NKLattice
Project governance for React teams using Next.js, Vite + React and React. Assess nine domains across standalone apps and npm/pnpm workspaces: exact app inventory, dependency policy, dependency freshness, architecture, dependency security, code quality, code security, browser/mobile-emulation compatibility and automated accessibility on tested routes.
The CLI writes offline JSON/HTML without an account or automatic upload. Lattice Cloud is optional, with password login, organization/team access and one organization ingestion token for multiple stable repository keys. Existing project-key/password uploads remain supported. Mobile emulation is not physical-device evidence.
Artifact and publication boundary: this README describes the package/source artifact carrying it. A source version or local tarball does not prove registry publication. Choose an exact public version reviewed for your project, then check the installed CLI with --version and command --help; an older pin may lack features described here. Production capabilities require separate server configuration and evidence.
Release history: on 1 November 2026, @anhcodo13/[email protected] was publicly released and checked with a fresh-cache registry consumer. This dated observation does not identify the latest version. Use the registry check and exact VERIFIED_VERSION installation procedure below for the version you have reviewed.
Install a verified public version
Use Node.js 24+. The package is @anhcodo13/lattice; the executable is lattice. No private provider repository access is required. Check the registry, then replace VERIFIED_VERSION below with the exact public version you have reviewed; it is a placeholder, not an assumed release.
npm view @anhcodo13/lattice version
npm install --save-dev --save-exact @anhcodo13/lattice@VERIFIED_VERSION
For pnpm, use pnpm add -DE @anhcodo13/lattice@VERIFIED_VERSION. Commit the manifest and lockfile. Use the installed executable for assessment; an assessment request does not authorize installation or an upgrade.
pnpm exec lattice --version
pnpm exec lattice --help
pnpm exec lattice doctor .
pnpm exec lattice analyze .
Assess and gate the whole project
Commit .nklattice-apps.json with the exact app paths/profiles. The bundled policy is at node_modules/@anhcodo13/lattice/governance/policy.json; copy and review it if your team owns a central variant. Dependency requirements stay >=X.Y.Z: declared ranges, lockfile specifiers and resolutions must satisfy the floor. This does not guarantee compatibility with every newer major version.
pnpm exec lattice governance check . --expect-apps 1
pnpm exec lattice governance run . --expect-apps 1 \
--evidence /tmp/lattice-governance-evidence.json
The full gate needs the consuming app's scanner/test setup and may run repository code and use the network. Missing tools, stale evidence, undeclared apps and unsupported flows stay incomplete. analyze is exploratory; full governance returns 0 for pass, 7 for measured failure and 3 for incomplete evidence/command error. Schema3 prioritizes confirmed blockers (7) even with an incomplete summary; schema2 keeps its original precedence. A source-only restriction requires the supported explicit source mode, not the default gate.
Assessment writes .nklattice-governance/assessment.json and report.html; architecture exploration writes .nklattice-report/analysis.json and report.html. Architecture weights and all nine domains remain intact. Read the existing governance and agent setup guides; the website's advertised version is verified separately from this artifact.
Work with an AI agent and security evidence
pnpm exec lattice skills install . --agent both
The installed skill supports Codex ($lattice-governance) and Claude Code (/lattice-governance). Review and commit it with the pinned package. The CLI determines the verdict; the skill cannot infer waiver authorization, owner approval or verified-CI trust and never uploads automatically.
Read the bundled security workflow offline after confirming that the installed CLI supports its commands. The opt-in profile uses an explicit surface manifest and source/build/runtime/behavioral/operational evidence. Technical score, typed coverage, local decisions, historical receipts and current server eligibility are separate. Source candidates are not confirmed findings; incomplete, N/A and measured zero remain distinct. Workload OIDC is CI identity, not user OAuth login or scanner certification. Native Windows credential fixture validation fails closed; use WSL/Linux with POSIX permissions for that capability.
The public production security/v3 protocol is ON, supporting payload versions 1/3 and organization envelope versions 2/4. Capability support does not grant tenant readiness: security uploads require the current owner-approved model and applicable enrollment, authority, recovery and quota checks. verified-ci additionally requires an exact matching owner-approved trusted binding and accepted GitHub OIDC proof; source uploads remain self-reported and never become verified through acceptance alone. See current availability and proof limits.
Optional MFA remains OFF, the external webhook is Not configured, and the Cloudflare provider analytics beacon is blocked by strict CSP. Docker acceptance is excluded and unpassed. Reference screenshots and local canaries do not prove production scanners, physical devices, provider backups or an SLA. Upload requires explicit authorization, the approved destination and environment credentials; preview the exact sanitized payload with --dry-run first.
Tiếng Việt
Lịch sử phát hành: ngày 01/11/2026, @anhcodo13/[email protected] đã phát hành public và được kiểm tra bằng consumer registry dùng cache mới. Quan sát có ngày này không xác định phiên bản mới nhất. README và reference này mô tả gói/source đi kèm; metadata hoặc tarball cục bộ không chứng minh đã phát hành trên registry. Dùng bước kiểm tra registry và quy trình cài đúng VERIFIED_VERSION ở trên cho phiên bản đã review, rồi kiểm tra --version và --help của CLI đã cài. VERIFIED_VERSION là chỗ cần thay bằng phiên bản đã xác minh, không phải tên release. Không tự cài hoặc nâng cấp khi chỉ được yêu cầu đánh giá.
Giữ đủ chín miền, policy dependency >=X.Y.Z, điểm architecture và ranh giới thiếu bằng chứng. CLI xem báo cáo offline không cần tài khoản hay upload; Cloud tùy chọn dùng password, quyền organization/team và token organization cho nhiều repository. Credential project-key/password cũ vẫn được hỗ trợ. Đọc security workflow đóng gói bằng CLI đã pin; tách điểm, độ phủ, trust, quyết định local, receipt lịch sử và điều kiện hiện tại.
Protocol public production security/v3 hiện ON, hỗ trợ payload 1/3 và envelope organization 2/4. Capability không cấp readiness cho tenant: upload security cần model được owner duyệt hiện tại cùng kiểm tra enrollment, thẩm quyền, recovery và quota. verified-ci còn cần trusted binding được owner duyệt khớp chính xác và proof GitHub OIDC được chấp nhận; upload source vẫn tự khai, không thành verified chỉ vì được nhận. Xem trạng thái và giới hạn bằng chứng hiện tại.
MFA tùy chọn vẫn OFF; webhook bên ngoài Not configured; beacon analytics Cloudflare bị CSP nghiêm ngặt chặn. Docker acceptance bị loại khỏi phạm vi và chưa đạt. Credential fixture trên Windows native bị từ chối an toàn; dùng WSL/Linux với quyền POSIX. Upload cần yêu cầu rõ ràng, xem --dry-run trước; secret qua environment, không đưa vào argv/log/prompt. Fixture, ảnh chụp và browser emulation không thành bằng chứng production, thiết bị thật, backup provider hay SLA.
Maintainer verification
Authorized source checkouts use pnpm 10.30.3: pnpm install --frozen-lockfile, pnpm verify, and pnpm --dir docs verify. Review the exact packed consumer before human publication approval; verify the public registry artifact before updating or deploying the website's release guidance.
English website · Tiếng Việt · Cloud dashboard · MIT License