# Contributor handoff — postcss/postcss

> Canonical page: https://codevetter.com/unpack/postcss/agent-handoff

# Contributor handoff — postcss/postcss

Scanned commit 7ac902664902289ea0cb9d6b1096b81e8d33bbf5 (2026-09-29). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Begin with the package contract and trace the affected runtime branch before proposing edits. Preserve source positions, formatting raws, parent ownership, dirty propagation, and mutation-aware iterator behavior together. Tests and CI were inspected, not executed; their existence is not a passing result, and this inventory is bounded rather than exhaustive coverage. Continued work under the current authority must remain read-only, with executable validation deferred to a separately authorized task.
- Read package.json, docs/architecture.md, postcss.js, Processor, and LazyResult first for processing changes; the package exposes both ESM/CommonJS surfaces and a no-work branch that must be considered separately. — [package.json#L37-50](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/package.json#L37-L50) [docs/architecture.md#L122-144](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/docs/architecture.md#L122-L144) [lib/postcss.js#L22-27](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/lib/postcss.js#L22-L27) [lib/processor.js#L44-54](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/lib/processor.js#L44-L54)
- AST edits should preserve iterator timing across Container.insertAfter and both LazyResult walkers; existing regressions compare inserted-sibling order across sync and async processing. — [lib/container.js#L160-174](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/lib/container.js#L160-L174) [lib/lazy-result.js#L504-523](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/lib/lazy-result.js#L504-L523) [lib/lazy-result.js#L559-590](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/lib/lazy-result.js#L559-L590) [test/visitor.test.ts#L347-368](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/test/visitor.test.ts#L347-L368)
- Preserve raws and source when creating or hydrating nodes: cloneNode shares source references, plugin guidance recommends cloning for maps, and fromJSON attaches children after construction to avoid overwriting their spacing. — [lib/node.js#L25-35](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/lib/node.js#L25-L35) [docs/guidelines/plugin.md#L194-215](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/docs/guidelines/plugin.md#L194-L215) [lib/fromJSON.js#L52-58](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/lib/fromJSON.js#L52-L58) [test/fromJSON.test.ts#L43-53](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/test/fromJSON.test.ts#L43-L53)
- Read PreviousMap and its boundary tests before changing map loading; distinguish annotation paths from trusted map.prev callbacks and the explicit unsafeMap option rather than applying one rule to all inputs. — [lib/previous-map.js#L97-131](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/lib/previous-map.js#L97-L131) [test/previous-map.test.ts#L297-340](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/test/previous-map.test.ts#L297-L340) [lib/postcss.d.ts#L355-361](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/lib/postcss.d.ts#L355-L361)
- For authorized validation later, select the relevant uvu suite first, then existing test:types, test:integration, test:lint, or test:coverage scripts as needed; tests and CI in this brief were only inspected, with map-generator.js outside coverage enforcement. — [package.json#L80-89](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/package.json#L80-L89) [package.json#L133-140](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/package.json#L133-L140) [.github/workflows/test.yml#L23-26](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/.github/workflows/test.yml#L23-L26)
- Preserve the declared Node 10/12/14+ compatibility and browser-disabled modules; old-runtime tests adapt node: imports and ts-node settings, while .editorconfig requires two spaces, LF, and a final newline. — [package.json#L38-44](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/package.json#L38-L44) [package.json#L142-144](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/package.json#L142-L144) [test/old-node.js#L4-27](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/test/old-node.js#L4-L27) [.editorconfig#L1-9](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/.editorconfig#L1-L9)
- Runtime API changes require reviewing adjacent declarations and both export surfaces; contributing guidance uses classes for runtime classes, namespaces for related functions, and interfaces for custom types, while test/version.js requires package and Processor versions to agree. — [.github/CONTRIBUTING.md#L41-50](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/.github/CONTRIBUTING.md#L41-L50) [lib/postcss.d.ts#L195-259](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/lib/postcss.d.ts#L195-L259) [lib/postcss.mjs#L5-30](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/lib/postcss.mjs#L5-L30) [test/version.js#L3-8](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/test/version.js#L3-L8)
- Treat architecture/security prose as guidance requiring source verification: architecture token examples describe line/column tuples while the tokenizer emits offsets, and THREAT_MODEL describes a minimumReleaseAge cooldown not configured in the inspected pnpm-workspace.yaml. — [docs/architecture.md#L94-114](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/docs/architecture.md#L94-L114) [lib/tokenize.js#L84-93](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/lib/tokenize.js#L84-L93) [docs/THREAT_MODEL.md#L27-31](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/docs/THREAT_MODEL.md#L27-L31) [pnpm-workspace.yaml#L1-6](https://github.com/postcss/postcss/blob/7ac902664902289ea0cb9d6b1096b81e8d33bbf5/pnpm-workspace.yaml#L1-L6)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)