feat: split Open Agile Architecture into standalone arckit-oaa plugin

[terrygzhou]

Motivation

Open Agile Architecture (O-AA, standard C208) currently ships inside arckit-togaf-adm as an extension of the TOGAF overlay. O-AA is a different practice (agile, product-driven, sprint-based EA vs TOGAF's document-centric ADM) and users who only want one of the two are forced to install both. This split extracts O-AA into its own standalone community plugin, arckit-oaa, with its own command namespace, doc-type codes, recipe, and templates. The two overlays remain complementary (see the O-AA vs TOGAF ADM decision guide in the plugin README).

Changes

• New plugin plugins/arckit-oaa/ — five commands (oaa-adm-lite, product-architecture, agile-strategy, agile-security, agile-governance), oaa-full build recipe, references, templates (incl. document-control-*.md partials), userConfig support, nested mirror under plugins/arckit-claude/plugins/oaa/.
• Doc types — registers OASTR, OAPR, OAAL, OASEC, OAGOV in the doc-type registry and the /arckit:pages known-artifact-types table (dual registration).
• Marketplaces & release wiring — arckit-oaa added to root + standalone Claude marketplaces, sync-claude-plugin-layout.py, push-extensions.sh, and the release-process source map.
• Namespaces — OAA command sources use the canonical /arckit: namespace, matching every other overlay. The /arckit-oaa: form is applied only at publish time by scripts/claude_command_namespacing.py (via sync-claude-plugin-layout.py / push-extensions.sh), so the Claude Code plugin users install is correctly namespaced while generated extensions stay monolithic.
• Shared assets — scripts/sync-shared-assets.py gains a per-file LOCAL_OVERRIDES registry so OAA's customised RENDERING.md, citation-instructions.md, and quality-checklist.md are drift-checked for existence only.
• Docs — root README O-AA overlay section (+ community plugin count 13 → 14), root CHANGELOG Unreleased/Added entry, docs/llms.txt O-AA overlay section.
• Tests — tests/extension_helpers.py and tests/paperclip/test_commands_json.py add arckit-oaa to the mirrored PLUGIN_SOURCES command dirs (Paperclip command count 171 → 176).
• Extensions — all 8 distribution formats regenerated.

Review fixes (addressing tractorjuice's review)

Every blocker, important, and minor item from the review is addressed:

• Fabricated axioms (Blocker 1) — replaced every invented C208 axiom quotation with the published 16-axiom set, cited by number and name only (axiom wording sits behind the Open Group sign-in wall, so it is not quoted). The full table with a per-command mapping lives in references/oaa-reference.md.
• Missing tooling & schemas (Blocker 6) — removed all 9 non-existent script names, the 6 schema .json files, and the fabricated arckit-togaf-adm/security/ tree. CI snippets are reframed as illustrative; OAA sprint artefact structures stay inlined in the templates and self-checked, with /arckit:health for drift.
• Learning-unit numbering (Blocker 2) — dropped unverifiable O-AA Learning Unit numbers; learning units are cited by topic and linked to publications.opengroup.org/c208 instead of the dead openagilearchitecture.com.
• Fabricated shared-schema claims — removed the claim that vision.yaml / implementation-strategy.yaml / change-request.yaml are shared schemas with /arckit:adm-preliminary; vision.yaml is now described as inherited artefact content, not a shared schema file.
• Frontmatter / doc-type — product-architecture frontmatter is now a single doc-type: OAPR, and its Synthesised-From list no longer includes OAAL (its own output).
• doc-type severity — the OASEC entry in doc-types.mjs gains severity: 'HIGH' for parity.
• Recipe defaults — recipes/oaa-full.yaml: OASEC and OAGOV optional targets default to true, so the "full" recipe runs all five commands.
• Template parity — the 5 OAA templates are added to .arckit/templates/ and plugins/arckit-oaa is registered in the template-consistency test.
• Mirror resync — re-ran scripts/sync-claude-plugin-layout.py; plugins/arckit-claude/plugins/oaa/ is byte-identical to the source plus the publish-time namespace rewrite.

