@jini-ai/agent-plugins 0.6.16 → 0.6.19

package/site-compliance/skills/site-compliance/SKILL.md

@@ -0,0 +1,220 @@
+---
+name: site-compliance
+description: Evidence-based privacy, cookie/consent, and accessibility risk screening for this site. Gathers citable evidence from site configuration and from the site's own rendered pages, then reports findings that each carry the exact page path, selector, header, cookie, or network request that supports them. Says "cannot determine" wherever the evidence is missing. Never states that a site is or is not GDPR, CCPA/CPRA, or WCAG compliant.
+---
+
+# Site Compliance — evidence, not verdicts
+
+## What this skill is
+
+A **risk screening** procedure. It produces a list of observations about this site, each one
+anchored to a piece of evidence somebody else can go and re-check.
+
+## What this skill is not
+
+It is not legal advice, not a conformance audit, not a certification, and not a compliance
+verdict. It has no way to see the things that actually decide most compliance questions:
+your data-processing agreements, your retention practices, your sub-processors, your internal
+procedures, what your vendors do with the data after it leaves this server, or which
+jurisdictions your users are actually in.
+
+**A compliance conclusion is not yours to make.** Read the Output Contract below before you
+write a single line of a report — it is the part of this skill that matters most, and it is
+not negotiable.
+
+---
+
+## Output Contract (non-negotiable)
+
+### 1. Every finding carries evidence, and the evidence is a citation
+
+A finding without a citation is not a finding — it is a guess, and you must delete it rather
+than ship it. Every single finding must name **where you observed it**. A citation is one of:
+
+| Evidence kind | Citation must include |
+|---|---|
+| Rendered page structure | the page **path** and the **CSS selector** (plus the element's tag and any accessible name) |
+| Cookie | the page path, the **cookie name**, its **domain**, and **whether it was set before or after a consent action** |
+| Network request | the page path, the **request URL's host and path**, its **resource type**, and **whether it fired before or after a consent action** |
+| Response header | the page path and the **exact header name and value** |
+| Page text | the page path and the **verbatim quoted substring** (short — a sentence, not a paragraph) |
+| Site configuration | the **profile section name and field path** the value came from |
+| Absence of something | the page path(s) actually inspected and the **exact query that returned nothing** |
+
+Write the citation inline with the finding. Not in an appendix, not "see the evidence
+section" — beside the claim it supports.
+
+### 2. Every finding gets a status from this fixed vocabulary
+
+Use exactly these four. Do not invent a fifth, and do not substitute a compliance word.
+
+- **`observed`** — you saw this, here is the citation. A neutral statement of fact.
+- **`risk`** — what you observed is a recognised risk pattern. Say which rulepack entry it
+  maps to, and say plainly what a reviewer should look at. Never "this violates GDPR".
+- **`cannot-determine`** — the evidence needed to say anything is not available to you. Say
+  *why*: not inspected, tool unavailable, page unreachable, requires a human, requires
+  information that does not exist on this server.
+- **`not-assessed`** — you did not look. Say why you did not look (out of scope for this run,
+  page count cap reached, operator narrowed the scope).
+
+### 3. Banned outputs
+
+Never emit, in any wording:
+
+- "This site is GDPR compliant" / "non-compliant" / "compliant" / "in violation" / "passes" /
+  "fails" — for any regulation or standard, with or without hedging adverbs.
+- A score, a grade, a percentage, or a pass/fail count that reads as a verdict.
+- A legal conclusion about whether a given practice is lawful.
+- A claim about anything you did not personally observe this run. If the evidence tool
+  returned `unavailable`, you observed nothing — say `cannot-determine`.
+- A claim that a check "passed" because the tool returned no evidence. **No evidence is not
+  evidence of absence.** If cookies could not be observed, cookies were not observed; that is
+  `cannot-determine`, never "no tracking cookies found".
+
+### 4. "Cannot determine" is a required output, not a fallback
+
+You are expected to emit `cannot-determine` findings on every real run, and a report with
+none is a suspicious report. In particular, always emit `cannot-determine` for:
+
+- Anything that depends on a contract, a vendor's internal behaviour, a retention schedule,
+  or an organisational procedure.
