23out of 100 before any changeLoose threads
297 components and 3 tokens read.
- Source
- github.com/carbon-design-system/carbon, packages/react/src (with the package root's docs, tests, stories and token files)
- Pinned at
- v11.70.0 (commit
aa67ac9), @carbon/react 1.70.0 - Licence
- Apache-2.0: LICENSE at the repository root (Apache License 2.0)
- Why this source
- The carbon repository's packages/react folder at tag v11.70.0, which is the source of @carbon/react 1.70.0. We also read the published npm package; it ships compiled code and type declarations without tests, stories or docs, so it showed less (16 out of 100 against 23 here).
- How it was read
- A sparse git checkout of the one package folder at the pinned tag. Loom's engagement checkout clones a whole repository, and the carbon monorepo is too large for this run, so the package folder was fetched with git directly and then read by the same audit.
- Engine
- Loom conversion engine 0.1.0, commit
1e10804; Loom 2026 standard (public rubric 2026.1); no AI model - Run
- 1 November 2026 with
npm run open-audit -- carbon-react --date 2026-11-01
Carbon's React package is well covered by stories and tests
Most components in the React package have their own test or story, a Storybook names most of them, and Figma Code Connect files link the design library to code. These are the areas where the evidence in the package is strongest.
Much of Carbon lives outside the package we read
Carbon keeps its tokens in other packages of the same repository, its ownership and CI files at the repository root, and its usage guidance on its website. The audit read only the React package, so several low areas mean that the evidence is elsewhere. The notes beside each area say where.
The eight areas, with what each score can show
| Area | Score | What the score can and cannot show |
|---|---|---|
| Foundations and tokens | 15 | Carbon's tokens live in other packages of the same repository (@carbon/themes, @carbon/colors, @carbon/type and others), which this read did not include. The low score says the tokens are not in packages/react, not that Carbon has none. |
| Components | 48 | Scored from what this source holds. |
| Patterns and pages | Not scored | No pattern or template records in the inputs: this area is left out of the overall score, not scored zero. |
| Usage | Not scored | Only the library's own source was read: its components defining themselves are not adoption, and usage can only be measured in product code that consumes the library, so this area is left out of the overall score. |
| Governance | 16 | Ownership (CODEOWNERS), the changelog (release notes) and the CI configuration sit at the repository root or on GitHub, outside packages/react, so they were not in this read. |
| Brand, illustration, microcopy and localisation | 7 | Carbon's brand, illustration and content guidance is published on its website from another repository and was not read. |
| Tools and sync | 38 | CI configuration and the token pipeline sit at the repository root and in the token packages, outside this read. Stories and Figma Code Connect files are in packages/react and were found. |
| AI readiness | 10 | Scored from what this source holds. |
Three findings, with their evidence
Each finding links to the file at the pinned commit, or says that nothing was found in the source we read.
297 components below 80% contract completeness
Each component's contract (purpose, when to use, anatomy, states, accessibility, content) is mostly not in this source; Carbon publishes usage guidance on its website, from another repository.
Evidence
- AccordionSkeletonItem 0% — missing purpose, whenToUse, whenNotToUse, anatomy, api, states, behavior, accessibility, content, examples (@carbon/react:components/Accordion/Accordion.Skeleton.tsx#AccordionSkeletonItem)
- Item 0% — missing purpose, whenToUse, whenNotToUse, anatomy, api, states, behavior, accessibility, content, examples (@carbon/react:components/Breadcrumb/Breadcrumb.Skeleton.tsx#Item)
- ExampleDropContainerApp 0% — missing purpose, whenToUse, whenNotToUse, anatomy, api, states, behavior, accessibility, content, examples (@carbon/react:components/FileUploader/stories/drag-and-drop-single.js#ExampleDropContainerApp)
Loom's proposed change
Complete these contracts before agents are allowed to use the components unsupervised.
117 of 180 components identified as interactive have no matching keyboard/focus test in the supplied inputs
Loom identifies interactive components by name, so the 180 include skeleton placeholders. 63 of them have a keyboard or focus test in this source that names them.
Evidence
- AccordionSkeleton — react/src/components/Accordion/Accordion.Skeleton.tsx:50
- AccordionSkeletonItem — react/src/components/Accordion/Accordion.Skeleton.tsx:116
- AccordionProvider — react/src/components/Accordion/AccordionProvider.tsx:20
Loom's proposed change
Supply or link the component's keyboard tests, then run the applicable paths (Tab order, Enter/Space, Escape, arrow keys, focus return). Written keyboard tables and source matches do not prove execution.
