mandrel 2.4.0 → 2.5.0

package/.agents/audit-checklists/accessibility.md

@@ -0,0 +1,29 @@
+<!-- GENERATED FILE — do not edit by hand.
+     Source of truth: .agents/workflows/audit-accessibility.md
+     Regenerate: node .agents/scripts/generate-lens-checklists.js
+     Drift is gated by: npm run docs:check
+-->
+
+# Accessibility (WCAG) Audit — authoring checklist
+
+> Audit WCAG accessibility conformance (static-first) with an optional runtime verification pass, and produce a structured findings report
+
+Self-check your change against this lens's concerns before you ship:
+
+- [ ] `audit-accessibility` (this lens)
+- [ ] `audit-ux-ui`
+- [ ] Renderable surface
+- [ ] Static a11y tooling already in the repo
+- [ ] Design tokens
+- [ ] Runtime target (optional)
+- [ ] Semantic structure
+- [ ] ARIA correctness
+- [ ] Keyboard operability & focus management
+- [ ] Forms & labels
+- [ ] Media alternatives
+- [ ] Contrast where statically derivable
+- [ ] Raw-element census
+- [ ] Resolve the target from config — never a hardcoded URL.
+- [ ] Sample routes from the navigability SSOT.
+- [ ] Run an accessibility engine per sampled route.
+- [ ] Median-of-3 or provisional.

package/.agents/audit-checklists/architecture.md

@@ -10,13 +10,12 @@
 
 Self-check your change against this lens's concerns before you ship:
 
+- [ ] Cycle detection.
+- [ ] Dead-export detection.
+- [ ] Hotspot ranking.
+- [ ] LLM triage on top.
 - [ ] Documented architecture boundaries
 - [ ] Automated boundary checks
-- [ ] Over-Engineering & Abstractions
-- [ ] Cognitive Load & Nesting
-- [ ] Dead Code & Redundancy
-- [ ] Naming & Self-Documentation
-- [ ] Coupling & Cohesion
 - [ ] Testable Surface (Humble-Object Boundary)
 - [ ] High
 - [ ] Medium

package/.agents/audit-checklists/clean-code.md

@@ -10,6 +10,16 @@
 
 Self-check your change against this lens's concerns before you ship:
 
+- [ ] Complexity / maintainability (scoped mode).
+- [ ] Committed baselines (codebase-wide mode).
+- [ ] Duplication.
+- [ ] Dead code.
+- [ ] Entry points
+- [ ] Public API surface
+- [ ] Dynamic imports
+- [ ] Test-only seams
+- [ ] Framework/registration hooks
+- [ ] Churn-by-complexity hotspot cap.
 - [ ] Logic Complexity
 - [ ] Duplication
 - [ ] Component Health

package/.agents/audit-checklists/data-model.md

@@ -0,0 +1,22 @@
+<!-- GENERATED FILE — do not edit by hand.
+     Source of truth: .agents/workflows/audit-data-model.md
+     Regenerate: node .agents/scripts/generate-lens-checklists.js
+     Drift is gated by: npm run docs:check
+-->
+
+# Data Model & Persistence Audit — authoring checklist
+
+> Audit the persistence layer as a first-class artifact — model↔migration↔seed drift, constraint completeness, migration hygiene, type fidelity, and access-pattern fit; gated by a persistence-layer applicability probe so DB-less repos skip cleanly.
+
+Self-check your change against this lens's concerns before you ship:
+
+- [ ] ORM drift tooling (preferred)
+- [ ] Read-only file fallback
+- [ ] Model & schema inventory
+- [ ] Migration history
+- [ ] Seed & fixture data
+- [ ] Model↔migration↔seed drift
+- [ ] Constraint completeness
+- [ ] Migration hygiene
+- [ ] Type fidelity
+- [ ] Access-pattern fit

package/.agents/audit-checklists/dependencies.md

@@ -10,5 +10,14 @@
 
 Self-check your change against this lens's concerns before you ship:
 
-- [ ] Inventory & Stale Check
-- [ ] Vulnerability Scan
+- [ ] Outdated inventory.
+- [ ] Unused dependencies.
+- [ ] Staleness.
+- [ ] Node-engine drift.
+- [ ] Two-pass audit diff.
+- [ ] Severity rubric.
+- [ ] Report shape — no flooding.
+- [ ] Enumerate the delta.
+- [ ] Provenance.
+- [ ] New install scripts.
+- [ ] Typosquat near-misses.

