manually converting requirements into user stories, estimating effort, prioritising work, and organising into sprints. This command automates that process in minutes, saving 75%+ of the time while maintaining GDS compliance and best practices.
+
+The backlog command bridges the gap between ArcKit's design phase commands (`/arckit.requirements`, `/arckit.hld`) and implementation, providing a sprint-ready backlog that development teams can immediately use for sprint planning.
+
+## [0.5.0] - 2025-10-30
+
+### Added
+
+- **`/arckit.service-assessment` command**: GDS Service Standard assessment preparation
+  - Analyzes evidence against all 14 Service Standard points
+  - Generates RAG (Red/Amber/Green) ratings per point and overall readiness score
+  - Provides phase-appropriate gap analysis (alpha/beta/live)
+  - Creates actionable recommendations with priorities (Critical/High/Medium) and timelines
+  - Includes comprehensive assessment day preparation guidance
+  - Maps all ArcKit artifacts to Service Standard evidence requirements
+  - Output: `projects/{project-dir}/service-assessment-{phase}-prep.md`
+
+- **docs/guides/service-assessment.md**: Comprehensive 600+ line guide
+  - GDS Service Standard overview (14 points explained)
+  - Assessment process and timings (alpha/beta/live)
+  - Phase-appropriate evidence requirements
+  - Complete workflow (Week 0 to assessment day)
+  - Real-world examples (NHS Appointment Booking alpha prep)
+  - Common pitfalls and how ArcKit helps
+  - Integration with other ArcKit commands
+  - Tips for success and assessment day guidance
+
+- **gds-service-assessment-command-design.md**: 800+ line design specification
+  - Research findings from actual GDS assessment reports
+  - Design rationale and decision log
+  - Evidence discovery algorithm
+  - Phase-specific evidence matrices (alpha/beta/live)
+  - Recommendation generation approach
+  - Success criteria and future enhancements
+
+### Changed
+
+- **Command count**: 25 → 26 commands
+- **README.md**: Added service-assessment to Phase 13 (UK Government Compliance)
+- **docs/index.html**: Added new "UK Government Compliance" section with service-assessment command
+- **Version**: Updated from v0.4.1 to v0.5.0 across all files
+
+### Deployment
+
+Deployed to 6 test repositories:
+
+- arckit-test-project-v1-m365
+- arckit-test-project-v2-hmrc-chatbot
+- arckit-test-project-v3-windows11
+- arckit-test-project-v6-patent-system
+- arckit-test-project-v7-nhs-appointment
+- arckit-test-project-v8-cabinet-office-genai (new)
+
+## [0.4.1] - 2025-10-29
+
+### Added
+
+- **CONTRIBUTING.md**: Comprehensive contribution guide (241 lines)
+  - Getting started workflow (fork, clone, branch)
+  - Types of contributions (bugs, features, docs, commands, code)
+  - Command structure and standards
+  - Documentation style guidelines (UK English, GOV.UK principles)
+  - Commit message conventions (conventional commits)
+  - Pull request process
+  - Testing guidelines
+  - UK Government standards compliance requirements
+  - Command naming conventions
+  - Code of conduct
+
+### Changed
+
+- **docs/index.html**: Complete redesign using GOV.UK Design System v5.13.0
+  - Professional, accessible, mobile-responsive design
+  - Official GDS components: phase banner, buttons, tags, typography, grid
+  - Reduced file size 45% (978 → 542 lines)
+  - CDN-hosted GOV.UK Frontend assets
+  - WCAG 2.1 AA accessibility compliance
+  - Progressive enhancement with js-enabled detection
+
+- **Documentation Expansion** (+1,336 lines across 4 guides):
+  - **docs/guides/analyze.md**: 535 → 876 lines (+341)
+    - Added "Integration with Other Requirements" section (145 lines)
+    - Added "Common Gaps and How to Fix Them" section (8 gaps, 192 lines)
+  - **docs/guides/diagram.md**: 525 → 857 lines (+332)
+    - Added "Integration with Other Requirements" section (139 lines)
+    - Added "Common Gaps and How to Fix Them" section (8 gaps, 208 lines)
+  - **docs/guides/traceability.md**: 639 → 808 lines (+169)
+    - Added "Integration with Other Requirements" section (163 lines)
+  - **docs/guides/wardley-mapping.md**: 112 → 606 lines (+494)
+    - Added "Integration with Other Requirements" section (168 lines)
+    - Added "Common Gaps and How to Fix Them" section (8 gaps, 323 lines)
+
+- **scripts/converter.py**: Moved from root to scripts/ directory
+  - Better organization alongside other tools
+  - Updated all references in documentation
+  - Added comprehensive section to scripts/README.md
+
+- **scripts/bash/create-project.sh**: Removed empty file creation
+  - Commands use Write tool to create files with content
+  - Empty touch commands removed (requirements.md, sow.md, etc.)
