feat: arckit-au — Australian Federal / DISP-supplier overlay (supersedes #441)

.claude-plugin/marketplace.json

@@ -13,7 +13,7 @@
       "name": "arckit",
       "source": "./arckit-claude",
       "description": "71 slash commands for enterprise architecture artifacts, vendor procurement, and UK Government compliance",
-      "version": "5.0.0-alpha.7",
+      "version": "5.0.0-alpha.8",
       "author": {
         "name": "TractorJuice"
       },
@@ -127,6 +127,26 @@
         "compliance"
       ],
       "category": "productivity"
+    },
+    {
+      "name": "arckit-au",
+      "source": "./arckit-au",
+      "description": "Australian Federal Overlay — 8 commands for ASD Essential Eight, ISM, DTA DSS, Privacy Act 1988, OAIC NDB, PSPF, AI Assurance, DISP attestation",
+      "version": "5.0.0-alpha.1",
+      "author": {
+        "name": "TractorJuice"
+      },
+      "homepage": "https://github.com/tractorjuice/arc-kit",
+      "repository": "https://github.com/tractorjuice/arc-kit",
+      "license": "MIT",
+      "keywords": [
+        "architecture",
+        "governance",
+        "australia",
+        "compliance",
+        "disp"
+      ],
+      "category": "productivity"
     }
   ]
 }

CHANGELOG.md

@@ -11,7 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### BREAKING
 
-- **Community overlays moved to separate plugins**. The monolithic `arckit` plugin shipped 117 commands (71 core + 46 community). v5.0.0 splits the 46 community commands into five per-jurisdiction marketplace plugins: `arckit-uae` (12 commands + 2 recipes), `arckit-fr` (12), `arckit-ca` (12 + 1 recipe), `arckit-eu` (7), `arckit-at` (3). Users now install only the jurisdictions they need.
+- **Community overlays moved to separate plugins**. The monolithic `arckit` plugin shipped 117 commands (71 core + 46 community). v5.0.0 splits community commands into six per-jurisdiction marketplace plugins: `arckit-uae` (12 commands + 2 recipes), `arckit-fr` (12), `arckit-ca` (12 + 1 recipe), `arckit-eu` (7), `arckit-at` (3), and `arckit-au` (8 + 1 recipe — new in v5.0.0). Users now install only the jurisdictions they need. Total surface: 125 commands across 7 plugins.
   - **Migration:** after upgrading, install the community plugins you previously used. A one-shot SessionStart banner reads `.arckit/manifest.json` and prints the exact `claude plugin install ...` command for your project. Acknowledge with `touch .arckit/v5-migration-acked`.
   - **Token savings:** UK-only users save ~5K tokens per SessionStart system reminder (estimate — to be replaced with measured figures in Task 16).
   - **No functional change** for users who install all 6 plugins — the full 117-command surface is intact, just spread across plugins.
@@ -22,7 +22,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `scripts/check_doctype_collisions.py` — CI gate asserting every doc-type code in `arckit-claude/config/doc-types.mjs` is unique.
 - `scripts/tag-plugins.sh` — creates native `<plugin>--vX.Y.Z` tags per release (idempotent).
 - `arckit-claude/hooks/v5-migration-banner.mjs` — one-shot SessionStart hook suggesting per-jurisdiction installs based on prior project artefacts.
-- 5 new plugin directories: `arckit-uae/`, `arckit-fr/`, `arckit-ca/`, `arckit-eu/`, `arckit-at/`, each with their own `plugin.json`, `README.md`, `VERSION`, `commands/`, `templates/`, and (where applicable) `recipes/`.
+- 6 new plugin directories: `arckit-uae/`, `arckit-fr/`, `arckit-ca/`, `arckit-eu/`, `arckit-at/`, `arckit-au/`, each with their own `plugin.json`, `README.md`, `VERSION`, `commands/`, `templates/`, and (where applicable) `recipes/`.
+- **`arckit-au`** Australian Federal / DISP-supplier overlay — 8 commands (`au-e8-posture`, `au-pia`, `au-dss`, `au-ism-controls`, `au-ndb-playbook`, `au-pspf`, `au-ai-assurance`, `au-disp-attestation`), 8 templates, and the `au-federal` recipe (35 targets, 9 waves). 8 new doc-type codes registered in `arckit-claude/config/doc-types.mjs` (`AUE8`, `AUISM`, `AUPIA`, `AUNDB`, `AUDSS`, `AUPSPF`, `AUAIA`, `AUDISP`). Adds `AU` regime; also adds `CA` retroactively (CA shipped doc-types in v4.15.0 but was missing from `REGIMES`). Domain co-maintainer: @royster70. Supersedes #441.
 
