Use Lattice with AI agents

The lattice-governance skill gives an AI coding agent the Lattice workflow: identify managed Next.js, Vite + React, or React apps, review the exact inventory and policy, run the appropriate CLI check, explain the nine-domain assessment, and verify fixes. The CLI still produces the verdict; the skill does not replace scanners or automatically upload reports.

Install in the repository

Use Node.js 24 or newer. Pin the npm package, then install its bundled skill:

npm install --save-dev --save-exact @anhcodo13/lattice@0.11.1
pnpm exec lattice skills install . --agent codex

The second command writes .agents/skills/lattice-governance/SKILL.md and Codex UI metadata. For Claude Code, use --agent claude to write .claude/skills/lattice-governance/SKILL.md. Use --agent both when the team uses both agents. Commit the installed skill with the package manifest and lockfile so teammates use the same instructions. The installer is safe to rerun; it preserves edited files unless you explicitly pass --force after reviewing the changes.

For a pnpm workspace, run pnpm add -DwE @anhcodo13/lattice@0.11.1, then pnpm exec lattice skills install . --agent both from the workspace root. The skill is placed at the repository root so it is available while working across apps. CI still needs its own governance job; installing the skill does not add a gate.

Ask the agent

In Codex, start a session in the repository and ask:

Use $lattice-governance to assess this repository. Identify every managed app, review the inventory and policy, run the full governance check, then explain the score and the fixes in priority order.

In Claude Code, invoke /lattice-governance with the same request. Agents can also select the skill when your request matches its description. If an agent session was already open when you installed the skill, start a new session if it does not discover the new file.

The agent should report pass, fail, or incomplete from the CLI, not infer a pass from a clean-looking summary. Full assessment requires the repository’s scanner and test setup. A missing tool or missing app makes evidence incomplete. Project governance documents inventory, scanners, Nx/Turborepo behavior, and CI setup.

Publishing to the SaaS dashboard

The skill does not upload on its own. Ask explicitly if you want the agent to preview a sanitized payload and push it to your project. The public project key identifies the destination; the upload password belongs in a CI secret or local environment variable and must never appear in the skill file, a prompt, or a commit. See CLI commands for report push --dry-run.

For a shared organization token, provide a reviewed stable repository key and use --repository KEY; the agent reads LATTICE_INGEST_TOKEN from the environment. The same token can submit several repos without merging their history. New repositories remain pending until the owner approves their baseline and assigns team access. The skill cannot infer this approval or change membership through an upload. See organization uploads and team access.

The skill follows the Agent Skills specification and is distributed in the npm package. Its source is at skills/lattice-governance/SKILL.md in the Lattice repository.

Review authority with an agent

The public package and bundled skill work without provider GitHub access. Copy the installed skill, policy and owner-owned CI examples into your repository; do not depend on a private raw URL. Security guidance is included in public 0.11.1; production activation remains separate. Ask the agent to review the surface manifest, preserve candidate versus confirmed findings, and explain score/coverage/trust/decision separately. An agent instruction cannot authorize --offline-policy-reviewed, approve a SaaS model/waiver, grant verified CI or configure a webhook destination. See security evidence.