+  - Enhanced project README template with complete GDS workflow
+
+### Fixed
+
+- **Font Licensing Compliance**: GDS Transport font override for non-gov.uk domains
+  - GDS Transport licensed only for *.gov.uk,*.service.gov.uk, *.blog.gov.uk
+  - Added explicit system font override: -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Helvetica, Arial
+  - Complies with GDS typography guidelines for non-government services
+  - Transparent footer note explaining font choice
+  - Reference: https://design-system.service.gov.uk/styles/typeface/
+
+- **Broken Links**: Created missing CONTRIBUTING.md (was returning 404)
+
+### Removed
+
+- **SETUP.md**: Deleted outdated development artifact (329 lines)
+  - Referenced only 8 templates (now 25 commands)
+  - Had TODOs for already-implemented commands
+  - Superseded by README.md, .claude/COMMANDS.md, .codex/README.md
+
+- **docs/index.html from test repositories**: Removed from all 8 test projects
+  - Website hosting only needed in main arc-kit repository
+  - Test projects are for testing commands, not hosting website
+
+- **arckit.digital-marketplace command**: Deprecated command fully removed
+  - Replaced by focused commands: `/arckit.dos` and `/arckit.gcloud-search`
+  - Removed from Claude, Codex, and Gemini command sets
+  - Total commands reduced from 26 to 25
+
+## [0.4.0] - 2025-10-28
+
+### Added
+
+- **`/arckit.plan`**: Comprehensive project planning command
+  - Generates project plans with GDS Agile Delivery phases (Discovery → Alpha → Beta → Live)
+  - Mermaid Gantt charts with timeline visualization
+  - Workflow diagrams showing decision gates
+  - Phase-by-phase activity tables with ArcKit command recommendations
+  - Approval criteria for each phase
+  - Risk mitigation strategies
+  - Resource allocation planning
+  - Success metrics and KPIs
+  - Comprehensive 660-line planning guide
+
+### Changed
+
+- **Documentation Guides**: Expanded procurement and design-review guides
+  - **docs/guides/procurement.md**: Enhanced with detailed DOS and G-Cloud workflows
+  - **docs/guides/design-review.md**: Added comprehensive 10-section assessment checklist
+
+- **Multi-AI Deployment**: Plan command deployed to all three AI systems
+  - `.claude/prompts/arckit.plan.md` - Claude Code version
+  - `.codex/prompts/arckit.plan.md` - Codex CLI version
+  - `.gemini/commands/arckit/plan.toml` - Gemini CLI version
+
+- **Workflow Enhancement**: Added Phase 0 (Planning) to GDS Agile Delivery framework
+  - Updated all documentation to show: Phase 0 → Discovery → Alpha → Beta → Live
+  - Planning phase runs before Discovery to establish project foundation
+
+### Fixed
+
+- **Version Consistency**: Synchronized all version references to v0.4.0
+  - VERSION file: Updated to 0.4.0
+  - pyproject.toml: version = "0.4.0"
+  - README.md: Latest Release links
+  - docs/README.md: ArcKit Version
+  - .codex/README.md: version and What's New
+
+## [0.3.6] - 2025-10-27
+
+### Added
+
+- **Gemini CLI Support**: Full support for Google Gemini CLI across all commands
+  - Added `scripts/converter.py` to convert Claude markdown commands to Gemini TOML format
+  - All 24 commands now available for Gemini CLI (`.gemini/commands/arckit/*.toml`)
+  - Automatic conversion maintains command functionality and arguments
+  - Complete parity: Claude, Codex, and Gemini now have identical command sets
+  - Credit: @umag (PR #5)
+
+- **Digital Marketplace Command Split**: Split monolithic command into three focused commands
+  - **`/arckit.dos`** - Digital Outcomes and Specialists (custom development)
+    - ~400 lines (focused, clean - down from 754 lines)
+    - Covers 95% of arc-kit use cases
+    - Essential vs desirable skills extraction
+    - Evaluation framework (40% Technical, 30% Team, 20% Quality, 10% Value)
+    - Technology-agnostic success criteria
+    - No branching logic (DOS only)
+  - **`/arckit.gcloud-search`** - G-Cloud with Live Marketplace Search
+    - ~500 lines with WebSearch integration
+    - **Live Digital Marketplace search** using WebSearch
+    - Searches: `site:digitalmarketplace.service.gov.uk g-cloud [keywords]`
+    - Finds actual services with suppliers, prices, features, links
+    - Service comparison table (top 3-5 services)
+    - Recommendations based on requirements match
+    - Covers 5% of use cases (cloud services only)
+  - **`/arckit.gcloud-clarify`** - G-Cloud Service Validation (NEW!)
