@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/DISCLOSURE

@@ -0,0 +1 @@
+Lattice CLI includes defensive security review features for repositories and applications the user is authorized to assess. It can inspect source, configuration, and dependency data for potential exposed secrets, known dependency vulnerabilities, suspicious package changes, and malware indicators, then report findings and supporting evidence. It does not grant access to targets or authorize testing; users must have permission to scan each target. These features are intended for defensive review, remediation, and release readiness.

package/README.md

@@ -1,3 +1,119 @@
-# Temporary Holding Version
+# @m2-ai/lattice-cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+`@m2-ai/lattice-cli` is the CLI for Lattice Core and Lattice Architect installs.
+
+This source targets the new `@m2-ai` npm namespace. Existing published `@latticeai/cli`, `@latticeai/engine`, and
+`latticeai` packages remain unchanged.
+
+It powers:
+
+- Core setup for existing repositories
+- agent instruction generation for Codex, Cursor, and Claude Code
+- verification, drift detection, release checks, and security scanning
+- Architect project installs with `create --id`
+- OpenClaw runtime and generated-workspace installs with `openclaw install --id`
+- runtime-neutral agent setup installs with `agent install --id`
+- reviewed Hermes releases and personalized profile distributions with `hermes install --id`
+
+## Install
+
+```bash
+npm install -g @m2-ai/lattice-cli
+```
+
+Or use the public launcher:
+
+```bash
+npx --yes @m2-ai/lattice-cli@0.8.7
+```
+
+## Core workflow
+
+```bash
+latticeai setup --projectType nextjs --preset startup
+latticeai verify
+latticeai security-scan
+latticeai update
+```
+
+Custom external bundles must use HTTPS. Redirects must remain on HTTPS, embedded URL credentials are rejected, and
+downloads have fixed redirect, response-size, and timeout limits. Saved CLI login credentials are replaced atomically;
+on POSIX systems, Lattice enforces owner-only permissions on the credentials directory and file.
+
+For packaged built-in bundles, npm intentionally omits nested `.gitignore` files from the tarball. Before applying a
+built-in bundle, the CLI checks the target repository and offers to synthesize the stack-specific `.gitignore`
+independently. The generated file excludes `node_modules/`, `.env`, `.env.local`, and `.env*.local` while retaining
+`.env.example`. Serialized Architect bundle JSON includes `.gitignore` directly and does not use npm's tar transport.
+
+## Architect workflow
+
+```bash
+latticeai create --id <project-id>
+```
+
+## OpenClaw workflow
+
+```bash
+npx --yes @m2-ai/lattice-cli@0.8.7 openclaw install --id <project-id>
+```
+
+The guided installer requires Node.js 22.19 or newer. It opens official OpenClaw onboarding for credentials and channel
+authorization, keeps the gateway bound to loopback by default, backs up managed files, validates the generated patch,
+and restores Lattice-owned workspace files and OpenClaw configuration if verification fails. Runtime installation,
+onboarding, provider or credential setup, daemon or gateway state, and operating-system service changes are not
+automatically reverted and must be reviewed separately before retrying.
+
+## Agent Setup workflow
+
+Let the paid project select its runtime automatically:
+
+```bash
+npx --yes @m2-ai/lattice-cli@0.8.7 agent install --id <project-id>
+```
+
+The existing OpenClaw command remains supported. Hermes projects can also use the explicit alias:
+
+```bash
+npx --yes @m2-ai/lattice-cli@0.8.7 hermes install --id <project-id>
+```
+
+For Hermes, Lattice downloads the official installer, verifies the reviewed script's SHA-256, pins the reviewed
+upstream commit, installs a persistent local profile distribution, applies any approved user and memory seed files,
+and runs Hermes configuration, doctor, and profile checks. Provider and channel credentials are entered only in the
+official Hermes setup flow; they are not accepted in the Lattice manifest, command, logs, or receipt.
+
+The default Hermes command is resolved only within the requested Hermes home: the managed `hermes-agent/.hermes/bin`
+launcher, the home's `bin` launcher, then the legacy `hermes-agent/venv` launcher. An explicit `--hermes-command`
+remains available for an existing installation. Lattice does not search unrelated homes or global commands.
+
+Useful recovery and preview options:
+
+```bash
+# Show the complete local plan without downloading, running, or writing anything
+latticeai hermes install --id <project-id> --dry-run
+
+# Keep setup for later; the receipt prints an exact resume command
+latticeai hermes install --id <project-id> --skip-setup --skip-model-check --skip-gateway-setup
+
+# Resolve a same-name profile without overwriting it
+latticeai hermes install --id <project-id> --profile-name <alternate-name>
+
+# After reviewing the generated files, explicitly update a same-name profile
+latticeai hermes install --id <project-id> --update-existing-profile
+```
+
+Receipts and backups are stored under `~/.lattice/agent-setups/<project-id>/`. Lattice restores only the distribution
+and seed files it owns. It does not uninstall the Hermes runtime or automatically revert profile registration or
+aliases, provider or credential setup, model usage, sessions, learned memory, gateway or operating-system service
+state, or user-created skills. Review those changes separately after a failed install. Hermes Agent is an independent
+open-source project from Nous Research. Lattice is not affiliated with or endorsed by Nous Research.
+
+Lattice's generated launcher may use `--install-token <short-lived-token>` instead of a saved CLI login. The token is
+project-scoped, is never written to credentials or failure reports, and is used only to fetch that install manifest and
+send back a sanitized status receipt. Receipts contain stage/runtime/release metadata and file counts—not generated
+content, credentials, command output, errors, local paths, or the token.
+
+## Links
+
+- Docs: https://latticeai.app/core
+- Source: https://github.com/rmach816/lattice

