open/ms-ai-architect
1
0
Fork 0
Code Issues Releases 1 Activity

fix(ms-ai-architect): #7d privat-sektor-paritet — sektor-parametrisering + onboarding-forgrening + 2 nye kommandoer (audit §5)

Browse source 
Audit §161-185: kjerne-dybden var sektor-agnostisk, men entry-points/kalibrering/
navigasjon var systematisk offentlig-sektor-først. Operatørvalg: full audit (kjerne
+ begge nye kommandoer). Telling 27→29 kommandoer. Ingen versjonsbump (→ #9-release).

Mekanisk kjerne:
- Sektor parametrisert i 6 kmd (classify/dpia/ros/review default nøytral m/offentlig-
  spesialisering; utredning beholder utredningsinstruksen + peker privat til :design;
  review får privat/regulert-gren DORA/Finanstilsynet). frontmatter-desc for review
  synket i CLAUDE/help.
- FRIA-scope KORRIGERT (verifisert mot AI Act Art. 27(1), WebSearch 2026-06-18):
  obligatorisk for (a) offentligrettslige organer, (b) private som leverer offentlige
  tjenester, (c) private deployere i kredittscoring (UNNTATT svindeldeteksjon) +
  livs-/helseforsikringsprising. Ikke lenger feilrådet som rent offentlig-verktøy.
- onboarding-agent forgrenet: sektortype (offentlig/privat) → private sektor-valg
  + privat reg-sett (DORA/Finansforetaksloven/IKT-forskrift/Verdipapirhandelloven);
  stiller ALDRI private om Offentleglova/Arkivloven. Sektortype skrevet til org-fil.
- requirements detekterer finans → DORA/Finanstilsynet (betinget §3-sjekkliste).

Nye kommandoer (refererer kun eksisterende kjerne-KB → ingen nye orphans):
- /architect:design — sektor-nøytralt Solution Architecture Document (mellombane
  mellom samtale og full utredning).
- /architect:vendor — tredjeparts/SaaS due diligence (dataresidens, sub-prosessorer,
  DPA, Schrems II/EDPB-TIA, AI Act-deployer).

Navigasjon/wiring:
- README: privat-enterprise-arbeidsflyt (eksempel 5) + DORA/FRIA-nyanse + design/vendor
  i tabeller + "Beyond Public Sector"-note.
- help.md: privat-bane i arbeidsflyt + design/vendor + manglende kb-update lagt til.
- CLAUDE.md-tabell: design/vendor + synket review/frimpact-desc.
- playground: katalog-oppføringer (produces_report:false), SHARED.sector utvidet med
  private sektorer, 2 privat-seeds (fraud-detection FRIA-unntatt + kredittscoring
  FRIA-pliktig). Telling 25/27→29 i playground/docs/README/test.

Tester: validate 239 PASS · playground v3 223 static / 390 kombinert · kb-integrity
115/115 · run-e2e alle suiter — 0 FAIL. CHANGELOG-«24 commands» bevart (historiske notater).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01REiKFhP4w6xGXXqWKpPCJJ
This commit is contained in:
Kjell Tore Guttormsen 2026-06-18 18:27:51 +02:00
commit 6e1fc6d37c
16 changed files with 291 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