 ### Changed
 

CLAUDE.md

@@ -9,7 +9,7 @@ ArcKit is an **Enterprise Architecture Governance & Vendor Procurement Toolkit**
 **Six distribution formats** exist side-by-side in this repo:
 
 1. **CLI package** (`src/arckit_cli/`) — Python CLI installed via `pip`/`uv`, runs `arckit init` to scaffold projects for Codex CLI or OpenCode CLI
-2. **Claude Code plugins** (`arckit-claude/`, `arckit-uae/`, `arckit-fr/`, `arckit-ca/`, `arckit-eu/`, `arckit-at/`) — installed via marketplace (`/plugin marketplace add tractorjuice/arc-kit`). Core `arckit` ships 71 commands + all hooks/MCP/doc-types config. Five community overlays ship per-jurisdiction commands and recipes. Install only what you need; community plugins require the `arckit` core plugin.
+2. **Claude Code plugins** (`arckit-claude/`, `arckit-uae/`, `arckit-fr/`, `arckit-ca/`, `arckit-eu/`, `arckit-at/`, `arckit-au/`) — installed via marketplace (`/plugin marketplace add tractorjuice/arc-kit`). Core `arckit` ships 71 commands + all hooks/MCP/doc-types config. Six community overlays ship per-jurisdiction commands and recipes. Install only what you need; community plugins require the `arckit` core plugin.
 3. **Gemini CLI extension** (`arckit-gemini/`) — published as `tractorjuice/arckit-gemini`, installed via `gemini extensions install`
 4. **OpenCode CLI extension** (`arckit-opencode/`) — scaffolded via `arckit init --ai opencode`
 5. **Codex CLI extension** (`arckit-codex/`) — published as `tractorjuice/arckit-codex`

README.md

@@ -72,11 +72,11 @@ claude plugin install arckit
 # UK + UAE federal
 claude plugin install arckit arckit-uae
 
