Skip to content

fix(arckit-ca): name SOIA correctly and run the business case before ca-pspc (#949) - #967

Merged
tractorjuice merged 1 commit into
mainfrom
fix/949-ca
Oct 18, 2026
Merged

tractorjuice merged 1 commit into
mainfrom
fix/949-ca

Conversation

@tractorjuice

Copy link
Copy Markdown
Owner

Part of #949.

This is the Canada (arckit-ca) part of #949. Each disputed fact was checked against the primary source. The command, guide, recipe and dependency docs now agree.

Decisions

Item Decision Primary source
SOIA name. The ca-itsg-33 guide called it a "Statement of Initial Authority". SOIA is the Security of Information Act handling plan, as the ca-soia command, its template and doc-types.mjs already say. Only the guide was wrong; no other file used the "Initial Authority" name. Security of Information Act, R.S.C. 1985, c. O-5. Section 8(1) defines "special operational information". https://laws-lois.justice.gc.ca/eng/acts/O-5/
ca-pspc ordering. The command read the SOBC and also handed off to it. The guide said to run it after the business case, and the recipe ran the business case after it. Business case first, then procurement strategy. The sobc handoff is removed from the command and the guide. The command's SOBC input now says the strategy is written for the option the business case recommends. The guide's "When to run" cites the Directive and says to revisit the business case at the next gate if the strategy moves the cost or the route. In the recipe, SOBC deps are [REQ, STKE, RISK] and CA_PSPC deps are [REQ, SOBC, CA_ITSG, CA_CRES]. TBS Directive on the Management of Projects and Programmes: D.1 (every project must be supported by a business case); Appendix E, which puts the business-case results and the comparison of options (E.2.4) and the recommended option's baseline (E.2.5) ahead of the procurement strategy (E.2.7); 4.2.19 (business case revalidated at each gate). https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32594. Also the Directive on the Management of Procurement 4.2.5 (engage contracting authorities at the outset of investment planning): https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32692
Recipe ran REQ alongside STKE. STKE now runs before REQ (STKE in wave 2, REQ in wave 3). /arckit:requirements lists STKE as MANDATORY ("warn if missing"), while /arckit:stakeholders reads REQ only as context. plugins/arckit-claude/commands/requirements.md step 2

Other guide/command contradictions fixed (clear-cut)

  • ca-itsg-33 and ca-cloud-residency guides. Both guides named the DR-* requirements as the source of per-element sensitivity. Both commands read the data model (DATA) for it. fix: overlay commands, templates and guides name registered doc-type codes (#949) #964 changed the commands to DATA and the guides to DR-*, so the two drifted apart. The guides now list the data model. The ca-cloud-residency guide also gains the PIA input that its command reads.
  • ca-soia guide. It listed a PIA input that the command never reads. The recipe and the dependency matrix leave it out too, so the row is removed.
  • Dependency matrix (docs/ and plugin copies) and docs/commands.html. These listed fr-dr (France's Diffusion Restreinte command) as a recommended input to ca-itsg-33, which contradicted the matrix's own note that DR is not shown. The rows for ca-itsg-33 and ca-cloud-residency now show data-model at R, matching the commands' unmarked DATA read.
  • Recipe header. It described ca-pspc as "ICV", which is the UAE In-Country Value programme. It now says Indigenous procurement.

Docs updated to match the new recipe order

  • docs/WORKFLOW-DIAGRAMS.md 7a and 7b add stakeholders between principles and requirements, and run sobc before ca-pspc. These diagrams state that they show the recipe's run order.
  • docs/DEPENDENCY-MATRIX.md: in the 2026-05-04 Canada entry, the ca-pspc → sobc handoff row is removed and both canonical chains are re-ordered.

Files changed

  • plugins/arckit-ca/commands/ca-pspc.md
  • plugins/arckit-ca/recipes/ca-federal-fitaa.yaml
  • docs/guides/ca-itsg-33.md, ca-pspc.md, ca-soia.md, ca-cloud-residency.md. Their plugin copies were regenerated by check-guide-parity.py --sync.
  • docs/DEPENDENCY-MATRIX.md, plugins/arckit-claude/docs/DEPENDENCY-MATRIX.md, docs/commands.html, docs/WORKFLOW-DIAGRAMS.md
  • The nested mirror under plugins/arckit-claude/plugins/ca/, regenerated by sync-claude-plugin-layout.py

No template changes were needed. The ca-pspc template already reads the SOBC affordability envelope, which fits the business-case-first order.

Judgement calls left open

  1. Every other recipe runs REQ alongside STKE. That covers all four core recipes under skills/arckit-build/recipes/ and the au, us, uae, togaf, oaa, agent-architecture and au-energy recipes. This PR changes only the Canada recipe. Core sobc.md also says to run it "Before: /arckit:requirements", which does not match the core recipes, where SOBC runs after REQ. Both belong in a core follow-up.
  2. Other upstream-pointing handoffs in the overlay, left as they are: ca-soia → ca-itsg-33, ca-cloud-residency → ca-itsg-33, and ca-atip/ca-aia/ca-ocap → ca-pia. Each one hands off to a command it also reads as a prerequisite, so it works as a "revisit" cross-reference. None of them contradicts its guide or the recipe the way ca-pspc → sobc did.
  3. ca-charter vs ca-fitaa ordering. The ca-charter guide says Charter §2 analysis is "unconditional after /arckit:ca-fitaa" and "typically after the PIA". The recipe deliberately runs ca-charter first, because it informs the FITAA, PIA and AIA designs, and ca-fitaa hands off to ca-charter. The guide's wording can be read as "mandatory once FITAA applies", so it was not changed. A Canadian domain reviewer should choose.
  4. PSAB → PSIB. Across the overlay (command, guide, template, README), "Procurement Strategy for Indigenous Business" carries its pre-2021 acronym PSAB (Procurement Strategy for Aboriginal Business). Indigenous Services Canada now uses PSIB. This is stale wording, not a contradiction between files, so it is left for a separate change. Source: https://www.sac-isc.gc.ca/eng/1753131962825/1753132000580
  5. The Act's alternative title. The Security of Information Act may now also be cited as the Foreign Interference and Security of Information Act (2024, c. 16, s. 50, from Bill C-70). Bill C-70 also amended the Act itself, so the ca-soia guide's line that the Act "itself is comparatively stable" may be out of date. That line was not changed.

