As of October 29, 2026. This dossier describes gnosix.ds at commit a7fbfc8 (version 4.6.0, with amendment AMD-001). Underlined links lead to the files of that commit, frozen.
Dossier · The design system
gnosix.ds — a design system a machine can check
A design system is a set of decisions other people make every day. gnosix.ds writes them in a form a machine can check — 29 rules, 16 roles, 14 components — and carries them to the web, Rust, Android and FigCraft, without letting any toolkit become the design system.
On this page
In one picture
Think of the standard metre: a reference bar, kept apart, and instruments that compare every copy with the original. A copy that grows by a millimetre is rejected, even though nobody meant it to.
gnosix.ds does this for an interface. The colour of a text, the radius of a corner, the name of a component have a reference value; each platform receives a copy, and 36 gates compare each copy with the original. A colour that drifts is a false metre, and the gate sees it.
The problem: the same decision, made a thousand times
Choosing the grey of a caption takes a second. Choosing it in eleven interfaces, with no shared rule, gives hundreds of nearly identical greys.
That is what the field audit measured before a single rule was written. It read eleven interfaces — sites, portals, tools — and recorded everything they use that the system does not provide. One holds 1,263 colours outside the palette, another 421, a third 294. Stand-in typefaces, spacings of 9, 10 or 11 pixels where the scale has none.
None of these values is a mistake. Each was reasonable on the day it was written. What was missing was a reference to consult — and an instrument that says "stop" when a copy drifts from it.
The full inventory is public: every colour, typeface and length outside the contract, interface by interface, with an absorption plan saying what to change and in which order (the inventory, the plan).
Meaning first, colour second
The system does not say "#111418"; it says "the text that is read first". The colour is only the value of that role on a given ground.
The whole contract fits in four tiers, and each is a file you can read:
| Tier | What it holds | File |
|---|---|---|
| Rules | 29 numbered obligations (COL-001, A11Y-001…), each with what is observed and the test that checks it | rules.json |
| Palette | 5 approved colours, their ramps, the elevation steps of surfaces, spacing, the typeface | TOKENS.json |
| Roles | 16 roles — surface, ink, accent, focus, positive… — bound to a value on each ground | ROLES.json |
| Components | 14 elements (button, field, badge, dialog…), their states, variants and the accessibility they owe; 36 arrangements | COMPONENTS.json |
Everything else is a projection: generated from these files, checked in, and refused as soon as it drifts. A copy is never touched by hand; the original changes, and the copies follow.
An example: the green that carries no text
The approved green measures 4.09:1 against the light ground. That is enough for a mark, not for a sentence: readable text needs 4.5:1. Rather than cheat on the colour, the system splits two roles. positive is the pip beside the word; positive-surface is the tinted ground behind it. Every pair that carries text is measured at 4.5:1 on both grounds.
36 gates, one command
The same command runs on the workstation and in continuous integration: 36 gates, 24 seconds, one verdict. A gate that changes its mind fails the whole run.
python3 -m tools.ci
…
PASS the severity register is honest
PASS the surfaces render as the system carries them
PASS test suite
PASS: 36 gates in 23.8sThe run above was taken at commit a7fbfc8 on October 29, 2026 (full run). A few of these gates capture the spirit of the project:
- "Every colour is one of ours." A value that is not in the palette, wherever it appears, fails the gate.
- "The contrast table measures what the palette says." Contrast ratios are not copied: they are recomputed on every run.
- "Every gate says what it must say." A gate that exits cleanly but prints something other than what the list of expectations states still fails.
- The eye. A driven browser renders the system's web surfaces on both grounds, runs an accessibility checker over them, and compares the pictures, byte for byte, with the ones the system carries. Today: 3 surfaces, 0 findings.
- The severity register. Where the system and the field differ is recorded, with its severity and its owner. A closed deviation carries a probe: if it comes back, the gate fails.
Nobody has to remember the rules: the machine does. A mistake is found on the workstation, in 24 seconds, not three weeks later in a screenshot.
Written once, carried everywhere
A web page, a Rust application and an Android application read the same decision, each in its own language: a CSS sheet, a Rust constant, a Kotlin function.