+    - **Bridge between search and evaluation** - validates services before supplier engagement
+    - Systematic gap analysis (MUST/SHOULD requirements vs service descriptions)
+    - Detects three gap types: ✅ Confirmed, ⚠️ Ambiguous, ❌ Not mentioned
+    - Generates prioritised questions (🔴 Critical / 🟠 High / 🔵 Medium / 🟢 Low)
+    - Risk assessment matrix for each service
+    - Email templates for supplier engagement
+    - Evidence requirements specification
+    - Completes the G-Cloud workflow: Search → Clarify → Evaluate
+
+### Changed
+
+- **Command Count**: Now 25 commands per AI assistant (22 original + 3 new G-Cloud commands)
+- **README**: Updated to reflect new DOS, G-Cloud search, and G-Cloud clarify commands
+- **Complete G-Cloud Workflow**: Requirements → Search → Clarify → Engage → Evaluate → Award
+
+### Benefits
+
+- **Clearer Purpose**: No framework confusion (DOS vs G-Cloud)
+- **More Powerful**: G-Cloud search finds actual services, not just requirements
+- **Complete Validation**: Gap analysis identifies missing/ambiguous requirements before supplier engagement
+- **Risk Mitigation**: Identifies blockers BEFORE contacting suppliers
+- **Better UX**: Users know which command to use at each workflow stage
+- **Easier Maintenance**: Smaller, focused templates (400-500 lines vs 754)
+- **Time Savings**:
+  - G-Cloud search: 30+ minutes of manual marketplace searching automated
+  - G-Cloud clarify: 30-60 minutes of manual gap analysis automated
+  - Total: 1-2 hours saved per procurement
+- **Structured Process**: End-to-end G-Cloud workflow from discovery to contract award
+
+## [0.3.5] - 2025-10-26
+
+### Added
+
+- **Codex CLI Integration**: Full support for OpenAI Codex CLI in `arckit init`
+  - Added `codex` to AGENT_CONFIG with proper installation URL
+  - Automatic `.envrc` generation for Codex projects with `CODEX_HOME` environment variable
+  - Auto-creates `.gitignore` entries to exclude auth tokens while preserving prompts
+  - Copies slash commands to `.codex/prompts/` directory
+  - Added Codex to interactive AI assistant selection menu
+  - Enhanced next steps output with Codex-specific setup instructions (direnv recommended)
+- Added `.envrc` and updated `.gitignore` for main arc-kit repository
+
+### Changed
+
+- Updated `arckit init` help text to include `codex` as supported AI assistant option
+- Commands are now copied for both Claude and Codex (previously Claude-only)
+
+## [0.3.4] - 2025-10-23
+
+### Fixed
+
+- **Critical Installation Bug**: Fixed package distribution to properly include markdown files
+  - Added `[tool.hatch.build.targets.wheel.shared-data]` configuration to pyproject.toml
+  - Templates, scripts, and .claude commands now correctly packaged in wheel
+  - Enhanced `get_data_paths()` function to locate installed package data:
+    - Supports uv tool installs (`~/.local/share/uv/tools/arckit-cli/share/arckit/`)
+    - Supports pip installs (site-packages)
+    - Supports platformdirs locations
+    - Fallback to source directory for development mode
+  - Added debug output showing resolved data paths during `arckit init`
+  - Added warning messages if templates/scripts/commands not found
+  - Fixed: `arckit init` now works correctly when installed via pip or uv
+  - Credit: @umag (PR #3)
+
+### Added
+
+- **UI Implementation Plan**: Comprehensive plan for building a web-based user interface
+  - Next.js 14 + FastAPI architecture for hybrid CLI/UI approach
+  - Interactive dashboard with project visualization and status tracking
+  - Requirements management interface with filtering, sorting, and graph views
+  - Traceability matrix visualization (interactive graph + table views)
+  - Diagram viewers for Mermaid diagrams and Wardley Maps
+  - Vendor comparison dashboard with side-by-side evaluation
+  - AI assistant chat integration for executing slash commands from UI
+  - Real-time sync between CLI and UI using file watchers and WebSockets
+  - 5-phase implementation roadmap (12-16 weeks)
+  - Multiple deployment options: local web server, desktop app (Electron), cloud
+  - Maintains markdown files as source of truth (no database lock-in)
+  - Full technical specifications, API design, and risk assessment
