How it works · foundations 5

The instruments

Beyond the eval suite (188/188 deterministic checks), three standing instruments measure the pipeline against material this project doesn't own — and publish their numbers as committed reports.

The whole-kit census

Every component set in a live enterprise Figma kit, replayed through the full deterministic import pipeline — the exact engine the playground runs: propose → captured-token layer → validate → all 4 emitters. Current standing: 1,618/1,618 sets clean, including all 76 real variant composites (menus, cards, avatar groups, dialogs) where failures used to concentrate.

"Clean" is deliberately qualified: refusal-free ≠ pixel-right. Alongside the clean rate, the census counts facts carried (token-bound style facts, with minted provisional tokens marked), named notes, and capture degradations per set — so a clean import is never confused with a lossless one. Reproduce: npm run extract:figma:gauntlet → CENSUS.md.

The visual-parity instrument

Emitted previews perceptually diffed against the design tool's own PNG renders — pixelmatch, with a text-masked second score because the design tool and the browser rasterize the same glyphs differently. Ranked worst-first as a standing fix queue; every row over threshold carries a named cause from a committed triage table (engine / capture-gap / renderer / harness / design) or prints UNTRIAGED. A baseline gate re-scores every row and fails on regression beyond ±0.1pp; moving the baseline is an explicit, reviewed act. Reproduce: npm run extract:figma:visual → REPORT.md.

Cross-renderer deltas are named, not tolerated away: font rasterization differences ride the text mask; text-hug metrics (±1–2 CSS px on hug-sized boxes) stay in the score and are triaged renderer.

The enterprise gauntlet

Four large production design systems run through the unmodified code-extraction pipeline at pinned SHAs. The exercise surfaced two silent-loss classes the friendlier pilots never hit — vanishing as-expression exports, hollow intersection-of-named-refs props — both eliminated and receipt-locked. Every workaround is named in the report: ENTERPRISE-GAUNTLET.md. The brownfield pilots that preceded it — including a 58/58-component web-component library, a 245-component React system extracted in under a second, and a complete real code ⇄ design pair — keep their receipts in extract/pilots/.

Certification, today and tomorrow

Today, "certified" means: every capability claim in the reference implementation is backed by an executable check or a committed receipt — the eval suite gates the machinery, the census and visual instruments gate the imports, and the golden manifests gate the generators. The end state is a conformance kit a second, independent implementation can run — the roadmap's final, falsifiable exit criterion: an implementation this repo's authors didn't write passes the conformance kit (ROADMAP.md).