CodeVetter · Repo Unpack · Contributor handoff
postcss/postcss
Begin with the package contract and trace the affected runtime branch before proposing edits. Preserve source positions, formatting raws, parent ownership, dirty propagation, and mutation-aware iterator behavior together. Tests and CI were inspected, not executed; their existence is not a passing result, and this inventory is bounded rather than exhaustive coverage. Continued work under the current authority must remain read-only, with executable validation deferred to a separately authorized task.
- Read package.json, docs/architecture.md, postcss.js, Processor, and LazyResult first for processing changes; the package exposes both ESM/CommonJS surfaces and a no-work branch that must be considered separately.
- AST edits should preserve iterator timing across Container.insertAfter and both LazyResult walkers; existing regressions compare inserted-sibling order across sync and async processing.
- Preserve raws and source when creating or hydrating nodes: cloneNode shares source references, plugin guidance recommends cloning for maps, and fromJSON attaches children after construction to avoid overwriting their spacing.
- Read PreviousMap and its boundary tests before changing map loading; distinguish annotation paths from trusted map.prev callbacks and the explicit unsafeMap option rather than applying one rule to all inputs.
- For authorized validation later, select the relevant uvu suite first, then existing test:types, test:integration, test:lint, or test:coverage scripts as needed; tests and CI in this brief were only inspected, with map-generator.js outside coverage enforcement.
- Preserve the declared Node 10/12/14+ compatibility and browser-disabled modules; old-runtime tests adapt node: imports and ts-node settings, while .editorconfig requires two spaces, LF, and a final newline.
- Runtime API changes require reviewing adjacent declarations and both export surfaces; contributing guidance uses classes for runtime classes, namespaces for related functions, and interfaces for custom types, while test/version.js requires package and Processor versions to agree.
- Treat architecture/security prose as guidance requiring source verification: architecture token examples describe line/column tuples while the tokenizer emits offsets, and THREAT_MODEL describes a minimumReleaseAge cooldown not configured in the inspected pnpm-workspace.yaml.