ultra11y 5.23.0 → 5.25.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.23.0",
+      "version": "5.25.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.23.0",
+  "version": "5.25.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.23.0",
+  "version": "5.25.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.23.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.25.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -25,7 +25,7 @@ Full details, thresholds and off-switches under [Install](#install).</sub>
 
 > Audit HTML/CSS/JSX against **WCAG 2.2 AA** accessibility and produce a dated compliance report — or author/review accessible markup without regressions. A [skills.sh](https://skills.sh) agent skill: a deterministic, zero-dependency static engine **plus** the agent's judgment, with `check`/`verify` gates against hallucinated non-conformities. **The central deliverable is the auditor conformance block** — theme, criterion + official wording, test(s), WCAG mapping + level, finding, expected state, verification, `file:line` occurrences — rendered identically by the `report` (compliance doc), the `prd` backlog and the GitHub issues, in the active standard's vocabulary and **in your language** (`--lang auto` follows the conversation/repo). **WCAG is the worldwide core; country standards (RGAA, …) are pluggable in-repo packs.**
 
-ultra11y is built around an honest **division of labour**. Automated tools only catch a fraction of accessibility problems, so the engine does the *mechanical* work — 78 machine-detectable static checks tied to the WCAG 2.2 success criteria — and is explicit about everything it can't decide statically. What it can't, the **AI agent adjudicates** (statically, from the evidence, gated by `verify`/`check`) — not a deferral to a human:
+ultra11y is built around an honest **division of labour**. Automated tools only catch a fraction of accessibility problems, so the engine does the *mechanical* work — 81 machine-detectable static checks tied to the WCAG 2.2 success criteria — and is explicit about everything it can't decide statically. What it can't, the **AI agent adjudicates** (statically, from the evidence, gated by `verify`/`check`) — not a deferral to a human:
 
 - **Automatable (engine):** missing `alt`/`lang`/`title`, unlabeled fields, empty links/buttons, icon-only controls, iframes without title, tables without headers, heading-level skips, empty/dangling headings & labels, duplicate ids, invalid/broken ARIA, positive `tabindex`, autoplay/timed-refresh/`blink`/`marquee` media…
 - **Agent judgment (gated):** alt-text relevance, link purpose in context, reading/tab order, caption accuracy — the agent rules on these via `verify --manual` → `--apply`, each verdict carrying a justification (or a groundable NC), never a silent "conforming".
@@ -226,7 +226,7 @@ from auditing out of memory. `cwd` is optional on all five; it selects whose pac
 `ultra11y_method` is the one to call first. It partitions the standard into evidence tiers —
 `source`, `cross-file`, `rendered-page`, `browser`, `judgment`, `out-of-scope` — from the
 engine's own per-criterion rule applicability, never from guessing at the wording of a test.
-For RGAA it reports that **58 of 106 criteria declare that no engine rule can evidence them**.
+For RGAA it reports that **56 of 106 criteria declare that no engine rule can evidence them**.
 That is the standard saying they are yours, and a plan that hides it reads as coverage that
 does not exist.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.23.0",
+  "version": "5.25.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/build-pack-rgaa.mjs

@@ -6,7 +6,8 @@
 // of its criteria onto WCAG success criteria (bare SC ids). The WCAG↔rule coverage
 // lives in the core (scripts/build-standards.mjs). The RGAA content is Licence
 // Ouverte / Etalab 2.0 — see NOTICE. The official source is vendored under
-// scripts/vendor/rgaa/ so the build is reproducible offline.
+// scripts/vendor/rgaa/ (criteres.json, glossaire.json, methodologies.json) so the
+// build is reproducible offline.
 //   node scripts/build-pack-rgaa.mjs            # build from the vendored source
 //   node scripts/build-pack-rgaa.mjs --offline  # alias (the source is always local)
 //   node scripts/build-pack-rgaa.mjs --fetch     # refresh the vendored source from DINUM, then build
@@ -76,6 +77,22 @@ const flattenNode = (v) => {
 };
 const toArr = (v) => flattenNode(v);
 