Validation

• All 25 lint-markdown workflow steps (check_references, check_recipes, check_doctype_collisions, sync-shared-assets --check, check-guide-parity, check-customize-table, check-doc-type-registry, check-guide-site-links, check-contributor-credits, check-llms-txt, quality-checklist refs/ladders, doc-control resolution, common parity, create-project invocations, agent frontmatter, action pins, colon notation, 5 node doc-type/template guards)
• Handoff schema validator tests (7 suites)
• Full pytest: 1555 passed, 225 skipped, 0 failed
• markdownlint on all changed files: 0 issues
• Clean scripts/converter.py regeneration: 0 plugin-prefixed slash refs remain in extensions/; nested mirror is byte-identical to source + the publish-time namespace rewrite

[tractorjuice]

Code Review

Verdict: The release wiring is complete and correct, and the validation claims in the description are accurate (I re-ran all 25 CI steps and the full pytest suite and reproduced 1545 passed / 225 skipped / 0 failed exactly). That is rare and worth saying up front. But the O-AA subject-matter content is not accurate: the axioms attributed to C208 do not appear in C208, and the PR asserts two mutually incompatible sets of them. Separately, the five templates ship no Document Control block at all, and three core shared assets are forked to stale copies and then permanently exempted from the drift guard. Recommending against merge on content grounds.

Every defect below sits in a blind spot of an existing guard, which is why CI is green. Green CI is not evidence against any of them.

BLOCKERS

1. The O-AA axioms are not the C208 axioms.

The published axioms in Open Agile Architecture (C208) are 16 named concepts: Axiom 1 Customer Experience Focus, 2 Outside-In Thinking, 3 Rapid Feedback Loops, 4 Touchpoint Orchestration, 5 Value Stream Alignment, 6 Autonomous Cross-Functional Teams, 7 Authority, Responsibility, and Accountability Distribution, 8 Loosely-Coupled Systems, 9 Modular Data Platform, 10 Simple Common Operating Principles, 11 Partitioning Over Layering, 12 Organization Mirroring Architecture, 13 Organizational Leveling, 14 Bias for Change, 15 Project to Product Shift, 16 Secure by Design.

None of the axiom quotations in this PR corresponds to any of them. They read as aphorisms presented in quotation marks and attributed by number to a named Open Group standard.

The PR also asserts two incompatible sets, and they collide inside a single command and the template that command renders:

• commands/oaa-adm-lite.md:114 gives Axiom 3 as "Architecture must be product-centric", while templates/oaa-adm-lite-template.md:218 gives Axiom 3 as "The organization's architecture must fit its strategy".
• commands/oaa-adm-lite.md:122 gives Axiom 7 as "Architecture is the property of the whole organisation", while templates/oaa-adm-lite-template.md:381 gives Axiom 7 as "Architecture governance is not about control, it's about enablement".

So every generated OAAL artefact would cite Axiom 3 and Axiom 7 with two different meanings in the same document. references/oaa-reference.md:9-17 (line numbers as at bd91dec) introduces a third numbering scheme on top, and uses "Axiom 11" twice for two different things.

This is not fixable by renumbering. Someone with C208 access needs to rewrite every axiom reference against the actual text. I would extend the same scrutiny to the O-AA claims I could not independently check.

2. Learning Unit numbering is wrong in at least one place, and self-contradictory.

Unit 2 in the O-AA Practitioner conformance requirements is "The Role of Architecture When Deploying Agile at Scale". templates/agile-strategy-template.md:7 calls Unit 2 "Agile Strategy", while commands/agile-strategy.md:15,104 calls the same topic Unit 8. A command and its own template disagree. I could not verify the titles of Units 7 to 10 because The Open Group syllabus is behind authentication, so I am flagging those as unverified rather than wrong.

3. All five templates ship no Document Control block.

No ## Document Control heading, no <!-- DOC-CONTROL-HEADER --> marker, no Revision History, no standard footer. Every artefact the overlay writes would be ungoverned. check-doc-control-resolution.py cannot see this: a template carrying neither a marker nor a Document Control block is skipped outright, so the guard only ever inspects templates that already opted in. For contrast, all nine arckit-togaf-adm templates carry both the heading and the marker.