package/bundles/expo-mobile/.agents/skills/lattice-feature-handoff/SKILL.md

@@ -0,0 +1,31 @@
+---
+name: lattice-feature-handoff
+description: Prepare an evidence-backed feature handoff for Lattice release review after scoped implementation or when work is blocked.
+---
+
+# Lattice Feature Handoff
+
+Use this skill after a scoped feature task, before asking for merge or release review, or when a prerequisite blocks completion.
+
+## Authority
+
+You may implement the approved scope, run checks, and prepare a handoff. You may not merge, deploy, migrate data, change provider accounts, change secrets or environment configuration, or perform destructive actions without explicit owner approval.
+
+## Steps
+
+1. Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.lattice/release-workflow.json`.
+2. Confirm the repository, worktree, branch, approved base ref, base SHA, and current head SHA. Do not infer lineage from a task description.
+3. Inspect the exact diff and preserve unrelated work. Record included and excluded scope.
+4. Run the repository checks required for the change. Record every material command as `passed`, `failed`, `not_run`, or `blocked`; never convert missing proof into a pass.
+5. Assess database migrations, environment changes, background workers, provider effects, and destructive actions. A field needing review must remain `needs_assessment`.
+6. Copy `.lattice/templates/feature-handoff.json` to `.lattice/runtime/<handoff-id>.json` and replace every placeholder. Do not include credentials, tokens, secret values, payment data, or direct personal contact data.
+7. Check that the handoff parses as JSON and contains every field required by `.lattice/schemas/feature-handoff.schema.json`.
+8. Set exactly one status:
+   - `READY_FOR_RELEASE`: scoped implementation and its required proof are complete.
+   - `NEEDS_REWORK`: a confirmed defect or failed check remains.
+   - `BLOCKED`: an external prerequisite, missing authority, or unsafe ambiguity prevents progress.
+9. If the current environment exposes a native messaging tool and an exact Release Manager destination is bound, send the handoff there. Otherwise use the repository's GitHub issue, pull request, or comment, or surface the exact artifact path to the owner. Never claim delivery without tool evidence.
+
+## Handoff Summary
+
+Report the artifact path, status, base SHA, head SHA, checks, operational impacts, required approvals, and transport result. `READY_FOR_RELEASE` means ready for independent review, not merged, deployed, released, or live.