+
+### Documentation
+
+- Added `UI-IMPLEMENTATION-PLAN.md` with complete architecture and implementation strategy
+- Detailed backend API specifications with FastAPI endpoints
+- Frontend component structure and technology stack recommendations
+- Data flow diagrams showing CLI-to-UI synchronization
+- Risk assessment and mitigation strategies
+- Budget and resource requirements
+- Success metrics and KPIs
+
+## [0.3.2] - 2025-10-21
+
+### Changed
+
+- **BREAKING CHANGE: MOD Secure by Design - RMADS Removed**:
+  - `/arckit.mod-secure` updated to align with current MOD framework (August 2023)
+  - RMADS (Risk Management and Accreditation Documentation Set) REMOVED
+  - Point-in-time accreditation process REPLACED with continuous assurance
+  - **CAAT** (Cyber Activity and Assurance Tracker): Self-assessment tool now mandatory
+    - All programmes must register on CAAT in Discovery/Alpha
+    - Based on 7 SbD Principles question sets
+    - Continuously updated throughout lifecycle (not one-time submission)
+    - Available through MOD Secure by Design portal (DefenceGateway account)
+  - **New Roles**:
+    - Delivery Team Security Lead (DTSL): Owns security (First Line of Defence)
+    - Security Assurance Coordinator (SAC): Supports DTSL
+    - IAO/IAA roles replaced/redefined
+  - **Terminology Changes**:
+    - "Accreditation" → "Continuous assurance"
+    - "Accreditation blockers" → "Deployment blockers"
+    - "RMADS documentation submitted" → "CAAT self-assessment completed"
+    - "Accreditation approval" → "Security governance review"
+  - Supplier attestation required for vendor-delivered systems (ISN 2023/10)
+  - SROs and capability owners accountable (not delegated to accreditation authority)
+  - Cyber security is a "licence to operate" - cannot be traded out
+
+- **Enhanced Analysis Command**:
+  - `/arckit.analyze` updated to analyze all artifacts from v0.2.1-v0.3.1
+  - **New Detection Passes**:
+    - **E. Stakeholder Traceability Analysis** (if stakeholder-drivers.md exists):
+      - Requirements traced to stakeholder goals
+      - Orphan requirements (not linked to stakeholder goals)
+      - Requirement conflicts documented and resolved
+      - RACI governance alignment (risk owners, data owners from RACI)
+    - **F. Risk Management Analysis** (if risk-register.md exists):
+      - High/Very High risks have mitigation in requirements/design
+      - Risk owners aligned with RACI matrix
+      - Risk-SOBC alignment (strategic risks, financial risks in Economic Case)
+      - Risk-requirements alignment (mitigation actions to requirements)
+    - **G. Business Case Alignment** (if sobc.md exists):
+      - Benefits traced to stakeholder goals and requirements
+      - Benefits measurable and verifiable
+      - Option analysis quality (Do Nothing baseline, build vs buy)
+      - SOBC-requirements alignment (drivers, benefits, budget, delivery)
+      - SOBC-risk alignment (risks in Management Case Part E)
+    - **H. Data Model Consistency** (if data-model.md exists):
+      - DR-xxx requirements mapped to entities
+      - Data model-design alignment (schemas match entities, CRUD aligns)
+      - Data governance alignment (owners from RACI, PII identified, GDPR)
+      - Data model quality (ERD renderable, complete specs, relationships)
+    - **J. MOD Secure by Design Compliance** (if mod-secure-by-design.md exists):
+      - 7 SbD Principles assessment
+      - NIST CSF coverage (Identify, Protect, Detect, Respond, Recover)
+      - CAAT continuous assurance process (registration, self-assessment)
+      - Three Lines of Defence implementation
+      - Supplier attestation (ISN 2023/10)
+      - Classification-specific requirements
+  - **Enhanced Report Structure**:
+    - Stakeholder Traceability Analysis section
+    - Risk Management Analysis section
+    - Business Case Analysis section
+    - Data Model Analysis section
+    - MOD Secure by Design Analysis section (separate from UK Gov TCoP)
+  - **New Severity Criteria**:
+    - CRITICAL: Orphan requirements, high/very high risks unmitigated, benefits not traced, DR-xxx unmapped, PII not identified, CAAT not registered
