generating-lattice — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited generating-lattice (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Generate and maintain lat.md/ knowledge graphs — structured, cross-referenced markdown anchored to source code symbols. The output is validated by the lat CLI, which catches documentation drift whenever code or docs change.
The core mechanism is bidirectional linking:
[[src/auth.js#getValidToken]] wiki links inlat.md/ files point to specific symbols in source. When a symbol is renamed or deleted, lat check catches the broken link.
// @lat: [[auth#Token Refresh]] comments insource point back to the concept they implement. When a section is renamed or removed, lat check catches the dangling reference.
Without both directions, the lattice is a static essay that drifts silently. With both, lat check enforces consistency.
Dependency: Requires mapping-codebases skill. The structural maps (_MAP.md files) are the input that makes LLM-assisted authoring token-efficient — read maps to understand API surfaces, then selectively read source files only where design rationale lives.
npm install -g lat.md
lat --version # verify (requires Node.js 22+)The lat CLI provides lat check (validation), lat search (semantic search), lat section (browsing), lat refs (reference lookup), and lat mcp (agent integration).
Ensure _MAP.md files exist. Generate them if missing:
# Install mapping-codebases dependencies
uv venv /home/claude/.venv
uv pip install tree-sitter-language-pack --python /home/claude/.venv/bin/python
# Generate maps
/home/claude/.venv/bin/python /mnt/skills/user/mapping-codebases/scripts/codemap.py /path/to/repo \
--skip tests,.github,node_modules,vendorRead the root _MAP.md first for high-level orientation, then drill into subdirectory maps. The maps are the symbol inventory — they tell you what exists and where, so you can write source code links without reading every file.
Maps reveal the API surface (exports, signatures, line numbers) without reading full files. Read source selectively to understand design rationale:
Read fully: Files with complex algorithms, business logic, configuration constants, data schemas. The maps identify these by export density and file size.
Read partially: Header comments and constant blocks in large files.
Skip: Files where the map signature tells the full story (thin wrappers, simple CRUD, format utilities).
Create lat.md/ directory and generate markdown files. Every section must be anchored to source code symbols — this is what makes lat check catch drift.
#### Section Structure Rules
[[wiki link]] content). This is the section's identity in search results.
lat check validates this rule.# Good Section
Brief overview anchored to [[src/auth.js#refreshToken]] and [[src/api.js#fetchWithRetry]].
More detail can follow in subsequent paragraphs.#### Source Code Links (the top-down anchors)
Use [[src/path/file.ext#symbolName]] wiki links to anchor documentation to specific symbols. Supported extensions: .ts, .tsx, .js, .jsx, .py, .rs, .go, .c, .h.
## Token Refresh
OAuth token lifecycle managed by [[src/auth.js#getValidToken]] with automatic
refresh via [[src/auth.js#refreshToken]]. The refresh window
([[src/auth.js#REFRESH_THRESHOLD_MS]]) triggers proactive renewal before expiry.Symbol granularity matters. Link to the specific function, class, constant, or method — not just the file. [[src/auth.js#refreshToken]] is useful; [[src/auth.js]] tells you nothing that the filename didn't already say.
For class methods: [[src/server.ts#App#listen]]. For Rust impl methods: [[src/lib.rs#Greeter#greet]]. For Python: [[lib/utils.py#parse_args]].
#### Section-to-Section Links
Use [[file#Section#Subsection]] or short form [[file#Section]] when the file stem is unique:
The sync pipeline ([[data#Sync Pipeline]]) uses the same token refresh
mechanism described in [[auth#Token Refresh]].#### Conceptual Grouping
Organize by domain concept, not file structure. A data.md file might reference db.js, sync.js, and demo.js because they're all part of the data layer. The _MAP.md files already provide file-level structure; lat.md/ adds the semantic layer explaining WHY things connect.
#### Index File
lat.md/lat.md must contain a bullet list of all files with one-sentence descriptions using wiki links. lat check --index validates completeness:
- [[architecture]] — System design, OAuth flow, routing, signals
- [[data]] — IndexedDB schema, sync pipeline, demo mode
- [[awards]] — Award computation engine, data quality rulesSubdirectories need their own index: lat.md/api/api.md.