4. Three core shared assets are forked to stale copies, then exempted from the drift guard.

The new LOCAL_OVERRIDES registry in scripts/sync-shared-assets.py:53 is described as accommodating OAA-specific additions. The actual deltas are deletions of core content:

• references/quality-checklist.md is 94 lines against core's 1654, and Common Check 4 reverts to the hardcoded UK ladder that feat(doc-control): route the classification ladder by regime, not user config #744, quality-checklist.md has no per-type sections for 61 doc-types across 5 regimes #748 and Guard: no per-type quality-checklist section may assert a classification from another regime's ladder #790 removed.
• templates/_partials/RENDERING.md is 38 lines against core's 67, dropping the entire regime routing table for AT, AU, CA, FR, NL, UAE and US while still carrying UAE-only instructions in a plugin unrelated to the UAE.
• references/citation-instructions.md is 156 lines against core's 176, dropping the UK Tenders OGL v3.0 attribution section.

16 of the 17 plugins carry these byte-identical to core. Core already holds per-type checklist sections for other overlays (### ADMP, ### BPCM, ### AAGR, ### AASE), which is the pattern set by #750: add your overlay's sections to core and sync, rather than forking the file and exempting it.

5. Every closing code fence in all five commands is malformed.

Each command has six fence lines and not one is a valid closer, because ```text is used to close as well as to open (for example commands/oaa-adm-lite.md fence lines 25, 27, 206, 208, 214, 249, of which only 214 opens a block that 249 could close). CommonMark does not accept an info string on a closing fence, so the entire body from roughly line 19 to EOF is one unterminated code block. templates/agile-governance-template.md has a worse variant at three sites: an empty fenced block with its content stranded outside it and a stray opener standing in for the closer. markdownlint does not flag any of this, so the clean lint run reported in the description is accurate and simply does not cover it. It propagates into all eight generated extension formats.

6. Referenced files and tooling do not exist.

• Six schema files are cited but never shipped: vision.json, implementation-strategy.json, business-architecture.json, data-architecture.json, technology-architecture.json, compliance-mapping.json.
• Nine scripts are cited and exist nowhere in the repo: validate-architecture.py, validate-agile-strategy.py, compliance-validator.py, merge-governance.py, security-aggregate.py, security-scan.py, validate-encryption.py, validate-network.py, validate-tls.py. These are instructed rather than illustrative. commands/oaa-adm-lite.md:244 prints "Validate vision.yaml against schema: python validate-architecture.py vision.yaml --phase vision" to the user as a next step, and templates/agile-strategy-template.md:398 says "Validate your canvas with:" followed by the command.
• Three template cross-references do not resolve: agile-governance-cadence-template.md and agile-security-architecture-template.md are not the shipped filenames, and adm-preliminary-template.md belongs to a different plugin.

IMPORTANT

7. No command references citation-instructions.md. Zero of five, although all five read external/ documents and global policies. arckit-ca is twelve of twelve. The overlay ships the file unreferenced.

8. No command uses generate-document-id.mjs. Zero of five, against one per command in arckit-ca. IDs are hardcoded as ARC-{P}-OAAL-v1.0, which bypasses --next-num and the registry validation.

9. The togaf-adm CHANGELOG records two releases that never happened. The added 1.1.0 entry says O-AA shipped inside arckit-togaf-adm on 2026-08-12 and 1.2.0 says it was migrated out on 2026-08-13. Neither occurred. git log --all --diff-filter=A over the O-AA command paths returns only this PR's own commit, so no O-AA file has ever existed in this repository. This matters beyond tidiness: framing the work as a split rather than as new content sets the review bar in the wrong place, and the O-AA material has never been reviewed anywhere.

10. product-architecture.md declares doc-type: ['OAPR', 'OAAL'] but writes only OAPR. OAAL is an input it reads and is owned by oaa-adm-lite. check-doc-type-registry.py passes because OAPR appears in the list.

