The token pipeline in this monorepo runs a build script, validates against the DTCG schema, and emits three artifacts: a CSS file, a Tailwind config, and a TOON format used by downstream agents. The work looks like build engineering. It is not. It is a small constitution that the rest of the construction inherits at compile time.
A token is a vow
A typography token does not say “this font, this size.” It says: every surface that calls --text-display-1 will look identical, today and a year from today, until an amendment changes the token itself. The component does not get to pick. The page does not get to override without disclosure. The token is a vow that has been compiled.
This is the structural argument the pipeline is making, and it makes it before any component has been written. Tokens land first. Components inherit. Pages compose. By the time prose is being drafted, the visual identity has already been locked at the foundation, and the only way to break it is to break the build.
A token is a vow that has been compiled.
Why this matters for an agent
An agent generating UI code has a thousand local degrees of freedom. A token-first pipeline removes most of them. The agent cannot decide that this particular page deserves a slightly warmer red, or that this heading wants a marginally tighter leading. The token does not permit it. The agent’s job is no longer to choose; it is to compose within a choice that has already been made and notarized.
That removal of freedom reads, on first contact, like a constraint. It is not. It is a liberation from the wrong question. The agent stops asking “what looks right here” and starts asking “what is the right token to call.” The first question has no defensible answer in an agentic system. The second one is solvable.
What the token pipeline rejects
The pipeline rejects three patterns explicitly. It rejects hardcoded values in components, by failing the lint pass. It rejects token drift between Penpot and code, by failing the schema validator. It rejects new tokens added casually, by routing them through an amendment that lands at the design-source-of-truth before the build can pass.
Each rejection is a refusal made cheap. The refusal happens in CI, not in code review. By the time a human looks at the PR, the structural argument has already been won or lost. This is the brand library’s enforcement lifecycle applied at the bytecode of the build chain, and it is the cheapest enforcement any operator will encounter.
A constitution is not a document. It is the set of refusals the system makes without consulting anyone.