Project governance and architecture analysis

NKLattice is a local CLI for React project governance. Its assessment checks the app inventory, approved dependency minimums, source architecture, dependency advisories, code quality, code security and browser/mobile compatibility. Local architecture analysis is also available for exploration. It supports Next.js, Vite + React and React in npm/pnpm workspaces or separate repositories.

The current public release is @anhcodo13/lattice@0.5.0. It requires Node.js 24+ and installs the lattice command. The product and repository remain named NKLattice.

The core repository holds the policy and reusable CI workflow. Each consumer repository supplies an app inventory and its manifests, lockfiles and source. The assessment answers: which managed apps comply with the rules this policy actually evaluates, and where is the evidence incomplete?

Choose the job you need

Need	Run	What you receive
Assess project policy before deployment	lattice governance collect + assess (npm 0.5.0)	App-by-app pass, fail or incomplete across eight evidence domains; JSON and HTML reports.
Check dependency versions only	lattice governance check (npm 0.5.0)	App/package mismatches and exit code 7 on drift.
Inspect import structure and component heuristics	lattice analyze	Offline report.html and analysis.json.
Confirm a directory has scannable source	lattice doctor	Running Node version and supported source-file count.

Project governance describes the exact inventory, direct package checks and central architecture gates. Architecture analysis describes individual findings and local exploration. A finding is an observed pattern for review, not proof of a defect.

Where it fits in delivery

1. A core maintainer reviews dependency floors and architecture gates in one policy.
2. Each consumer commits the exact app inventory and aligns its manifests, lockfiles and source.
3. The app PR runs governance assess; policy breaches fail, and missing evidence remains incomplete.
4. Deployment depends on that governance job. analyze itself remains exploratory and exits zero even with findings.

The sample consumer workflow shows the CI relationship. NKLattice does not edit manifests, open upgrade PRs or maintain a central inventory of consumer repositories.

Supported today

• Source scan: ts, tsx, js, jsx, mts, mjs, cts, and cjs files. Local import resolution uses the analyzed root’s tsconfig.json when available.
• Governance profiles: next, vite-react, and react; direct dependencies, devDependencies, and optionalDependencies.
• Lockfiles: npm lockfile version 3 and pnpm lockfile version 9. Yarn and Bun are not supported.
• Local reports: HTML with embedded data/script/styles and a JSON companion. Source is not uploaded by the analyzer.

The exploratory analyze parser does not perform a production build, typecheck the app, or trace every dynamic import and runtime dependency. The separate governance collector runs TypeScript and other scanners when configured. An architecture score is a review aid, not a performance, security, or code-correctness grade.

Start with the quick start and then read the guide for the job you plan to put into CI.