package/.agents/audit-checklists/devops.md

@@ -10,6 +10,10 @@
 
 Self-check your change against this lens's concerns before you ship:
 
+- [ ] Workflow static analysis (`actionlint`).
+- [ ] Workflow security posture (`zizmor`).
+- [ ] Container linting (`hadolint`), presence-gated on Dockerfiles.
+- [ ] Pipeline reliability history (`gh run list`).
 - [ ] Redundancy & Duplication
 - [ ] Performance Gaps
 - [ ] Security & Compliance

package/.agents/audit-checklists/navigability.md

@@ -12,3 +12,6 @@ Self-check your change against this lens's concerns before you ship:
 
 - [ ] Every route has a persona nav door.
 - [ ] No nav href is dead.
+- [ ] Dynamic-segment children of a surfaced parent
+- [ ] System routes
+- [ ] Inbound in-app references

package/.agents/audit-checklists/performance.md

@@ -6,17 +6,14 @@
 
 # Performance & Bottleneck Audit — authoring checklist
 
-> Audit hot paths, algorithmic complexity, and I/O bottlenecks in the tooling surface (`single-story-close`, dispatcher, gates); propose remediations.
+> Audit performance by measuring first — profile hot paths, I/O, memory, and payload against the repo's own numbers — and audit interleaving/partial-failure correctness (TOCTOU, unawaited promises, non-atomic writes) as a first-class dimension.
 
 Self-check your change against this lens's concerns before you ship:
 
-- [ ] Database/API Efficiency
-- [ ] Frontend Rendering
-- [ ] Bundle Size
-- [ ] Resource Usage
-- [ ] Network Path
-- [ ] Latency
-- [ ] Throughput
-- [ ] Efficiency
-- [ ] Scalability
-- [ ] Core Web Vitals
+- [ ] Diff against the previous baseline
+- [ ] Suppress unchanged known findings.
+- [ ] CPU & algorithmic hot paths
+- [ ] I/O & syscall efficiency
+- [ ] Memory & leaks
+- [ ] Payload & bundle (web only)
+- [ ] Interleaving & partial-failure correctness

package/.agents/audit-checklists/privacy.md

@@ -10,10 +10,9 @@
 
 Self-check your change against this lens's concerns before you ship:
 
-- [ ] Log Statements
-- [ ] Storage
-- [ ] API Requests
-- [ ] Analytics
+- [ ] Enumerate the sinks.
+- [ ] Secret scan.
+- [ ] Trace PII sources to the enumerated sinks.
 - [ ] Data Minimization
 - [ ] Leaky Logging
 - [ ] Insecure Transmission

package/.agents/audit-checklists/quality.md

@@ -10,6 +10,8 @@
 
 Self-check your change against this lens's concerns before you ship:
 
+- [ ] Story-scoped mode
+- [ ] Codebase-wide mode
 - [ ] Coverage vs. Confidence
 - [ ] Test Fragility & Flakiness
 - [ ] Mocking & Stubbing Strategy

package/.agents/audit-checklists/security.md

@@ -10,11 +10,10 @@
 
 Self-check your change against this lens's concerns before you ship:
 
-- [ ] Input Validation
-- [ ] Injection Risks
-- [ ] Authentication/Authorization
-- [ ] Dependency Security
-- [ ] Secret Management
+- [ ] Dependency CVEs (`npm audit`).
+- [ ] Secret scanning (`gitleaks` / `trufflehog`), with a grep fallback.
+- [ ] Grep battery (deterministic fallback / augmentation).
+- [ ] Manual surface review.
 - [ ] Injection
 - [ ] Broken Access Control
 - [ ] Cryptographic Failures

package/.agents/audit-checklists/seo.md

@@ -10,7 +10,13 @@
 
 Self-check your change against this lens's concerns before you ship:
 
+- [ ] Auth-walled / private surface
+- [ ] Publicly indexable surface
+- [ ] Mixed
+- [ ] Step 1a — Identify the meta mechanism.
+- [ ] Step 1b — Enumerate the routes.
+- [ ] Step 1c — Per-route metadata probe.
 - [ ] Traditional SEO
 - [ ] AIO & GEO (Answer Engine Optimization)
-- [ ] Core Web Vitals
+- [ ] Statically-provable Core Web Vitals defects only
 - [ ] Crawlability

package/.agents/audit-checklists/sre.md

@@ -10,15 +10,17 @@
 
 Self-check your change against this lens's concerns before you ship:
 