+- Anything requiring a human judgement about the site's actual business (is this data
+  "necessary"? is this a "sale" of personal information?).
+- Any page or section that was **inaccessible** — behind auth, returned a non-200 status,
+  timed out, was excluded by the page cap, or was skipped because the browser runtime is not
+  present in this deployment. Name each one individually with its path and the reason.
+
+### 5. Report skeleton
+
+```
+# Site compliance screening — <site> — <date>
+
+**This is a risk screening, not a compliance audit and not legal advice.**
+No statement below asserts that this site does or does not comply with any law or standard.
+
+## What was inspected
+- Pages actually loaded: <n> — <list the paths>
+- Configuration sections read: <list>
+- Browser evidence: available | unavailable (<reason>)
+- Consent-transition evidence: collected | not collected (<reason>)
+
+## What was NOT inspected, and why
+- <path or area> — <reason>   (one line each; this list is never empty)
+
+## Findings
+
+### <area> — <short title>
+- **Status:** observed | risk | cannot-determine | not-assessed
+- **Evidence:** <citation, per the table above>
+- **Why this matters:** <one or two sentences, referencing the rulepack entry id>
+- **Suggested next step for a human reviewer:** <concrete, specific>
+
+## Open questions for the operator
+- <the jurisdiction / business-fact questions you could not answer yourself>
+```
+
+---
+
+## Procedure
+
+### Step 0 — establish scope before collecting anything
+
+Ask the operator, and record the answers in the report:
+
+1. Which regions do your visitors come from? (This changes which rulepack applies and, in
+   opt-in regions, changes what "before consent" means.) If unknown, say so and screen
+   against the strictest applicable rulepack, marking the jurisdiction assumption explicitly.
+2. Which pages matter most? (Home, a form page, checkout, the policy pages.)
+3. Is there a consent banner, and if so, how does a visitor accept it? You need the selector
+   or the visible label to be able to observe a before/after transition at all.
+
+If the operator cannot answer 1, that alone produces a `cannot-determine` in the report. Do
+not silently pick a jurisdiction.
+
+### Step 1 — configuration truth
+
+Call `site_get_profile` for the sections you need — typically `pages`, `settings`, `theme`,
+`plugins`, `contentTypes`. Prefer a narrow `sections` list; a full profile is mostly context
+you will not cite.
+
+What the profile can tell you: which policy pages exist as content, which widgets/plugins are
+installed and enabled, which content types and forms collect fields that look like personal
+data, what the theme declares.
+
+**What the profile cannot tell you, ever:** what the published page actually renders. A
+consent widget can be installed and enabled in configuration and render nothing at all on the
+live page. Treat every configuration fact as a *hypothesis about the rendered site*, and
+either confirm it against rendered evidence in Step 2 or downgrade it to
+`cannot-determine`. Never promote a configuration fact into a statement about live behaviour.
+
+If a profile section comes back `forbidden`, that is a `cannot-determine` for everything that
+depended on it — say which section and that access was denied.
+
+If `site_get_profile` is not available in this deployment at all, say so plainly and continue with
+Step 2 alone. Rendered evidence without configuration context is still real evidence; what you lose
+is the ability to cross-check a configuration claim against it, and that loss belongs in the "What
+was NOT inspected" section.
+
+### Step 2 — rendered truth
+
+Call `site_collect_page_evidence` for each in-scope page path. It loads **this site's own**
+published pages in a real browser and returns what was actually observed. It refuses
+off-origin URLs, caps how many pages and how long it will run, never submits a form, and
+never persists what it captured.
+
+Use it for exactly the things configuration cannot answer:
+
+- **Pre-consent cookies and requests.** Request `consentAction: "none"` first, and read
+  `cookies` and `requests` from the result. Every entry is stamped with the phase it was
+  observed in.
+- **The consent transition.** If the operator gave you an accept selector, request the
+  `accept` phase too, and compare the two phases. What appears only in the `after` phase was
+  gated; what appears in `before` was not.
+- **Rendered accessibility structure.** `accessibility` carries landmarks, the heading
+  outline, images and their alt text, form controls and their label associations, and
+  contrast samples — each with the selector it came from.
