Engineering DS Tokens

Overview

Designers systematize, automation codes, AI delivers

Token delivery used to break on someone else's timeline. A designer would push a token change in Figma, Supernova's GitHub bot would silently fail somewhere in its delivery step, and the fix lived in tribal knowledge held by one or two engineers who had to pause their roadmap work to triage. I designed and wrote the backup pipeline for the one fragile layer myself: a written runbook an AI agent reads top to bottom, with nine pre-flight checks and three destination-CI checks so a bypass PR is byte-identical to what the bot would have pushed. I partnered with our lead developer to approve the PRs and walk me through each destination repo's specifics.

The challenge

One fragile layer was costing days

Most of the pipeline was solid. Only the handoff to GitHub was fragile, because it depended on permissions that silently stopped working. We aligned on three goals before writing a single line of YAML.

Mapping the pipeline

Four layers, only one is fragile

Before we wrote the bypass, we mapped the lifecycle so we'd know exactly which layer to replace and which layers to leave alone. Figma, the Supernova plugin, and the per-brand exporter were healthy whenever Supernova's preview said "Up to date." Layer 4, delivery to GitHub, was the only one we needed to back up. The bypass replaces layer 4 and only layer 4. Nothing else changes.

The system in markdown

Prose that actually executes

The full bypass consists of four file types: a runbook per exporter, a slash-command skill that registers it inside Cursor, a CI template that drops into every destination repo, and a public-facing playbook site that documents the system. The runbook isn't a description of the process. It is the process. An AI agent reads it top to bottom and runs every step exactly as written, with all of the constants in one table so nothing drifts out of sync.

Safety gates

Nine pre-flight checks before anything moves

Every check is a hard stop. Most run before any change is made, so a bad run is caught before it can do damage. The bypass refuses to bypass anything important: branch protection, CODEOWNERS review, commit author, and Supernova's own preview pipeline all remain exactly as the normal flow would leave them.

Destination CI

Three checks catch drift before merge

Whether Supernova's bot or the AI bypass pushed the file, every destination repo runs the same checks. Hand-edits that strip the header, shorten the file, or modify other files fail and block the merge, so a bypass PR cannot silently drift away from what the bot would have produced.

First production run

Twelve minutes from failed pipeline to merged PR

On 2026-04-21, Supernova pipeline 136244 failed at delivery. The bypass ran end-to-end, destination CI caught a genuine downstream regression in a hand-written consumer file, the consumer fix proceeded through normal CODEOWNERS review, and the PR merged to main the following morning. Same author, same reviewers, same checks: the only difference was who opened the PR.

For developers

A developer view next to the simulator

The plain-language overview lives on the home page; the developer view sits beside it, with constants, payloads, the slash command, the execution flow, the CI checks, and every runbook .md embedded live. Same source of truth as the markdown files, with a more accessible surface for engineers debugging at any hour.

Reflection

Where design ends and engineering starts

I'd done substantial token work before, but writing prose precise enough for an AI agent to execute was new territory. The default designer instinct is to leave room for interpretation; for a runbook, every constant has to live in one table and every failure mode has to refuse the run. Owning this end to end with one engineer as the reviewer (given his deep familiarity with the destination repos), and shipping the same artifact in markdown, in a Cursor skill, in a CI template, and as a playbook site, is the closest I've come to systems work that actually behaves as a system.

Outcomes

What changed when designers owned delivery