+    - HIGH: Conflicts unresolved, medium risks unmitigated, benefits not measurable, schema mismatch, SbD gaps
+    - MEDIUM: Missing stakeholder/risk/SOBC/data-model artifacts (recommended)
+  - **Updated Metrics Dashboard**:
+    - Stakeholder traceability score
+    - Risk management score
+    - Business case score
+    - Data model score
+    - MOD SbD score (separate from UK Gov compliance)
+
+### Documentation
+
+- Updated MOD Secure by Design command documentation with:
+  - CAAT continuous assurance process
+  - ISN 2023/09 and ISN 2023/10 references
+  - JSP 453 Digital Policies
+  - https://www.digital.mod.uk/policy-rules-standards-and-guidance/secure-by-design
+- Updated analysis command documentation with new detection passes and report sections
+- Deployed to all 7 test repositories
+
+### Resources
+
+- MOD Secure by Design portal: https://www.digital.mod.uk/policy-rules-standards-and-guidance/secure-by-design
+- Launched 28 July 2023, mandatory from August 2023
+- Replaces point-in-time accreditation with continual assurance
+
+## [0.3.1] - 2025-10-21
+
+### Added
+
+- **Data Modeling Command**: `/arckit.data-model` for comprehensive data modeling with ERD, GDPR compliance, and data governance
+  - Visual Entity-Relationship Diagram (ERD) using Mermaid syntax
+  - Detailed entity catalog (E-001, E-002, etc.) with attributes, types, validation rules
+  - PII identification and GDPR/DPA 2018 compliance (retention, erasure, subject access rights)
+  - Data governance matrix (business owners from stakeholder RACI, stewards, custodians)
+  - CRUD matrix showing which components Create/Read/Update/Delete each entity
+  - Data integration mapping (upstream sources, downstream consumers)
+  - Sector-specific compliance (PCI-DSS for payments, HIPAA for health, FCA for finance, Government classifications)
+  - Data quality framework with measurable metrics (accuracy, completeness, consistency, timeliness, uniqueness)
+  - Complete traceability: DR-xxx requirements → Entities → Attributes → Stakeholders
+- `templates/data-model-template.md` (720 lines) - Comprehensive data modeling template
+- `.claude/commands/arckit.data-model.md` - Data modeling command specification
+- `.codex/prompts/arckit.data-model.md` - Data modeling command for OpenAI Codex CLI
+
+### Changed
+
+- **WORKFLOW UPDATE**: Data modeling now positioned after requirements, before vendor selection
+  - Old workflow: Requirements → SOW → Vendor selection
+  - New workflow: Requirements → **Data Model** → SOW → Vendor selection
+- Total command count increased from 19 to 20
+
+### Documentation
+
+- Updated `README.md`:
+  - Added Phase 5.5: Data Modeling
+  - Updated feature list to include data modeling, risk management, and SOBC
+  - Added data-model to Core Commands table
+  - Updated payment gateway example workflow to include data modeling step
+  - Updated project structure to include data-model.md
+  - Renumbered subsequent phases (6→7, 7→8, 8→9, 9→10)
+- Updated `.claude/COMMANDS.md`:
+  - Added section 6 for `/arckit.data-model`
+  - Renumbered subsequent sections (6→7, 7→8, 8→9, 9→10, 10→11)
+  - Updated workflow overview and best practices
+  - Updated common patterns to include data modeling
+- Updated `.codex/README.md`:
+  - Added Phase 5.5: Data Model
+  - Updated to v0.3.1 with 20 commands
+  - Updated file structure to show data-model files
+- Deployed to all 7 test repositories
+
+### Integration
+
+- Data model integrates with:
+  - **Input**: Requires `requirements.md` (extracts DR-xxx Data Requirements)
+  - **Input**: Uses `stakeholder-drivers.md` (for data ownership RACI matrix)
+  - **Input**: References `sobc.md` (for data-related costs and benefits)
+  - **Output**: Feeds into `/arckit.hld-review` (validates database technology choices)
+  - **Output**: Feeds into `/arckit.dld-review` (validates schema design, indexes, query patterns)
+  - **Output**: Supports `/arckit.traceability` (DR-xxx → Entity → Attribute → HLD Component)
+
+## [0.3.0] - 2025-10-21
+
+### Added
+
+- **Strategic Outline Business Case (SOBC) Command**: `/arckit.sobc` implementing HM Treasury Green Book 5-case model
+  - Strategic Case: Problem, drivers, stakeholder goals, scope
+  - Economic Case: Options analysis (Do Nothing, Minimal, Balanced, Comprehensive), benefits mapping, NPV, ROI