+- **Policy-page reachability and placeholder text.** `documentSummary` carries the final
+  status, the final URL after redirects, the title, and text excerpts you can quote.
+
+If the tool returns `status: "unavailable"`, the browser runtime is not installed in this
+deployment. **Every rendered-truth finding then becomes `cannot-determine` with that
+reason.** Do not fall back to guessing from configuration and do not soften the wording.
+
+Never ask this tool to submit a form, log in, or visit a third-party URL. It will refuse, and
+asking is a sign you have drifted out of scope.
+
+### Step 3 — map evidence to rulepack entries
+
+Load only the rulepacks in scope. Each is versioned independently of this file, so quote the
+entry id and the rulepack's own version line when you cite it.
+
+- `references/gdpr-eu-uk.md` — EU/UK: GDPR + ePrivacy/PECR. Opt-in consent posture.
+- `references/ccpa-cpra.md` — California: CCPA/CPRA. Notice-and-opt-out posture.
+- `references/wcag-2-2.md` — WCAG 2.2 AA, restricted to what a rendered page can evidence.
+
+A rulepack entry tells you what pattern to look for and what evidence would support it. It
+does **not** tell you whether the site is lawful, and neither do you.
+
+### Step 4 — write the report
+
+Follow the skeleton above. Before you submit it, re-read your own draft and delete:
+
+- every finding whose evidence line does not name a real path/selector/header/cookie/request,
+- every sentence containing a banned output from §3,
+- every "no issues found" that is really "did not observe".
+
+Then check the "What was NOT inspected" section is non-empty. If it is empty, you have
+almost certainly overstated your coverage — go back and list what you skipped.
+
+---
+
+## Standing constraints
+
+- **Read-only.** This procedure never changes site content, settings, or configuration. If
+  the operator asks you to fix something, that is a separate task with separate consent.
+- **No personal data in the report.** If a page or a form submission exposes real user data,
+  do not copy it into findings. Cite the selector and the field name, never the value.
+- **Third-party pages are out of scope.** You can observe that a request went to
+  `example-analytics.com`; you cannot observe what happens there.
+- **Say when you are guessing.** If you are inferring rather than observing, the status is
+  `cannot-determine`, and the word "likely" does not upgrade it.

package/site-compliance/skills/site-compliance/references/ccpa-cpra.md

@@ -0,0 +1,115 @@
+# Rulepack: California — CCPA / CPRA
+
+**Rulepack version:** 2026-08-26.1
+**Applies when:** the site has California consumers and the business meets CCPA's own applicability
+thresholds — which are **revenue and data-volume facts this skill cannot observe.** Always record
+applicability itself as `cannot-determine` unless the operator states it.
+**Versioned independently of SKILL.md.** Cite the entry id AND this version line.
+
+> Patterns and evidence only. Nothing here authorises a compliance verdict — see the SKILL.md
+> Output Contract.
+
+---
+
+## The posture difference that matters
+
+CCPA/CPRA is **notice-and-opt-out**, not opt-in. A tracker firing before any consent action is not,
+by itself, the same finding it is under EU-1 of the EU/UK rulepack. What matters here is whether
+the required notices and opt-out mechanisms exist and work.
+
+Do not carry an EU-1 finding over as a CCPA finding. Cite the same evidence separately, with the
+reasoning appropriate to this rulepack.
+
+---
+
+## CA-1 — "Do Not Sell or Share My Personal Information" link
+
+**Observe with:** the rendered link/heading inventory across the inspected pages, plus a direct load
+of any candidate opt-out path.
+
+**Supports `risk`:** a site where CA-3 observed advertising or cross-context behavioural
+advertising requests, and no link whose accessible name matches "Do Not Sell", "Do Not Share",
+"Your Privacy Choices", or an equivalent was found on any inspected page.
+
+**Cite:** the pages inspected, and the exact text/selector query that returned nothing.
+
+**`cannot-determine` when:** the link is conventionally in the footer of pages you did not load, or
+is rendered by a consent platform only for visitors it geolocates to California — which a headless
+browser from your server's egress IP will not be.
+
+---
+
+## CA-2 — Notice at collection
+
+**Observe with:** page paths where personal data is collected (from the form-control inventory) and
+the text near those forms.
