@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/bundles/expo-mobile/.github/agents/lattice-release-manager.agent.md

@@ -0,0 +1,7 @@
+---
+name: lattice-release-manager
+description: Audits an exact Lattice candidate and returns an evidence-backed release, rework, or blocked decision.
+tools: ["read", "search", "execute"]
+---
+
+Read `AGENTS.md`, `docs/LATTICE_RELEASE_WORKFLOW.md`, and `.agents/skills/lattice-release-manager/SKILL.md`. Verify the handoff against the pull request's exact base SHA, head SHA, diff, checks, impacts, and approvals. Record rework evidence on the originating issue or pull request. Never merge or claim deployment, release, or live state without separate authority and proof.

package/bundles/expo-mobile/.github/copilot-instructions.md

@@ -0,0 +1,37 @@
+# GitHub Copilot Instructions
+
+Read `PROJECT_GUIDE.md` and `AGENTS.md` first. Use `docs/rules/codex.md` for the deeper execution workflow and keep these instructions aligned with `.cursor/rules.md` and `CLAUDE.md`.
+
+## Stack
+
+- **Framework**: Expo
+- **Language**: TypeScript (strict mode)
+- **Styling**: Tailwind CSS
+- **Testing**: Jest + React Testing Library
+
+## Repository Guidance
+
+- Stay strictly within the approved scope from `PROJECT_GUIDE.md`.
+- Prefer small, reviewable diffs over broad rewrites.
+- Match the existing folder structure and app patterns before inventing new abstractions.
+- Do not add placeholder code, fake implementations, or silent behavior changes.
+- Keep generated and user-authored instruction files aligned when you touch them.
+
+## Required Verification
+
+Run these before marking work complete:
+
+```bash
+npm run lint
+npm run typecheck
+npm run test
+npm run build
+npm run verify
+```
+
+## Hard Stops
+
+- Requirements conflict with the requested scope.
+- Verification fails and has not been fixed.
+- An API, package, or version cannot be verified.
+- A change would expose secrets or overwrite unrelated work.

package/bundles/expo-mobile/.github/instructions/lattice-core.instructions.md

@@ -0,0 +1,11 @@
+---
+applyTo: "**/*.ts,**/*.tsx,**/*.js,**/*.jsx"
+---
+
+# Lattice Project Builder Code Instructions
+
+- Follow the approved plan in `PROJECT_GUIDE.md` and the shared guardrails in `AGENTS.md`.
+- Keep Expo Router and React Native patterns consistent with the existing codebase.
+- Avoid broad rewrites, compatibility guesses, and unverified dependencies.
+- Preserve existing behavior unless the task explicitly changes it.
+- Finish by running `npm run lint`, `npm run typecheck`, `npm test`, `npm run build`, and `npm run verify`.

package/bundles/expo-mobile/.github/workflows/ci.yml

@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    name: Verify Expo
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: "24.22.0"
+          cache: npm
+      - run: npm ci
+      - name: Verify application
+        run: npm run verify
+      - name: Verify Lattice rules
+        run: npx latticeai@0.8.4 verify-rules

package/bundles/expo-mobile/.gitmessage

@@ -0,0 +1,24 @@
+# <type>(<scope>): <subject>
+#
+# <body>
+#
+# <footer>
+#
+# Types:
+#   feat     - New feature
+#   fix      - Bug fix
+#   docs     - Documentation only
+#   style    - Formatting, no code change
+#   refactor - Code change that neither fixes a bug nor adds a feature
+#   test     - Adding or updating tests
+#   chore    - Maintenance tasks
+#
+# Scope: Component or area affected (optional)
+#
+# Subject: Imperative mood, no period, max 50 chars
+#
+# Body: Explain what and why (not how), wrap at 72 chars
+#
+# Footer: Reference issues, breaking changes
+#   Fixes #123
+#   BREAKING CHANGE: description

package/bundles/expo-mobile/.lattice/config.json

@@ -0,0 +1,9 @@
+{
+  "version": "1.0.0",
+  "stack": "expo",
+  "projectType": "expo-eas",
+  "strictnessPreset": "startup",
+  "policyVersion": "1.0.0",
+  "createdAt": "2026-10-18T14:44:48.176Z",
+  "bundle": true
+}