+// The official méthodologie de test for one criterion, keyed by the criterion's OWN test
+// numbers so it renders directly under the test it explains: `{ "1": "1. Retrouver…", … }`.
+// DINUM's file is flat and keyed by full test id ("11.2.1"), so this is the re-key.
+//
+// Returns undefined when the criterion has none, and the field is then absent from the pack
+// rather than present-and-empty: `methodology` is optional on PackCriterion, and an empty
+// object would make every consumer test for two shapes instead of one.
+function methodologyOf(methodologies, id, tests) {
+  const out = {};
+  for (const k of Object.keys(tests || {})) {
+    const text = methodologies[`${id}.${k}`];
+    if (typeof text === "string" && text.trim()) out[k] = text.trim();
+  }
+  return Object.keys(out).length ? { methodology: out } : undefined;
+}
+
 // crude HTML -> plaintext for glossary bodies
 const deHtml = (s) =>
   s
@@ -245,6 +262,12 @@ const RULE_TO_CRITERIA = {
 async function main() {
   const criteres = await source("criteres.json");
   const glossaire = await source("glossaire.json");
+  // THE OFFICIAL TEST METHODOLOGY — the third file DINUM publishes beside the other two,
+  // keyed by TEST id ("11.2.1"), and the one thing an adjudicator was never given. The
+  // criterion's wording says WHAT is required; this says HOW it is tested, step by step, in
+  // the referential's own words. Vendored like the rest so it reaches CI, an offline run and
+  // a model prompt without a network call — see `methodology` in src/standards/types.ts.
+  const methodologies = await source("methodologies.json");
 
   const glossary = {};
   for (const e of glossaire.glossary) glossary[slug(e.title)] = { title: e.title, body: deHtml(e.body) };
@@ -267,6 +290,7 @@ async function main() {
         title: { fr: criterium.title },
         titlePlain: { fr: plain(criterium.title) },
         tests: criterium.tests || {},
+        ...(methodologyOf(methodologies, id, criterium.tests) ?? {}),
         techniques: [...techniques],
         ...(criterium.technicalNote ? { technicalNote: toArr(criterium.technicalNote) } : {}),
         ...(criterium.particularCases ? { particularCases: toArr(criterium.particularCases) } : {}),
@@ -310,7 +334,10 @@ async function main() {
   // (link explicitness, WCAG 2.4.4). ADVISORY: it surfaces as a recommendation in the RGAA
   // projection and NEVER makes 6.1 non-conformant. This proves a pack ships its OWN
   // detection without forking the engine (see skills/ultra11y/references/packs.md).
-  const DOWNLOAD_EXT = "pdf|docx?|pptx?|xlsx?|odt|ods|odp|rtf|csv|zip|rar|7z|gz|epub|mp3|mp4|avi|mov";
+  // Kept in step with the engine instead of retyped: two hand-maintained copies of a rule-id
+// list are two chances for the pack to claim an instrument the engine does not ship.
+const PRESENTATIONAL_RULE_IDS = ["presentational-element", "presentational-attribute", "presentational-spacing"];
+const DOWNLOAD_EXT = "pdf|docx?|pptx?|xlsx?|odt|ods|odp|rtf|csv|zip|rar|7z|gz|epub|mp3|mp4|avi|mov";
   const rules = [
     {
       id: "download-link-format",
@@ -423,6 +450,28 @@ async function main() {
     c.appliesTo = { ruleIds: [...new Set([...c.appliesTo.ruleIds, `pack:rgaa:${rule.id}`])].sort() };
   }
 