No machine-readable component contracts
AI readiness is low: there is no machine-readable contract, agent instruction file or agent interface in this source.
Evidence
- Not found anywhere in the source we read.
Loom's proposed change
Publish contracts as JSON (generated stubs in artefacts/contracts) so agents read rules instead of inferring them from source.
Every gap, and what Loom would propose
| Area | Gap, and what the source showed | What Loom would propose |
|---|---|---|
| Foundations and tokens | A named token inventory exists3 tokens (20+ scores full) | Adopt the typed token set (typed, described, DTCG-valid) and build it with the token pipeline. |
| DTCG token file validatesNo DTCG token file in the inputs | Adopt the typed token set (typed, described, DTCG-valid) and build it with the token pipeline. | |
| Semantic/component tokens alias a lower tierNo semantic or component tier | Adopt the typed token set (semantic tokens alias primitives) and build it with the token pipeline. | |
| No role token repeats another token's literalNo role colour tokens to assess | Adopt the typed token set (typed, described, DTCG-valid) and build it with the token pipeline. | |
| 3-tier architecture (primitive → semantic → component)tiers present: primitive; chained: 0% | Adopt the typed token set (semantic tokens alias primitives) and build it with the token pipeline. | |
| Light, dark and high-contrast modeslight 1, dark 0, high contrast 0 | Adopt the typed token set (add the proposed modes) and build it with the token pipeline. | |
| Colour pairs meet WCAG in every declared mode0/0 pairs pass; checked in 0 of 1 declared mode(s); 0 name-based pairs listed separately; 4 undeterminable | Adopt the typed token set (typed, described, DTCG-valid) and build it with the token pipeline. | |
| OKLCH or declared colour spacecolour values with no declared space | Adopt the typed token set (typed, described, DTCG-valid) and build it with the token pipeline. | |
| Tokens carry a role description and provenance0/3 described with a source (0 described) | Adopt the typed token set (typed, described, DTCG-valid) and build it with the token pipeline. | |
| Components | Average contract completeness (10 template fields)16% across 297 components | Fill the open contract fields (the questions are in each contract). |
| Components at ≥80% completeness0/297 | Fill the open contract fields (the questions are in each contract). | |
| Matching keyboard/focus test source in supplied inputs63/180 components identified as interactive by name or export; source matches only, execution not assessed; roots: react | Fill each contract's behaviour and accessibility fields, and test the states in stories with the interaction and a11y add-ons. | |
| Cross-platform parity (React Native counterpart or explicit exclusion)0/297 with a counterpart or platform declaration | Fill the open contract fields (the questions are in each contract). | |
| Governance | Owners per componentabsent: No CODEOWNERS file, ownership section or per-component owner field found. | Answer the setup questions (npm run setup, or Setup in the control area): they write loom/governance.json, rituals and monitoring; the plan's governance model is the proposal they start from. |
| Changelogabsent: No changelog found. | Answer the setup questions (npm run setup, or Setup in the control area): they write loom/governance.json, rituals and monitoring; the plan's governance model is the proposal they start from. | |
| Deprecation policy with timelinesmentioned: Deprecation is mentioned without a policy (replacement, removal condition, timeline). | Answer the setup questions (npm run setup, or Setup in the control area): they write loom/governance.json, rituals and monitoring; the plan's governance model is the proposal they start from. | |
| Decision recordsabsent: No decision records found. | Answer the setup questions (npm run setup, or Setup in the control area): they write loom/governance.json, rituals and monitoring; the plan's governance model is the proposal they start from. | |
| Layer model (system of systems)absent: No layer model: a single layer, with nothing that says what a brand, region or product may override. | Answer the setup questions (npm run setup, or Setup in the control area): they write loom/governance.json, rituals and monitoring; the plan's governance model is the proposal they start from. | |
| Lifecycle statusabsent: 297 components have no lifecycle status. | Answer the setup questions (npm run setup, or Setup in the control area): they write loom/governance.json, rituals and monitoring; the plan's governance model is the proposal they start from. | |
| Brand, illustration, microcopy and localisation | Brand rulesabsent: No brand guidance: nothing says how the brand shows up in type, colour, shape, motion or imagery, so every team and agent improvises. | Fill the guideline's decisions and turn them into rules Loom checks. |
