Essay · August 26, 2026
Vetted is a procedure, not a compliment
A skill that tells an agent where to get a component is a supply chain, whether or not anyone calls it that. The agent does not weigh the list, it installs from it. So the word "vetted", sitting in a file an agent reads at build time, has to describe work that already happened and that a stranger can re-run.
What the word has to cover
Four operations per source, each one leaving a result behind.
Load the source live, so the entry describes what is there now, not what a summary said last quarter. Read the license and the pricing tiers, because a free core with a paid upper tier is the common shape, and a demo page does not separate the halves. Run the domain through threat-intelligence reputation scanning. Pin the source repository, so the entry names a path in version control rather than a brand.
The file carries its verification date, plus an instruction that matters more: if a URL stops resolving, a license changes, or a tier moves, the reference gets fixed in the same change that works around it. Skip those four operations and "vetted" means the author had heard of it.
Probably innocent is not cleared
Five sources were evaluated. Four cleared. The fifth sits in a section titled not yet vetted, with the reason written out.
Its domain was about two weeks old and carried a "suspicious" threat-reputation verdict. The innocent reading is the likely one. New domains score badly for being new, and the account behind this one has years of public history. Likely is still the wrong bar. A reference file gets read by something that acts on it, and probably fine is indistinguishable from fine once code is being copied.
So the entry is held, and it names what would end the hold.
Promote it to the vetted table only when both hold: the threat verdict has cleared, and the domain is older than 90 days. Until then, take the code from the pinned repository rather than the domain, and read every file before it lands.
Both conditions, not either one. A hold with no route forward gets ignored.
Deleting the entry would have been easier and worse. It is the only source in the file aimed at agent-native surfaces, so dropping it means the next build rediscovers it with none of this attached. Promoting it would have laundered a hunch into a recommendation. A held entry with written conditions is the only version that carries the reasoning forward.
Pin the repository, not the domain
A domain is a live service. Whatever it serves at the moment of the request is what gets copied, and last month's check constrains none of that. A repository at a named path is history: readable, diffable, attributable, and awkward to change quietly.
So every entry pins one, and the checklist points the agent at the repository instead of the page. That also settled a name collision the file ran into. Two unrelated projects share a product name on different domains, with different authors and repositories. A name is not an identifier. The pin is, so the entry carries a warning naming which of the two is meant.
Where an import stops being a paste
A source list with no adoption procedure produces components pasted in with somebody else's palette still on them. Seven checks run per import.
- Local first. Name the gap in the local system before importing. If the system already has the piece, style that instead.
- Registry over hand-copy. Install through the registry when the source supports one, and record the source URL in the commit message when it does not.
- Signature test. A stock component is raw material; anyone can install the same one. It becomes a signature element only after customization that no one else's build would show.
- Retokenize. Swap the import's palette, radii, spacing, and fonts for local tokens. An import still carrying its source palette is unfinished.
- Motion law. Imported motion animates
transformandopacityonly, and ships a reduced-motion variant. - License and tier. Confirm the license in the source repository, and never paste paid-tier content out of a demo.
- Render proof. The source's own demo proves the demo. Render the import in the local stack at desktop and mobile widths before calling it working.
Every one of those is an action with an artifact behind it. None of them is a standard you can feel your way toward.
The part that makes it affordable
The reference loads only when a task imports a component the local system lacks. Audits and restyles never read it. Both design skills carry the same file, so the discipline is identical whether the request arrives as one token decision or a full surface build.
That conditional load is what keeps the discipline from getting skipped. Supply-chain care usually arrives as a tax on every task, and then gets dropped on the tasks in a hurry. Attached to the one condition that needs it, it costs next to nothing the rest of the time.
The test for the word is easy to run. Hand the file to somebody with no reason to trust you, and see whether they can reproduce every claim from the file alone. Four operations, a check date, a pinned repository, and a held entry with its conditions in the open. Without that, the word is decoration.