@piercebarney/whs-eleventy 2026.10.5 → 2026.10.7

package/lib/compliance.js

@@ -51,6 +51,37 @@ function walk(dir) {
   return out;
 }
 
+// Mask out every @media (prefers-reduced-motion: no-preference) { ... }
+// block's entire contents (string search + brace-counting to find the
+// matching close, so nested rulesets inside the media block are correctly
+// included in what gets masked) — whatever remains is, by construction,
+// outside the required gate.
+function maskGatedMotionBlocks(css) {
+  const marker = /@media[^{]*prefers-reduced-motion\s*:\s*no-preference[^{]*\{/;
+  let out = "";
+  let rest = css;
+  let m;
+  while ((m = rest.match(marker))) {
+    let depth = 1;
+    let i = m.index + m[0].length;
+    while (i < rest.length && depth > 0) {
+      if (rest[i] === "{") depth++;
+      else if (rest[i] === "}") depth--;
+      i++;
+    }
+    out += rest.slice(0, m.index);
+    rest = rest.slice(i);
+  }
+  return out + rest;
+}
+
+// (?<![\w-]) rather than a bare \b: a custom property like --pico-transition:
+// is not a transition *declaration* — \b alone still matches right after the
+// hyphen in "-transition", which false-positives on exactly that shape (found
+// in the reference template's own vendored pico.min.css).
+const MOTION_PROP = /(?<![\w-])(transition|animation|scroll-behavior)\s*:/;
+const hasUngatedMotion = (css) => MOTION_PROP.test(maskGatedMotionBlocks(css));
+
 // grep the tracked source tree (not _site, not node_modules).
 function grepSrc(re, exts = [".js", ".njk", ".css", ".json"]) {
   const roots = ["src", "static", "scripts"].map((d) => path.join(ROOT, d));
@@ -594,9 +625,28 @@ const CHECKS = {
   a11y: () => {
     if (!/\ba11y\b/.test(JSON.parse(read("package.json") || "{}").scripts?.check || ""))
       return { status: FAIL, note: "no a11y stage in the gate" };
+    // Scan the authored source tree (src/static/scripts), not built _site —
+    // a passthrough-copied third-party stylesheet (e.g. a CSS framework
+    // vendored via addPassthroughCopy) lands in _site but was never authored
+    // by, or gate-able by, this project; scanning it produced a false FAIL
+    // against the reference template's own vendored pico.min.css.
+    const cssFiles = ["src", "static", "scripts"]
+      .map((d) => path.join(ROOT, d))
+      .flatMap((r) => walk(r))
+      .filter((f) => f.endsWith(".css"));
+    const ungated = cssFiles.filter((f) => hasUngatedMotion(fs.readFileSync(f, "utf8")));
+    if (ungated.length)
+      return {
+        status: FAIL,
+        note: `transition/animation not gated behind prefers-reduced-motion in ${ungated
+          .map((f) => path.relative(ROOT, f))
+          .join(", ")}`,
+      };
     return {
       status: MANUAL,
-      note: "axe scan is in the gate; confirm the checklist items beyond the scan (focus order, live regions)",
+      note:
+        "axe scan is in the gate; prefers-reduced-motion gating confirmed; " +
+        "confirm remaining checklist items beyond the scan (focus order, live regions)",
     };
   },
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piercebarney/whs-eleventy",
-  "version": "2026.10.5",
+  "version": "2026.10.7",
   "description": "The web house style's Eleventy + Netlify tooling — the compliance sweep, the infra doctor, the link/CSP integrity check, and the a11y scan, shared by every project on the stack.",
   "bin": {
     "whs": "cli.js"

package/standard/CHANGELOG.md

@@ -21,6 +21,71 @@ enforced, new *opt-in* chapters/capabilities, tooling-only changes — is
 