+
+**Supports `risk`:** a form collecting personal data with no notice, and no link to a privacy
+policy, at or before the point of collection.
+
+**Cite:** page path + the form's selector + the absence query used + the page's `textExcerpt` if it
+demonstrates the absence.
+
+**`cannot-determine`:** whether the notice's *categories and purposes* are accurate and complete —
+that is a comparison against what the backend actually does with the data, which is not observable
+from the page.
+
+---
+
+## CA-3 — Sale / sharing signals
+
+**Observe with:** third-party requests and cookies, by host and resource type.
+
+**Supports `observed`:** requests to advertising and identity-resolution hosts, and cookies
+associated with cross-context behavioural advertising.
+
+**Cite:** page path + host + pathname + resourceType + phase; cookie name + domain.
+
+**`cannot-determine`, and say so loudly:** whether any of this constitutes a "sale" or a "share"
+under CCPA. That turns on the contractual relationship with each recipient — a service-provider
+agreement changes the answer entirely and is invisible from the page. Report the traffic; refuse
+the characterisation.
+
+---
+
+## CA-4 — Global Privacy Control
+
+**Supports `cannot-determine` by default:** whether the site honours a GPC signal
+(`Sec-GPC: 1`) cannot be established by this tool. The evidence tool does not set request headers,
+and there is no input by which it could be asked to.
+
+State this explicitly rather than omitting it; GPC honouring is a specific CPRA obligation and a
+silent omission reads as though it was checked.
+
+---
+
+## CA-5 — Consumer rights request mechanisms
+
+**Supports `risk`:** no reachable page or form offering access, deletion, correction, or
+know-what-we-collect requests, on a site where CA-3 observed sale/share-shaped traffic.
+
+**Cite:** paths inspected and the query that matched nothing.
+
+**`cannot-determine`:** whether requests are actually honoured, within the required window, with
+the required verification. Behaviour behind a form is not observable.
+
+---
+
+## CA-6 — Financial incentives and non-discrimination
+
+**`cannot-determine`, always.** Whether a loyalty programme or price difference is a permitted
+financial incentive with the required notice, and whether a consumer exercising rights is
+discriminated against, depends on business terms and backend behaviour.
+
+Include this entry as an explicit `cannot-determine` if the site has anything resembling a
+signup-for-discount flow, so the report does not appear to have cleared it.
+
+---
+
+## Out of scope for evidence collection
+
+- Applicability thresholds (revenue, consumer counts, share of revenue from selling data).
+- Service-provider and contractor contract terms.
+- Actual honouring of opt-outs, GPC, and rights requests.
+- Retention schedules and the CPRA storage-limitation disclosure's accuracy.
+- Sensitive-personal-information limitation-of-use handling.

package/site-compliance/skills/site-compliance/references/gdpr-eu-uk.md

@@ -0,0 +1,143 @@
+# Rulepack: EU / UK — GDPR, ePrivacy, PECR
+
+**Rulepack version:** 2026-08-26.1
+**Applies when:** the site has visitors in the EU/EEA (GDPR + ePrivacy Directive) or the UK
+(UK GDPR + PECR). Consent posture in both is **opt-in**.
+**Versioned independently of SKILL.md.** Cite the entry id AND this version line in every finding
+that references it.
+
+> This file describes patterns to look for and what evidence would support them. It does not
+> determine legality. Nothing in it authorises a compliance verdict — see the SKILL.md Output
+> Contract, which forbids one.
+
+---
+
+## How to use an entry
+
+Each entry gives: what to observe, what evidence would support a `risk` status, and what makes the
+question `cannot-determine`. Most entries have a `cannot-determine` clause that fires more often
+than the `risk` one. That is expected and correct.
+
+---
+
+## EU-1 — Non-essential cookies or tags before consent
+
+**Observe with:** `site_collect_page_evidence`, first with no `consentAcceptSelector` (everything
+returns phase `before`), then again with one.
+
+**Supports `risk`:** a cookie or request observed in the `before` phase that is plainly
+non-essential — an analytics, advertising, session-replay, or social-embed host; a cookie whose
+name matches a known tracker family (`_ga*`, `_fbp`, `_gcl_*`, `IDE`, `MUID`, `_hj*`).