package/bundles/expo-mobile/.agents/skills/lattice-release-manager/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: lattice-release-manager
+description: Independently audit a Lattice feature handoff and prepare an evidence-backed release recommendation without assuming production authority.
+---
+
+# Lattice Release Manager
+
+Use this skill when a feature handoff is ready for independent release review or needs an evidence-backed rework decision.
+
+## Authority
+
+You may inspect source state, review the exact diff, run non-destructive checks, request rework, and prepare a release recommendation. You may not deploy or promote production, migrate data, write to provider accounts, change secrets or environment configuration, or perform destructive actions without explicit owner approval.
+
+## Review
+
+1. Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, `.lattice/release-workflow.json`, and the handoff schema.
+2. Resolve the actual repository and worktree. Verify the handoff base SHA, head SHA, branch, and diff. A mismatch blocks the review until reconciled.
+3. Review only the exact candidate. Treat handoff claims as evidence to verify, not truth to repeat.
+4. Rerun the checks proportionate to the change and inspect failure, permission, recovery, migration, provider, worker, and environment boundaries that are in scope.
+5. Confirm no secret values or direct personal contact or payment data appear in the handoff.
+6. Return one decision:
+   - Accept for owner approval: the exact candidate and required proof pass.
+   - Request rework: a reproducible defect, failed gate, incomplete evidence, or scope mismatch is identified.
+   - Block: lineage, authority, environment, or safety cannot be resolved.
+7. When rework is required and a native tool plus exact origin task are available, send the evidence to that task. Otherwise record it on the shared GitHub surface or preserve a handoff artifact and report that routing remains pending.
+
+## Release State
+
+Keep these states separate: automated validation, candidate preparation, owner approval, deployment, and live verification. Do not merge or clean feature work until the authorized release is proven live and rollback evidence is current.

package/bundles/expo-mobile/.agents/skills/lattice-verify/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: lattice-verify
+description: Run the repo's Lattice verification sequence before final handoff, release work, or after meaningful code edits.
+---
+
+# Lattice Verify
+
+Use this skill when the user asks to verify, ship, prepare a PR, review final changes, or confirm the project still passes its gates.
+
+## Steps
+
+1. Confirm the current working directory and inspect `git status --short`.
+2. Preserve unrelated user changes. Do not reset, delete, or stage files outside the requested scope.
+3. Run the verification commands in this order:
+   - `npm run lint`
+   - `npm run typecheck`
+   - `npm test`
+   - `npm run build`
+   - `npm run verify`
+4. If a command fails, fix the smallest responsible issue and rerun the failed command before continuing.
+5. Final handoff must report which commands passed, which were not run, and any remaining risk.
+
+## Stack Notes
+
+- Framework: Expo
+- Use Expo and React Native conventions from the existing repo.
+- Treat `PROJECT_GUIDE.md`, `AGENTS.md`, and package versions as source of truth.

package/bundles/expo-mobile/.claude/agents/lattice-feature-agent.md

@@ -0,0 +1,10 @@
+---
+name: lattice-feature-agent
+description: Implements one approved feature in an isolated worktree and prepares a Lattice release handoff.
+tools: Read, Glob, Grep, Edit, Write, Bash, Skill, SendMessage
+model: inherit
+permissionMode: default
+isolation: worktree
+---
+
+Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.agents/skills/lattice-feature-handoff/SKILL.md` before editing. Work only on the assigned scope, run proportionate checks, and produce the schema-shaped handoff. Use `SendMessage` only when the exact destination is present. Never merge, deploy, migrate, change provider state, change environment secrets, or perform destructive actions.

package/bundles/expo-mobile/.claude/agents/lattice-release-manager.md

@@ -0,0 +1,9 @@
+---
+name: lattice-release-manager
+description: Independently audits a Lattice feature handoff and returns a release, rework, or blocked decision.
+tools: Read, Glob, Grep, Bash, Skill, SendMessage
+model: inherit
+permissionMode: plan
+---
+
+Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.agents/skills/lattice-release-manager/SKILL.md`. Verify the actual repository, exact base and head SHAs, diff, checks, impacts, and approval gates. Use `SendMessage` only when the exact origin is present. Never claim a candidate is merged, deployed, released, or live without matching proof.

package/bundles/expo-mobile/.claude/hooks/README.md

@@ -0,0 +1,9 @@
+# Claude Hook Templates
+
+These scripts are templates generated by Lattice Project Builder.
+
+- `pre-tool-use`: blocks obviously dangerous shell patterns.
+- `pre-commit-verify`: runs `npm run verify` before commit workflows.
+
+The generated `.claude/settings.json` already wires `pre-tool-use`.
+If you want a commit-time hook, wire `pre-commit-verify.mjs` into your local git workflow.

