DS-repo restored scripts/sync-design-system.mjs with an explicit source
allowlist and verified the command; ran their exact command (never one
reconstructed locally). MANIFEST.json was rewritten by the script itself,
never edited by hand.
source_commit now reads efaa3d0 (playground-design-system's main on the
public mirror), verified reachable via git ls-remote against the public
remote and git cat-file -t locally — in contrast to the previous c1b7bad,
which does not exist as a git object in that repo at all. 26/27 files
byte-identical to the source; only their README.md content differs.
Replaced the three stale prose points in README.md and docs/playground.md
that described the missing command and the untrustworthy source_commit.
Suite: 1070/1070 (tracked kb-update + kb-eval test files).
[skip-docs]: README.md and docs/playground.md are the doc update this task
required (vendoring section accuracy). CLAUDE.md's command/agent/skill
surface is unaffected — no new commands, agents, or skills.
Initial sync of shared/playground-design-system/ into
plugins/ms-ai-architect/playground/vendor/playground-design-system/
via scripts/sync-design-system.mjs.
Source commit: f1fecf39b8fc20e86f6ec3c737f0dfda8403712e
Files: 25 (7 CSS + 11 fonts/licenses + 3 schemas + README + MANIFEST)
Vendored copy keeps the plugin standalone — playground will load CSS
from ./vendor/ regardless of where the plugin is installed.
Also adds .gitleaks.toml at repo root with a path allowlist for
vendored MANIFEST.json files (SHA-256 file hashes are not secrets).
Docs updated together with the playground HTML refactor that actually
consumes the vendored CSS (next commit). This commit is internal-only.
