Sovereign Ministry Digital Transformation

2.1Colour

{
  "color": {
    "primary": { "mirage": { "$type": "color", "$value": "#0F2837" } },
    "secondary": { "chestnutRose": { "$type": "color", "$value": "#EB5A3C" } }
  }
}

2.2Type, space, elevation

Eleven type tokens on one family, a twelve-step ramp on a 16px base, and a five-step elevation ladder. What matters is not that they exist — every system has them — but that each one names its job rather than its value. A button label is not “14px” but Effra Regular 14 / 18 · 2%; E300 is not “medium shadow” but hover and dropdown menu. Naming the whole thing is what stops it drifting one property at a time.

Effra is licensed and not embedded; sizes, weights and tracking are the specified values in a stand-in face. The ladder is specified on dark as well as light — only E300 carries a published numeric value, the rest are shown at their relative step.

3.1Buttons

3.2Controls

Every selected state in this set is carried by two signals — the colour and a shape. A rule under the tab, a tick in the box, a knob that travels, an underline beneath the page number, a dismiss target on the chip. That redundancy is deliberate, and Section 5 (Accessibility Ledger) is why.

3.3Patterns & assemblies

Components assemble into repeatable enterprise patterns. Below, an abstract service queue table combines inputs, status pills, primary buttons, and pagination into one cohesive, accessible workflow.

Beyond these sit nine more families — inputs, dropdowns, navigation, toasts, sliders, process and card sets, pop-ups, footers and the elevation ladder — across a component sheet roughly 18,000 pixels wide. Breadth is what decides whether teams adopt a system or route around it, and most of that breadth is unremarkable by design.

5.1Where the identity orange landed

5.2The ledger

Every interactive pairing in the library, measured. This is the honest version, and it is the more useful one: two of the button fills carry a 14px label at AA and two do not, which is a fact a team needs in front of them rather than behind a compliance claim.

5.4The remediation

Redundancy makes the shipped system usable. It does not make the token pass. So the proposal is a darker Chestnut Rose — hue and saturation locked to the original, HSL lightness moved 57.8% → 43.9%. Nothing else about the colour changes.

The binding constraint is not white; it is the chip tint. Darkening only until the swatch passes on white lands at #DB3816, which still reads at 4.05:1 on a chip — a fix that holds everywhere the colour is looked at and fails where it is actually read. Grading against the worst ground, not the easiest one, is the whole discipline.

Darkening has one cost, and it is worth stating plainly. Chestnut Rose and Stiletto #B41932 — the primary and the destructive fill — move from 1.94:1 apart to 1.30:1. At that separation a Submit and a Delete button are no longer reliably tellable apart, which in a public-service system is a safety problem rather than a cosmetic one. There is no darker Stiletto that fixes it; the room has run out.

So the answer is the one the system already uses everywhere else: stop asking colour to carry the distinction alone. Destructive keeps its fill and gains a glyph.