How to build PR-style brand-spec versioning

The 4-skill bundle on the brand-spec-versioning agent

One agent. Four coordinated skills. The Branch + Review + Sign + Audit bundle runs above the VCS + design-tokens + multi-channel + supply-chain-attestation substrate and writes one canonical per-spec per-PR versioning record.

Compliance overlay

Five anchors run per-spec per-PR before any spec promotes to runtime. The first anchor is operationally distinctive: PR-style workflow + W3C Design Tokens + Style Dictionary + Sigstore + SLSA Level 3+ + SBOM + EO 14028 + NIST SSDF converge on every brand-spec versioning decision.

FAQ

What is PR-style brand-spec versioning — and what is the W3C-Design-Tokens-times-Style-Dictionary-times-Sigstore-Cosign-times-SLSA-Level-3-times-SBOM-times-EO-14028-times-NIST-SSDF problem distinctive to this skill?

A DTC ecommerce operator with 50,000-2M SKUs ships brand-voice + visual-design + ad-copy + email-copy + SMS-copy + product-page-copy + landing-page-copy + storefront-theme + checkout-theme across 10-25 channels (Shopify Polaris + Liquid theme + Klaviyo email-template + Iterable + Attentive SMS + Postscript + Meta Advantage+ ad + Google Performance Max + TikTok Smart Performance + Pinterest + Instagram Shop + YouTube Shopping). Each per-spec change requires per-branch versioning + per-PR review + per-token semver + per-token deprecation + per-channel re-publication + per-vendor sync. The four-skill bundle on the brand-spec-versioning agent — Branch, Review, Sign, Audit — sits above the VCS + design-tokens + multi-channel + supply-chain-attestation substrate (GitHub + GitLab + Bitbucket + Azure DevOps + Git-flow + Conventional Commits + W3C Design Tokens + Style Dictionary + Specify + Knapsack + Storybook + Figma Tokens Studio + Penpot + Lokalise + Phrase + Sigstore + Cosign + Rekor + Fulcio + SLSA + in-toto + SPDX + CycloneDX) and writes a per-spec per-PR canonical versioning record. The operationally distinctive anchor: PR-style brand-spec versioning workflow (Git-flow + GitHub Flow + GitLab Flow + trunk-based development + Gitflow + per-branch semver + per-PR-review approval workflow + per-RFC + per-ADR) + W3C Design Tokens Community Group draft specification (per-token JSON Schema Draft 2020-12 + per-token semantic versioning + per-token deprecation policy + per-token reference token + per-token alias token + per-token composite token) + Style Dictionary + Specify + Knapsack token-translation + per-CSS-in-JS theming (styled-components + Emotion + Stitches + Vanilla Extract + PandaCSS) + per-Tailwind-config drift detection + per-Figma-token sync (Figma Tokens Studio + Penpot tokens + Sketch tokens) + per-localization-sync (Lokalise + Phrase) + Code Owners + branch protection + required-reviewer + required-status-check + linear-history + signed commits (GPG + SSH + S/MIME) + Sigstore + Cosign artifact attestation + Rekor transparency log + Fulcio certificate authority + SLSA Level 3+ supply chain attestation + in-toto attestation + SBOM Software Bill of Materials (SPDX 2.3 + CycloneDX 1.5 + SWID ISO/IEC 19770-2) + Executive Order 14028 Improving the Nation Cybersecurity + NIST SSDF Secure Software Development Framework SP 800-218.

Why do GitHub + GitLab + Style Dictionary + Storybook + Figma Tokens Studio break at multi-channel-multi-spec-multi-stakeholder scale?

