Inside a monorepo
Check Next, Vite and React apps from the workspace root and keep the shared lockfile in step.
PROJECT GOVERNANCE · NEXT.JS / VITE / REACT
Project governance.
For React teams.
Review one policy for every managed app. NKLattice connects inventory, dependency security, code quality, source security, accessibility and browser compatibility to a traceable CI verdict before deployment.
Runs locally · npm & pnpm · Node.js 24+
APPROVED MINIMUMS
React
>=19.3.1Next.js
>=16.4.2Vite
>=8.3.4TypeScript
>=5.9.3SAMPLE APP ASSESSMENTS
apps/nextPolicy pass
apps/vitePolicy pass
apps/reactPolicy pass
The same policy for workspaces and separate repositories
Built for React teams using
Next.js
React
TypeScript
Vite
Exact reviewed app inventoryEight evidence domainsCI gate before deploy
ANONYMIZED PROJECT RESULTS
Analysis results from a Vite + React project.
NKLattice analyzed a private Vite + React codebase. The owner approved publication of these aggregate results; project identifiers and the raw report remain private.
Full checkout · 17 Oct 2026 · source withheld
How these numbers were collectedlattice analyze .
NKLattice analyzed 331 modules. Score 11 (F); 232 findings.
Report paths redacted because the source is private.
ARCHITECTURE SCORE11/100F
Static analysis review score for this run; not a runtime or security grade.
Modules scanned331
Internal import links954
Findings232
Warnings169
Info63
Errors0
lattice governance check . --expect-apps 2
2 applications checked; 5 dependency mismatches.
The policy gate found five mismatches across two discovered package manifests. This run was blocked.
| Manifest | Package | Required | Declared | Locked |
|---|---|---|---|---|
| A | vite | >=6.4.3 | ^5.2.13 | 5.4.21 |
| A | react | >=19.2.0 | ^18.3.1 | 18.3.1 |
| A | react-dom | >=19.2.0 | ^18.3.1 | 18.3.1 |
| B | react | >=19.2.0 | ^18.3.1 | 18.3.1 |
| B | react-dom | >=19.2.0 | ^18.3.1 | 18.3.1 |
Policy failedexit 7
PROJECT GOVERNANCE FOR REACT TEAMS
Know which apps comply with the policy you approved.
The source assessment checks each app against a reviewed policy: exact inventory, dependency versions and advisories, architecture, code quality, source security, browser tests and accessibility scans. Every result carries its policy, inventory and input hashes.
PROJECT GOVERNANCE
Define scope. Inspect evidence. Gate the release.
A passing source assessment means every listed app was found and every required domain had fresh evidence within the reviewed thresholds. Missing scanners, stale evidence and unresolved local imports produce an incomplete result.
- 01
Review the scope
Commit the exact app paths and profiles that must be assessed.
.nklattice-apps.json - 02
Approve the rules
Set dependency, architecture, quality, security and compatibility thresholds in the core policy.
governance/policy.json - 03
Gate deployment
The reusable workflow reports pass, fail or incomplete with JSON and HTML evidence.
needs: governance
FROM SOURCE TO REPORT
How Lattice works
The CLI scans source files, evaluates defined rules and records the evidence behind each finding.
- 01
Scan
Find supported JavaScript and TypeScript files, excluding dependencies and build output.
- 02
Parse
Read imports, exports, JSX and file-level structure.
- 03
Build graph
Resolve local imports and connect the modules they reference.
- 04
Evaluate
Run configured rules for cycles, boundaries, components and complexity.
- 05
Score
Apply category weights and show each deduction behind the review score.
- 06
Report
Write an offline HTML report and machine-readable JSON.
governance run executes the required scanners and evaluates their results with inventory, dependency floors and architecture findings in one process. Local analyze remains available for exploration.
See the policy gateARCHITECTURE REPORT
Explore an architecture report from a React project.
These CLI 0.2.0 screenshots document the private Vite + React run. Project identifiers were replaced before capture; the measured score, counts, category breakdown and selected graph connections were retained. Version 0.5.0 adds a separate eight-domain governance report.
- Overview and explainable score
- Findings and hotspots
- A 32-node view of the local dependency graph
Findings
Rule IDs and severities from the analysis; source evidence withheld.
Hotspots
Measured finding counts and estimated impact, with module aliases.
Dependency graph
The real selected connections, labeled with module aliases.
MONOREPOS AND STANDALONE APPS
One policy across repositories and monorepos.
Each repository reviews its app inventory and pins the same central policy revision; workspaces can assess several apps in one run.
Across repositories
Each adopted repo pins a core SHA and calls the governance workflow. Its deployment job can wait for that check.
PRODUCT ROADMAP
What works today and what comes next.
The eight-domain assessment is available in the CLI. The next proof is a required gate in an independent consumer repository.
Available
Exact inventory, managed libraries, advisories, architecture, quality, security, browser and accessibility evidence by app.
Adoption next
Prove a required governance gate and a deployment dependency in an independent consumer.
Further ahead
Assisted updates, finer architecture rules and comparable reports.
GET STARTED
Put your React project policy in CI.
Review the inventory and policy, run the sample assessment, then make deployment depend on the governance job.