package/bundles/expo-mobile/.claude/hooks/pre-commit-verify.mjs

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import process from "node:process";
+
+const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
+const result = spawnSync(npmCommand, ["run", "verify"], {
+  stdio: "inherit",
+});
+
+process.exit(result.status ?? 1);

package/bundles/expo-mobile/.claude/hooks/pre-tool-use.mjs

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+/* global Buffer */
+import process from "node:process";
+
+async function main() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+
+  const payload = chunks.length > 0 ? Buffer.concat(chunks).toString("utf8") : "";
+  let command = "";
+
+  try {
+    const parsed = JSON.parse(payload || "{}");
+    command =
+      typeof parsed?.tool_input?.command === "string" ? parsed.tool_input.command : "";
+  } catch {
+    command = "";
+  }
+
+  const blockedPatterns = [
+    {
+      pattern: /(^|\s)rm\s+-rf(\s|$)/,
+      reason: "Blocked dangerous command pattern: rm -rf",
+    },
+    {
+      pattern: /git\s+reset\s+--hard/,
+      reason: "Blocked dangerous command pattern: git reset --hard",
+    },
+  ];
+
+  const blocked = blockedPatterns.find(({ pattern }) => pattern.test(command));
+  if (!blocked) {
+    return;
+  }
+
+  process.stdout.write(
+    JSON.stringify({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: blocked.reason,
+      },
+    }),
+  );
+}
+
+main().catch(() => {
+  process.exit(0);
+});

package/bundles/expo-mobile/.claude/rules/lattice-core.md

@@ -0,0 +1,20 @@
+---
+paths:
+  - "**/*.{ts,tsx,js,jsx}"
+  - "app/**"
+  - "components/**"
+  - "lib/**"
+  - "src/**"
+  - "package.json"
+---
+
+# Lattice Core Code Rule
+
+Claude loads this rule when working on source or project configuration files.
+
+- Match the existing Expo patterns before creating new structure.
+- Keep edits scoped to the user's request and the plan in `PROJECT_GUIDE.md`.
+- Prefer small, reviewable diffs.
+- Use `/lattice-verify` or the generated `.claude/skills/lattice-verify/SKILL.md` workflow before final handoff.
+- Ask before destructive commands, production writes, dependency upgrades, or secret-handling changes.
+- Follow Expo Router and React Native file conventions.

package/bundles/expo-mobile/.claude/settings.json

@@ -0,0 +1,38 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "permissions": {
+    "defaultMode": "default",
+    "allow": [
+      "Read(**)",
+      "Edit(**)",
+      "Glob(**)",
+      "Grep(**)",
+      "Bash(npm run lint)",
+      "Bash(npm run typecheck)",
+      "Bash(npm run test)",
+      "Bash(npm run build)",
+      "Bash(npm run verify)"
+    ],
+    "deny": [
+      "Bash(rm -rf *)",
+      "Bash(sudo *)",
+      "Bash(git reset --hard *)",
+      "Read(./.env)",
+      "Read(./.env.*)",
+      "Read(./secrets/**)"
+    ]
+  },
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$CLAUDE_PROJECT_DIR\"/.claude/hooks/pre-tool-use.mjs"
+          }
+        ]
+      }
+    ]
+  }
+}

package/bundles/expo-mobile/.claude/skills/lattice-verify/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: lattice-verify
+description: Run the repo's Lattice verification sequence before final handoff, release work, or after meaningful code edits.
+---
+
+# Lattice Verify
+
+Use this skill when the user asks to verify, ship, prepare a PR, review final changes, or confirm the project still passes its gates.
+
+## Steps
+
+1. Confirm the current working directory and inspect `git status --short`.
+2. Preserve unrelated user changes. Do not reset, delete, or stage files outside the requested scope.
+3. Run the verification commands in this order:
+   - `npm run lint`
+   - `npm run typecheck`
+   - `npm test`
+   - `npm run build`
+   - `npm run verify`
+4. If a command fails, fix the smallest responsible issue and rerun the failed command before continuing.
+5. Final handoff must report which commands passed, which were not run, and any remaining risk.
+
+## Stack Notes
+
+- Framework: Expo
+- Use Expo and React Native conventions from the existing repo.
+- Treat `PROJECT_GUIDE.md`, `AGENTS.md`, and package versions as source of truth.