package/bundles/expo-mobile/.lattice/dependency-security.json

@@ -0,0 +1,91 @@
+{
+  "schemaVersion": 1,
+  "generatedBy": "Lattice",
+  "stack": "expo",
+  "auditPolicy": "Preserve raw audit output; this manifest records reviewed source repairs and does not suppress advisories.",
+  "advisories": [
+    {
+      "package": "braces",
+      "registryVersion": "3.0.3",
+      "replacement": {
+        "package": "@m2ai/braces",
+        "version": "3.0.3-m2ai.1",
+        "maintainer": "M2 AI, LLC",
+        "locator": "file:vendor/m2ai-braces-3.0.3-m2ai.1.tar",
+        "distribution": "local-vendor-only",
+        "provenance": "SOURCE-PROVENANCE.json",
+        "archiveSha256": "E583B39B213E373A2B5276E112F0FE2C12CB9FC801A9E762FA42C360E090F7BE",
+        "archiveSha512": "61AF201668A7EF1988F369A294ADB316F78C00B564D23E14B4399193BB0473667BB2F8F7F7AEF68AE4D143E57BE7103A91ECAB606E6AF69797C21B3F69A82AE6"
+      },
+      "advisory": "GHSA-vfj7-8cjw-p6xm",
+      "cve": "CVE-2026-93687",
+      "status": "local-vendor-fork-reviewed",
+      "source": {
+        "repository": "https://github.com/micromatch/braces",
+        "pullRequest": "https://github.com/micromatch/braces/pull/87",
+        "commit": "d44b9b1ee12e7804d4232d5a47a4a0c61d2fbefe",
+        "archive": "https://github.com/micromatch/braces/archive/d44b9b1ee12e7804d4232d5a47a4a0c61d2fbefe.tar.gz",
+        "archiveSha512": "F016D19CF7F0F67478AD0A31C641F2FB64509543389055D8BAFCD805425F5C3E35C4315CEF65A1CD838F5971696C7156E478B9145BDB2FA8D26280675A526E05"
+      },
+      "license": {
+        "spdx": "MIT",
+        "source": "https://github.com/micromatch/braces/blob/d44b9b1ee12e7804d4232d5a47a4a0c61d2fbefe/LICENSE"
+      },
+      "maintainer": "M2 AI, LLC",
+      "provenance": "SOURCE-PROVENANCE.json records unchanged upstream MIT source, local vendor fork ownership, and archive lineage.",
+      "reconciliationPolicy": "Reconcile with the first upstream patched release when available, or before any product release while no patched release exists.",
+      "productionFiles": {
+        "lib/compile.js": "b651f7715e6db8942ce61d3394357b4d81c8ece88240aa31a458ea1165edd195",
+        "lib/constants.js": "f9fb688959232eee3e6ad7906a5b0e3234815db49ee857ef86983d65b917dc7c",
+        "lib/expand.js": "7ea3e14c2b2b256ef244fd3d83b8fcaa20aa2232b4e6d768c3bb6ab567f66cf5",
+        "lib/parse.js": "b1bf766fba6a62035f78ecbda8a5fd94e921aa1c1ec0cdf3f467e9c836abed55",
+        "lib/stringify.js": "49dc2d8bafa74f34715a18a845bcb82ce66caaf3bab4cf117998e06b1f9a50a9"
+      }
+    },
+    {
+      "package": "node-forge",
+      "registryVersion": "1.4.0",
+      "candidateVersion": "1.4.1-0",
+      "advisory": "GHSA-86w9-cpqp-85rv",
+      "cve": "CVE-2026-85393",
+      "status": "unpublished-reviewed-backport",
+      "source": {
+        "repository": "https://github.com/digitalbazaar/forge",
+        "pullRequest": "https://github.com/digitalbazaar/forge/pull/1159",
+        "commit": "db05494352dd3c9a5a07c5270333dcc78866cad2",
+        "archive": "https://github.com/matthewscottconroy/forge/archive/db05494352dd3c9a5a07c5270333dcc78866cad2.tar.gz",
+        "archiveSha256": "d08f40bfda39415d608a044b01d3d617dc44026b7cde10febc29cfbe90193b1f",
+        "rsaSha256": "c7b72e7ef41f4fc0e5228dce3e37851e9ca064c789365d5e392c25d1c5f6e710"
+      },
+      "license": {
+        "spdx": "BSD-3-Clause OR GPL-2.0-only",
+        "source": "https://github.com/matthewscottconroy/forge/blob/db05494352dd3c9a5a07c5270333dcc78866cad2/LICENSE"
+      }
+    },
+    {
+      "package": "commons-io:commons-io",
+      "upstreamVersion": "1.4",
+      "selectedVersion": "2.14.0",
+      "advisory": "GHSA-gwrp-pvrq-jmwv",
+      "additionalAdvisory": "CVE-2024-47554",
+      "status": "patched-release-native-qualification-required",
+      "source": {
+        "repository": "https://github.com/apache/commons-io",
+        "artifact": "https://repo1.maven.org/maven2/commons-io/commons-io/2.14.0/commons-io-2.14.0.jar",
+        "security": "https://commons.apache.org/proper/commons-io/security.html"
+      },
+      "license": {
+        "spdx": "Apache-2.0",
+        "source": "https://github.com/apache/commons-io/blob/rel/commons-io-2.14.0/LICENSE.txt"
+      },
+      "guard": {
+        "expoFileSystemVersion": "58.0.9",
+        "expectedRequestedVersion": "1.4",
+        "androidApiQualification": [
+          24,
+          25
+        ]
+      }
+    }
+  ]
+}

