Product roadmap

NKLattice aims to give React teams a reviewable answer to which managed apps comply with the policy they approved. That answer must name its evaluated domains and evidence gaps. The roadmap has no promised dates.

Available in version 0.5.0

• Exact app coverage: a committed .nklattice-apps.json lists paths and profiles; discovery must match it exactly. --expect-apps is an additional count guard.
• Dependency evidence: mandatory framework and conditional React-library floors, source imports, declared ranges and npm/pnpm lockfile specifiers/resolutions are compared with one reviewed policy.
• Architecture gates: central score floor, maximum errors, blocked rule IDs, thresholds, weights and import boundaries. App-local analysis configuration cannot relax the governance gate.
• Dependency security: fresh npm/pnpm audit results, with zero high and critical advisories by default.
• Code quality and security: ESLint, TypeScript, Vitest with line coverage, Semgrep SAST and Gitleaks secrets enter the per-app verdict.
• Accessibility: axe scans tested routes on desktop Chromium and emulated Android Chrome, recording violations and inconclusive checks.
• Compatibility: Chromium, Firefox and WebKit projects plus Android Chrome and iPhone Safari emulation, each tested at two viewport widths with browser versions recorded.
• Incomplete verdict: missing apps, missing source, parse/config errors, unresolved local imports and unavailable lockfile evidence cannot become a pass.
• Review artifacts: versioned JSON and offline HTML show per-app domains, findings, coverage, browser matrix and policy/inventory/input hashes. CI uploads them on failure.
• Source examples: standalone React/npm and Next/Vite/React pnpm workspace fixtures run the real scanner chain; negative tests cover policy breaches and missing evidence.

The 0.5.0 npm package exposes the eight-domain assessment. Source examples prove sample behavior, not that a separate company repository has made the job a required merge and deployment gate.

Next adoption proof

Work	Evidence required
Independent consumer pilot	A separate React repository and a pnpm monorepo pin the same reviewed SHA at workflow uses: and core-ref, commit inventories, require governance for merge and gate real deploy jobs. Capture pass, fail, incomplete, correction and rollback.
Adoption visibility	Know which consumer repositories use each policy revision, have failed, or have not run since an update. Core changes alone do not start their CI.
Assisted updates	Evaluate shared Renovate policy, then produce reviewable dependency update PRs.

Later policy and rollout work

License obligations, physical-device OS versions, runtime observations and repository controls need independent evidence adapters, ownership and reviewed thresholds. Time-limited exceptions need an owner, reason, expiry and audit trail. These are not part of a current pass. Architecture analysis can also expand framework-aware route, alias and generated-code coverage, with false-positive fixtures before new rules enter a gate.

Read Project governance for the exact current verdict and Reports for the two artifact types.