Appearance
Generated assets and dependencies
Closed inventory of derived repository assets and dependency-policy gates; authored language specifications and conformance fixtures are source.
| Family | Canonical input and producer | Output | Freshness and class |
|---|---|---|---|
| Embedded fonts and notices | scripts/font-assets.json; scripts/generate-font-assets.py with pinned archives and scripts/font-requirements.txt | packages/render/src/text/generated-fonts.ts; packages/render/third_party/fonts/ | Font tests plus API, package, and static checks; tracked derived |
| PWA icons | Fixed algorithm in scripts/generate-pwa-icons.mjs | packages/diagram-editor/public/icons/coral-192.png and coral-512.png | PWA byte checks; tracked derived |
| PWA visual reference | Reviewed icon art | packages/diagram-editor/public/icons/coral-source.svg | Provenance-marker test and visual review; manually synchronized and not generator input |
| Tree-sitter parser | packages/tree-sitter-coral/grammar.js; pinned tree-sitter generate | packages/tree-sitter-coral/src/parser.c, packages/tree-sitter-coral/src/grammar.json, packages/tree-sitter-coral/src/node-types.json, packages/tree-sitter-coral/src/tree_sitter/alloc.h, packages/tree-sitter-coral/src/tree_sitter/array.h, packages/tree-sitter-coral/src/tree_sitter/parser.h | Generation, native, corpus, and consumer tests; tracked derived |
| Reviewed documentation figure | Slice 60 Coral source and review recorded by docs/figures.json | docs/public/figures/coral-overview.svg | Source/output hashes, SVG metadata, and human review; tracked derived |
| npm dependency graph | Root and workspace manifests plus approved policy; npm 12.0.2 | package-lock.json | Clean install, policy, audit, build, and test gates; tracked derived |
| Site and test output | Tracked source and the owning build or test | docs/.vitepress/dist/, build/, package distributions, coverage, reports, and temporary consumers | Owning command and cleanup; disposable |
Regeneration boundaries
- Ordinary install, build, test, and publication use the committed fonts and do not download or regenerate them. Font regeneration is maintainer-only, needs Python plus the pinned requirements, and acquires only pinned archives.
npm run generate:pwa-iconsregenerates deterministic PNG bytes. The SVG is reviewed reference art and remains manually synchronized.npm run generate -w tree-sitter-coralupdates parser artifacts fromgrammar.js; native and corpus checks validate the result.- The reviewed documentation figure changes only with its Coral source, manifest hashes, exported SVG, and human visual decision together.
- Generated site, package, coverage, report, and consumer directories are disposable. Never treat them as canonical input.
Dependency update policy
| Policy | Owner and evidence |
|---|---|
| Compatible dependency updates | Dependabot groups development and production minor and patch updates separately; review the lockfile and owning gates |
| Deferred major updates | TypeScript 7 and Node 26 types remain intentional deferrals until a separately reviewed migration |
| Runtime and release pins | Root and workspace manifests plus package-lock.json; exact-toolchain and consumer checks |
| GitHub Actions | Every external Action uses a full commit SHA with an exact version comment; workflow-policy tests enforce it |
| Vulnerabilities | npm audit --audit-level=high is the blocking high/critical audit; fragment review stays separate |
| Install scripts | Root allowScripts is the closed approval for reviewed build dependencies and native tooling |
| Licences | Root and package licences, embedded-font notices, package manifests, API compatibility, and static-delivery checks |
Update canonical inputs first, regenerate only the affected family, and run its focused freshness gate before widening verification to the blast radius.