package/bundles/expo-mobile/.lattice/prompts/01-feature.md

@@ -0,0 +1,36 @@
+# Feature Implementation Prompt
+
+Copy this prompt and fill in the blanks:
+
+---
+
+**Role**: You are implementing a new feature in this Expo codebase.
+
+**Goal**: [What the user should be able to do when this is complete]
+
+**Constraints**:
+- Use existing patterns from this codebase
+- No new dependencies unless explicitly approved
+- Must pass all verify checks
+
+**Context**:
+- Files to read first: [list relevant files]
+- Related components: [list any]
+- API endpoints: [list any]
+
+**Files allowed to change**:
+- [file1.tsx]
+- [file2.tsx]
+
+**Files NOT to touch**:
+- [protected files]
+
+**Acceptance Criteria**:
+- [ ] [Criterion 1]
+- [ ] [Criterion 2]
+- [ ] All verify checks pass
+
+**Non-goals**:
+- [What is explicitly out of scope]
+
+**Deliverable**: Working code + brief summary of changes

package/bundles/expo-mobile/.lattice/prompts/02-bugfix.md

@@ -0,0 +1,32 @@
+# Bug Fix Prompt
+
+Copy this prompt and fill in the blanks:
+
+---
+
+**Role**: You are fixing a bug in this Expo codebase.
+
+**Bug Description**: [What is happening]
+
+**Expected Behavior**: [What should happen]
+
+**Reproduction Steps**:
+1. [Step 1]
+2. [Step 2]
+3. [Step 3]
+
+**Files to investigate**:
+- [suspected file 1]
+- [suspected file 2]
+
+**Constraints**:
+- Minimal change to fix the issue
+- No refactoring unrelated code
+- Must not break existing tests
+
+**Acceptance Criteria**:
+- [ ] Bug no longer reproduces
+- [ ] No new bugs introduced
+- [ ] All verify checks pass
+
+**Deliverable**: Targeted fix + explanation of root cause

package/bundles/expo-mobile/.lattice/prompts/03-refactor.md

@@ -0,0 +1,30 @@
+# Safe Refactor Prompt
+
+Copy this prompt and fill in the blanks:
+
+---
+
+**Role**: You are refactoring code in this Expo codebase.
+
+**Goal**: [What improvement you're making - e.g., extract component, rename, simplify]
+
+**Current State**: [Brief description of what exists now]
+
+**Desired State**: [Brief description of the end result]
+
+**Constraints**:
+- Behavior must remain IDENTICAL
+- Keep diffs small and reviewable
+- No feature changes
+- No dependency changes
+
+**Files to refactor**:
+- [file1.tsx]
+- [file2.tsx]
+
+**Verification**:
+- [ ] All existing tests still pass
+- [ ] Manual testing confirms same behavior
+- [ ] No new warnings or errors
+
+**Deliverable**: Refactored code with same behavior + summary of changes

package/bundles/expo-mobile/.lattice/prompts/04-test.md

@@ -0,0 +1,31 @@
+# Test-First Development Prompt
+
+Copy this prompt and fill in the blanks:
+
+---
+
+**Role**: You are adding tests before implementing a feature.
+
+**Feature to test**: [What functionality needs tests]
+
+**Test cases to write**:
+1. [Happy path case]
+2. [Edge case 1]
+3. [Edge case 2]
+4. [Error case]
+
+**Test file location**: [e.g., app/component.test.tsx]
+
+**Constraints**:
+- Write tests FIRST, then implementation
+- Tests should fail initially
+- Use existing test patterns from this codebase
+- Use React Testing Library conventions
+
+**Acceptance Criteria**:
+- [ ] Tests written and initially failing
+- [ ] Implementation makes tests pass
+- [ ] No skipped or commented tests
+- [ ] All verify checks pass
+
+**Deliverable**: Test file + implementation that passes

