ultra11y 5.22.1 → 5.24.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.22.1",
+      "version": "5.24.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.22.1",
+  "version": "5.24.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.22.1",
+  "version": "5.24.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.22.1";
+const ULTRA11Y_PLUGIN_VERSION = "5.24.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -25,7 +25,7 @@ Full details, thresholds and off-switches under [Install](#install).</sub>
 
 > Audit HTML/CSS/JSX against **WCAG 2.2 AA** accessibility and produce a dated compliance report — or author/review accessible markup without regressions. A [skills.sh](https://skills.sh) agent skill: a deterministic, zero-dependency static engine **plus** the agent's judgment, with `check`/`verify` gates against hallucinated non-conformities. **The central deliverable is the auditor conformance block** — theme, criterion + official wording, test(s), WCAG mapping + level, finding, expected state, verification, `file:line` occurrences — rendered identically by the `report` (compliance doc), the `prd` backlog and the GitHub issues, in the active standard's vocabulary and **in your language** (`--lang auto` follows the conversation/repo). **WCAG is the worldwide core; country standards (RGAA, …) are pluggable in-repo packs.**
 
-ultra11y is built around an honest **division of labour**. Automated tools only catch a fraction of accessibility problems, so the engine does the *mechanical* work — 78 machine-detectable static checks tied to the WCAG 2.2 success criteria — and is explicit about everything it can't decide statically. What it can't, the **AI agent adjudicates** (statically, from the evidence, gated by `verify`/`check`) — not a deferral to a human:
+ultra11y is built around an honest **division of labour**. Automated tools only catch a fraction of accessibility problems, so the engine does the *mechanical* work — 81 machine-detectable static checks tied to the WCAG 2.2 success criteria — and is explicit about everything it can't decide statically. What it can't, the **AI agent adjudicates** (statically, from the evidence, gated by `verify`/`check`) — not a deferral to a human:
 
 - **Automatable (engine):** missing `alt`/`lang`/`title`, unlabeled fields, empty links/buttons, icon-only controls, iframes without title, tables without headers, heading-level skips, empty/dangling headings & labels, duplicate ids, invalid/broken ARIA, positive `tabindex`, autoplay/timed-refresh/`blink`/`marquee` media…
 - **Agent judgment (gated):** alt-text relevance, link purpose in context, reading/tab order, caption accuracy — the agent rules on these via `verify --manual` → `--apply`, each verdict carrying a justification (or a groundable NC), never a silent "conforming".
@@ -226,7 +226,7 @@ from auditing out of memory. `cwd` is optional on all five; it selects whose pac
 `ultra11y_method` is the one to call first. It partitions the standard into evidence tiers —
 `source`, `cross-file`, `rendered-page`, `browser`, `judgment`, `out-of-scope` — from the
 engine's own per-criterion rule applicability, never from guessing at the wording of a test.
-For RGAA it reports that **58 of 106 criteria declare that no engine rule can evidence them**.
+For RGAA it reports that **56 of 106 criteria declare that no engine rule can evidence them**.
 That is the standard saying they are yours, and a plan that hides it reads as coverage that
 does not exist.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.22.1",
+  "version": "5.24.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/build-pack-rgaa.mjs