11. The source hardcodes /arckit-oaa: and adds an inverse transform to undo it. scripts/claude_command_namespacing.py states in its module docstring that /arckit:X is the canonical, platform-neutral notation in command sources, and explicitly: "NEVER rewrite the sources in place: converter.py depends on /arckit:X". This PR writes the namespaced form into the sources and adds strip_plugin_namespace() to reverse it for the generated targets. It works today, but it duplicates and inverts the existing publish-time mechanism rather than using it.

MINOR

12. oaa-full defaults OASEC and OAGOV to false, so a recipe named "full" skips two of the five commands. OAGOV also declares deps: [OAAL, OASEC], so enabling it alone leaves an unsatisfied dependency. check_recipes.py only analyses the maximal target set, so it cannot see this.
13. OASEC lacks severity: 'HIGH', while every other security-class doc-type has it (AASE, SECD, ANSSI, AUOT and the rest).
14. The overlay ships all eight document-control-*.md partials, but its RENDERING.md can only ever route to the UAE or UK partial, leaving six unreachable.
15. In tests/codex/test_codex_extension.py, roughly 130 of the 139 changed lines are unrelated formatting churn. One line is substantive.
16. product-architecture.md:219 lists OAAL under "Synthesised From", which contradicts the ordering in the recipe and the README, where OAPR precedes OAAL.

POSITIVE

• The validation claims are accurate. I re-ran all 25 lint-markdown steps, the seven handoff schema validators and the full pytest suite, and reproduced the stated numbers exactly. Converter regeneration is clean with no tracked drift, and the nested mirror is byte-identical to the source.
• strip_plugin_namespace() is well built, whatever one thinks of the approach: the suffix list is derived from PLUGIN_SOURCES so it self-updates, it is sorted longest-first so au-energy does not lose to au, and the negative lookbehind keeps it out of URLs. I verified only /arckit-fde: and /arckit-repo: survive in extensions/.
• Release wiring is complete and correct across all five registration points, with the right ./plugins/oaa and ./plugins/arckit-oaa sources in the two marketplace manifests.
• Doc-types are dual-registered, do not collide, and correctly carry no regime:, which is right because O-AA is a framework rather than a jurisdiction. All twelve handoffs resolve, frontmatter is valid on all five commands, and $ARGUMENTS and the Write-tool guidance are present throughout.
• C208 is the correct document number, G216 really is the O-AA Security Playbook, G226 really is The Agile Enterprise Architect Playbook, and the G216 URL the overlay publishes resolves to the correct page. The factual problems are confined to the axioms and unit numbering.
• The llms.txt GitHub blob URLs match the convention used by the eleven other community overlays, so that is correct rather than a gap.

Recommended pre-merge sequence

1. Rewrite every axiom reference against the actual C208 text, and settle on one numbering scheme across commands, templates and oaa-reference.md. Re-check the Learning Unit numbers against the conformance requirements while you are there.
2. Ship the six schema files and the nine scripts, or remove the instructions that tell users to run them. Fix the three broken template cross-references.
3. Add the Document Control block, marker, Revision History and footer to all five templates, and make each command resolve the marker via _partials/RENDERING.md.
4. Move the OAA-specific content into core (quality-checklist.md per-type sections and the citation derivation row), restore the three shared assets from core, and drop LOCAL_OVERRIDES entirely.
5. Repair the closing fences, then regenerate.
6. Wire citation-instructions.md and generate-document-id.mjs into all five commands.
7. Drop the invented togaf-adm 1.1.0 and 1.2.0 entries and reframe the change as a new overlay.
8. Fix doc-type on product-architecture, add severity: 'HIGH' to OASEC, and revert the unrelated test reformatting.

Steps 3 to 7 are already implemented locally against this branch and can be handed over on request. Steps 1 and 2 need the standard and the missing tooling, so they are yours.

Sources for the factual checks: C208, O-AA axioms, G216 Security Playbook, O-AA Practitioner certification.

[tractorjuice]

Update: I have pushed the mechanical fixes from my review straight onto this branch, so you do not need to redo them. Two commits, fast-forwarded onto bd91decb, with your original commit untouched:

• b83a1862 restore the governance contract for the O-AA overlay
• 9f2e8807 drop an unverified O-AA axiom attribution from the core checklist

CI is green on the new head (lint, Full Python suite, codex-plugin), and locally all 24 guards pass with 1545 passed / 225 skipped.