package/bundles/expo-mobile/.lattice/prompts/05-polish.md

@@ -0,0 +1,38 @@
+# UX Polish Prompt
+
+Copy this prompt and fill in the blanks:
+
+---
+
+**Role**: You are polishing the UX of a specific component or screen.
+
+**Component/Screen**: [What you're polishing]
+
+**Current issues**:
+- [Spacing issue]
+- [Copy issue]
+- [State handling issue]
+
+**Desired improvements**:
+- [Improvement 1]
+- [Improvement 2]
+- [Improvement 3]
+
+**Constraints**:
+- Focus on micro-interactions and visual polish
+- No feature changes
+- No structural changes
+- Keep changes localized to this component
+
+**Files to modify**:
+- [component.tsx]
+- [styles if applicable]
+
+**Vibe Check**:
+- [ ] Spacing feels balanced
+- [ ] Copy is clear and helpful
+- [ ] Loading states are smooth
+- [ ] Error states are clear
+- [ ] Interactions feel responsive
+
+**Deliverable**: Polished component + summary of changes

package/bundles/expo-mobile/.lattice/prompts/06-security.md

@@ -0,0 +1,32 @@
+# Security Review Prompt
+
+Copy this prompt and fill in the blanks:
+
+---
+
+**Role**: You are conducting a security review of this codebase.
+
+**Scope**: [What area to review - e.g., auth, API routes, data handling]
+
+**Review checklist**:
+- [ ] Input validation on all user inputs
+- [ ] Output encoding to prevent XSS
+- [ ] Authentication checks on protected routes
+- [ ] Authorization checks for user actions
+- [ ] Sensitive data not logged or exposed
+- [ ] API keys and secrets in environment variables
+- [ ] CSRF protection on mutations
+- [ ] Rate limiting on sensitive endpoints
+
+**Files to review**:
+- [file1]
+- [file2]
+
+**Output format**:
+For each finding:
+1. **Risk**: High/Medium/Low
+2. **Location**: File and line
+3. **Issue**: What's wrong
+4. **Fix**: How to address it
+
+**Deliverable**: Security findings list + recommended fixes

package/bundles/expo-mobile/.lattice/release-workflow.json

@@ -0,0 +1,55 @@
+{
+  "schemaVersion": "1.0",
+  "productionBranch": "main",
+  "runtimeStatePath": ".lattice/runtime/release-state.json",
+  "artifacts": {
+    "workflowGuide": "docs/LATTICE_RELEASE_WORKFLOW.md",
+    "handoffSchema": ".lattice/schemas/feature-handoff.schema.json",
+    "handoffTemplate": ".lattice/templates/feature-handoff.json",
+    "featureSkill": ".agents/skills/lattice-feature-handoff/SKILL.md",
+    "releaseManagerSkill": ".agents/skills/lattice-release-manager/SKILL.md"
+  },
+  "statuses": [
+    "READY_FOR_RELEASE",
+    "NEEDS_REWORK",
+    "BLOCKED"
+  ],
+  "stages": [
+    "feature_work",
+    "handoff",
+    "release_audit",
+    "candidate_prepared",
+    "owner_approved",
+    "deployed",
+    "live_verified",
+    "cleanup"
+  ],
+  "transports": [
+    "native_task_message_when_bound",
+    "github_issue_pull_request_or_comment",
+    "versioned_handoff_artifact"
+  ],
+  "ownerApprovalRequiredFor": [
+    "production_promotion",
+    "database_or_data_migration",
+    "provider_or_account_write",
+    "secret_or_environment_change",
+    "destructive_action"
+  ],
+  "authority": {
+    "featureAgent": [
+      "implement_approved_scope",
+      "run_verification",
+      "prepare_handoff"
+    ],
+    "releaseManager": [
+      "audit_exact_candidate",
+      "request_rework",
+      "prepare_release_recommendation"
+    ],
+    "productOwner": [
+      "approve_consequential_action",
+      "authorize_production_release"
+    ]
+  }
+}