27
README.md
View file

@ -124,12 +124,14 @@ Cosmo will ask clarifying questions about your business need, licenses, data sou
| `/architect:review` | Architecture review against Norwegian public sector requirements |
| `/architect:dpia` | DPIA/PVK for an AI system with risk matrix and mitigation table |
| `/architect:license` | Map AI capabilities per license type (E3, E5, F1, G5, etc.) |
| `/architect:vendor` | Third-party / SaaS vendor due diligence — data residency, sub-processors, DPA, Schrems II, AI Act deployer obligations |
### Documentation & Output
| Command | Description |
|---------|-------------|
| `/architect:adr` | Generate Architecture Decision Record (MADR v3.0) |
| `/architect:design` | Sector-neutral Solution Architecture Document (SAD) — context, NFRs, options, chosen design, risk, roadmap |
| `/architect:summary` | Generate executive summary and decision memo from assessments |
| `/architect:diagram` | Generate architecture diagram with Imagen 3 or Mermaid |
| `/architect:export` | Export architecture document to PDF |
@ -275,11 +277,28 @@ BCDR planning, hybrid and edge deployment, sovereign cloud (Norway regions), net
/architect:export # PDF for stakeholders
```
### 5. Private Sector / Enterprise — Design → Security → Cost → ADR
The same depth applies outside the public sector, without the Utredningsinstruksen/Digdir scaffolding:
```
/architect:classify # AI Act applies to all providers/deployers — public and private
/architect:design # Sector-neutral Solution Architecture Document (not utredning)
/architect:security # 6-dimension security assessment
/architect:cost # Cost estimate with P10/P50/P90
/architect:vendor # Due diligence on external SaaS/AI vendors
/architect:adr # Formalize the decision
```
> For **regulated** private sector (finance), `/architect:ros` and `/architect:requirements` auto-surface DORA / Finanstilsynet / Finansforetaksloven coverage via the 17-point finance checklist in the KB. Note: FRIA (`/architect:frimpact`) is mandatory for private deployers in credit scoring (excl. fraud detection) and life/health-insurance pricing — not only public bodies.
---
## Norwegian Public Sector Features
This plugin is specifically designed for Norwegian public sector governance requirements:
This plugin's regulatory depth is calibrated for Norwegian public sector — but the core (security scoring, cost models, ROS, the finance/DORA checklist, RAG/engineering KB) is sector-agnostic. Private and regulated-sector users get a parallel path: see [Workflow Example 5](#workflow-examples) and `/architect:design` / `/architect:vendor`.
The public sector framework coverage:
### Regulatory Frameworks
@ -355,7 +374,7 @@ Two runtime hooks provide session context and safety guardrails:
Interactive **decision-builder + report viewer** for Microsoft AI architecture decisions, runnable from `file://` without a server. Replaces the v2 5-step pipeline with a multi-surface app that persists state across sessions and visualizes parsed reports inline.
- **File:** `playground/ms-ai-architect-playground.html` (~3870 lines, single-file v3 architecture)
- **4 surfaces:** Onboarding (18 shared fields) → Home (project list + 3 entry tracks) → Catalog (24 commands grouped by 5 expansion categories with search) → Project (per-project tabs, command form prefill, paste-back report import + visualization)
- **4 surfaces:** Onboarding (18 shared fields) → Home (project list + 3 entry tracks) → Catalog (29 commands grouped by 5 expansion categories with search) → Project (per-project tabs, command form prefill, paste-back report import + visualization)
- **Persistent state:** IndexedDB primary store with localStorage fallback. Schema-versioned (`STATE_KEY = 'ms-ai-architect-state-v1'`) with eager `MIGRATIONS` pipeline.
- **17 report renderers:** Each report-producing command has a parser (markdown → structured) and renderer (structured → HTML visualization: pyramid, matrix, radar, findings, distribution, capability-matrix, etc.) wired through a canonical archetype-routing table.
- **Theme:** Dark default + light mode toggle, persisted in `localStorage('ms-ai-architect-theme')`. Both themes ship Aksel-aligned tokens (full WCAG AA contrast) as of v1.10.0; theme-bootstrap script in `<head>` prevents FOUC.
@ -415,7 +434,7 @@ Screenshots of every surface in both themes live in `playground/screenshots/v1.1
| 03 | `03-project-rapporter-tool-{dark,light}.png` | 7 tool commands (no report — pipeline-string builders) |
| 04-06 | `04-project-oversikt-{dark,light}.png` etc. | Project screen-tabs (oversikt / kontekst / eksport) |
| 07 | `07-home-{dark,light}.png` | Home with project list + 3 entry tracks |
| 08 | `08-catalog-{dark,light}.png` | Catalog with 24 commands in 5 expansion-grupper |
| 08 | `08-catalog-{dark,light}.png` | Catalog with 29 commands in 5 expansion-grupper |
| 09 | `09-onboarding-prefilled-{dark,light}.png` | Onboarding with state from demo |
Regenerate via `cd tests/screenshot && npm install && npx playwright install chromium && node run.mjs`.
@ -424,7 +443,7 @@ Regenerate via `cd tests/screenshot && npm install && npx playwright install chr
| Test | Command | Coverage |
|------|---------|----------|
| Static structure | `bash tests/test-playground-v3.sh` | 201 PASS — vendored CSS, surfaces, 24 commands, 14 parsers, 17 renderers (felles grunnskjelett), design-system classes, action handlers, Tier 3-bruk, onboarding field-distribution |
| Static structure | `bash tests/test-playground-v3.sh` | 223 PASS — vendored CSS, surfaces, 29 commands, 14 parsers, 17 renderers (felles grunnskjelett), design-system classes, action handlers, Tier 3-bruk, onboarding field-distribution |
| Parser fixtures | `bash tests/test-playground-parsers.sh` | 70 PASS — 17 fixtures × parser routing |
| Migrations | `bash tests/test-playground-migrations.sh` | 7 PASS — v1→v2 idempotent migration |
| Combined (E2E) | `bash tests/run-e2e.sh --playground` | static + parser suites |