| Illustration & imagery rulesabsent: No illustration or imagery guidance: no style, purpose, sourcing/rights, alt-text or allowed-context rules. | Fill the guideline's decisions and turn them into rules Loom checks. | |
| Illustration library metadataabsent: No asset manifest: illustrations and images cannot be tracked, checked for rights or given alt-text rules. | Fill the guideline's decisions and turn them into rules Loom checks. | |
| Microcopy & voice rulesdocumented: Prose guidance only; nothing machine-readable, so it cannot be enforced or handed to an agent as rules. | Fill the guideline's decisions and turn them into rules Loom checks. | |
| Message catalogue (IDs + variables)absent: No message catalogue: UI strings are literals in code (or English defaults in props), with no IDs, variables or plural rules a writer, translator or copy check can work from. | Fill the guideline's decisions and turn them into rules Loom checks. | |
| Localization policymentioned: Mentioned in passing (4 places); no rule an agent or reviewer could check work against. | Fill the guideline's decisions and turn them into rules Loom checks. | |
| Localisation readinessdocumented: Signals found: direction (RTL) rule; missing: externalised strings, pseudo-localisation, text-expansion rule. | Fill the guideline's decisions and turn them into rules Loom checks. | |
| Tools and sync | One token source built into codesources: none; build: none | Build the one token source into code with the token pipeline script, in CI. |
| Documentation site built from the system0 documentation pages; react/code-connect/README.md | Use Storybook autodocs as the documentation site built from the system. | |
| CI runs the system's checksno CI file and no documented check commands | Copy the CI template into the CI folder so every pull request runs the system's checks. | |
| AI readiness | Components with a machine-readable contract0/297 | Adopt the machine-readable contracts and their exact imports. |
| Components with followable rules (do/don't/when-not)42/297 | Ship the agent rules and instructions (and connect Loom's MCP server for live lookups). | |
| MCP/knowledge interfaceno MCP; no static index | Ship the agent rules and instructions (and connect Loom's MCP server for live lookups). | |
| Components with one exact import143/297 | Adopt the machine-readable contracts and their exact imports. | |
| Retrieval tests shipped with the systemnone found | Ship the retrieval tests and run them in CI. | |
| Builder knowledge index returns the right component + import0/10 top-1 hits with import | Ship the retrieval tests and run them in CI. | |
| Agent instructions shipped with the systemnone found | Ship the agent rules and instructions (and connect Loom's MCP server for live lookups). | |
| Tokens with allowed/forbidden use0/3 | Ship the agent rules and instructions (and connect Loom's MCP server for live lookups). |
The proposed after: draft pull requests, never opened
A dry run: 6 draft pull requests were planned and none was opened. Nothing was applied to Carbon (React).
- Token set: typed, aliased and valid DTCG, built from one source
loom/plan/carbon-react-tokens-a2f4bef484 - A contract per component: purpose, when to use and not, states, accessibility, content
loom/plan/carbon-react-contracts-13bfe32990 - Governance records: changelog, deprecation policy, decisions, layers, lifecycle
loom/plan/carbon-react-governance-495220d6e3 - Guidelines as rules: brand, voice, message catalogue, localisation
loom/plan/carbon-react-guidelines-374255aa79 - Agent interface: instructions, rules and retrieval tests
loom/plan/carbon-react-agent-3ef3f9496b - Tools: stories, keyboard tests and a documentation site
loom/plan/carbon-react-tools-5045443456
What this read cannot show
- Static analysis only: no code was run, no build was made and no test was executed. A matching test file is evidence that the test exists, not that it passes.
- Usage is not scored. Only the library's own source was read; usage can be measured only in the product code that consumes the library, which is not part of this source.
- A low area can mean the evidence is not in the public source we read (it may live on a documentation site, in another repository or in a team process), not that the system is weak there.
- Patterns and pages are not scored: the source holds no pattern or page-template records Loom can read, so the area is left out of the overall score.
- Nothing was applied to the project. The plan is listed as draft pull requests that were not opened (a dry run), and no after score is claimed.
- Read from packages/react at tag v11.70.0 only. Carbon's tokens (@carbon/themes, @carbon/colors and other packages), its repository-level ownership and CI files, and its website guidance were not read.
- The published npm package (@carbon/react 1.70.0) was read as a check and scored lower (16 out of 100), because compiled code and .d.ts files carry no docs, tests, stories or rules.