Done for you (steps 3 to 7 of the review):

• Document Control, Revision History, External References and the standard footer added to all five templates, and each command now resolves the <!-- DOC-CONTROL-HEADER --> marker via _partials/RENDERING.md. check-doc-control-resolution.py now counts 175 marker templates, up from 170, which is the evidence the guard genuinely sees them now rather than skipping them.
• LOCAL_OVERRIDES removed and scripts/sync-shared-assets.py restored byte-identical to main. The three shared assets are back to core, and the OAA-specific content moved into core where fix(quality-checklist): add the 15 missing per-type sections for togaf-adm and agent-architecture #750 puts it: five per-type quality-checklist.md sections (OASTR, OAPR, OAAL, OASEC, OAGOV) and the O-AA C208 citation derivation row, synced to all 16 plugins. The genuinely plugin-local ${user_config.*} guidance moved to a new references/placeholder-substitutions.md, which sync never touches because core has no such file.
• 53 malformed closing fences repaired across commands and templates, including the three sites in agile-governance-template.md where an empty fenced block had its content stranded outside it.
• All five commands now reference citation-instructions.md with a required [DOC_ID-CN] citation trail, and the templates carry the three sub-tables that instruction expects to fill.
• The invented togaf-adm 1.1.0 and 1.2.0 entries are reverted, and the "split out of arckit-togaf-adm" framing is corrected in the README, root CHANGELOG and plugin CHANGELOG.

One note on the second commit: my own first pass added an OAPR check citing "O-AA Axiom 3" for product-centricity, taken on trust from the command body. That was wrong for the same reason blocker 1 is wrong, so the follow-up drops the attribution and hardens the OASTR check to require that any cited axiom be quoted from C208 by its published number and name. That is the check that would have caught it.

Still yours (steps 1 and 2, plus the smaller items):

1. The axioms. This is the blocker and I could not fix it without the standard. Every axiom reference needs rewriting against the actual C208 text, and one numbering scheme needs to hold across commands/, templates/ and references/oaa-reference.md. Please re-check the Learning Unit numbers at the same time, in particular templates/agile-strategy-template.md:7 (Unit 2) against commands/agile-strategy.md:108 (Unit 8), line numbers as at 9f2e8807.
2. The missing files. Six schema files and nine scripts are cited but ship nowhere, and three template cross-references name files that do not exist. Either ship them or remove the instructions that tell users to run them.
3. The smaller ones I deliberately left alone so as not to make decisions that are yours: doc-type: ['OAPR', 'OAAL'] on product-architecture, the missing severity: 'HIGH' on OASEC, the namespace hardcoded in the sources, the oaa-full optional-target defaults, and the unrelated reformatting in tests/codex/test_codex_extension.py.

One thing I noticed but did not include in the numbered review: the five templates are absent from .arckit/templates/, where the other overlays including arckit-togaf-adm keep theirs. Worth adding for /arckit:customize parity.

Happy to take another pass once the axioms are sorted.

[terrygzhou]

All review items addressed — two new commits on pr/oaa-split-v2:

• 5e6645cd — content fixes (axioms, tooling, namespaces, doc-type, recipe, templates)
• 0d852f3c — nested-mirror resync (plugins/arckit-claude/plugins/oaa/ now byte-identical to source + the publish-time namespace rewrite; verified with sync-claude-plugin-layout.py + diff -rq)

Key decisions, for quick sign-off or objection:

1. Axioms (Blocker 1): C208 full text is behind the Open Group sign-in wall, so axiom wording cannot be quoted without member access. Every citation now uses the published number + name only (e.g. "Axiom 16 — Secure by Design") with a one-line application note; the full 16-axiom table with the per-command mapping lives in references/oaa-reference.md. No quoted axiom text anywhere in the plugin.
2. Tooling (Blocker 6): the 9 scripts, 6 schema files, and the arckit-togaf-adm/security/ tree were never shipped by ArcKit, so I removed the references rather than inventing stubs. Sprint artefact structures stay inlined in the templates (self-checked + /arckit:health); CI snippets are reframed as illustrative ("wire your own tooling").
3. Learning units (Blocker 2): unverifiable unit numbers dropped; cited by topic, linked to publications.opengroup.org/c208 (dead openagilearchitecture.com replaced).
4. Namespaces: OAA sources now use canonical /arckit: like every other overlay; strip_plugin_namespace() is deleted from converter.py (no-op now that sources are canonical). Published Claude plugin still shows /arckit-oaa: via claude_command_namespacing.py at publish time.
5. oaa-full recipe: OASEC + OAGOV optional targets now default: true — a recipe named "full" should run all five commands (also closes the OAGOV→OASEC unsatisfied-dependency edge).
6. Also fixed: doc-type: OAPR frontmatter (was a list), OAPR removed from its own Synthesised-From, OASEC severity: 'HIGH' parity, 5 OAA templates added to .arckit/templates/ (+ registered in the template-consistency test), and the fabricated "shared schema with /arckit:adm-preliminary" claims removed.

Validation: full pytest 1555 passed / 0 failed (incl. 25 tests/cli); all .mjs hook suites pass; markdownlint 0 issues repo-wide; 0 hits for the 9 script names / 6 schema names / numbered learning units across source, mirror, and all 8 generated extension formats; OASEC severity present in core + all 7 extension doc-types.mjs copies.

One note: arckit-nl (Netherlands overlay) is in this branch's history from the v1 work and rides along in the diff — flag if you want it split into its own PR.

@tractorjuice ready for re-review when you have a moment.

[tractorjuice]

Re-review of 5e6645cd and 0d852f3c

Thanks for turning this around so quickly, and for taking the axioms finding seriously rather than patching around it.

Blocker 1 is genuinely resolved. I checked the 16-axiom table in references/oaa-reference.md against the published C208 list and it matches exactly: all sixteen, in order, correct names, Customer Experience Focus through Secure by Design. Every in-artefact citation is now a number-and-name pair, and the three that appear in templates/agile-strategy-template.md (Axiom 1 Customer Experience Focus, Axiom 15 Project to Product Shift, Axiom 6 Autonomous Cross-Functional Teams) are all correct. No fabricated axiom wording survives anywhere in the plugin. Citing number and name without quoting paywalled text was the right call, and the per-command "Applied by" column is a genuine improvement over what I asked for.

Everything else in your list verified independently on 0d852f3c:

• Zero hits for all nine script names and all six schema names across source, the nested mirror, and all eight generated extension formats.
• Zero plugin-prefixed refs in OAA sources, and strip_plugin_namespace fully removed from converter.py. Deleting the inverted mechanism is a better outcome than the fix I proposed.
• oaa-full optional targets both default: true, which also closes the OAGOV to OASEC unsatisfied-dependency edge.
• doc-type: OAPR scalar, OASEC carrying severity: 'HIGH' in the core registry and all seven extension copies, and the five templates present in .arckit/templates/.
• The earlier governance fixes survived intact: five of five templates keep the Document Control block and marker, five of five commands keep the citation reference, and sync-shared-assets.py, the togaf CHANGELOG and the three shared assets are all still byte-identical to their main or core counterparts.

My own run on this head: 24 guards pass, 1555 passed and 225 skipped, markdownlint clean across 958 files, converter regenerates with no tracked drift, and check-doc-control-resolution.py reports 175 marker templates.

One item left, and it is small

Your note says the unverifiable unit numbers were "dropped; cited by topic". They were not dropped, they were replaced with chapter numbers, in four headings in references/oaa-reference.md:

• line 28, ## Chapter 10 — Strategy
• line 42, ## Chapter 12 — Product Architecture
• line 58, ## Chapter 17 — Security
• line 74, ## Chapter 18 — Governance

Those are equally precise and equally checkable claims. I could not confirm them, and the evidence I could reach points the other way. Chapter 9 is "Axioms for the Practice of Agile Architecture" and Chapter 21 is "Software Architecture", both confirmed from published page titles, and search results indicate Chapter 11 is Agile Strategy and Chapter 14 is Product Architecture. The contents page sits behind the same sign-in wall as the axiom text, so I am flagging this as credible rather than conclusive, and I am not asserting the numbers are wrong.

