​

Governance Quality Analysis

​

Command

arckit analyze <project ID or scope>

​

Arguments

• scope (required): Project ID or “all projects”

​

Examples

arckit analyze "001"
arckit analyze "all projects"

​

Purpose

​

Operating Constraints

• Non-Destructive: Do NOT modify existing artifacts
• Architecture Principles Authority: Principles are non-negotiable - conflicts require adjustment of requirements/designs, not principles
• UK Government Compliance Authority: TCoP, AI Playbook, ATRS compliance are mandatory
• Evidence-Based: Every finding must cite specific file:section:line references

​

Detection Passes

​

A. Requirements Quality Analysis

• Near-duplicate requirements across BR/FR/NFR categories
• Redundant requirements that should be consolidated

• Vague adjectives lacking measurable criteria (“fast”, “secure”, “scalable”)
• Missing acceptance criteria
• Unresolved placeholders (TODO, TBD, TBC, ???)

• Requirements with verbs but missing measurable outcomes
• Missing NFR categories (no security, no performance, no compliance)
• Missing data requirements (handles sensitive data but no DR-xxx)

• All requirements marked as MUST (no prioritization)
• No MUST requirements (everything is optional)
• Conflicting priorities

​

B. Architecture Principles Alignment

• Requirements or designs that violate architecture principles
• Technology choices that conflict with approved stack
• Security approaches that violate security-by-design principle

• Principles not reflected in requirements
• Principles not validated in design reviews

​

C. Requirements → Design Traceability

• Requirements with zero design coverage
• Critical MUST requirements not covered
• Security requirements (NFR-S-xxx) not in security architecture
• Performance requirements (NFR-P-xxx) not validated in design

• Components in HLD/DLD not mapped to any requirement
• Technology choices not justified by requirements

​

D. Vendor Procurement Analysis

• SOW requirements match ARC--REQ-.md?
• Missing evaluation criteria?
• Ambiguous acceptance criteria?

• Evaluation criteria align with requirement priorities?
• All critical requirements included in evaluation?

​

E. Stakeholder Traceability Analysis

• All requirements traced to stakeholder goals?
• Orphan requirements (not linked to any stakeholder goal)?

• Requirement conflicts documented and resolved?
• Decision authority identified?

• Risk owners from stakeholder RACI matrix?
• Data owners from stakeholder RACI matrix?

​

F. Risk Management Analysis

• High/Very High inherent risks have mitigation requirements?
• Risks reflected in design?
• Risk owners assigned and aligned with RACI matrix?

• Strategic risks reflected in Strategic Case urgency?
• Financial risks in Economic Case cost contingency?

​

G. Business Case Alignment

• All benefits mapped to stakeholder goals?
• All benefits supported by requirements?
• Benefits measurable and verifiable?

• Do Nothing baseline included?
• Recommended option justified by requirements scope?

​

H. Data Model Consistency

• All DR-xxx requirements mapped to entities?
• All entities traced back to DR-xxx requirements?

• Database schemas in DLD match data model entities?
• CRUD matrix aligns with component design in HLD?

​

I. UK Government Compliance

• Assessment exists?
• All 13 points assessed?
• Critical issues resolved?

• Assessment exists?
• Risk level determined?
• All 10 principles and 6 themes assessed?
• Mandatory assessments completed (DPIA, EqIA, Human Rights)?

• Record exists?
• Tier 1 and Tier 2 completed?
• Ready for GOV.UK publication?

​

J. MOD Secure by Design Compliance

• All 7 principles assessed?
• CAAT registered and updated?
• DTSL appointed?

• Identify, Protect, Detect, Respond, Recover functions covered?

• First Line (DTSL), Second Line (Technical Coherence), Third Line (Audit) implemented?

​

K. Consistency Across Artifacts

• Same concept named differently across files
• Inconsistent capitalization/formatting

• Stack choices in HLD match principles
• Technology in DLD matches HLD

​

Severity Assignment

• Violates architecture principles (MUST)
• Missing core artifact (no ARC--REQ-.md)
• MUST requirement with zero design coverage
• Stakeholder: Orphan requirements not linked to goals
• Risk: High/Very High risks with no mitigation
• UK Gov: TCoP/AI Playbook blocking issues
• MOD: CAAT not registered, no DTSL appointed

• Duplicate or conflicting requirements
• Ambiguous security/performance attribute
• Missing NFR category (no security, no performance)
• Vendor design doesn’t address SOW requirements

• Terminology drift
• Missing optional NFR coverage
• Underspecified edge case
• Minor traceability gaps

• Style/wording improvements
• Minor redundancy
• Documentation formatting

​

Output

• Executive summary with overall status and governance health score
• Findings summary table (ID, Category, Severity, Location, Summary, Recommendation)
• Requirements analysis with coverage matrix
• Architecture principles compliance
• Stakeholder traceability analysis
• Risk management analysis
• Business case analysis (if SOBC exists)
• Data model analysis (if DATA exists)
• UK Government compliance analysis (if applicable)
• MOD compliance analysis (if applicable)
• Security & compliance summary
• Recommendations (Critical/High/Medium/Low priorities)
• Metrics dashboard
• Detailed findings with examples

​

Governance Health Score

• A (90-100%): Excellent governance, ready to proceed
• B (80-89%): Good governance, minor issues
• C (70-79%): Adequate governance, address high-priority issues
• D (60-69%): Poor governance, major rework needed
• F (<60%): Insufficient governance, do not proceed

​

Prerequisites

• Check if projects/000-global/ARC-000-PRIN-*.md exists
• If NOT found: ERROR “Run /arckit:principles first”

• REQ (Requirements)
• STKE (Stakeholder Analysis)
• RISK (Risk Register)
• SOBC (Business Case)
• DATA (Data Model)
• Vendor HLD/DLD files
• Design review documents (HLDR, DLDR)
• Compliance assessments (TCOP, SECD, AIPB, ATRS)

​

Hook Pre-processing

• All artifact metadata, requirements, principles, risks, cross-references extracted
• Vendor data and placeholder counts available
• Go directly to semantic analysis and detection passes
• Do NOT re-read artifacts listed in hook output

​

Related Commands

• arckit conformance - Architecture conformance (ADR implementation, drift)
• arckit traceability - Requirements traceability matrix
• arckit principles-compliance - Detailed RAG scoring of principles
• arckit health - Quick metadata health check

​

Remediation Guidance

1. Specific edits to fix requirements
2. Design review guidance
3. Command sequences to address gaps
4. Templates for missing artifacts

• arckit principles - Create/update architecture principles
• arckit stakeholders - Analyze stakeholder drivers, goals, conflicts
• arckit risk - Create risk register
• arckit sobc - Create business case
• arckit data-model - Create data model
• arckit tcop - Technology Code of Practice assessment
• arckit ai-playbook - AI Playbook assessment
• arckit mod-secure - MOD Secure by Design assessment