Add // @lat: or # @lat: comments in source code pointing back to lat.md/ sections. This is not optional — back-links are what make lat check detect when source code changes break documentation.
Run the back-link helper to identify where annotations are needed:
python3 SKILL_DIR/scripts/suggest_backlinks.py /path/to/repoThis parses all [[src/...]] wiki links from lat.md/ files, looks up referenced symbols in _MAP.md files for O(1) line number resolution, and suggests @lat: comment placements. Requires _MAP.md files from Phase 1.
Comment syntax by language:
// @lat: [[section#Subsection]]# @lat: [[section#Subsection]]Place one @lat: comment per section reference, at the relevant code location — not at the top of the file:
// @lat: [[auth#Token Refresh]]
async function refreshToken(token) { ... }To auto-apply suggestions (review the output first):
python3 SKILL_DIR/scripts/suggest_backlinks.py /path/to/repo --applyAfter backlinks exist in source, annotate _MAP.md files so someone browsing a code map can find the lat.md section that explains WHY a module is designed the way it is:
python3 SKILL_DIR/scripts/annotate_maps.py /path/to/repoThis scans @lat: comments in source and adds > Documented in: lines to _MAP.md file headers. Idempotent — safe to re-run after regenerating maps.
Example output in _MAP.md:
### auth.js
> Documented in: [[auth#Token Refresh]], [[auth#Server]]
> Imports: `express`
- **refreshToken** (f) `(token)` :15#### require-code-mention for Critical Sections
For sections where bidirectional traceability is essential (test specs, invariants, key business rules), add frontmatter:
---
lat:
require-code-mention: true
---This makes lat check fail if ANY leaf section in the file lacks a corresponding @lat: comment in the codebase. Use for test spec files where every test must trace to its specification.
cd /path/to/repo
lat checkThis runs ALL checks:
[[wiki link]] in lat.md/ resolves to a real section orsource symbol
@lat: comment in source points to a real section; andevery leaf section in require-code-mention files is referenced by code
lat.md/ has a complete index fileAll four must pass. Fix errors iteratively until lat check is clean.
Set up files that make coding agents maintain the lattice automatically.
Cache exclusion — create lat.md/.gitignore:
.cache/Agent instructions — append to CLAUDE.md (or AGENTS.md) using markers:
%% lat:begin %%
# Before starting work
- Run `lat search` to find sections relevant to your task.
- Run `lat expand` on user prompts to expand any `[[refs]]`.
# Post-task checklist (REQUIRED — do not skip)
After EVERY task, before responding to the user:
- [ ] Update `lat.md/` if you changed functionality, architecture, or behavior
- [ ] Run `lat check` — all wiki links and code refs must pass
%% lat:end %%For full agent integration (hooks that auto-inject search results and block completion when lat check fails), run lat init interactively. This sets up agent hooks in .claude/settings.json, .cursor/hooks.json, etc. The hooks require absolute paths to the lat binary, which is machine-local.
The lattice stays in sync because changes to either side break lat check:
| What changed | What breaks | How lat check catches it |
|---|---|---|
| Symbol renamed in source | [[src/file#oldName]] wiki links in lat.md/ | lat check --md reports broken source ref |
| Symbol deleted | Same as above | Same — dead source link |
| Section renamed in lat.md/ | @lat: [[old#Section]] comments in source | lat check --code-refs reports dangling ref |
| Section deleted | Same as above | Same — orphaned code ref |
| New code added without docs | No back-link for new functions | Manual review (or require-code-mention enforcement) |
| New docs without code anchors | Sections with no [[src/...]] links | Manual review — but this is the failure to prevent |
The critical gap: new code without docs and new docs without anchors are NOT caught automatically unless require-code-mention is set. The agent integration hooks (Phase 6) address this by reminding agents to update lat.md/ after every task and running lat check before completion.
A good generated lattice:
via [[src/...#symbol]], not just file-level links
@lat: comments pointing to thesections that describe them
Anti-patterns (what our v0.1 got wrong):
[[clusters#Visual Pipeline]])and no source anchors — lat check cannot catch code changes
a static document, not a knowledge graph
@lat: comments, the bottom-upview doesn't exist and half the drift detection is missing
The maps-first approach significantly reduces LLM token cost:
complexity, not codebase size
is deterministic
lat check~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.