-- [ ] Config Integrity
-- [ ] Hardcoding Scan
-- [ ] Fallback Logic
-- [ ] Secret Leaks
-- [ ] Input Sanitization
-- [ ] Dependency Risks
-- [ ] Console Hygiene
-- [ ] Error Swallowing
-- [ ] Boundary Handling
-- [ ] Dead Code
-- [ ] Complexity
-- [ ] Asset Loading
+- [ ] Run the resilience battery.
+- [ ] Rollback Path
+- [ ] Migration Reversibility
+- [ ] Feature-Flag Kill Switch
+- [ ] Structured Logging
+- [ ] Metrics & Tracing
+- [ ] Alerting & SLOs
+- [ ] Timeouts & Cancellation
+- [ ] Retry & Backoff
+- [ ] Graceful Shutdown
+- [ ] Error Boundaries
+- [ ] Runbook Coverage
+- [ ] Health & Readiness
+- [ ] On-Call Escalation

package/.agents/audit-checklists/ux-ui.md

@@ -10,8 +10,12 @@
 
 Self-check your change against this lens's concerns before you ship:
 
+- [ ] Design tokens / theme
+- [ ] Component library
+- [ ] Documented conventions
 - [ ] Hardcoded Values
 - [ ] Component Re-implementation
+- [ ] Inline-style census
 - [ ] Interactive States
 - [ ] Typography
 - [ ] Information Hierarchy

package/.agents/docs/configuration.md

@@ -280,6 +280,9 @@ top-level keys are validation errors.
 | `feedbackLoop` | No | `object` | — | Nested configuration block. |
 | `feedbackLoop.auditResultsAutoFile` | No | `boolean` | `true` | When true (default), the close-time audit-results graduator auto-files non-blocking audit-results findings as follow-up issues routed by source classification. Set to false to suppress auto-filing; findings remain accessible in the structured comments on the Story. |
 | `feedbackLoop.retroProposals` | No | `boolean` | `true` | When true (default), the retro auto-files its actionable routed proposals as meta::<framework-gap\|consumer-improvement> + friction::<category> issues via the graduator pre-parsed-findings seam, and the rendered retro sections list the filed issue numbers instead of paste-ready gh command stanzas. Set to false to fall back to the command stanzas. |
+| `auditToStories` | No | `object` | — | Nested configuration block. |
+| `auditToStories.severityFloor` | No | `"critical"` \| `"high"` \| `"medium"` \| `"low"` \| `"all"` | `"high"` | Minimum severity a finding must meet to be proposed as a Story on an unattended `/audit-to-stories --auto` sweep (Story #4626). Default high. |
+| `auditToStories.autoComment` | No | `boolean` | `true` | When true (default), `/audit-to-stories --auto` posts a re-detected comment on an already-open matched Issue instead of silently skipping it. |
 
 <!-- END GENERATED:agentrc -->
 

package/.agents/docs/workflows.md

@@ -32,18 +32,19 @@ by `node .agents/scripts/generate-workflows-doc.js`; `npm run docs:check`
 fails when it drifts from the on-disk workflow set. To change a command’s
 description, edit the workflow file’s front-matter and regenerate.
 
-## Commands (23)
+## Commands (24)
 