@@ -310,7 +310,10 @@ async function main() {
   // (link explicitness, WCAG 2.4.4). ADVISORY: it surfaces as a recommendation in the RGAA
   // projection and NEVER makes 6.1 non-conformant. This proves a pack ships its OWN
   // detection without forking the engine (see skills/ultra11y/references/packs.md).
-  const DOWNLOAD_EXT = "pdf|docx?|pptx?|xlsx?|odt|ods|odp|rtf|csv|zip|rar|7z|gz|epub|mp3|mp4|avi|mov";
+  // Kept in step with the engine instead of retyped: two hand-maintained copies of a rule-id
+// list are two chances for the pack to claim an instrument the engine does not ship.
+const PRESENTATIONAL_RULE_IDS = ["presentational-element", "presentational-attribute", "presentational-spacing"];
+const DOWNLOAD_EXT = "pdf|docx?|pptx?|xlsx?|odt|ods|odp|rtf|csv|zip|rar|7z|gz|epub|mp3|mp4|avi|mov";
   const rules = [
     {
       id: "download-link-format",
@@ -377,6 +380,42 @@ async function main() {
         fr: 'Utilisez dir="rtl" ou dir="ltr" (ou dir="auto"), en accord avec le sens de lecture du texte porté.',
       },
     },
+    // RGAA 8.1 — « chaque page web est-elle définie par un type de document ? » THE criterion
+    // no engine could reach: it maps only onto WCAG 4.1.1, which WCAG 2.2 REMOVED, so
+    // `derivePackResults` classed it out of scope and left it « à évaluer » on every page of
+    // every run — the one criterion of the 106 that no measurement could ever close and only a
+    // model could. Measured on a real RGAA deliverable: a grid that sat at 105/106.
+    //
+    // Its subject is not an element, which is why no element rule could express it: the
+    // doctype is not part of `documentElement.outerHTML`. The collector records it beside the
+    // DOM (SnapshotMeta.doctype), and this DOCUMENT-level rule reads it there.
+    //
+    // WHAT IT DECIDES, AND WHAT IT DOES NOT. Test 8.1.1 (is a doctype present?) is the whole
+    // of it. 8.1.2 (is it valid?) and 8.1.3 (is it before <html>?) are not tested separately
+    // and deliberately so: a doctype the browser PARSED — which is the only kind that reaches
+    // `document.doctype` — is by construction well-formed and positioned ahead of the root
+    // element; one written after <html>, or malformed, is ignored by the parser and arrives
+    // here as the recorded empty string, i.e. as the absence this rule reports. Inventing a
+    // separate "invalid" verdict would mean guessing at legacy but legitimate declarations,
+    // and manufacturing a non-conformity is the one thing this tier must not do.
+    //
+    // NORMATIVE, and signal-gated: it fires only where a capture recorded the field, so a
+    // source file and a pre-field capture are both silence rather than a failure.
+    {
+      id: "doctype-missing",
+      criterion: "8.1",
+      wcag: ["4.1.1"],
+      severity: "majeur",
+      doc: { signal: "doctype", op: "absent" },
+      message: {
+        en: "The captured page declares no document type — the browser parsed no <!DOCTYPE> ahead of <html> (RGAA test 8.1.1).",
+        fr: "La page capturée ne déclare aucun type de document — le navigateur n’a analysé aucun <!DOCTYPE> avant <html> (test RGAA 8.1.1).",
+      },
+      remediation: {
+        en: "Emit <!DOCTYPE html> as the first line of the document, before <html>. A doctype placed after <html>, or malformed, is ignored by the parser and counts as absent.",
+        fr: "Émettez <!DOCTYPE html> en première ligne du document, avant <html>. Un doctype placé après <html>, ou malformé, est ignoré par l’analyseur et compte comme absent.",
+      },
+    },
   ];
   // Wire each rule's namespaced id (`pack:rgaa:<id>`) into the criterion it reports under,
   // so derivePackResults routes its finding onto that criterion through the same
@@ -387,6 +426,28 @@ async function main() {
     c.appliesTo = { ruleIds: [...new Set([...c.appliesTo.ruleIds, `pack:rgaa:${rule.id}`])].sort() };
   }
 
+  // ---- RGAA 10.1 — the engine's presentational-markup rules, and their normativity ----
+  //
+  // 10.1's three tests are « these must be absent », over lists the RGAA closes itself: the
+  // glossary entry « Présentation de l'information » names the forbidden elements and
+  // attributes. The engine ships the instruments (src/rules/presentation.ts); the pack says
+  // they decide THIS criterion, and re-normativizes them.
+  //
+  // They ship ADVISORY because `<center>` is obsolete HTML rather than a WCAG failure —
+  // nothing about it breaks assistive technology, and reporting a WCAG 1.3.1 non-conformity
+  // for it would be wrong. Under the RGAA it is a plain failure of test 10.1.1, so the pack
+  // flips it here. This is what `overrides` is for, and it is the first use of it.
+  //
+  // Before this, 10.1 had NO instrument and inherited `readingOrder` through WCAG 1.3.2 — a
+  // subject that answers a different question — so it reached the adjudicator with an empty
+  // harvest. Measured on run 32508717451 (Sonnet, RGAA, 3 passes): the model ruled `C` three
+  // times, the gate refused all three for citing nothing, and 10.1 was the ONE criterion of
+  // the 106 left « à évaluer », on the run and on every page.
+  const presentational = criteria.find((x) => x.id === "10.1");
+  if (!presentational) throw new Error("build-pack-rgaa: RGAA 10.1 is missing from the referential");
+  presentational.appliesTo = { ruleIds: [...new Set([...presentational.appliesTo.ruleIds, ...PRESENTATIONAL_RULE_IDS])].sort() };
+  const overrides = Object.fromEntries(PRESENTATIONAL_RULE_IDS.map((id) => [id, { advisory: false, severity: "majeur" }]));
+
   const pack = {
     key: "rgaa",
     name: "RGAA",
@@ -469,6 +530,7 @@ async function main() {
       },
     ],
     rules,
+    overrides,
     themes,
     criteria,
   };