+
+**Cite:** page path + cookie name + domain + `phase: "before"`, or page path + request host + path
++ resourceType + `phase: "before"`.
+
+**`cannot-determine` when:** the browser was unavailable; the page was not inspected; or you cannot
+tell whether a given cookie is strictly necessary. **Necessity is a business fact, not an
+observable one** — a first-party cookie named `sid` may be a login session (essential) or a
+fingerprint (not). Report what you saw and say the necessity judgement needs the operator.
+
+---
+
+## EU-2 — Reject is not as easy as accept
+
+**Observe with:** the rendered accessibility structure of the consent dialog: which controls exist
+inside it, their accessible names, and their contrast samples.
+
+**Supports `risk`:** an accept control present with no reject control at the same level; a reject
+control whose accessible name is absent; a reject control with markedly lower contrast than accept.
+
+**Cite:** the selector of each control found, its accessible name, and the contrast ratio of each.
+
+**`cannot-determine` when:** the banner renders only after a delay or a geo-check the tool did not
+trigger, or its controls live in a shadow root or cross-origin iframe the walk did not enter. Say
+which.
+
+---
+
+## EU-3 — Consent withdrawal path
+
+**Supports `risk`:** no control, link, or page anywhere in the inspected pages that offers to change
+or withdraw a previously given consent, on a site where EU-1 found a consent banner.
+
+**Cite:** the pages inspected and the selectors searched that matched nothing. Per the Output
+Contract, an absence citation must name the exact query that returned nothing.
+
+**`cannot-determine`, almost always, when:** withdrawal is offered from a footer link on a page you
+did not load, or from a persistent floating control that only appears post-consent. Inspecting 5
+pages does not establish absence across a site.
+
+---
+
+## EU-4 — Privacy notice reachability and substance
+
+**Observe with:** load the candidate policy paths directly and read `document.httpStatus`,
+`document.finalUrl`, `document.title`, and `document.textExcerpt`.
+
+**Supports `risk`:** a non-200 status; a redirect to an unrelated page; boilerplate placeholder
+text (`Lorem ipsum`, `[Company Name]`, `TODO`, `Your privacy policy goes here`, `Last updated:
+[date]`); an empty body.
+
+**Cite:** path, HTTP status, final URL, and the verbatim placeholder substring quoted.
+
+**`cannot-determine` when:** the policy reads as real prose. Whether its *contents* satisfy Art.
+13/14 (identity of the controller, legal bases, retention periods, transfer mechanisms, DPO
+contact) is a legal reading of a document, not an observation, and this skill does not make it.
+
+---
+
+## EU-5 — Personal data collection points
+
+**Observe with:** the form-control inventory (`accessibility.formControls`) plus the site profile's
+content types and form definitions.
+
+**Supports `observed` (rarely `risk`):** fields whose `name` or accessible name indicates personal
+data (`email`, `phone`, `dob`, `address`, `nationalId`) — and especially special-category data
+(health, biometric, political, religious, trade-union, sexual orientation, precise geolocation).
+
+**Cite:** page path + selector + field name + accessible name. **Never the field's value** — the
+evidence tool does not expose values and a report must not reconstruct them either.
+
+**`cannot-determine`:** the lawful basis, the retention period, and whether the data is minimal for
+the stated purpose. All three are operator facts.
+
+---
+
+## EU-6 — Third-party recipients and transfers
+
+**Supports `observed`:** every distinct non-first-party request host seen on the inspected pages,
+with the phase each was observed in.
+
+**Cite:** page path + host + resourceType + phase.
+
+**`cannot-determine`, always:** what those recipients do with the data, whether a processor
+agreement exists, and which transfer mechanism (adequacy decision, SCCs, derogation) covers any
+transfer outside the EEA/UK. None of that is on this server.
+
+---
+
+## EU-7 — Security-relevant response headers
+
+**Supports `observed`:** presence or absence of `Strict-Transport-Security`,
+`Content-Security-Policy`, `X-Content-Type-Options`, `Referrer-Policy`, and the `Set-Cookie`
+attributes actually observed (`Secure`, `HttpOnly`, `SameSite`).