 | Command | Description |
 | --- | --- |
+| `/audit-accessibility` | Audit WCAG accessibility conformance (static-first) with an optional runtime verification pass, and produce a structured findings report |
 | `/audit-architecture` | Audit architectural boundaries, module coupling, and layering violations; emit a structured findings report keyed to High/Medium/Low severity. |
 | `/audit-clean-code` | Audit code smells, dead code, complexity hotspots, and maintainability-index outliers; emit a structured findings report. |
+| `/audit-data-model` | Audit the persistence layer as a first-class artifact — model↔migration↔seed drift, constraint completeness, migration hygiene, type fidelity, and access-pattern fit; gated by a persistence-layer applicability probe so DB-less repos skip cleanly. |
 | `/audit-dependencies` | Audit `package.json` for unused, outdated, and major-version-stale dependencies; surface Node-engine drift and propose upgrade batches. |
 | `/audit-devops` | Audit CI/CD workflows, container images, infrastructure-as-code, and deployment pipelines; surface failure modes and hardening gaps. |
 | `/audit-documentation` | Audit the repository's main documentation for staleness, semantic drift, and completeness; emit a structured High/Medium/Low findings report. |
-| `/audit-lighthouse` | Run a Lighthouse audit (Performance / Accessibility / Best Practices / SEO) and produce a structured findings report |
 | `/audit-navigability` | Audit the whole route tree against the consumer's nav-registry SSOT — every route has a persona nav door and no nav href is dead. A deliberately-global lens (Epic #4131, F2/F3) exempt from the cross-epic-leak guard and routed onto route-adding change sets. |
-| `/audit-performance` | Audit hot paths, algorithmic complexity, and I/O bottlenecks in the tooling surface (`single-story-close`, dispatcher, gates); propose remediations. |
+| `/audit-performance` | Audit performance by measuring first — profile hot paths, I/O, memory, and payload against the repo's own numbers — and audit interleaving/partial-failure correctness (TOCTOU, unawaited promises, non-atomic writes) as a first-class dimension. |
 | `/audit-privacy` | Audit logs, telemetry, and persistence paths for PII leakage and retention violations; surface secrets exposure and consent gaps. |
 | `/audit-quality` | Audit test coverage gaps, flaky tests, missing assertions, and test-pyramid balance; recommend a remediation batch. |
 | `/audit-security` | Audit dependency CVEs, input-validation gaps, secrets handling, and auth boundaries; emit a structured High/Medium/Low findings report. |

package/.agents/schemas/agentrc.schema.json

@@ -1368,6 +1368,23 @@
             }
           },
           "additionalProperties": false
+        },
+        "auditToStories": {
+          "type": "object",
+          "properties": {
+            "severityFloor": {
+              "type": "string",
+              "enum": ["critical", "high", "medium", "low", "all"],
+              "default": "high",
+              "description": "Minimum severity a finding must meet to be proposed as a Story on an unattended `/audit-to-stories --auto` sweep (Story #4626). Default high."
+            },
+            "autoComment": {
+              "type": "boolean",
+              "default": true,
+              "description": "When true (default), `/audit-to-stories --auto` posts a re-detected comment on an already-open matched Issue instead of silently skipping it."
+            }
+          },
+          "additionalProperties": false
         }
       },
       "additionalProperties": false

package/.agents/schemas/audit-rules.json

@@ -14,6 +14,33 @@
       "scope": "cumulative",
       "substitutionKeys": []
     },
+    "audit-data-model": {
+      "triggers": {
+        "gates": ["gate1", "gate3"],
+        "keywords": [
+          "migration",
+          "schema",
+          "orm",
+          "prisma",
+          "foreign key",
+          "constraint",
+          "cascade",
+          "backfill"
+        ],
+        "filePatterns": [
+          "**/migrations/**",
+          "**/migrate/**",
+          "**/seeds/**",
+          "**/*.sql",
+          "**/*.prisma",
+          "**/entities/**",
+          "**/models/**"
+        ]
+      },
+      "target": "data-model",
+      "scope": "local",
+      "substitutionKeys": []
+    },
     "audit-security": {
       "triggers": {
         "gates": ["gate1", "gate3"],
@@ -25,7 +52,19 @@
           "password",
           "encrypt"
         ],
-        "filePatterns": ["**/*.lock", "**/auth/*.js", "**/crypto/*.js"]
+        "filePatterns": [
+          "**/*.lock",
+          "**/auth/**",
+          "**/authn/**",
+          "**/authz/**",
+          "**/middleware/**",
+          "**/crypto/**",
+          "**/session/**",
+          "**/*credential*",
+          "**/*permission*",
+          "**/*.pem",
+          "**/*.key"
+        ]
       },
       "scope": "local",
       "substitutionKeys": []
@@ -33,31 +72,53 @@
     "audit-privacy": {
       "triggers": {
         "gates": ["gate1", "gate3"],
-        "keywords": ["privacy", "pii", "gdpr", "cookie", "tracking"],
-        "filePatterns": ["**/user-profile/**/*.js"]
+        "keywords": [
+          "privacy",
+          "pii",
+          "gdpr",
+          "cookie",
+          "tracking",
+          "telemetry",
+          "analytics",
+          "logging",
+          "consent"
+        ],
+        "filePatterns": [
+          "**/user-profile/**",
+          "**/*logger*",
+          "**/*logging*",
+          "**/logging/**",
+          "**/*telemetry*",
+          "**/telemetry/**",
+          "**/*analytics*",
+          "**/analytics/**"
+        ]
       },
       "scope": "local",
       "substitutionKeys": []
     },
-    "audit-lighthouse": {
+    "audit-accessibility": {
       "triggers": {
         "gates": ["gate2", "gate3"],
         "keywords": [
-          "lighthouse",
           "a11y",
           "accessibility",
           "wcag",
-          "ui",
-          "frontend",
           "aria",
-          "core web vitals",
-          "lcp",
-          "cls"
+          "screen reader",
+          "keyboard",
+          "focus",
+          "contrast",
+          "alt text",
+          "label"
         ],
         "filePatterns": [
           "**/*.html",
-          "**/*.css",
-          "**/components/**/*.js",
+          "**/*.astro",
+          "**/components/**/*.{js,jsx,ts,tsx,vue,svelte}",
+          "**/app/**/{page,layout,route,head,default,template,loading,error,not-found}.{js,jsx,ts,tsx}",
+          "**/pages/**/*.{js,jsx,ts,tsx,vue}",
+          "**/routes/**/*.{jsx,tsx,vue,svelte}",
           "**/frontend/**/*.js"
         ]
       },
@@ -80,8 +141,30 @@
       "substitutionKeys": []
     },
     "audit-sre": {
-      "triggers": { "gates": ["gate4"] },
-      "scope": "global",
+      "triggers": {
+        "gates": ["gate3"],
+        "keywords": [
+          "sre",
+          "slo",
+          "observability",
+          "runbook",
+          "rollback",
+          "error budget",
+          "on-call",
+          "incident",
+          "resilience"
+        ],
+        "filePatterns": [
+          "**/Dockerfile",
+          "**/Dockerfile.*",
+          "**/migrations/**",
+          "**/deploy/**",
+          "**/*deploy*.sh",
+          ".github/workflows/**",
+          "**/*health*"
+        ]
+      },
+      "scope": "cumulative",
       "substitutionKeys": []
     },
     "audit-documentation": {
@@ -130,8 +213,27 @@
     "audit-performance": {
       "triggers": {
         "gates": ["gate1", "gate3"],
-        "keywords": ["performance", "n+1", "hot path", "latency", "throughput"],
-        "filePatterns": [".agents/scripts/**", "src/**/*.{ts,js}"]
+        "keywords": [
+          "performance",
+          "n+1",
+          "hot path",
+          "latency",
+          "throughput",
+          "concurrency",
+          "race",
+          "toctou",
+          "atomic",
+          "idempotent",
+          "bundle",
+          "memory leak"
+        ],
+        "filePatterns": [
+          ".agents/scripts/**",
+          "src/**/*.{ts,js}",
+          "**/*.html",
+          "**/*.css",
+          "**/components/**/*.js"
+        ]
       },
       "scope": "local",
       "substitutionKeys": []
@@ -140,7 +242,7 @@
       "triggers": {
         "gates": ["gate1", "gate3"],
         "keywords": ["test", "coverage", "flaky", "assertion"],
-        "filePatterns": ["tests/**", "**/*.test.{ts,js}", "**/*.spec.{ts,js}"]
+        "sourceWithoutSiblingTest": true
       },
       "scope": "local",
       "substitutionKeys": []
@@ -149,7 +251,15 @@
       "triggers": {
         "gates": ["gate2", "gate3"],
         "keywords": ["seo", "meta", "structured data", "schema.org", "sitemap"],
-        "filePatterns": ["**/*.html", "**/sitemap*", "**/robots.txt"]
+        "filePatterns": [
+          "**/*.html",
+          "**/*.astro",
+          "**/sitemap*",
+          "**/robots*",
+          "**/app/**/{page,layout,route,head,default,template,loading,error,not-found,opengraph-image,twitter-image}.{js,jsx,ts,tsx}",
+          "**/pages/**/*.{js,jsx,ts,tsx,vue}",
+          "**/routes/**/*.{jsx,tsx,vue,svelte}"
+        ]
       },
       "target": "web",
       "scope": "local",
@@ -162,7 +272,12 @@
         "filePatterns": [
           "**/components/**/*.{tsx,jsx,vue,svelte}",
           "**/styles/**",
-          "**/*.css"
+          "**/*.css",
+          "**/*.{scss,sass,less}",
+          "**/tailwind.config.{js,ts,cjs,mjs}",
+          "**/theme/**",
+          "**/tokens/**",
+          "**/design-system/**"
         ]
       },
       "target": "web",