package/bundles/expo-mobile/.codex/agents/lattice-feature-agent.toml

@@ -0,0 +1,9 @@
+name = "lattice-feature-agent"
+description = "Implements one approved feature in isolation and prepares a schema-shaped Lattice handoff for release review."
+sandbox_mode = "workspace-write"
+developer_instructions = """
+Read AGENTS.md, docs/LATTICE_RELEASE_WORKFLOW.md, and .agents/skills/lattice-feature-handoff/SKILL.md before editing.
+Work only on the assigned scope in the isolated worktree supplied by the parent.
+Run proportionate checks and produce the exact handoff evidence required by the shared skill.
+Do not merge, deploy, migrate, change provider state, change environment secrets, or perform destructive actions.
+"""

package/bundles/expo-mobile/.codex/agents/lattice-release-manager.toml

@@ -0,0 +1,9 @@
+name = "lattice-release-manager"
+description = "Read-only release auditor that verifies exact Git lineage, diff, checks, impacts, and approval gates."
+sandbox_mode = "read-only"
+developer_instructions = """
+Read AGENTS.md, docs/LATTICE_RELEASE_WORKFLOW.md, and .agents/skills/lattice-release-manager/SKILL.md.
+Independently verify the handoff against the actual repository, base SHA, head SHA, and diff.
+Return accept for owner approval, request rework, or block with concrete evidence.
+Never describe a candidate as merged, deployed, released, or live without matching proof.
+"""

package/bundles/expo-mobile/.cursor/mcp.json

@@ -0,0 +1,34 @@
+{
+  "mcpServers": {
+    "filesystem": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-filesystem@1.0.0",
+        "."
+      ],
+      "disabled": true
+    },
+    "github": {
+      "url": "https://api.githubcopilot.com/mcp/readonly",
+      "headers": {
+        "Authorization": "Bearer ${env:GITHUB_TOKEN}"
+      },
+      "disabled": true
+    },
+    "supabase": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@supabase/mcp-server-supabase@0.14.0",
+        "--read-only",
+        "--project-ref",
+        "${env:SUPABASE_PROJECT_REF}"
+      ],
+      "env": {
+        "SUPABASE_ACCESS_TOKEN": "${env:SUPABASE_ACCESS_TOKEN}"
+      },
+      "disabled": true
+    }
+  }
+}

package/bundles/expo-mobile/.cursor/rules/lattice-core.mdc

@@ -0,0 +1,35 @@
+---
+description: Lattice Core engineering rules for this Expo repo. Use for implementation, verification, and release-safety work.
+globs:
+  - "**/*"
+alwaysApply: true
+---
+
+# Lattice Core Rules
+
+## Scope
+- Implement exactly what is requested.
+- Preserve existing behavior unless change is requested.
+- Read `AGENTS.md` and `PROJECT_GUIDE.md` before coding.
+- Use this project rule for Agent Chat. Cursor Tab and inline edit do not receive these rules.
+
+## Quality Gates
+- Run `npm run lint`
+- Run `npm run typecheck`
+- Run `npm run test`
+- Run `npm run build`
+- Run `npm run verify`
+
+## Skills and Tools
+- Use `.agents/skills/lattice-verify/SKILL.md` when a task asks for verification, release readiness, or final handoff checks.
+- Project MCP examples live in `.cursor/mcp.json`; keep credentials in environment variables.
+- Keep rules short. Add a focused skill instead of growing this always-applied rule when the guidance is procedural.
+
+## Security
+- Never commit secrets or credentials.
+- Use env vars for sensitive values.
+- Refuse destructive shell commands unless explicitly requested.
+
+## Framework Rules
+- Active framework: Expo
+- Use Expo Router and React Native conventions.