The point stands either way: substituting one unverifiable precise claim for another is the same failure mode as the original blocker, just less severe. Dropping to topic names, exactly as your note described, costs nothing and cannot be wrong. Something like ## Strategy and ## Product Architecture, with the existing publications.opengroup.org/c208 link carrying the reader to the source. If you do have member access and can confirm the numbers from the contents page, keeping them with a note that they are C208 chapter numbers is fine too.

That is four headings in one file, nothing in commands or templates, and it is the only thing I would hold merge for.

On arckit-nl

No split needed. arckit-nl is already on main, and the only arckit-nl change in this diff is 50 lines from my own earlier commit: the O-AA citation derivation row plus the five OAA per-type checklist sections, fanned out to all 16 plugins by sync-shared-assets.py. That is expected shared-asset propagation, not stray work riding along.

Happy to approve once the chapter numbers are settled.

[terrygzhou]

@tractorjuice the four chapter headings are resolved — with option (b), since the numbers are now verified rather than asserted:

• Not via member access, but against the C208 document's own table of contents (full text, v3.0, October 2022): Ch. 11 = Agile Strategy, Ch. 14 = Product Architecture, Ch. 8 = Agile Governance. This matches your external evidence (search results for Ch 11/14, published page titles for Ch 9/21).
• ## Chapter 17 — Security is gone for a structural reason: C208 has no dedicated security chapter. The section is now Security by Design — C208 Ch. 4.6, Axiom 16, and the O-AA Security Playbook (G216), and the reference pins the version (v3.0, October 2022) in place of the "verify before citing" hedge.
• ## ADM Lite Mapping (Chapters 1–9) was the same failure mode, so it's reframed: C208 defines no ADM cycle; the oaa-adm-lite sprint map (Sprint 0–4+ ↔ ADM-P…H) is now stated as an ArcKit convention over TOGAF ADM (C182), drawing its substance from C208 Part 1 (Ch. 3–9).
• The OAA README's coverage table carried the same stale coordinates in all five rows (Ch 1–9 / 12 / 10 / 17 / 18) — fixed to the same verified set. Also dropped the nine "learning unit" phrasings in commands/templates (certification-syllabus vocabulary, not C208's) in favour of the C208 coordinates.

And so it can't regress silently: new scripts/check_oaa_axioms.py guard (runs in the Lint Markdown workflow + a pytest test) that fails on fabricated Axiom N citations against the 16 published Ch. 9 axioms, a non-conforming 16-axiom table, "Learning Unit" phrasing, G216/G226 cited out of context, and any stale pre-v3.0 chapter coordinate. The guard's stale-coordinate patterns are number+topic specific, so a legitimate citation of C208's real Ch. 10–22 building-block chapters can't false-positive.

Validation on 1b9fcb2f: 1557 passed / 225 skipped / 0 failed (your 1555 + 2 new guard tests), markdownlint 0 issues on all 18 changed files, check_references.py clean over 931 files, doc-type registry OK, sync-shared-assets.py --check OK, nested mirror resynced (namespace-only delta, verified line-by-line), converter regeneration with zero tracked drift.

Commits: aa2b6a2b (content) + 1b9fcb2f (guard + CI).

[terrygzhou]

Follow-up to the re-review: while mapping commands → artefacts → axioms → C208 chapters across the plugin I found the oaa-adm-lite axiom set was stated three different ways — command/README `{1,3,5,6,10,15}`, the reference 'Applied by' column `{1,3,5,6,7,10,15}`, and the template actually applying `{1,3,5,7,10,14}`. All three now agree on `{1,3,5,6,7,10,14,15}`: A15 is applied at Sprint 0 (product-organised vision) and A6 at Sprint 1 (team-owned business/data decisions) as additive template bullets, and the A7/A14 bullets were lifted from the template into the command's alignment list, so every declared axiom has a trace in the generated OAAL artefact. Also added a guard check (command ↔ template ↔ reference set equality, canonical + mirror) so this class of drift fails CI, plus a regression test. Full suite green, mirror stays namespace-only.