Release notes

0.5.0 — React library catalog and accessibility

The reviewed policy adds conditional minimums for eleven common React libraries. Declared packages and packages imported in supported source are checked against the app manifest and npm/pnpm lockfile; an importing app cannot rely solely on a workspace-root declaration. The eighth governance domain reads axe-core results from reviewed Playwright tests in desktop Chromium and emulated Android Chrome. The report lists tested routes, rule checks, violations and inconclusive items. This is automated evidence for tested pages, not full WCAG certification or a physical-device test. See Managed libraries and Accessibility evidence.

0.4.0 — seven-domain project governance

The project assessment now joins seven domains: exact app inventory, direct dependency floors, source architecture, known dependency advisories, code quality, code security and browser/mobile-emulation compatibility. governance collect runs npm/pnpm audit, ESLint, TypeScript, Vitest with V8 coverage, Semgrep, Gitleaks and Playwright. governance assess requires fresh evidence bound to the policy, inputs and commit. The offline JSON/HTML report records each domain status, finding, scanner version and browser matrix with observed and minimum test-environment versions. Missing scanner coverage produces incomplete; measured policy breaches produce fail. Browser floors do not establish physical-device or older-browser support.

The sample Next.js, Vite + React and React apps include real tests and browser projects for the new gate. The published 0.4.0 package includes these commands and policy 4.0.0.

0.3.0 — first project assessment (published)

governance assess combines exact app inventory, dependency minimums and central architecture gates into a per-app pass/fail/incomplete verdict. It emits versioned JSON and self-contained HTML with policy and inventory hashes. The reusable workflow gates on that result and uploads evidence. The dependency-only governance check remains available.

The offline architecture HTML also gains a clearer score summary, weighted breakdown, 25-at-a-time findings, ranked review lists and a focused dependency graph. The anonymized screenshots on this website come from CLI 0.2.0 and retain that label. Published 0.3.0 does not include the security, quality or compatibility scanners and is not the comprehensive release.

0.2.0 — minimum-version policy

Policy schema 2 and bundled policy 2.0.0 use >=X.Y.Z floors for Next, Vite, React, and TypeScript. The checker accepts an app’s exact or ranged declaration when every version it allows meets the floor. It checks the lockfile specifier and verifies the resolved version against both the policy and the app’s range. Governance text and JSON findings retain the expected field, now containing the required range such as >=19.2.0.

Schema 1 policy files must be migrated for CLI 0.2.0. Older published CLI versions retain their original exact-version behavior. See Dependency governance for examples and limits. Architecture report schema and scoring are unchanged.

0.1.0 — initial independent codebase

This version establishes the first NKLattice CLI and website. The public npm release is @anhcodo13/lattice@0.1.0, which installs the lattice executable. There is no earlier release history.

The published CLI and bundled policy were built from core commit 87de7db. The bundled policy identifies itself as version 1.0.0; the npm package version and policy version serve different purposes.

Added

• A local JS/TS architecture scanner, resolved import graph, ten built-in rule IDs, custom module-boundary policies, weighted scoring, and offline HTML/JSON reports.
• Exact-version dependency governance for the next, vite-react, and react profiles. It checks direct declarations and npm v3 or pnpm v9 lockfile resolutions.
• A reusable GitHub Actions check, a sample consumer deployment gate, a pnpm workspace with three app profiles, and a standalone npm React example.
• Node.js 24+ enforcement, --expect-apps coverage checking, and a reusable workflow that requires a reviewed core commit SHA for its CLI and policy.
• A bilingual landing site and task-oriented English/Vietnamese guides.

Current boundaries

The CLI does not yet publish dependency upgrade PRs, compare two architecture runs automatically, or maintain a central consumer inventory. A consumer must pin both the workflow uses ref and its core-ref input to the same commit. The checked-in examples do not prove a gate in an independent repository, and a core policy change does not automatically trigger one. Architecture findings do not change the analyze exit code.

For exact current behavior, read Commands and Dependency governance. Future work belongs in the Roadmap, not in this release record.