Each VCS + design-tokens + multi-channel vendor ships per-account flat versioning primitive at single-spec level. None coordinates per-spec per-PR per-branch versioning + per-token semver + per-token deprecation + per-channel re-publication + per-vendor sync against W3C Design Tokens Community Group draft specification + Style Dictionary + Specify + Knapsack token-translation + per-CSS-in-JS theming + per-Tailwind-config drift detection + per-Figma-token sync + per-localization-sync. None handles Code Owners + branch protection + required-reviewer + signed commits + Sigstore/Cosign attestation + Rekor transparency log + Fulcio + SLSA Level 3+ supply chain + in-toto + SBOM + EO 14028 + NIST SSDF SP 800-218 at the per-spec level. None gates against FTC Endorsement Guides + FTC Fake Review Rule + FTC Native Advertising + FTC Made in USA Labeling + per-state attorney advertising + per-vertical FDA/DEA/alcohol/cannabis + HIPAA + FINRA + Tennessee ELVIS Act 2024. None enforces SOX 302/404/906 when public-company brand-spec material. None writes a per-spec per-PR WORM versioning audit trail with regulatory-defense retention. The four-skill bundle Branch + Review + Sign + Audit sits above the VCS + design-tokens + multi-channel + supply-chain-attestation substrate — it does not replace it.

How does Branch + Review work?

Branch runs per-spec per-PR branch creation following Git-flow + GitHub Flow + GitLab Flow + trunk-based development + Gitflow workflow. Per-branch semver tagging (MAJOR.MINOR.PATCH + per-pre-release + per-build-metadata). Per-PR Conventional Commits (feat + fix + chore + docs + style + refactor + perf + test + build + ci + revert) + semantic-release + Changesets + Lerna versioning. Per-RFC (Request for Comments) + per-ADR (Architecture Decision Record) creation for high-risk per-spec changes. Per-spec W3C Design Tokens Community Group draft schema validation (per-token JSON Schema Draft 2020-12 + per-token semantic versioning + per-token deprecation policy + per-token reference token + per-token alias token + per-token composite token). Per-spec Style Dictionary + Specify + Knapsack token-translation. Per-CSS-in-JS theming sync (styled-components + Emotion + Stitches + Vanilla Extract + PandaCSS). Per-Tailwind-config drift detection. Per-Figma-token sync via Figma Tokens Studio + Penpot tokens + Sketch tokens. Per-localization-sync via Lokalise + Phrase. Review runs per-PR Code Owners review + per-branch protection enforcement + required-reviewer + required-status-check + linear-history + per-RFC approval workflow + per-ADR approval workflow.

What does Sign + Audit do?

Sign runs per-PR signed commits (GPG + SSH + S/MIME) + per-artifact Sigstore Cosign attestation + Rekor transparency log + Fulcio certificate authority + per-build SLSA Level 3+ supply chain attestation (build-isolation + parameterless build + hermetic build + reproducible build) + per-build in-toto attestation + per-artifact SBOM Software Bill of Materials (SPDX 2.3 + CycloneDX 1.5 + SWID ISO/IEC 19770-2) + Executive Order 14028 attestation + NIST SSDF Secure Software Development Framework SP 800-218 compliance. Per-spec severity classification: P0 SLSA Level 3+ supply-chain violation immediate + P1 SBOM provenance gap 72-hour + P2 Code Owners approval gap 7-day + P3 Conventional Commits drift 30-day + P4 docs-only. Gate runs 5 anchors per-spec per-PR before any spec promotes to runtime. (1) PR-style brand-spec versioning workflow + W3C Design Tokens Community Group draft + Style Dictionary + per-CSS-in-JS + per-Tailwind-config + per-Figma-token sync + per-localization-sync + Code Owners + branch protection + signed commits + Sigstore + Cosign + Rekor + Fulcio + SLSA Level 3+ + in-toto + SBOM (SPDX + CycloneDX + SWID) + Executive Order 14028 + NIST SSDF SP 800-218. (2) FTC Endorsement Guides 16 CFR Part 255 + FTC Fake Review Rule 16 CFR Part 465 + FTC Native Advertising .com Disclosures + FTC Made in USA Labeling + Section 5 + Pfizer 1972 + MARS + Health Products + CFPB UDAAP + Lanham + USPTO + state UDTPA + Robinson-Patman + per-state attorney advertising 50-state. (3) Per-vertical FDA OPDP + DEA + alcohol TABC/CalABC/TTB + cannabis state-board + tobacco + HIPAA Safe Harbor + FINRA Rule 2210 + ABA Model Rule + Tennessee ELVIS Act 2024 right-of-publicity when AI-generated brand-spec voice/likeness. (4) EU AI Act Article 50 transparency when AI-generated brand-spec changes + Article 13/14/15 + Annex III when AI-ML brand-spec drafting routes publish-block + Article 6/27 FRIA + DSA + DMA + GDPR Article 6/7/28/30 + LGPD + DPDP + PIPEDA + Quebec Law 25 + CCPA + CPRA + 18-state. (5) WCAG 2.2 AA + ARIA + EAA + ADA Title III + Section 508 + SOX 302/404/906 when public-company brand-spec material + COSO + Exchange Act 13(b)(2) + SEC Reg S-K. Audit writes a per-spec per-PR WORM versioning record: spec snapshot + per-branch semver + per-PR Code Owners approval + per-artifact Sigstore Cosign attestation + Rekor transparency log entry + SLSA Level 3+ provenance + in-toto attestation + SBOM + per-anchor gate-pass + AI-ML provenance + EU AI Act FRIA. Retention: 7-year FTC + 7-year IRS + 7-year HIPAA + 7-year state bar + 6-year SEC + 3-year FINRA + 7-year SOX + GDPR Article 30 + EU AI Act Article 12 + SOC 2 CC7/CC8.