+  - Commercial Case: Procurement strategy, Digital Marketplace routes (UK Gov)
+  - Financial Case: Budget, TCO, affordability, Value for Money
+  - Management Case: Governance, delivery, change management, benefits realization, risk management
+- **Risk Management Command**: `/arckit.risk` implementing HM Treasury Orange Book 2023 framework
+  - Part I: 5 Risk Management Principles (Governance, Integration, Collaboration, Risk Processes, Continual Improvement)
+  - Part II: Risk Control Framework (4-pillar structure)
+  - 6 risk categories: Strategic, Operational, Financial, Compliance, Reputational, Technology
+  - 4Ts response framework: Tolerate, Treat, Transfer, Terminate
+  - 5×5 risk matrix: Inherent vs Residual risk (Likelihood × Impact)
+  - Complete stakeholder integration (risk owners from RACI matrix)
+  - Risk appetite compliance monitoring
+- `templates/sobc-template.md` (1,012 lines) - Comprehensive Green Book 5-case business case template
+- `templates/risk-register-template.md` (900 lines) - Comprehensive Orange Book risk register template
+- `.codex/prompts/arckit.sobc.md` - SOBC command for OpenAI Codex CLI
+- `.codex/prompts/arckit.risk.md` - Risk command for OpenAI Codex CLI
+
+### Changed
+
+- **CRITICAL WORKFLOW CHANGE**: Risk assessment and business case now come BEFORE requirements
+  - Old workflow: Principles → Stakeholders → Requirements
+  - New workflow: Principles → Stakeholders → **Risk** → **SOBC** → Requirements
+- Updated `/arckit.requirements` to reference SOBC approval as prerequisite
+- Enhanced SOBC to use risk register for:
+  - Strategic Case urgency ("Why Now?" uses strategic risks)
+  - Economic Case risk-adjusted costs (optimism bias from risk scores)
+  - Management Case Part E (full risk register included)
+  - Recommendation (high-risk profile influences option selection)
+- Total command count increased from 17 to 19
+
+### Documentation
+
+- Updated `README.md`:
+  - Added Phase 3: Risk Assessment
+  - Added Phase 4: Business Case Justification (SOBC)
+  - Renumbered all subsequent phases
+  - Added risk and SOBC to Core Commands table
+  - Updated payment gateway example workflow
+  - Updated project structure to include risk-register.md and sobc.md
+- Updated `.claude/COMMANDS.md`:
+  - Added section 3: Risk Management (Orange Book) - 220+ lines
+  - Added section 4: Strategic Outline Business Case (SOBC)
+  - Renumbered all subsequent sections (requirements=5, sow=6, evaluate=7, hld=8, dld=9, traceability=10)
+  - Updated workflow overview
+  - Updated Best Practices to include risk and SOBC
+  - Updated Common Patterns examples
+  - Updated file structure reference
+- Updated `.codex/README.md`:
+  - Added Phase 3: Risk Assessment (NEW - v0.3.0)
+  - Added Phase 4: Business Case (updated from v0.2.3)
+  - Renumbered subsequent phases
+  - Added Orange Book and Green Book framework overviews
+  - Documented SOBC-risk integration
+- Deployed to all 7 test repositories:
+  - arckit-test-project-v0-mod-chatbot
+  - arckit-test-project-v1-m365
+  - arckit-test-project-v2-hmrc-chatbot
+  - arckit-test-project-v3-windows11
+  - arckit-test-project-v4
+  - arckit-test-project-v5
+  - arckit-test-project-v6-patent-system
+
+### UK Government Compliance
+
+- **Green Book Compliance**: Full 5-case business case model for investment appraisal
+  - Options analysis with do-nothing baseline
+  - Benefits mapping to stakeholder goals
+  - Digital Marketplace procurement routes
+  - Social value (minimum 10% weighting)
+  - Green Book discount rates (3.5% standard)
+  - Optimism bias adjustment from risk assessment
+  - Whole-life costs (3-year TCO)
+- **Orange Book Compliance**: Comprehensive risk management framework
+  - Systematic risk identification (6 categories)
+  - Inherent vs Residual risk assessment
+  - 4Ts response framework (Tolerate, Treat, Transfer, Terminate)
+  - Risk appetite and tolerance monitoring
+  - Risk ownership from stakeholder RACI matrix
+  - Continual improvement and monitoring framework
+- UK-specific risks included:
+  - Strategic: Policy/ministerial changes, machinery of government, parliamentary scrutiny