 ---
 
+## 2026-10-07 [breaking]
+
+### core: a11y
+
+`core.md#a11y`'s Contract never named a WCAG version/level as its
+conformance target — only "WCAG AA" for contrast. It now declares **WCAG 2.1
+Level AA** explicitly as the target, anchored to US law (the ADA Title II
+rule and US web-accessibility litigation/settlements reference WCAG 2.1 AA;
+Section 508's WCAG 2.0 AA is already covered by it) rather than WCAG 2.2 AA
+— the upgrade trigger to 2.2 AA is recorded, not scheduled, for once US rules
+reference it. **Breaking:** a project that was previously compliant by
+meeting the checklist plus passing the automated scan must now conform to
+all of WCAG 2.1 AA, including criteria the checklist and scan don't
+individually name (e.g. captions, reflow, keyboard operability everywhere)
+— a real added requirement, not just a clarification of an already-met bar.
+No tooling change: Eleventy's `whs a11y` scan already runs `wcag2a`/
+`wcag2aa`/`wcag21a`/`wcag21aa` — it already matched this target. SvelteKit's
+and Phoenix's scan gaps (no automated a11y tooling yet) are pre-existing and
+unrelated to this change. Decided by the owner in
+`feedback/2026-09-26-external-standards-survey.md` ("Decisions (2026-09-26)"
+item 1); see that file for the full WCAG-version rationale, including why
+2.1 and not 2.2.
+
+### core: styling
+
+The contrast line in `#styling` now also says "WCAG 2.1 AA" (was "WCAG AA"),
+matching the version now named in `#a11y`.
+
+### stacks/eleventy-netlify.md, stacks/phoenix.md, stacks/sveltekit-netlify.md
+
+Each of `stacks/eleventy-netlify.md`, `stacks/phoenix.md`, and
+`stacks/sveltekit-netlify.md`'s `#a11y` Core-contract pointer line now
+mentions WCAG 2.1 AA alongside the existing checklist/scan pointer — no
+change to any stack's own mechanism.
+
+---
+
+## 2026-10-06 [breaking]
+
+### packages/whs-eleventy
+
+`a11y`'s chapter in `lib/compliance.js` was 100% unconditional `MANUAL` — it
+never actually checked any of the Contract specs it listed. This adds real
+mechanization for one of them: `core.md#a11y` requires every transition/
+animation to be gated behind `@media (prefers-reduced-motion: no-preference)`
+(also called out in `core.md`'s own anti-patterns list). Found via a real
+project's manual anti-patterns review catching a violation the compliance
+sweep itself missed. The check scans authored source (`src/static/scripts`),
+not built output, so vendored/passthrough-copied third-party CSS a project
+doesn't author is correctly excluded. Unlike this week's other silent-pass
+fixes, this doesn't just correct a check that had a redundant real backstop
+elsewhere (`client-logic`, 2026-10-03) or a pure-doc mismatch with no
+enforcement (`forms`, 2026-10-04) — this is genuinely new detection where
+none existed before. That means it can flip an already-`MANUAL`-passing real
+project's `a11y` status to `FAIL` on its very next compliance run, if that
+project has real, ungated transition/animation CSS in its own authored
+source — not a bug in this fix, but the intended, working check finally
+running. Known, narrow limitation: vendor-prefixed declarations
+(`-webkit-transition:` etc.) aren't detected — an acceptable, low-probability
+gap, consistent with other crude-but-honest heuristics already in this file.
+No `core.md` chapter changed — `packages/whs-eleventy`-only. No `feedback/`
+file. Fixed in `6576a04`.
+
+---
+
 ## 2026-10-05 [non-breaking]
 
 ### templates/commands

package/standard/core.md

@@ -1,6 +1,6 @@
 # Web project house style — CORE (stack-agnostic)
 
-**Version:** 2026-10-05 · **Status:** active
+**Version:** 2026-10-07 · **Status:** active
 
 This is the stack-agnostic contract every web project follows, regardless of
 framework, host, or CSS system. It says **what** must be true, with concrete
@@ -244,7 +244,7 @@ contrast-correct at the token level.
 - **Strict-CSP-safe:** no `style-src 'unsafe-inline'`, no inline `style=`
   attributes in templates, no per-page `<style>` blocks. Utility-class systems
   (Tailwind) are fine; inline style strings are not.
-- Contrast meets WCAG AA. When a pair fails, fix the **token**, not the usage.
+- Contrast meets WCAG 2.1 AA. When a pair fails, fix the **token**, not the usage.
 - Theme is applied via a data attribute set before first paint (`#theme`).
 - A second stylesheet only for a genuinely separable widget, justified in a
   comment.
@@ -834,8 +834,11 @@ states.
 
 ## a11y — Accessibility checklist
 
-**Contract.** Every page meets the checklist below. An automated a11y scan over
-every page runs in the gate — and is understood to catch regressions, not
+**Contract.** Every page conforms to **WCAG 2.1 Level AA** — the level US
+accessibility law references (the ADA Title II rule; Section 508's WCAG 2.0 AA
+is covered by it). The checklist below is the house's concrete mechanism for
+the parts of AA most often missed, not the whole of it. An automated a11y scan
+over every page runs in the gate — and is understood to catch regressions, not
 everything.
 
 **Specs.**
@@ -858,7 +861,7 @@ everything.
   keyboard button — don't re-bind Enter/Space or add `role`/`tabindex`.
 - **Icons:** decorative → `aria-hidden="true"`; meaningful → `<title>` in the
   SVG or `aria-label` on the control.
-- **Contrast** meets WCAG AA; fix failures at the token (`#brand-source`), not
+- **Contrast** meets WCAG 2.1 AA; fix failures at the token (`#brand-source`), not
   with a one-off override.
 - **Focus visibility:** a visible focus ring on every interactive element; if
   you override the default, keep one.
@@ -1467,7 +1470,7 @@ governs it and follow that chapter — the slugs are the index (a `<script>` →
 - production-url: https://example.com
 - content-type: tool           # tool | article  (article => feeds)
 - publishing-rate: ~5 pages/week
-- standard-version: 2026-10-05  # recommended — enables standard-version drift tracking (#compliance)
+- standard-version: 2026-10-07  # recommended — enables standard-version drift tracking (#compliance)
 ```
 
 If the section is absent, the assistant's first action is to run the flow above