vendored-assets

1---2name: vendored-assets3description: Vendored assets. Use when importing or updating checked-in third-party or externally generated JavaScript, CSS, registries, schemas, snapshots, or Scalar, Swagger, and MIME artifacts.4---5 6Treat upstream artifacts as supply-chain inputs. Change their generator or7documented import source, then regenerate; generated output is review evidence,8not an editing surface.9 10## Workflow11 121. **Trace ownership.** Identify the artifact, generator or exact import13   procedure, upstream source/version, license, consumers, tests, and shipped14   package or bundle. Search by asset and upstream project name to find current15   packaging scripts, generated artifacts, consumers, and history.16   Continue when every input and consumer is accounted for.172. **Pin provenance.** Resolve moving URLs, tags, branches, and omitted versions18   to an immutable release or artifact. Record project, version, path or URL,19   and digest in the generator or maintenance header. Omit a digest only when20   another enforced immutable source is recorded.21   Continue when a future run cannot silently select different bytes.223. **Clear the license gate.** Verify release metadata, license files, bundled23   notices, and the license trail retained in the distributed form.24   Continue when every distributed artifact has a verified retained license trail.254. **Regenerate.** Improve the generator or import reference first. Recover an26   exact procedure for generatorless assets; add a deterministic script only27   for recurring updates. Record a one-off procedure beside the artifact. A28   clean rerun must produce no diff.295. **Audit the complete diff.** Account for behavior, URLs and runtime fetches,30   source maps, notices, encoding, format changes, and additions or removals.31   For browser assets, also read [browser-assets.md](browser-assets.md).32   Continue when every change is attributable and suspicious content is resolved33   or reported.346. **Clear test and size gates.** Record byte sizes before and after, use35   focused consumer tests, and compare bundle size or composition when shipped36   JavaScript, CSS, or registry output changes materially. Compare that output37   against the pre-update revision rather than measuring only current size.38   Continue when focused checks pass and every non-trivial size delta is explained.397. **Close release impact.** Apply root changeset routing for consumer-visible40   behavior, browser support, wire data, or meaningful shipped-size changes.41   Generated sections owned by barrels, AI docs, or migration tooling remain42   with the owners named in root instructions.43 44The task is complete when every input and consumer is accounted for, provenance45and licenses are immutable and retained, regeneration is deterministic, every46output change and non-trivial size delta is explained, focused checks pass or47are reported as not runnable, and release impact is recorded.48