package/.agents/schemas/audit-rules.schema.json

@@ -61,8 +61,8 @@
         },
         "target": {
           "type": "string",
-          "enum": ["web", "any"],
-          "description": "Target-applicability gate: the kind of project this lens can say anything about. `web` — the lens reads a rendered web surface (pages, routes, HTML/CSS, design tokens) and is skipped entirely on a project that has none, however well its keyword or file-pattern triggers match. `any` — always applicable. ABSENT MEANS `any`: omitting the key never changes a lens's behaviour. Applicability is decided by the hasWebSurface() probe in lib/audit-suite/selector.js from observables in the consumer's own checkout — configured navigability routeGlobs, a declared web-framework dependency, or a tracked .html/.css/.jsx/.tsx source file — and NOT from an .agentrc key, so a consumer with a real web surface keeps these lenses with no configuration. The probe fails OPEN: an indeterminate answer treats the project as web-capable, because a wasted lens run is recoverable and silently dropped coverage is not.",
+          "enum": ["web", "data-model", "any"],
+          "description": "Target-applicability gate: the kind of project this lens can say anything about. `web` — the lens reads a rendered web surface (pages, routes, HTML/CSS, design tokens) and is skipped entirely on a project that has none, however well its keyword or file-pattern triggers match. `data-model` — the lens reads a persistence layer (ORM models, schema migrations, seed data) and is skipped entirely on a project that has none. `any` — always applicable. ABSENT MEANS `any`: omitting the key never changes a lens's behaviour. Applicability is decided by a probe in lib/audit-suite/selector.js from observables in the consumer's own checkout — hasWebSurface() for `web` (configured navigability routeGlobs, a declared web-framework dependency, or a tracked .html/.css/.jsx/.tsx source file), hasPersistenceLayer() for `data-model` (a declared ORM dependency, a database migrations directory, or a tracked .prisma/.sql schema file) — and NOT from an .agentrc key, so a consumer with a real surface keeps these lenses with no configuration. Each probe fails OPEN: an indeterminate answer treats the project as capable, because a wasted lens run is recoverable and silently dropped coverage is not.",
           "default": "any"
         },
         "substitutionKeys": {
@@ -95,6 +95,10 @@
           "items": { "type": "string", "minLength": 1 },
           "uniqueItems": true,
           "description": "Glob patterns matched against changed files in the diff."
+        },
+        "sourceWithoutSiblingTest": {
+          "type": "boolean",
+          "description": "Coverage-gap routing trigger (Story #4628). When true, the lens is selected whenever the change set touches a production source file whose sibling test (matched by stem, e.g. foo.js ↔ foo.test.js) is NOT also in the change set — the classic 'shipped source without a test' signal. Implemented by changeSetLacksSiblingTest() in lib/audit-suite/selector.js. Used by audit-quality in place of the backwards test-file filePatterns trigger, which fired the coverage-gap detector on test-only diffs."
         }
       }
     }

package/.agents/scripts/audit-labels-bootstrap.js

@@ -38,6 +38,10 @@ import { gh as defaultGh, GhExecError } from './lib/gh-exec.js';
  * register colour/description here first.
  */
 const LENS_META = Object.freeze({
+  accessibility: {
+    color: 'c5def5',
+    description: 'Audit-sourced finding: WCAG accessibility conformance',
+  },
   architecture: {
     color: '6f42c1',
     description: 'Audit-sourced finding: architectural concerns',
@@ -58,10 +62,6 @@ const LENS_META = Object.freeze({
     color: '1d76db',
     description: 'Audit-sourced finding: documentation staleness / gaps',
   },
-  lighthouse: {
-    color: 'c5def5',
-    description: 'Audit-sourced finding: Lighthouse score regressions',
-  },
   navigability: {
     color: 'bfdadc',
     description: 'Audit-sourced finding: route / nav reachability',