Checks

  • scripts/check_recipes.py: OK, 15 recipes validated
  • scripts/check-doc-type-registry.py: OK, 408 recipe targets agree with their command's declared doc-type
  • pytest: 2420 passed, 228 skipped
  • node --test tests/plugin/*.test.mjs tests/plugin/test_*.mjs tests/certification/*.test.mjs: 653 passed, 0 failed
  • Lint checks: 34 checks, 0 failed
  • markdownlint-cli2@0.18.1 "**/*.md": 0 errors
  • Sync order run: check-guide-parity.py --sync → sync-shared-assets.py (0 files) → sync-claude-plugin-layout.py → converter.py

🤖 Generated with Claude Code

…ca-pspc (#949)

SOIA. The ca-itsg-33 guide called the SOIA input a "Statement of
Initial Authority". The registered SOIA artefact is the Security of
Information Act handling plan (R.S.C. 1985, c. O-5; s.8 defines special
operational information), as the ca-soia command, template and the
doc-type registry already say. The guide now names it that way.
Source: https://laws-lois.justice.gc.ca/eng/acts/O-5/

ca-pspc ordering. The command both read the SOBC and handed off to it;
the guide said run it after the business case; the recipe ran the
business case after it. One order now: business case first. The TBS
Directive on the Management of Projects and Programmes requires every
project to be supported by a business case (D.1), and the project brief
reports the business case's comparison of options (E.2.4), the baseline
of the recommended option (E.2.5) and then the procurement strategy
(E.2.7); the business case is revalidated at each gate (4.2.19).
- command: the sobc handoff is removed; the SOBC input says the
  strategy is written for the option the business case recommends
- guide: the sobc handoff bullet is removed; "When to run" cites the
  Directive and says to revisit the business case at the next gate
- recipe: SOBC deps [REQ, STKE, RISK]; CA_PSPC deps add SOBC
- DEPENDENCY-MATRIX handoff row and Canada chains, WORKFLOW-DIAGRAMS
  7a/7b updated to the recipe's new order
Source: https://www.tbs-sct.canada.ca/pol/doc-eng.aspx?id=32594

REQ alongside STKE. The recipe ran requirements in the same wave as
stakeholders, but /arckit:requirements lists the stakeholder analysis
as MANDATORY. REQ now depends on STKE (waves: STKE 2, REQ 3).

Guide/command contradictions found in the overlay read-through:
- ca-itsg-33 and ca-cloud-residency guides listed DR-* requirements as
  the per-element sensitivity source; both commands read the DATA
  artefact (data model) for it. Guides now list the data model, and
  the cloud-residency guide adds the PIA input the command reads.
- ca-soia guide listed a PIA input the command never reads (nor the
  recipe or the matrix); the row is removed.
- DEPENDENCY-MATRIX (both copies) and commands.html listed fr-dr
  (France's Diffusion Restreinte) as a ca-itsg-33 input; the command
  reads the data model. ca-itsg-33 and ca-cloud-residency rows now show
  data-model at R.
- recipe header described ca-pspc as "ICV" (the UAE In-Country Value
  programme); it now says Indigenous procurement.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@tractorjuice tractorjuice added the bug Something isn't working label Oct 18, 2026
@tractorjuice
tractorjuice merged commit 26f5cf8 into main Oct 18, 2026
3 checks passed
@tractorjuice
tractorjuice deleted the fix/949-ca branch October 18, 2026 10:45
MarkkuPekkarinen pushed a commit to MarkkuPekkarinen/arc-kit that referenced this pull request Oct 18, 2026
/arckit:requirements reads the stakeholder analysis and warns when it is
missing, but all four core recipes (uk-saas, uk-mod-sovereign,
uk-nhs-clinical-safety, uk-fs-payments) and most overlay recipes ran REQ
and STKE in the same wave off PRIN, so a bulk build always wrote the
requirements without the stakeholder analysis.

- REQ now depends on STKE in the four core recipes and in the au-energy,
  us-federal, uae-agentic-transformation and uae-federal-ai recipes.
  Canada was fixed in tractorjuice#967; agent-architecture, au-federal, oaa-full,
  togaf-adm-full and togaf-agent-full are being fixed in their own tractorjuice#949
  overlay PRs.
- check_recipes.py gains ORDER_RULES (STKE before REQ, transitive deps
  count) and fails a recipe that breaks it. The five recipes whose fix
  is in flight sit in ORDER_RULES_PENDING and only warn; empty that set
  once those PRs merge.
- tests/plugin/test_recipe_order_rules.py probes the rule end to end:
  same wave fails, a direct or transitive dependency passes.
- sobc: "Before: /arckit:requirements" contradicted every recipe, which
  build SOBC after REQ and RISK. It is now "Usually before", and says
  existing requirements are read as the OPTIONAL input they already are.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant