@softspark/ai-toolkit 2.4.1 → 2.5.0

package/app/skills/a11y-validate/reference/wcag-2-1-aa.md

@@ -0,0 +1,285 @@
+# WCAG 2.1 Level A + AA Reference
+
+Reference for `a11y-validate`. All 50 WCAG 2.1 Level A + AA success criteria, with a detection-pattern matrix (which are statically detectable vs. runtime-only).
+
+Source: W3C Web Content Accessibility Guidelines (WCAG) 2.1 Recommendation, 5 June 2018 (most recent maintenance: October 2023).
+
+## Legend
+
+- **Static** — detectable via source-code pattern matching (this skill's wheelhouse).
+- **Heuristic** — static detection possible but with false-positive/negative risk.
+- **Runtime** — requires rendering, interaction, or AT testing; beyond static analysis.
+- **Authoring** — depends on content choices, not code patterns.
+
+---
+
+## Principle 1: Perceivable
+
+### Guideline 1.1 — Text Alternatives
+
+#### 1.1.1 Non-text Content (Level A) — **Static**
+Images, form inputs, and non-text UI components must have text alternatives. Detection: `<img>` without `alt`, icon fonts without `aria-label`, `<svg>` without `<title>`/`aria-label`, form inputs without label, decorative images with non-empty alt.
+
+### Guideline 1.2 — Time-based Media
+
+#### 1.2.1 Audio-only and Video-only (Prerecorded) (Level A) — **Static**
+Detection: `<audio>` without transcript; `<video>` without audio track requires captions.
+
+#### 1.2.2 Captions (Prerecorded) (Level A) — **Static**
+Detection: `<video>` without `<track kind="captions">`. **EAA legal risk.**
+
+#### 1.2.3 Audio Description or Media Alternative (Prerecorded) (Level A) — **Static**
+Detection: `<video>` without `<track kind="descriptions">` and no linked transcript.
+
+#### 1.2.4 Captions (Live) (Level AA) — **Runtime**
+Live caption quality can't be verified statically. Flag live-media patterns (WebRTC, YouTube Live embeds) for manual review.
+
+#### 1.2.5 Audio Description (Prerecorded) (Level AA) — **Static**
+Detection: Same as 1.2.3 but at AA level.
+
+### Guideline 1.3 — Adaptable
+
+#### 1.3.1 Info and Relationships (Level A) — **Static**
+Detection: `<div>` used where semantic element appropriate; heading skip; missing landmarks; tables without `<th>`/`<caption>`.
+
+#### 1.3.2 Meaningful Sequence (Level A) — **Heuristic**
+CSS `order` / `flex-direction: row-reverse` that disconnects visual from DOM order. Hard to verify without rendering.
+
+#### 1.3.3 Sensory Characteristics (Level A) — **Authoring**
+Instructions like "click the button on the right" — content-driven.
+
+#### 1.3.4 Orientation (Level AA) — **Static**
+Detection: CSS `@media (orientation: portrait)` / `landscape` with content visibility rules that lock orientation.
+
+#### 1.3.5 Identify Input Purpose (Level AA) — **Static**
+Detection: `<input type="email/tel/name/cc-*/bday-*/street-*">` without `autocomplete` matching WCAG input-purpose taxonomy.
+
+### Guideline 1.4 — Distinguishable
+
+#### 1.4.1 Use of Color (Level A) — **Heuristic**
+Detection: color-only signalling (links distinguished only by `color`, errors only by red, etc.).
+
+#### 1.4.2 Audio Control (Level A) — **Static**
+Detection: `<audio autoplay>` or `<video autoplay>` without `muted` AND without pause control.
+
+#### 1.4.3 Contrast (Minimum) (Level AA) — **Heuristic**
+Detection: hardcoded color pairs in CSS with computed contrast <4.5:1 (normal) or <3:1 (large text, 18pt+/14pt bold+). Runtime cascade may change this — flag as heuristic.
+
+#### 1.4.4 Resize Text (Level AA) — **Static**
+Detection: `<meta name="viewport">` with `user-scalable=no` or `maximum-scale=1`. Also flag `font-size` in `px` where rem/em would adapt better (INFO only).
+
+#### 1.4.5 Images of Text (Level AA) — **Heuristic**
+Detection: `<img>` with `alt` containing a full sentence — likely text rendered as image.
+
+#### 1.4.10 Reflow (Level AA) — **Runtime**
+Content must reflow at 320 CSS pixels width / 256 CSS pixels height without horizontal scroll. Requires rendering.
+
+#### 1.4.11 Non-text Contrast (Level AA) — **Heuristic**
+Detection: button/input border colors, focus indicator colors vs. adjacent colors — hardcoded combinations with <3:1 contrast.
+
+#### 1.4.12 Text Spacing (Level AA) — **Runtime**
+Content must adapt when users override line-height, letter-spacing, word-spacing, paragraph-spacing. Requires rendering.
+
+#### 1.4.13 Content on Hover or Focus (Level AA) — **Runtime**
+Tooltips/popovers must be dismissible, hoverable, persistent. Requires interaction testing.
+
+---
+
+## Principle 2: Operable
+
+### Guideline 2.1 — Keyboard Accessible
+
+#### 2.1.1 Keyboard (Level A) — **Heuristic**
+Detection: `onClick` on `<div>`/`<span>` without role+tabindex+keydown; native `<button>` converted via CSS to link (acceptable) but custom `<a role="button">` without tabindex/key handlers (not acceptable).
+
+#### 2.1.2 No Keyboard Trap (Level A) — **Heuristic**
+Detection: `event.preventDefault()` in keydown within modal/dialog without Escape handling.
+
+#### 2.1.4 Character Key Shortcuts (Level A) — **Heuristic**
+Detection: global keydown listener on single-character keys without modifier. Should be disableable or only active on focus.
+
+### Guideline 2.2 — Enough Time
+
+#### 2.2.1 Timing Adjustable (Level A) — **Runtime**
+Session timeouts, auto-refresh — requires behavioral testing.
+
+#### 2.2.2 Pause, Stop, Hide (Level A) — **Static**
+Detection: `<marquee>` / `<blink>` (deprecated); CSS `animation: ... infinite` on non-interactive element without pause control; auto-sliding carousel without pause button.
+
+### Guideline 2.3 — Seizures and Physical Reactions
+
+#### 2.3.1 Three Flashes or Below Threshold (Level A) — **Runtime**
+Requires visual analysis.
+
+### Guideline 2.4 — Navigable
+
+#### 2.4.1 Bypass Blocks (Level A) — **Static**
+Detection: No skip link (`<a href="#main">`) and no landmark `<main>`.
+
+#### 2.4.2 Page Titled (Level A) — **Static**
+Detection: `<title>` missing, empty, or duplicated across routes.
+
+#### 2.4.3 Focus Order (Level A) — **Static**
+Detection: `tabindex` value >0.
+
+#### 2.4.4 Link Purpose (In Context) (Level A) — **Heuristic**
+Detection: link text "click here", "read more", "here" without surrounding descriptive context.
+
+#### 2.4.5 Multiple Ways (Level AA) — **Static**
+Detection: Sitemap / search / navigation absence across project.
+
+#### 2.4.6 Headings and Labels (Level AA) — **Static**
+Detection: Empty `<h1>`, empty `<label>`, generic "Input" labels.
+
+#### 2.4.7 Focus Visible (Level AA) — **Static**
+Detection: `outline: none` / `outline: 0` on focusable selector without `:focus-visible` replacement.
+
+### Guideline 2.5 — Input Modalities
+
+#### 2.5.1 Pointer Gestures (Level A) — **Heuristic**
+Detection: Multi-touch / path-based gestures (swipe, pinch) without single-pointer alternative.
+
+#### 2.5.2 Pointer Cancellation (Level A) — **Heuristic**
+Detection: `onMouseDown` triggering action without `onMouseUp` confirmation (up-event cancellation).
+
+#### 2.5.3 Label in Name (Level A) — **Heuristic**
+Detection: `<button aria-label="Close">✕</button>` where visible text ("Close") doesn't appear in accessible name. Also: button visible text "Submit" with `aria-label="Save"` — mismatched.
+
+#### 2.5.4 Motion Actuation (Level A) — **Heuristic**
+Detection: `devicemotion` / `deviceorientation` handlers without alternative UI control.
+
+---
+
+## Principle 3: Understandable
+
+### Guideline 3.1 — Readable
+
+#### 3.1.1 Language of Page (Level A) — **Static**
+Detection: `<html>` missing `lang` attribute.
+
+#### 3.1.2 Language of Parts (Level AA) — **Heuristic**
+Detection: Foreign-language content without `<span lang="...">` wrapper.
+
+### Guideline 3.2 — Predictable
+
+#### 3.2.1 On Focus (Level A) — **Heuristic**
+Detection: `onFocus` handler that changes context (navigation, submit, modal open).
+
+#### 3.2.2 On Input (Level A) — **Heuristic**
+Detection: `<form>` submitted on `onChange` of single input; `window.location` changed in `onChange` handler.
+
+#### 3.2.3 Consistent Navigation (Level AA) — **Heuristic**
+Detection: Navigation component with route-dependent render (different nav on different pages).
+
+#### 3.2.4 Consistent Identification (Level AA) — **Heuristic**
+Detection: Same UI element with different ARIA labels / icons across pages.
+
+### Guideline 3.3 — Input Assistance
+
+#### 3.3.1 Error Identification (Level A) — **Heuristic**
+Detection: Error display without `aria-describedby` link from input.
+
+#### 3.3.2 Labels or Instructions (Level A) — **Static**
+Detection: `<input>` without label.
+
+#### 3.3.3 Error Suggestion (Level AA) — **Authoring**
+Content-driven: does the error message tell the user what's wrong and how to fix it?
+
+#### 3.3.4 Error Prevention (Legal, Financial, Data) (Level AA) — **Heuristic**
+Detection: Payment / delete / purchase form without confirmation step / review-before-submit.
+
+---
+
+## Principle 4: Robust
+
+### Guideline 4.1 — Compatible
+
+#### 4.1.1 Parsing (Level A, removed in WCAG 2.2) — **Static**
+Detection: Malformed HTML, duplicate IDs, unclosed tags. Modern browsers tolerate most parse errors; WCAG 2.2 removes this criterion.
+
+#### 4.1.2 Name, Role, Value (Level A) — **Static**
+Detection: `<div onClick>` without role; custom widgets without ARIA state; `aria-labelledby` pointing to non-existent ID.
+
+#### 4.1.3 Status Messages (Level AA) — **Heuristic**
+Detection: Toast / async error display without `role="status"` / `role="alert"` / `aria-live`.
+
+---
+
+## WCAG 2.2 AA Additions (enable with `--standard wcag-2.2-aa`)
+
+### 2.4.11 Focus Not Obscured (Minimum) (Level AA) — **Runtime**
+Focused element must not be entirely hidden by author-created content (sticky headers, cookie banners).
+
+### 2.5.7 Dragging Movements (Level AA) — **Heuristic**
+Detection: drag-and-drop UI without keyboard alternative (buttons to reorder).
+
+### 2.5.8 Target Size (Minimum) (Level AA) — **Heuristic**
+Detection: interactive target <24×24 CSS pixels in source CSS.
+
+### 3.2.6 Consistent Help (Level A) — **Heuristic**
+Detection: Help / contact / support link not consistently placed across pages.
+
+### 3.3.7 Redundant Entry (Level A) — **Heuristic**
+Detection: Multi-step form asking for same data (email, name, address) twice without autofill.
+
+### 3.3.8 Accessible Authentication (Minimum) (Level AA) — **Heuristic**
+Detection: CAPTCHAs (reCAPTCHA v2 checkbox, image-based CAPTCHAs) without non-cognitive alternative; passwords without `autocomplete="current-password"` / `autocomplete="new-password"`.
+
+---
+
+## EN 301 549 Additional Requirements (enable with `--standard en-301-549` or `eaa`)
+
+EN 301 549 v3.2.1 aligns with WCAG 2.1 AA but adds:
+
+- **Chapter 5: Generic requirements** — user preferences, biometric alternatives, privacy of personal information.
+- **Chapter 6: ICT with two-way voice communication** — real-time text, captions for calls.
+- **Chapter 7: ICT with video capabilities** — captions for recorded video.
+- **Chapter 9: Web** — full WCAG 2.1 AA.
+- **Chapter 10: Non-web documents** — WCAG for PDFs.
+- **Chapter 11: Software** — WCAG-equivalent for native apps. **Critical for EAA mobile scope.**
+- **Chapter 12: Documentation and support services** — accessibility information published.
+- **Chapter 13: ICT providing relay / emergency services**.
+
+### Chapter 11.x (Software / Mobile)
+
+Corresponds to WCAG criteria applied to mobile/native apps:
+
+| Clause | Maps to WCAG | Description |
+|--------|--------------|-------------|
+| 11.1.1.1 | 1.1.1 | Non-text content in software |
+| 11.1.3.1 | 1.3.1 | Info and relationships in software |
+| 11.2.1.1 | 2.1.1 | Keyboard alternatives in software |
+| 11.4.1.1 | 4.1.1 | Parsing in software (native UI tree correctness) |
+| 11.4.1.2 | 4.1.2 | Name, role, value in software |
+
+For React Native / Flutter, this means: every interactive widget needs an accessible name, role, state exposed to the platform accessibility API (iOS UIAccessibility / Android AccessibilityNodeInfo).
+
+See [mobile-eaa.md](mobile-eaa.md) for implementation patterns.
+
+---
+
+## Detection Coverage Summary
+
+Of 50 WCAG 2.1 Level A + AA criteria:
+- **~20 statically detectable** (this skill's definitive findings)
+- **~15 heuristically detectable** (confidence: heuristic)
+- **~10 runtime-only** (needs rendering/interaction)
+- **~5 authoring-only** (content decisions, not code)
+
+For complete coverage, pair `/a11y-validate` with:
+- **axe-core** (via Playwright / Cypress / Jest)
+- **Lighthouse accessibility audit**
+- **pa11y CLI**
+- **NVDA / JAWS / VoiceOver / TalkBack manual testing**
+- **User research with disabled participants**
+
+---
+
+## References
+
+- WCAG 2.1: https://www.w3.org/TR/WCAG21/
+- WCAG 2.2: https://www.w3.org/TR/WCAG22/
+- EN 301 549 v3.2.1: https://www.etsi.org/deliver/etsi_en/301500_301599/301549/03.02.01_60/en_301549v030201p.pdf
+- WCAG Quick Reference: https://www.w3.org/WAI/WCAG21/quickref/
+- Understanding WCAG: https://www.w3.org/WAI/WCAG21/Understanding/
+- Techniques for WCAG: https://www.w3.org/WAI/WCAG21/Techniques/

package/app/skills/a11y-validate/reference/wcag-2-2-aa.md

@@ -0,0 +1,221 @@
+# WCAG 2.2 New Success Criteria Reference
+
+Reference for `a11y-validate --standard wcag-2.2-aa`. Covers ONLY the 9 new success criteria added in WCAG 2.2 (not in 2.1). For the 50 inherited criteria, see [wcag-2-1-aa.md](wcag-2-1-aa.md).
+
+Source: W3C WCAG 2.2 Recommendation, 5 October 2023.
+
+Note: WCAG 2.2 removes SC 4.1.1 Parsing (Level A) -- modern parsers handle malformed markup; the criterion is obsolete.
+
+## Legend
+
+- **Heuristic** -- static detection possible with false-positive/negative risk.
+- **Runtime** -- requires rendering, interaction, or AT testing.
+
+---
+
+## Level A
+
+### 2.4.11 Focus Not Obscured (Minimum) -- **Runtime**
+
+When a component receives keyboard focus, it must not be entirely hidden by author-created content (sticky headers, cookie banners, chat widgets).
+
+**Failures:** `position: fixed/sticky` elements with high `z-index` covering focused items. Cookie banners without `scroll-into-view` logic. Chat widgets overlapping tab-order elements.
+
+```html
+<!-- FAIL: focused link hidden behind sticky header -->
+<header style="position: sticky; top: 0; z-index: 1000; height: 80px;">...</header>
+<main><a href="/about">About</a></main>
+```
+
+**Grep:** `position:\s*(fixed|sticky)` | `z-index:\s*[0-9]{3,}`
+
+**Frameworks:** React/Next -- add `scroll-padding-top` on `<html>` to offset sticky headers. Vue/Nuxt -- same for `<Teleport>` portals. Angular -- verify `CDK Overlay` does not obscure focus.
+
+---
+
+### 3.2.6 Consistent Help -- **Heuristic**
+
+Help mechanisms (contact info, chat, FAQ) must appear in the same relative order across all pages in a set.
+
+**Failures:** Help link in header on some pages, footer on others. Chat widget present on landing but absent on checkout.
+
+```html
+<!-- FAIL: Page A has help in header, Page B only in footer -->
+<header><a href="/support">Help</a></header>  <!-- Page A -->
+<footer><a href="/support">Help</a></footer>  <!-- Page B -->
+```
+
+**Grep:** `href=["'][^"']*(help|support|contact|faq)` | `(help|support|contact|chat|assistance)`
+
+**Frameworks:** Place help links in shared layout -- `layout.tsx` (Next App Router), `layouts/default.vue` (Nuxt), shared `AppComponent` (Angular).
+
+---
+
+### 3.3.7 Redundant Entry -- **Heuristic**
+
+Data previously entered in the same process must be auto-populated or selectable. Exceptions: security re-entry, expired/deleted data.
+
+**Failures:** Multi-step form re-asking email without pre-fill. Billing address blank with no "same as shipping" checkbox.
+
+```tsx
+// FAIL: Step 3 re-asks email without persisting from Step 1
+function Step3() {
+  const [email, setEmail] = useState(''); // should pre-fill
+  return <input value={email} onChange={e => setEmail(e.target.value)} />;
+}
+```
+
+**Grep:** `(step|wizard|multi.?step|checkout)` | `(name|email|phone|address).*input`
+
+**Frameworks:** React -- `useFormContext` (RHF) or Formik context across steps. Vue -- Pinia store. Angular -- shared `FormGroup` across stepper.
+
+---
+
+### 3.3.8 Accessible Authentication (Minimum) -- **Heuristic**
+
+No cognitive function test for auth unless: (a) alternative exists, (b) mechanism helps complete it (paste, password manager), or (c) test uses object/personal-content recognition (allowed at Minimum, not Enhanced).
+
+**Failures:** CAPTCHA with no non-cognitive alternative. Password field blocking paste or missing `autocomplete`. OTP input preventing paste.
+
+```html
+<!-- FAIL: blocks password manager -->
+<input type="password" onpaste="return false">
+<!-- FAIL: missing autocomplete -->
+<input type="password" name="pwd">
+<!-- PASS -->
+<input type="password" name="pwd" autocomplete="current-password">
+```
+
+**Grep:** `onpaste.*preventDefault|onpaste.*return\s*false` | `captcha|recaptcha|hcaptcha` | `type=["']password["'](?!.*autocomplete)`
+
+**Frameworks:** React uses `autoComplete="current-password"` (camelCase). Vue -- `autocomplete="current-password"`, no `@paste.prevent`. Angular -- `[attr.autocomplete]="'current-password'"`.
+
+---
+
+## Level AA
+
+### 2.4.12 Focus Not Obscured (Enhanced) -- **Runtime**
+
+No part of a focused component may be hidden by author-created content. Stricter than 2.4.11 -- even partial overlap fails.
+
+**Failures:** Same as 2.4.11 but partial coverage also fails. Sticky sidebar partially covering a focused input. Bottom nav overlapping lower portion of a button.
+
+```css
+/* Fix: offset fixed elements with scroll-padding */
+html { scroll-padding-bottom: 80px; scroll-padding-top: 100px; }
+```
+
+**Grep:** `position:\s*(fixed|sticky)` | `scroll-padding` | `scroll-margin`
+
+**Frameworks:** All -- use `scroll-padding-top`/`scroll-padding-bottom` on scroll container. Tab through all interactive elements to verify.
+
+---
+
+### 2.4.13 Focus Appearance -- **Heuristic**
+
+Focus indicator must have: (a) area >= perimeter x 2 CSS pixels (roughly a 2px outline), (b) >= 3:1 contrast between focused and unfocused states.
+
+**Failures:** 1px dotted outline. Focus ring color close to background. `box-shadow`-only focus with low opacity.
+
+```css
+/* FAIL */ :focus-visible { outline: 1px dotted #ccc; }
+/* FAIL */ :focus-visible { outline: 2px solid #e0e0e0; } /* ~1.1:1 on white */
+/* PASS */ :focus-visible { outline: 2px solid #0056b3; outline-offset: 2px; }
+```
+
+**Grep:** `:focus-visible|:focus\b` | `outline:\s*(1px|0\.5px|thin|dotted|none|0)` | `box-shadow.*:focus`
+
+**Frameworks:** React -- `@react-aria/focus` provides compliant rings; Shadcn `ring-2 ring-ring` needs contrast audit. Vue -- audit Vuetify/PrimeVue focus styles against theme. Angular -- Material `FocusMonitor` handles detection but verify visual indicator. Tailwind -- `focus-visible:ring-2 focus-visible:ring-offset-2` with high-contrast color.
+
+---
+
+### 2.5.7 Dragging Movements -- **Heuristic**
+
+Drag functionality must have a single-pointer non-drag alternative (unless dragging is essential).
+
+**Failures:** Drag-only reorder list without move buttons. Custom slider without keyboard steps. Kanban with drag-only cards.
+
+```tsx
+// FAIL: drag-only, no button alternative
+<DndContext onDragEnd={handleDragEnd}>
+  <SortableContext items={items}>
+    {items.map(item => <SortableItem key={item.id} {...item} />)}
+  </SortableContext>
+</DndContext>
+
+// PASS: add move buttons per item
+<button onClick={() => moveUp(id)} aria-label="Move up">^</button>
+<button onClick={() => moveDown(id)} aria-label="Move down">v</button>
+```
+
+**Grep:** `draggable|onDrag|DndContext|useDrag|useDrop` | `react-beautiful-dnd|@dnd-kit|react-dnd|vuedraggable|cdkDrag|SortableJS`
+
+**Frameworks:** React -- `@dnd-kit` supports `KeyboardSensor`; ensure it is registered. Vue -- `vuedraggable` lacks keyboard reorder; add move buttons. Angular -- `cdk/drag-drop` has keyboard support; verify active.
+
+---
+
+### 2.5.8 Target Size (Minimum) -- **Heuristic**
+
+Interactive targets must be >= 24x24 CSS pixels, unless spacing compensates, target is inline, or size is essential.
+
+**Failures:** 16x16 icon buttons without padding. Close (`x`) buttons with tiny tap targets. Dense table action icons.
+
+```css
+/* FAIL */ .icon-btn { width: 16px; height: 16px; padding: 0; }
+/* PASS */ .icon-btn { width: 24px; height: 24px; }
+/* PASS */ .icon-btn { width: 16px; height: 16px; padding: 4px; } /* 24x24 total */
+```
+
+**Grep:** `(width|height|min-width|min-height):\s*(1[0-9]|2[0-3])px` | `(w-[1-5]|h-[1-5])\b` | `padding:\s*0[;\s]`
+
+**Frameworks:** React -- Shadcn `size="icon"` is 36x36 (safe); custom icons need `min-w-6 min-h-6`. Vue -- Vuetify `v-btn icon` is 40x40 (safe). Angular -- `mat-icon-button` is 40x40 (safe). Tailwind minimum: `min-w-6 min-h-6` (24px); prefer `min-w-11 min-h-11` (44px) for touch.
+
+---
+
+## Level AAA
+
+### 3.3.9 Accessible Authentication (Enhanced) -- **Heuristic**
+
+Same as 3.3.8 but stricter: no cognitive test at all, including object recognition and personal content recognition. Only paste support, password manager autofill, or non-cognitive methods (WebAuthn, passkeys, magic links) qualify.
+
+**Failures:** "Select all traffic lights" CAPTCHA (passes 3.3.8, fails 3.3.9). "Which is your profile photo?" (same). Any image/puzzle verification without fully non-cognitive alternative.
+
+```html
+<!-- FAIL at AAA --> <div class="g-recaptcha" data-sitekey="..."></div>
+<!-- PASS --> <div class="g-recaptcha" data-sitekey="..." data-size="invisible"></div>
+<!-- PASS --> <button onclick="navigator.credentials.get({publicKey: opts})">Passkey</button>
+```
+
+**Grep:** `recaptcha|hcaptcha|captcha|turnstile` | `data-size=["']invisible["']` | `navigator\.credentials\.(get|create)` | `WebAuthn|passkey`
+
+**Frameworks:** All -- prefer WebAuthn/passkeys, magic links, or invisible CAPTCHA (reCAPTCHA v3, Turnstile managed). At AAA, even "select all buses" fails.
+
+---
+
+## Detection Coverage Summary
+
+| Criterion | Level | Detection |
+|-----------|-------|-----------|
+| 2.4.11 Focus Not Obscured (Min) | A | Runtime |
+| 2.4.12 Focus Not Obscured (Enhanced) | AA | Runtime |
+| 2.4.13 Focus Appearance | AA | Heuristic |
+| 2.5.7 Dragging Movements | AA | Heuristic |
+| 2.5.8 Target Size (Minimum) | AA | Heuristic |
+| 3.2.6 Consistent Help | A | Heuristic |
+| 3.3.7 Redundant Entry | A | Heuristic |
+| 3.3.8 Accessible Auth (Min) | AA | Heuristic |
+| 3.3.9 Accessible Auth (Enhanced) | AAA | Heuristic |
+
+- **0 statically detectable** -- no criterion is definitively matchable without context
+- **7 heuristically detectable** -- the skill can flag likely violations
+- **2 runtime-only** -- focus obscuring requires rendering to verify
+
+---
+
+## References
+
+- WCAG 2.2 Recommendation: https://www.w3.org/TR/WCAG22/
+- What's New in WCAG 2.2: https://www.w3.org/WAI/standards-guidelines/wcag/new-in-22/
+- Understanding WCAG 2.2: https://www.w3.org/WAI/WCAG22/Understanding/
+- WCAG 2.2 Quick Reference: https://www.w3.org/WAI/WCAG22/quickref/
+- Techniques for WCAG 2.2: https://www.w3.org/WAI/WCAG22/Techniques/