+  - Compliance: HMT spending controls, NAO audits, PAC scrutiny, FOI, judicial review
+  - Reputational: Media scrutiny, citizen complaints, select committees
+  - Operational: GDS Service Assessment, CDDO controls, security clearances
+
+### Integration
+
+- Complete traceability chain: Stakeholder → Driver → Goal → Risk → Benefit → Requirement
+- Risk register feeds into SOBC Management Case Part E
+- Financial risks inform Economic Case cost contingency (optimism bias)
+- Strategic risks demonstrate urgency in Strategic Case
+- Stakeholder RACI matrix provides risk owners
+- Risk appetite compliance enables go/no-go decisions
+
+### Bug Fixes
+
+- Fixed command ordering in `.claude/COMMANDS.md` (stakeholders correctly positioned before risk/SOBC)
+- Improved documentation commit messages for clarity
+- Corrected workflow documentation alignment across all files
+
+## [0.2.2] - 2025-10-20
+
+### Added
+
+- **OpenAI Codex CLI Support**: Complete `.codex/` folder structure with 17 prompts for OpenAI Codex CLI users
+- `.codex/README.md` - Comprehensive 400+ line setup guide for Codex CLI
+- `OPENAI-INTEGRATION-PLAN.md` - Integration strategy document comparing Codex CLI to alternative approaches
+- Codex CLI support deployed to all 7 test repositories
+- All ArcKit commands now available with `/prompts:arckit.*` format for Codex CLI users
+
+### Changed
+
+- Updated `README.md` to list OpenAI Codex CLI as supported AI agent
+- Updated `.codex/README.md` version to v0.2.2
+- Added Codex CLI usage examples throughout documentation
+- Supported AI agents increased from 4 to 5 (added Codex CLI)
+
+### Documentation
+
+- Updated version references throughout documentation
+
+## [0.2.1] - 2025-10-19
+
+### Added
+
+- **Stakeholder Analysis Command**: `/arckit.stakeholders` for comprehensive stakeholder driver analysis
+- `templates/stakeholder-drivers-template.md` (400+ lines) - Stakeholder analysis template with:
+  - Power-Interest Grid for stakeholder identification
+  - 7 types of drivers (STRATEGIC, OPERATIONAL, FINANCIAL, COMPLIANCE, PERSONAL, RISK, CUSTOMER)
+  - Driver → Goal → Outcome traceability mapping
+  - Conflict analysis and resolution framework
+  - RACI matrix for governance
+  - Engagement plan templates
+- **Conflict Resolution Framework** in requirements workflow:
+  - Systematic identification of conflicting requirements
+  - Trade-off analysis tables
+  - 4 resolution strategies (PRIORITIZE, COMPROMISE, PHASE, INNOVATE)
+  - Stakeholder management documentation (who won/lost)
+  - Decision authority tracking
+
+### Changed
+
+- **CRITICAL WORKFLOW CHANGE**: Stakeholder analysis now comes **BEFORE** requirements
+  - Old workflow: Principles → Requirements → Design
+  - New workflow: Principles → **Stakeholders** → Requirements → Design
+- Enhanced `/arckit.requirements` command to:
+  - Check for stakeholder analysis first (recommends `/arckit.stakeholders` if missing)
+  - Trace requirements back to stakeholder goals
+  - Identify requirement conflicts stemming from stakeholder conflicts
+  - Document conflict resolutions with stakeholder impact
+- Updated `templates/requirements-template.md` with:
+  - "Requirement Conflicts & Resolutions" section
+  - Stakeholder traceability references
+  - 6 common conflict patterns with example resolutions
+
+### Documentation
+
+- Updated `README.md` workflow to show stakeholders before requirements
+- Updated `.claude/COMMANDS.md` with stakeholder analysis step
+- Updated all 7 test repositories with:
+  - New `/arckit.stakeholders` command
+  - Enhanced requirements template
+  - Updated README files showing 17 total commands
+
+## [0.2.0] - 2025-10-14
+
+### Added
+
+- **UK Government Compliance Support**: Comprehensive support for UK Government frameworks
+- `/arckit.tcop` - Technology Code of Practice assessment (13 mandatory points)
+- `/arckit.ai-playbook` - AI Playbook compliance assessment (10 principles + 6 ethical themes)
+- `/arckit.atrs` - Algorithmic Transparency Recording Standard assessment
+- `/arckit.mod-secure` - MOD Secure by Design review (JSP 440, IAMM)
+- `templates/uk-gov-tcop-template.md` (718 lines) - TCoP assessment structure
+- `templates/uk-gov-ai-playbook-template.md` (853 lines) - AI Playbook assessment structure
