CMS Design Skill Dependencies

Purpose

Yayaw treats external design skills as versioned guidance dependencies for the CMS control plane. The client model remains responsible for creative reasoning and content generation. Yayaw does not call a second server-side language model and does not execute upstream skill scripts.

The dependency layer currently includes selected guidance from Impeccable and Taste Skill. Impeccable is available across marketing, editorial, and product surfaces. Taste Skill is deliberately restricted to marketing and editorial surfaces.

Files

• design-skills.json declares repositories, refs, resolved revisions, licenses, surface restrictions, and the files used for each design stage.
• design-skills.lock.json records the exact source revision, byte size, and SHA-256 checksum for every vendored file.
• vendor/design-skills contains only Markdown guidance and upstream license texts. Executable third-party files are rejected by the updater.

The stages are brief, composition, critique, and rework. The MCP design guidance operation can therefore return only the fragments needed for the current step instead of spending tokens on both complete upstream skills.

Updating

Run the updater from the repository root:

bun run cms:skills:update

The command resolves each declared Git ref, downloads the allowlisted files at the resolved commit, rewrites the vendored directory, and regenerates the lock. Review the upstream diff and license before committing an update.

Renovate tracks the Impeccable tag and the Taste Skill main branch digest. Its post-upgrade task runs the same updater. A self-hosted Renovate installation must explicitly allow bun run cms:skills:update in its global allowedCommands setting; repository configuration cannot grant that permission.

Verification

Run the offline integrity check:

bun run cms:skills:check

The check validates the manifest and lock metadata, rejects unexpected or executable files, and verifies every size and checksum without network access. CI runs this command as part of documentation integrity.

Third-party attribution is recorded in THIRD_PARTY_NOTICES.md, and the exact upstream license files travel with the vendored guidance.