Quality

Brok treats the registry as product code, not snippets. Every installable item must pass build-time validation, docs visibility checks, mirror parity, render tests, and token/a11y guards before it is considered shippable.

Note

This page describes the guards the registry itself runs. Application teams do not run these commands; use the release checklist for your own screens.

389

cataloged components

399

cataloged blocks

documented bundles

Registry Safety

The registry builder validates every manifest before writing JSON endpoints. It rejects unsafe target paths, missing source files, duplicate names, unknown dependencies, dependency cycles, and open items that depend on Pro items.

terminal

cd apps/docs-registry && php artisan registry:build --dry-run

Install Safety

Installed files are restricted to generated UI paths and each incoming file is re-hashed and checked against its SHA-256 hash before it is written — a mismatch aborts the install. The hash is co-shipped with the content to catch transport corruption and accidental drift. Consumers that pin the publisher's Ed25519 public key additionally verify the signed registry index, bind every fetched item to its signed content hash, and reject replayed older indexes. Existing files are preserved unless the user explicitly confirms an overwrite or passes --force.

resources/views/components/ui/**
resources/views/blocks/**
resources/views/pages/**
resources/js/ui/**
resources/css/themes/**

Design System Guards

Component and block tests enforce semantic tokens, primitive composition, raw color bans, RTL support, stable data-slot hooks, and admin surface pinning for admin blocks. The docs site renders registry Blade in place, and its copies of the shared ui.css / _styles.php and per-item JS must match the canonical source exactly.

terminal

cd apps/docs-registry && php artisan test tests/Feature/Components

Component API Coverage

Every catalog component must produce an API reference from either curated metadata or the registry manifest and Blade source. The guard renders every component docs page and fails when a component ships without generated targets, stable data-slot selectors, the API section, or the registry contract.

terminal

cd apps/docs-registry && php artisan test tests/Feature/Components/ComponentApiCoverageTest.php

Browser Coverage

Playwright tests run the docs site in Chromium desktop and mobile. Core docs and interaction smoke tests also run in Firefox desktop and WebKit desktop and mobile. The full release gate runs the executable sandbox showcase for every component state.

terminal

cd apps/docs-registry && npm run test:browser

Note

These checks are not a substitute for reviewing a component in your product context. They are the baseline that keeps the registry installable, visible in docs, theme-compatible, and safe to copy into a Laravel application.