<body data-gnosix-substrate="dark"> web: the ground is chosen once
let surface = gnosix_ds::roles::DARK.surface; Rust: the contract's own constant
val surface = GnosixRoles.of("dark", "surface") Kotlin: the same value| Target | What it receives | Where the proof stands |
|---|---|---|
| Web | Three CSS sheets (tokens, roles, components) and a state module | Rendered and looked at by the eye, on every run |
| Rust | A dependency-free crate carrying the contract's constants | Compiled and tested on every run; not yet seen on screen |
| Android | The Compose translation and a sample application | Written, not yet checked on a device |
| Interchange formats | The tokens in DTCG and Style Dictionary, readable by other tools | A gate checks the two say the same thing |
| FigCraft | A design project: boards, the component vocabulary, a published library | Generated, and compared byte for byte with its source |
This site is itself a client: its colours, its two themes and its boxes come from gnosix.ds. The row of triangles on the left of each box is amendment AMD-001, described below.
Names measured, not chosen
The fourteen components do not come from taste: they are the names several independent interfaces already used, counted once per lineage.
Why "per lineage"? Because two copies of one stylesheet are not two votes. Two repositories sharing a sheet written once carry one opinion; counting them twice would pass an opinion off as an agreement. Counted this way, 26 names appear in at least two lineages; once the parts of one component and the domain-specific patterns are set aside, fourteen remain.
The field also used 36 arrangements the system did not describe: 29 patterns (a ledger, a rail, a notice, a run of prose) and 7 primitives. The contract now describes them as the field's sheet writes them, and a gate checks both ways: an element the contract names that the sheet lacks is a failure, and so is the reverse.
Source: the convergence table.
History: up to the first amendment
From the first import to amendment AMD-001, which replaces a rule with a row of triangles: how a change enters a system that refuses to let its copies be touched.
| Date | What happens |
|---|---|
| October 20, 2026 | The public repository begins, at version 3.4.2. Older versions were distributed as archives and are not reconstructed. By that evening, after 92 commits, the system is at 4.6.0: roles, components, the eye, the severity register, the field audit. |
| October 21 | An inquiry into the field's upstream sources enters the repository (10 commits, PR #2). |
| October 29 | First amendment, AMD-001: the left rule of a note becomes a row of equal triangles pointing at the content (PR #3). |
| October 29, later | The README still announced 22 gates and 14 roles. The fix becomes a recorded deviation, DEV-022, with a probe that keeps it from coming back (PR #4, merged). |
Why an "amendment"
The stylesheet the system ships is cut from a historical copy that three repositories vendor byte for byte. Writing the triangles into that copy would have been erased by the next cut, or would have made the copy lie about what it is. So the system writes its changes apart, in a layer of amendments appended last: it wins the cascade, and the historical copy stays the one the field knows.
Outlook: the eye on a native surface
Today, the eye looks at web pages. Next: looking at native screens too, the ones gnosix and GPUI draw.
The answer is not a given, and the roadmap says so: first one has to find out whether the desktop's renderer can run without a display. If it can, native surfaces will be looked at like web pages; if not, the reason will be recorded. Either outcome counts as proof.
The rest of the roadmap follows the same format: for each task, where it lands, what proves it is finished, what it needs and what it costs. Two interfaces have already adopted the system, at version 4.2.1: the documentation portal and the engineering corpus, with zero colours outside the contract. The others will follow one by one, by the same six-step method, on a branch.
What it is not
- Not a component library. The repository ships no ready-made React buttons: it ships decisions, and their translations per platform.
- Not yet seen on a native screen. The Rust and Android translations are written; Rust compiles and passes its tests, but neither has been looked at on screen yet, and Android has not been tried on a device.
- Not finished. The register lists deviations that are still open, published with their severity and their owner.
- The field is mostly private. Of the eleven audited interfaces, most are not public; the inventory is.
What it changes, depending on who you are
Designer
A colour or spacing decision is written once, with its reason, and it arrives unchanged in the browser, the native application and the design tool.
Developer
No values to copy: you read the role. And one dependency-free command tells you in 24 seconds whether a change breaks a rule.
Decision-maker
A visual identity that does not drift from one product to the next, and a measured account of what is left to harmonise, interface by interface.
Going further
- The repository: gnu6dotlive/gnosix.ds, MIT licence.
- The qualification run behind this dossier: receipts/gnosix-ds-ci-a7fbfc8.txt.
- The first four dossiers — gnosix, gnostral.rs, Calix, in.gnu6 — in prologue, the October 29 snapshot.