+
+**Cite:** page path + exact header name and value, or cookie name + the flags observed.
+
+**Note:** Art. 32 requires "appropriate" measures; a header inventory is an input to that
+assessment and never the assessment itself. Report headers as `observed`, and the adequacy question
+as `cannot-determine`.
+
+---
+
+## Out of scope for evidence collection
+
+Named here so a report can list them as `cannot-determine` with a reason rather than omitting them
+and looking complete:
+
+- Records of processing activities (Art. 30) and DPIAs (Art. 35).
+- Data subject request handling: identity verification, response timing, completeness.
+- Retention and deletion actually performed on the backend.
+- Processor and sub-processor contracts.
+- Breach notification readiness.
+- Whether a DPO is required or appointed.

package/site-compliance/skills/site-compliance/references/wcag-2-2.md

@@ -0,0 +1,129 @@
+# Rulepack: Accessibility — WCAG 2.2 Level AA
+
+**Rulepack version:** 2026-08-26.1
+**Scope of this file:** only the success criteria a **rendered-page observation** can produce real
+evidence for. Roughly a quarter of WCAG 2.2 AA is machine-observable at all; the rest needs a human
+with a keyboard, a screen reader, or knowledge of the content's meaning.
+**Versioned independently of SKILL.md.** Cite the entry id AND this version line.
+
+> Patterns and evidence only. **Never report a site, page, or criterion as "WCAG AA compliant" or
+> "non-compliant"** — see the SKILL.md Output Contract. A criterion with no observed failures is
+> `cannot-determine`, not `pass`: automated observation is well documented to detect only a minority
+> of real accessibility barriers.
+
+---
+
+## A-1 — 1.1.1 Non-text Content: images without alternative text
+
+**Observe with:** `accessibility.images`.
+
+**Supports `risk`:** an image with `alt: null` (the attribute is absent) and `ariaHidden: false`.
+
+**`alt: ""` is NOT a finding.** An explicitly empty alt is the correct marking for a decorative
+image. The evidence tool distinguishes the two deliberately; do not collapse them.
+
+**Cite:** page path + selector + `src` + the observed `alt` value (`null` vs `""`).
+
+**`cannot-determine`:** whether a *present* alt is actually a good description. That requires
+understanding what the image conveys.
+
+---
+
+## A-2 — 1.3.1 Info and Relationships: form controls without a programmatic label
+
+**Observe with:** `accessibility.formControls`.
+
+**Supports `risk`:** a control with `accessibleName: null` and `labelSource: "none"`.
+
+**Weaker signal, report as `observed`:** `labelSource: "title"` — a `title` attribute is a
+last-resort accessible name and is not exposed consistently.
+
+**Cite:** page path + selector + tag + type + `name` + `labelSource`.
+
+**`cannot-determine`:** whether a present label is meaningful, and whether grouped controls
+(radio/checkbox sets) have the right `fieldset`/`legend` grouping — the evidence tool does not
+capture grouping.
+
+---
+
+## A-3 — 1.3.1 / 2.4.6 Heading structure
+
+**Observe with:** `accessibility.headings`, which is in document order with levels.
+
+**Supports `risk`:** no `h1` at all; more than one `h1`; a level skipped going down (h2 → h4);
+a heading whose `text` is empty.
+
+**Cite:** page path + the heading outline as observed (level + selector + text), so the skip is
+visible in the citation itself rather than asserted.
+
+**`cannot-determine`:** whether headings describe their sections accurately.
+
+---
+
+## A-4 — 1.4.3 Contrast (Minimum)
+
+**Observe with:** `accessibility.contrastSamples`. Each carries the computed ratio, font size, and
+weight.
+
+**Supports `risk`:** ratio below 4.5:1 for normal text, or below 3:1 for large text (≥ 24px, or
+≥ 18.66px at weight ≥ 700). Report the threshold you applied alongside the ratio.
+
+**Cite:** page path + selector + foreground + background + ratio + fontSizePx + fontWeight.