+- `templates/uk-gov-atrs-template.md` - ATRS transparency documentation
+- `templates/mod-secure-by-design-template.md` - MOD security review template
+
+### Documentation (6,000+ lines added)
+
+- `docs/principles.md` (527 lines) - Architecture Principles Guide
+- `docs/requirements.md` (628 lines) - Requirements Guide
+- `docs/procurement.md` (503 lines) - Vendor Procurement Guide
+- `docs/design-review.md` (668 lines) - Design Review Guide
+- `docs/traceability.md` (639 lines) - Traceability Guide
+- `docs/uk-government-digital-marketplace.md` (684 lines) - Digital Marketplace Guide
+
+### Changed
+
+- Updated `README.md` with UK Government support section
+- Added UK Government example workflows
+- Updated supported commands from 7 to 14
+
+## [0.1.0] - 2025-10-13
+
+### Added
+
+- Initial release of ArcKit
+- `/arckit.principles` - Create architecture principles
+- `/arckit.requirements` - Define comprehensive requirements
+- `/arckit.wardley` - Create Wardley Maps for strategic planning
+- `/arckit.diagram` - Generate architecture diagrams with Mermaid
+- `/arckit.sow` - Generate Statement of Work for RFPs
+- `/arckit.evaluate` - Create vendor evaluation frameworks
+- `/arckit.hld-review` - Review High-Level Design
+- `/arckit.dld-review` - Review Detailed Design
+- `/arckit.secure` - UK Government Secure by Design review
+- `/arckit.traceability` - Generate requirements traceability matrix
+- `/arckit.analyze` - Analyze architecture complexity
+- `/arckit.servicenow` - Export to ServiceNow CMDB
+
+### Templates
+
+- `templates/architecture-principles-template.md`
+- `templates/requirements-template.md`
+- `templates/wardley-map-template.md`
+- `templates/architecture-diagram-template.md`
+- `templates/sow-template.md`
+- `templates/evaluation-criteria-template.md`
+- `templates/vendor-scoring-template.md`
+- `templates/hld-review-template.md`
+- `templates/dld-review-template.md`
+- `templates/ukgov-secure-by-design-template.md`
+- `templates/traceability-matrix-template.md`
+
+### CLI Tool
+
+- `arckit init` command to bootstrap new projects
+- Support for Claude Code, OpenAI Codex CLI, and Gemini CLI
+- Bash and PowerShell script support
+
+### Documentation
+
+- Comprehensive README.md with examples
+- Quick start guide
+- Agent compatibility matrix
+
+---
+
+## Release Links
+
+- [v1.3.0](https://github.com/tractorjuice/arc-kit/releases/tag/v1.3.0) - External Document Support & Dynamic Version Placeholders
+- [v1.2.0](https://github.com/tractorjuice/arc-kit/releases/tag/v1.2.0) - Autonomous Agent System
+- [v1.0.0](https://github.com/tractorjuice/arc-kit/releases/tag/v1.0.0) - Production Release - Enterprise Architecture Governance Toolkit
+- [v0.3.1](https://github.com/tractorjuice/arc-kit/releases/tag/v0.3.1) - Data Modeling with ERD, GDPR Compliance, and Data Governance
+- [v0.3.0](https://github.com/tractorjuice/arc-kit/releases/tag/v0.3.0) - Green Book & Orange Book Edition (SOBC + Risk Management)
+- [v0.2.2](https://github.com/tractorjuice/arc-kit/releases/tag/v0.2.2) - OpenAI Codex CLI Support & Enhanced Stakeholder Analysis
+- [v0.2.1](https://github.com/tractorjuice/arc-kit/releases/tag/v0.2.1) - Stakeholder Analysis & Conflict Resolution
+- [v0.2.0](https://github.com/tractorjuice/arc-kit/releases/tag/v0.2.0) - UK Government Compliance Edition
+- [v0.1.0](https://github.com/tractorjuice/arc-kit/releases/tag/v0.1.0) - Initial Release
+
+---
+
+## Version Numbering
+
+ArcKit follows [Semantic Versioning](https://semver.org/):
+
+- **MAJOR** version (X.0.0): Incompatible API changes or breaking workflow changes
+- **MINOR** version (0.X.0): New features added in a backward-compatible manner
+- **PATCH** version (0.0.X): Backward-compatible bug fixes and documentation updates
+
+**Examples**:
+
+- v0.1.0 → v0.2.0: Added UK Government support (new features)
+- v0.2.0 → v0.2.1: Added stakeholder analysis (new feature)
+- v0.2.1 → v0.2.2: Added Codex CLI support (new feature)
+- v0.2.2 → v0.3.0: Added Green Book SOBC + Orange Book risk management (significant new features)
+- v0.3.0 → v0.3.1: Added data modeling command (new feature)
+- v0.x.x → v1.0.0: Production release with 40 commands, complete governance toolkit (major)