ArcKit v6.19.0

Added

• Distinguish scored and indicative chart marks
• Show uncertainty envelopes for incomplete scores
• Add draft legacy IT assessment workflow

Fixed

• Address review and verify live assessments
• Calculate continuous component positions and ranges
• Restore required citation reference tables
• Clarify evidence, approvals and assessment reports
• Use SLSA v1.2 Build L0-L3 and Source L1-L4 in the SBOM command (#1042)
• Use the Code's eight pillars and add du's National Hypercloud as a candidate CSP (#1042)
• Rebuild the SBOM command on OMB M-26-05 and replace dead FedRAMP and OMB links (#1042)
• Cover implementatiekader Art. 7 in nl-exit (#1042)
• Build the data model first, use the Act's current title, add Charter s.11 (#1042)
• Cite maturity benchmarks, drop levels NIST AI RMF and OWASP don't define (#1042)
• Reflect the Implementatiekader risicoafweging cloudgebruik in nl-cloud (#1042)
• Cover the enhanced CIRMP in the SOCI pack; fix the DISP E8 cross-reference (#1042)
• List arckit-nl, arckit-au-energy, arckit-oaa and arckit-repo in the commands page tier list (#1042)
• Ca-aia publishes before production, not 30 days pre-launch; peer review by Level (#982)
• Align uae-pdpl with the Decree-Law's own articles (#982)
• Cite the TBS Standard on PIA, drop the 30-day OPC claim, annual PSIB target, FITAA after the data model (#982)
• Add PDPL Article 2(2) scope test, correct transfer grounds and CSP certifications (#982)
• Working FCA Handbook section links, overlay guide recipe, README overlay order (#982)
• Add PAMS, the décret 2026-272 art. 3 derogation, and the real OIV/OSE qualification duties (#982)
• Move AI assurance to OMB M-25-21/M-25-22, drop the JAB path, and align the readiness check with the RAR (#982)
• Use ASD's Essential Eight strategy names, unnumbered (#982)
• Call APP the Application Inventory and read STRAT from 000-global (#982)
• ISM guidelines, AI/PSPF template fixes, SOCI reporting rows, au-energy risk target (#982)
• Word REEN art. 35 as one binding duty, not the only one (#982)
• SM&CR scope, Allied Wallet / Premier FX facts, Dear CEO date, soft-decline wording (#982)
• Run ca-charter after the PIA and FITAA, drop circular handoffs, PSIB and the C-70 SOIA title (#982)
• Name policy owners from the UAE Legislation Platform and align residency with NCSP v2.0 (#982)
• APRA CPS 234, GDPR article rows, TOGAF 10th Edition (#982)
• Regenerate the Python document-ID helper's multi-instance list (#982)
• Show changes/, audits/, framework/ and procurement/ on the pages dashboard (#982)
• Gap-analysis reads the Application Inventory and Rationalisation (#982)
• PACS, CRPA publication duty, environmental criterion, RGESN status, 2026 thresholds, SecNumCloud date (#982)
• Data Act Chapter II rows and the guide's F2 attribution (#982)
• Follow DTAC form 2.0, pin the SAFETY.md spec, fix dead design-log links (#982)
• Data Act citations, Cloud Sovereignty weighting source, NIS2 status in France (#982)
• Cite O-AA Standard v2.0 (C262), fix Sprint 2 phase, neutral examples (#982)
• NISG 2026 registration date, scope and channel, BaFG refs checked, BVergGVS/BVergGKonz are Acts (#982)
• Show overlay commands in their Claude Code form (#982)
• Order governance, security, integration; Critical escalation; real maturity sources (#982)
• Name the five clause 3.1 aspects, run risk after the NL commands (#982)
• Bust the awareness.js cache, cover 429 draw markers, align the plan
• Filter every gitignored path from the manifest and port the guard to Codex
• Resolve symlinks and anchor allowed dirs in file-protection
• Normalise Kimi file-tool payloads and fail closed in security guards
• Fence session history and external file names in SessionStart context
• Write docs/health.json without following symlinks
• Neutralise HTML from untrusted OKF bundles in RSCH notes
• Withhold reader replies that fail the handoff check
• Confine validate-arc-filename to /projects// and drop mkdirSync
• Drop PreToolUse allow for plugin Reads and script calls
• Deny Bash commands that name a protected credential file
• Make each quiz draw single-use and drop the score from a fail
• Escape quotes in escapeHtml; escape dashboard paths
• Escape nav titles/paths everywhere, show source when DOMPurify is missing, run Mermaid strict
• Escape search/doc titles and sanitise rendered markdown with DOMPurify

Changed

• Move assessment into optional UK overlay
• Monthly traction report 2026-11 (#1055)
• Resolve the Codex root temp path so the parity test runs on macOS
• Record the 28 October checks of owners, PDPL Article 22 and the cloud policy (#1042)
• Call the NHS overlay the second sector overlay, after UK Finance (#982)
• Record the guides.html lastmod from the site build (#982)
• Note corrections on the v5.3 UK finance overlay articles (#982)
• Record the 6.18.3 posts in the group and Discord
• Leave the plugin changelog to the release bump
• Record Kimi adapter normalisation in CHANGELOG and ENFORCEMENT
• Changelog and ENFORCEMENT row for the health.json symlink guard
• Record that failed reader replies are withheld
• Cover path traversal and no-mkdir in validate-arc-filename
• Document single-use draws and changelog entry
• Correct the plugin counts in CLAUDE.md
• Bring RELEASING.md and the release skill up to date after 6.18.3