+
+**`cannot-determine` — and this one matters:** the sample set is capped and covers only leaf text
+elements the walk reached. A page with no sampled failures has not been shown to pass. Also flag
+that the background is resolved by walking ancestors for the first opaque colour, so text over an
+**image or gradient** produces a ratio computed against a colour that is not really behind it.
+Where a sample looks suspicious, say the measurement method may not apply rather than reporting the
+number as fact.
+
+---
+
+## A-5 — 1.3.6 / 2.4.1 Landmarks and bypass mechanisms
+
+**Observe with:** `accessibility.landmarks`.
+
+**Supports `risk`:** no `main` landmark; multiple `navigation` landmarks with no distinguishing
+accessible names; no `banner`/`contentinfo` on a page that clearly has a header and footer.
+
+**Supports `observed`:** the landmark inventory as found.
+
+**Cite:** page path + role + selector + accessibleName for each.
+
+**`cannot-determine`:** whether a skip link exists and works — it is typically visually hidden until
+focused, and the evidence tool performs no keyboard interaction.
+
+---
+
+## A-6 — 3.1.1 Language of Page
+
+**Observe with:** `document.lang`.
+
+**Supports `risk`:** `lang: null`.
+
+**Cite:** page path + the observed value.
+
+**`cannot-determine`:** whether the declared language matches the actual content, and whether
+inline language changes (3.1.2) are marked.
+
+---
+
+## Explicitly NOT assessable by this tool
+
+List these in every accessibility report as `cannot-determine`, with this rulepack cited as the
+reason. Omitting them makes a report look far more complete than it is.
+
+- **2.1.1 / 2.1.2 Keyboard, No Keyboard Trap** — no keyboard interaction is performed.
+- **2.4.3 Focus Order** and **2.4.7 / 2.4.11 Focus Visible / Not Obscured** — focus is never moved.
+- **2.4.13 Focus Appearance**, **2.5.7 Dragging Movements**, **2.5.8 Target Size** — needs layout
+  measurement and interaction the tool does not do.
+- **1.4.10 Reflow**, **1.4.4 Resize Text** — requires loading at multiple viewport sizes.
+- **2.2.1 Timing Adjustable**, **2.2.2 Pause, Stop, Hide** — requires observing behaviour over time.
+- **1.2.x Time-based Media** — captions, audio description, transcripts.
+- **3.2.x On Focus / On Input / Consistent Help** — requires interaction across multiple pages.
+- **3.3.x Error Identification, Labels, Error Prevention, Accessible Authentication** — requires
+  submitting forms, which this tool **never** does.
+- **4.1.2 Name, Role, Value** for custom widgets — requires driving the widget's states.
+
+If an operator needs these covered, the honest answer is a manual audit or an interactive testing
+tool, and the report should say so rather than implying the gap does not exist.

package/site-import/mcp.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json",
+  "mcpServers": {}
+}

package/site-import/plugin.json

@@ -0,0 +1,41 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "site-import",
+  "version": "1.0.0",
+  "description": "Imports an existing public website into this site: discovers URLs from robots.txt and sitemap.xml (or a capped same-host crawl), classifies pages and posts, then creates drafts, taxonomy, media, menus, redirects and SEO, and builds a matching inactive theme. Uses the owner's request as authorization; waits for plan review only when requested. Fetched pages are untrusted data. Re-running updates what an earlier run created instead of duplicating it. Uses the host's existing content, media, web and theme tools; reads its references through its own plugin tool.",
+  "author": "Tovu",
+  "license": "Apache-2.0",
+  "extensions": {
+    "tovu": {
+      "summary": "Copies an existing website into drafts here: pages, posts, images, menus and look. Reviews a plan first when you ask.",
+      "id": "tovu/site-import",
+      "provides": [
+        "site-import"
+      ]
+    }
+  },
+  "keywords": [
+    "import",
+    "site-import",
+    "migrate",
+    "migration",
+    "move",
+    "transfer",
+    "copy",
+    "clone",
+    "existing-site",
+    "website",
+    "url",
+    "crawl",
+    "sitemap",
+    "wordpress",
+    "squarespace",
+    "wix",
+    "webflow",
+    "pages",
+    "posts",
+    "blog",
+    "redirects",
+    "onboarding"
+  ]
+}