package/bundles/expo-mobile/.cursor/rules.md

@@ -0,0 +1,94 @@
+<!--
+latticeVersion: 0.8.4
+stack: expo-eas
+policyVersion: 1.0.0
+configHash: a745426e75bc03513d9605fea56d6d1f617e3a64c3ad7527af105356ec0d2b0f
+-->
+<!-- LATTICE:START v1.0.0 -->
+# Lattice Project Rules
+
+## Stack
+- **Framework**: Expo (TypeScript strict mode)
+- **Styling**: Tailwind CSS
+- **Testing**: Jest + React Testing Library
+
+## Core Operating Rules
+
+1. **Stay in scope** - Only implement what's explicitly requested
+2. **No placeholders** - All code must be production-ready
+3. **Verify before coding** - Check current package versions and API compatibility
+4. **Minimal changes** - Keep modifications localized and simple
+5. **Test everything** - Run lint, typecheck, test, and build before submitting
+6. **Never expose secrets** - API keys, tokens, passwords, and credentials must NEVER be committed to version control
+
+## Verification Commands
+
+```bash
+npm run lint       # ESLint check
+npm run typecheck  # TypeScript check
+npm test           # Run tests
+npm run build      # Production build
+npm run verify     # All checks via Lattice
+```
+
+## Code Standards
+- Use TypeScript strict mode
+- Prefer functional components and hooks
+- Use async/await over .then()
+- Handle all errors explicitly
+- No `any` types without justification
+
+## File Organization
+- Keep components in /components with index.ts barrels
+- Keep utilities in /lib
+- Keep API routes in /app/api
+- Use feature-based organization for large projects
+
+## Expo EAS-Specific Guidelines
+- Use Expo Router (`app/` directory)
+- Follow Expo file conventions
+- Use expo-image for optimized images
+
+## Before Making Changes
+
+1. Restate the scope in one paragraph
+2. Identify files to create or modify
+3. Check existing patterns in the codebase
+4. Verify package versions are current
+
+## After Making Changes
+
+1. Run all verification commands
+2. Fix any failures before proceeding
+3. Report verification results
+
+## Security Rules (CRITICAL)
+
+- **NEVER** commit API keys, secrets, tokens, or credentials to version control
+- **ALWAYS** use environment variables (`.env.local`, `.env`) for sensitive data
+- **ALWAYS** ensure `.env*` files are in `.gitignore`
+- **NEVER** hardcode secrets in source code, even in comments
+- **ONLY** access sensitive keys server-side (never expose to client-side code)
+
+## Execution Discipline
+
+Implement one scoped change at a time. Run the affected checks and real journeys, fix confirmed failures, and record the exact candidate and evidence before handoff.
+
+## Non-Goals
+
+Avoid unrelated rewrites, speculative features, or provider and production changes outside the approved scope.
+
+## Priority Order
+
+User instructions, repository agreements, accepted scope, existing patterns, then optional improvements.
+
+## Hard Stop Conditions
+
+- If requirements conflict -> ask for clarification
+- If verification fails -> fix before continuing
+- If scope is unclear -> ask for clarification
+- If you can't verify an API or version -> ask
+- If code contains hardcoded secrets -> STOP and use environment variables
+
+Violation of these rules is a failure.
+<!-- LATTICE:END -->

package/bundles/expo-mobile/.env.example

@@ -0,0 +1,19 @@
+# Environment variables
+
+# Supabase
+# Project URL from Supabase settings.
+EXPO_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
+
+# Anon public key from Supabase settings.
+EXPO_PUBLIC_SUPABASE_ANON_KEY=your-supabase-anon-key
+
+# PostHog
+# Public phc_ project token for analytics; keep PostHog secret keys server-only.
+EXPO_PUBLIC_POSTHOG_PROJECT_TOKEN=<ph_project_token>
+
+# PostHog ingestion host for your region.
+EXPO_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com
+
+# Sentry
+# Public DSN for the Expo Sentry project.
+EXPO_PUBLIC_SENTRY_DSN=https://public@example.ingest.sentry.io/project-id

package/bundles/expo-mobile/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,42 @@
+## Summary
+
+<!-- Brief description of what this PR does -->
+
+## Changes
+
+<!-- List the main changes -->
+
+-
+
+## Type of Change
+
+- [ ] Bug fix (non-breaking change that fixes an issue)
+- [ ] New feature (non-breaking change that adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to change)
+- [ ] Refactor (no functional changes)
+- [ ] Documentation update
+
+## Checklist
+
+### Before requesting review:
+
+- [ ] I ran `npm run verify` and all checks pass
+- [ ] I tested the changes locally
+- [ ] I reviewed my own diff for unnecessary changes
+- [ ] I added/updated tests if applicable
+- [ ] I updated documentation if applicable
+
+### Vibe Check:
+
+- [ ] Core flow works end-to-end
+- [ ] UI states (loading, error, empty) are handled
+- [ ] No console errors
+- [ ] Edge cases considered
+
+## Screenshots (if UI changes)
+
+<!-- Add before/after screenshots -->
+
+## Notes for Reviewers
+
+<!-- Any context that would help reviewers -->

package/bundles/expo-mobile/.github/agents/lattice-feature-agent.agent.md

@@ -0,0 +1,7 @@
+---
+name: lattice-feature-agent
+description: Implements one approved feature and prepares a schema-shaped Lattice handoff for release review.
+tools: ["read", "search", "edit", "execute"]
+---
+
+Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.agents/skills/lattice-feature-handoff/SKILL.md`. Stay within the issue or pull request scope, preserve exact Git lineage, run proportionate checks, and attach or commit the schema-shaped handoff. Do not merge, deploy, migrate, change provider or environment state, or perform destructive actions.