What does this skill connect to on the brand-spec-versioning agent and across the swarm?

On the brand-spec-versioning agent: per-spec PR-versioning + per-spec design-tokens sync + per-spec multi-channel re-publication + per-spec attestation. Across the swarm: schema-driven brand-voice spec authoring (#549 UPSTREAM canonical for brand-voice tone-rule + lexicon) + per-location compliant social drafting (#598 DOWNSTREAM consumer of brand-spec) + per-vertical catalog schema validation (#597 DOWNSTREAM consumer of brand-spec) + real-time change-event emission (#603 DOWNSTREAM consumer of per-spec change-events) + integration-drift-monitor agent (#562 + #569 + #570 same per-schema-drift substrate) + per-state-overlay-composer (#599 UPSTREAM canonical for per-state attorney advertising + per-vertical FDA/alcohol/cannabis) + tiered pre-filter deterministic gates + per-vertical compliance overlay. Commercial-pillar parent: /brand-spec-authoring.

What does the 6-workstream pre-engagement-baseline reporting cycle look like for this skill?

Every two weeks during the Tier 3 Fractional CMO with AI Swarm engagement, six workstreams report against the pre-engagement baseline. Workstream 1: per-portfolio per-spec per-PR brand-spec versioning coverage — specs monitored + PRs reviewed + channels re-published + per-vendor sync attestations. Workstream 2: Branch per-spec per-PR branch flow — Git-flow + per-branch semver + Conventional Commits + per-RFC + per-ADR + W3C Design Tokens schema absorbed. Workstream 3: Review per-PR Code Owners flow — per-PR Code Owners review + branch protection + required-reviewer + required-status-check + per-RFC approval. Workstream 4: Sign per-PR signed-commits + Sigstore/Cosign flow — signed commits + Sigstore + Cosign artifact attestation + Rekor + Fulcio + SLSA Level 3+ + in-toto + SBOM + per-EO-14028 + per-NIST-SSDF-SP-800-218. Workstream 5: Regulatory-defense audit coverage — PR-style workflow + W3C Design Tokens + Style Dictionary + Sigstore + SLSA Level 3+ + SBOM + EO 14028 + NIST SSDF + EU AI Act Article 50 + FTC Endorsement + Fake Review + Made in USA + SOX. Workstream 6: FBC feedback-loop pattern-learning — per-spec realized-vs-predicted versioning + per-channel re-publication retrospective + per-attestation supply-chain incident retrospective.

Related reading

• Parent commercial pillar: brand spec authoring
• Sibling build-pillar: schema-driven brand-voice spec authoring (#549 UPSTREAM canonical for brand-voice tone-rule + lexicon)
• Sibling build-pillar: real-time change-event emission (#603 DOWNSTREAM consumer of per-spec change-events)
• Sibling build-pillar: per-state overlay configuration (#599 UPSTREAM canonical for per-state attorney advertising + per-vertical FDA/alcohol/cannabis)
• Fractional CMO with AI Swarm
• AI Readiness Assessment