-# Everything (117 commands across UK + UAE + FR + CA + EU + AT)
-claude plugin install arckit arckit-{uae,fr,ca,eu,at}
+# Everything (125 commands across UK + UAE + FR + CA + EU + AT + AU)
+claude plugin install arckit arckit-{uae,fr,ca,eu,at,au}
 ```
 
-All 6 plugins come from the same `tractorjuice/arc-kit` marketplace. Community plugins (`arckit-uae`, `arckit-fr`, `arckit-ca`, `arckit-eu`, `arckit-at`) require the `arckit` core plugin.
+All 7 plugins come from the same `tractorjuice/arc-kit` marketplace. Community plugins (`arckit-uae`, `arckit-fr`, `arckit-ca`, `arckit-eu`, `arckit-at`, `arckit-au`) require the `arckit` core plugin.
 
 > **Tip: lighter marketplace clone.** The command above clones the full arc-kit monorepo (~100 MB) because it hosts five other AI-assistant distributions, 147 vendored Wardley maps, and research docs you don't need. To fetch just the plugin's directories, add the marketplace via the CLI with `--sparse`:
 >

arckit-au/.claude-plugin/plugin.json

@@ -0,0 +1,12 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
+  "name": "arckit-au",
+  "version": "5.0.0-alpha.1",
+  "description": "Australian Federal Overlay for ArcKit — 8 commands for ASD Essential Eight, ISM, DTA Digital Service Standard, Privacy Act 1988 PIA, OAIC Notifiable Data Breach, PSPF, DTA AI Assurance, and DISP supplier attestation. Recipe: au-federal. Requires arckit core plugin.",
+  "author": {
+    "name": "TractorJuice",
+    "url": "https://github.com/tractorjuice"
+  },
+  "repository": "https://github.com/tractorjuice/arc-kit",
+  "license": "MIT"
+}

arckit-au/CHANGELOG.md

@@ -0,0 +1,33 @@
+# Changelog — arckit-au
+
+All notable changes to the `arckit-au` plugin will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [5.0.0] - 2026-XX-XX
+
+### Added
+
+Initial release of `arckit-au` — Australian Federal Government / DISP-supplier compliance overlay. Supersedes PR #441 (au-federal-recipe by @royster70) by restructuring the same content into the v5.0.0 per-jurisdiction layout.
+
+**8 community-overlay commands** (validated end-to-end against a real Australian SMB engagement; DISP-track, OFFICIAL:Sensitive):
+
+- `au-e8-posture` — ASD Essential Eight ML0–ML3 maturity assessment
+- `au-pia` — Privacy Act 1988 s33D Privacy Impact Assessment (13 APPs)
+- `au-dss` — DTA Digital Service Standard (13 criteria)
+- `au-ism-controls` — ASD ISM Statement of Applicability (17 control domains)
+- `au-ndb-playbook` — OAIC Notifiable Data Breach response playbook
+- `au-pspf` — Protective Security Policy Framework (4 outcomes / 16 core requirements)
+- `au-ai-assurance` — DTA AI Assurance Framework + Responsible AI Policy v2.0 baseline
+- `au-disp-attestation` — DISP Member self-attestation pack (consolidates E8 + ISM + PIA + NDB + PSPF)
+
+**Recipe:** `au-federal` (35 targets across 9 build waves).
+
+**8 doc-type codes** registered in `arckit-claude/config/doc-types.mjs` (per the v5.0.0 spec, doc-types stay in core): `AUE8`, `AUISM`, `AUPIA`, `AUNDB`, `AUDSS`, `AUPSPF`, `AUAIA`, `AUDISP`. Regime `AU` added to `REGIMES` and `REGIME_LABELS`.
+
+**Validation evidence** preserved from PR #441: 25/25 evaluation scorecard pass, 220 AU framework references in validation artefacts, 0 UK framework leakage. See `docs/au-federal-validation-scorecard.md`.
+
+**Domain co-maintainer:** @royster70.

arckit-au/README.md

@@ -0,0 +1,34 @@
+# ArcKit — Australian Federal Overlay
+
+8 slash commands and the `au-federal` build recipe covering Australian Federal Government and DISP-supplier compliance:
+
+- `/arckit:au-e8-posture` — ASD Essential Eight ML0–ML3 maturity assessment (8 mitigation strategies)
+- `/arckit:au-pia` — Privacy Act 1988 s33D Privacy Impact Assessment (13 APPs)
+- `/arckit:au-dss` — DTA Digital Service Standard (13 criteria) compliance assessment
+- `/arckit:au-ism-controls` — ASD Information Security Manual Statement of Applicability (17 control domains)
+- `/arckit:au-ndb-playbook` — OAIC Notifiable Data Breach response playbook (Privacy Act 1988 Part IIIC)
+- `/arckit:au-pspf` — Protective Security Policy Framework (4 outcomes / 16 core requirements)
+- `/arckit:au-ai-assurance` — DTA AI Assurance Framework + Responsible AI Policy v2.0 baseline
+- `/arckit:au-disp-attestation` — DISP Member self-attestation pack (consolidates E8, ISM, PIA, NDB, PSPF)
+
+Recipe: `au-federal` (35 targets across 9 build waves).
+
+## Requires arckit core plugin
+
+```bash
+claude plugin install arckit arckit-au
+```
+
+Without `arckit` (core), recipes won't resolve their foundation commands (`arckit:principles`, `arckit:requirements`, etc.) and `validate-arc-filename` won't recognise AU doc-type codes (`AUE8`, `AUISM`, `AUPIA`, `AUNDB`, `AUDSS`, `AUPSPF`, `AUAIA`, `AUDISP`).
+
+## Validation
+
+End-to-end validated against a real Australian SMB engagement (DISP-track, OFFICIAL:Sensitive). 25/25 evaluation scorecard pass at Run 3, 0 UK framework leakage, 220 AU framework references. See [`docs/au-federal-validation-scorecard.md`](https://github.com/tractorjuice/arc-kit/blob/main/docs/au-federal-validation-scorecard.md).
+
+## Regulatory anchors
+
+ASD Essential Eight Maturity Model · ASD Information Security Manual · DTA Digital Service Standard · Privacy Act 1988 (Cth) including Tranche 1 reforms (Dec 2024) · Defence Industry Security Program (DISP) · Protective Security Policy Framework · Commonwealth Procurement Rules (November 2025 overhaul) · DTA AI Assurance Framework + Responsible AI Policy v2.0 · PGPA Act 2013 s16 · IRAP.
+
+## Maintainer
+
+Domain co-maintainer: @royster70. Originally contributed via PR #441 (au-federal-recipe).

arckit-au/VERSION

@@ -0,0 +1 @@
+5.0.0-alpha.1