docs(vendoring): record re-sync decision and measured consumer drift

Vendoring stands: 26/27 vendored files are byte-identical in both consumers 3.5 months on, with no local drift. No re-sync command is published yet - the script is recoverable in full from catalog history and is already polyrepo-ready, but restoring it unchanged would copy this repo's root wholesale, STATE.md included.

Also records that MANIFEST.json's source_commit c1b7bad is not merely unreachable but false: the vendored tree carries components-tier4-project-view.css, which did not exist in that commit. Verified with git cat-file -e plus a known-positive control on components-tier3.css in the same commit.

Verification was find/git cat-file/SHA-256 comparison, not grep - the full log is in docs/vendoring-and-re-sync.md.
This commit is contained in:
Kjell Tore Guttormsen 2026-08-27 00:17:19 +02:00
commit c4253027ed
2 changed files with 181 additions and 0 deletions

View file

@ -12,6 +12,7 @@ Playgrounds are the visual self-service UIs that complement a plugin's terminal
- [Provenance](#provenance)
- [Directory layout](#directory-layout)
- [Quick start](#quick-start)
- [Vendoring and re-sync](#vendoring-and-re-sync)
- [Design principles](#design-principles)
- [Token system](#token-system)
- [Component reference](#component-reference)
@ -162,6 +163,34 @@ reader switches theme — the bootstrap script only reads it back on the next lo
bootstrap script, the page renders in the HTML attribute's default theme for one frame before
JavaScript applies the saved/OS preference — the FOUC it exists to prevent.
## Vendoring and re-sync
Vendoring remains the recommended consumer model. Measured 2026-08-27 across both consumers
(`ms-ai-architect`, `llm-security`): 26 of 27 vendored files are byte-identical to this repo's
current content three and a half months after their last sync, and neither copy has been edited
locally. The only file that differs is this README.
**There is no re-sync command today.** The `sync-design-system.mjs` script that produced the
existing vendored copies was deleted with the monorepo layout in 2026-06. It is recoverable in
full from the `catalog` repo's history and belongs in this repo once restored, but restoring it
unchanged would copy this repo's root wholesale — including files that are not part of the
delivered system. That boundary is an open decision, so no command is published here rather than
one that would be wrong.
Until then, a consumer can still check its own copy without any script:
- **Integrity** — re-hash the vendored files against the SHA-256 values in that copy's own
`MANIFEST.json`. Answers "has anyone edited the vendored files locally?"
- **Drift** — hash each vendored file, stripping the
`/* Code generated by sync-design-system.mjs; DO NOT EDIT. */` header line the sync injects into
every `.css`, and compare against the same filename at this repo's root.
`MANIFEST.json`'s `source` and `source_commit` fields in the existing copies point at the old
monorepo layout. Leave them alone for now — the recorded `source_commit` is not just unreachable
but inaccurate, and rewriting only the path would make a false pointer look plausible. See
[docs/vendoring-and-re-sync.md](docs/vendoring-and-re-sync.md) for the full decision, the
measurements behind it, and the recovery command.
## Design principles
1. **Aksel/Digdir-aligned.** Inter font, body 17px, Digdir blue `#0062BA`, semantic CSS tokens. Norwegian public sector users recognize this DNA.