# Design-system change playbook

Use this playbook only when the design-system orchestrator explicitly selects it.

## Sequence

1. Scope the affected product, library, surfaces, modes, and owners.
2. Audit tokens, components, variants, documentation, and known exceptions without mutating them.
3. Produce a change plan with affected consumers, migration risk, rollback, and verification.
4. Require an explicit approval before the first mutation.
5. Delegate each bounded mutation to the appropriate protected worker.
6. Verify naming, variants, variables, accessibility, responsive behavior, and downstream drift.
7. Synchronize records only after verification succeeds.

## Fail-closed rules

- Missing ownership, target file, font availability, or write authorization blocks mutation.
- An audit finding is not permission to change a library.
- A partial verification result cannot transition to synchronized.
- Exceptions stay explicit; do not silently normalize intentional differences.