+  // ---- RGAA 10.1 — the engine's presentational-markup rules, and their normativity ----
+  //
+  // 10.1's three tests are « these must be absent », over lists the RGAA closes itself: the
+  // glossary entry « Présentation de l'information » names the forbidden elements and
+  // attributes. The engine ships the instruments (src/rules/presentation.ts); the pack says
+  // they decide THIS criterion, and re-normativizes them.
+  //
+  // They ship ADVISORY because `<center>` is obsolete HTML rather than a WCAG failure —
+  // nothing about it breaks assistive technology, and reporting a WCAG 1.3.1 non-conformity
+  // for it would be wrong. Under the RGAA it is a plain failure of test 10.1.1, so the pack
+  // flips it here. This is what `overrides` is for, and it is the first use of it.
+  //
+  // Before this, 10.1 had NO instrument and inherited `readingOrder` through WCAG 1.3.2 — a
+  // subject that answers a different question — so it reached the adjudicator with an empty
+  // harvest. Measured on run 32508717451 (Sonnet, RGAA, 3 passes): the model ruled `C` three
+  // times, the gate refused all three for citing nothing, and 10.1 was the ONE criterion of
+  // the 106 left « à évaluer », on the run and on every page.
+  const presentational = criteria.find((x) => x.id === "10.1");
+  if (!presentational) throw new Error("build-pack-rgaa: RGAA 10.1 is missing from the referential");
+  presentational.appliesTo = { ruleIds: [...new Set([...presentational.appliesTo.ruleIds, ...PRESENTATIONAL_RULE_IDS])].sort() };
+  const overrides = Object.fromEntries(PRESENTATIONAL_RULE_IDS.map((id) => [id, { advisory: false, severity: "majeur" }]));
+
   const pack = {
     key: "rgaa",
     name: "RGAA",
@@ -437,6 +486,9 @@ async function main() {
     source: "https://github.com/DISIC/accessibilite.numerique.gouv.fr",
     attribution: "RGAA 4.1.2 © DINUM (Direction interministérielle du numérique) — Licence Ouverte / Etalab 2.0",
     idPattern: "^\\d+\\.\\d+$",
+    // Where DINUM publishes each criterion. Cited by the adjudication brief so a reader can
+    // reach the normative page — the vendored text above stays the authority either way.
+    criterionUrl: "https://accessibilite.numerique.gouv.fr/methode/criteres-et-tests/#{id}",
     // Auditor-display vocabulary (FR): the nouns an RGAA auditor reads. Rendered by the
     // `prd` auditor block + GitHub issues; see src/standards/vocabulary.ts.
     vocabulary: {
@@ -505,6 +557,7 @@ async function main() {
       },
     ],
     rules,
+    overrides,
     themes,
     criteria,
   };
@@ -546,9 +599,22 @@ async function main() {
     throw new Error(`build-pack-rgaa: ${stringified.length} normative text(s) stringified to "[object Object]" — extend flattenNode: ${stringified.join(", ")}`);
   }
 
+  // THE METHODOLOGY TABLE MUST NOT GO STALE EITHER. A methodology whose test id does not
+  // exist in the referential is a curation mistake upstream OR a re-key bug here, and it
+  // would ship as dead weight in every bundle. A test with no methodology is legitimate
+  // (DINUM does not document every one), so that is counted, not refused.
+  const testIds = new Set();
+  for (const c of criteria) for (const k of Object.keys(c.tests ?? {})) testIds.add(`${c.id}.${k}`);
+  const orphans = Object.keys(methodologies).filter((k) => !testIds.has(k));
+  if (orphans.length) {
+    throw new Error(`build-pack-rgaa: ${orphans.length} methodology(ies) name a test the referential does not have: ${orphans.join(", ")}`);
+  }
+  const documented = criteria.reduce((n, c) => n + Object.keys(c.methodology ?? {}).length, 0);
+
   const noWcag = criteria.filter((c) => c.wcag.length === 0).map((c) => c.id);
   console.log(`build-pack-rgaa: ${themes.length} themes, ${criteria.length} criteria → src/data/standards/rgaa.json`);
   console.log(`build-pack-rgaa: glossary ${Object.keys(glossary).length} entries → src/data/standards/rgaa.glossary.json`);
+  console.log(`build-pack-rgaa: official test methodology on ${documented}/${testIds.size} tests`);
   console.log(`build-pack-rgaa: criteria with no WCAG mapping (pack-local): ${noWcag.length ? noWcag.join(", ") : "none"} (${noWcag.length})`);
 }