FIGURE 0 · HOW THE PARTS FIT TOGETHERSIX PARTS, ONE LOOP
Six parts, one loop.
A standard says what a design system needs. The system packages it for an agent. A gate checks what the agent writes, and the product is built only from what passes. Whatever the system lacks comes back to it as a gap.
01
The standard.
It sets out six properties a design system needs before an agent can build with it reliably. Everything below is built to them and scored against them.
02
The design system.
It ships as one package: tokens, components and the rules written for an agent to read. Its own tests keep the rules and the code in step.
03
The agent.
A coding agent reads the system's rules the way a new engineer reads the docs, then writes files into the product.
04
The gate.
Undrift checks every file as the agent writes it, against the same rules the agent read.
05
Three outcomes.
Every file ends one of three ways. It is stopped and sent back with the reason, it passes, or the gate cannot read it, and then it is listed as not checked and never counted as clean.
06
The product.
It is built only from the system's parts. Where nothing fits, the agent marks the gap in magenta instead of inventing something, and the gap goes back to the system as its next job.
FIGURE 0 · HOW THE PARTS FIT TOGETHER
Six parts, one loop.
A standard says what a design system needs. The system packages it for an agent. A gate checks what the agent writes, and the product is built only from what passes. Whatever the system lacks comes back to it as a gap.
FIGURE 0 · STEP BY STEPSIX STEPS, IN THE ORDER A FILE TRAVELS
-
01
The standard.
It sets out six properties a design system needs before an agent can build with it reliably. Everything below is built to them and scored against them.
-
02
The design system.
It ships as one package: tokens, components and the rules written for an agent to read. Its own tests keep the rules and the code in step.
-
03
The agent.
A coding agent reads the system's rules the way a new engineer reads the docs, then writes files into the product.
-
04
The gate.
Undrift checks every file as the agent writes it, against the same rules the agent read.
-
05
Three outcomes.
Every file ends one of three ways. It is stopped and sent back with the reason, it passes, or the gate cannot read it, and then it is listed as not checked and never counted as clean.
-
06
The product.
It is built only from the system's parts. Where nothing fits, the agent marks the gap in magenta instead of inventing something, and the gap goes back to the system as its next job.
1
Five things that are new.
1.1
Most of what a product organisation ships is built by an agent.Whoever prompted it, and whatever the job title of the person who did.
1.2
The agent builds from the repository it works in, and nothing else.It never opens the design file, and it never met the designer.
1.3
The canvas is no longer where design is defined.Discovery still happens there. The decision does not.
1.4
Judgement that isn't written down is absent from the work.Not diluted, and not applied later. Absent, wherever the agent reads.
1.5
Review cannot scale to the volume.Either the system is right, or the wrong thing ships.
2
Rule · to be cited verbatim
The output is correct by design when the design system makes the wrong build impossible, not discouraged.
Published under CC BY 4.0. Cite it, build to it, argue with it.
Learey, C. (2026). Correct by Design. correctby.design
3
4
A design system built to the thesis.
Not a slide about the thesis. A complete design system that holds to it: tokens defined once, components where the wrong build will not compile, documentation that ships with the code.
Then a coding agent built a working application from it, with no design direction. The result is the system's output rather than a designer's, which is the whole claim made concrete.
The repository is public, under MIT. The system and the application an agent built from it are both in it.
The code
5
Six properties, each scored with the evidence attached.
Any design system can be assessed against the thesis, by anyone, in two passes.
5.1
Read the repository.Count what's actually there, with file references, against each of the six properties. This finds the cause.
5.2
Make an agent build with it.Before it runs, write down what it's expected to get wrong. This finds the gaps, which leave no trace to read.
5.3
Separate the three kinds of failure.What the documentation didn't say, what the components allowed, and what doesn't exist in the system at all.
Where something can't be measured, it comes back as not measured, with the reason. That never renders as a failure.
6
Ten systems, read and built with.
The same instrument, the same frozen task, applied to ten well-known design systems: what each one holds, and what an agent actually does with it.
10design systems, read from pinned commits by one instrument
3of six properties can be read straight from a repository
16screens built, cold and informed, under one frozen task
Where a property can't be read, it comes back as not measured, with the reason, never as a failure. The protocol was written and frozen in July 2026, before any run happened, and any change since is published as a deviation with its date and reason.
7
Use it.
The definition, the six properties and the diagrams are published under CC BY 4.0. Cite them, build to them, argue with them.