ultra11y 5.37.0 → 5.38.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "ultra11y",
       "source": "./",
       "description": "Automatic accessibility review of the code under change before every commit, push and pull request, plus full WCAG 2.2 AA / RGAA audits and conformance deliverables on demand.",
-      "version": "5.37.0",
+      "version": "5.38.0",
       "author": { "name": "maxgfr" },
       "homepage": "https://github.com/maxgfr/ultra11y",
       "repository": "https://github.com/maxgfr/ultra11y",

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.37.0",
+  "version": "5.38.0",
   "author": { "name": "maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "ultra11y",
   "description": "Accessibility for WCAG 2.2 AA and country standards (RGAA…): an automatic review of the code under change before every commit, push and pull request, plus full audits and conformance deliverables on demand.",
-  "version": "5.37.0",
+  "version": "5.38.0",
   "author": { "name": "maxgfr", "url": "https://github.com/maxgfr" },
   "homepage": "https://github.com/maxgfr/ultra11y",
   "repository": "https://github.com/maxgfr/ultra11y",

package/.opencode/plugins/ultra11y.js

@@ -27,7 +27,7 @@ import { fileURLToPath } from "node:url";
 // Ownership marker: `ultra11y install --opencode` refuses to overwrite a plugin file that
 // does not carry it, so a user's own ultra11y.js is never clobbered.
 const ULTRA11Y_OPENCODE_PLUGIN = "ULTRA11Y_OPENCODE_PLUGIN";
-const ULTRA11Y_PLUGIN_VERSION = "5.37.0";
+const ULTRA11Y_PLUGIN_VERSION = "5.38.0";
 
 const here = dirname(fileURLToPath(import.meta.url));
 

package/README.md

@@ -25,7 +25,7 @@ Full details, thresholds and off-switches under [Install](#install).</sub>
 
 > Audit HTML/CSS/JSX against **WCAG 2.2 AA** accessibility and produce a dated compliance report — or author/review accessible markup without regressions. A [skills.sh](https://skills.sh) agent skill: a deterministic, zero-dependency static engine **plus** the agent's judgment, with `check`/`verify` gates against hallucinated non-conformities. **The central deliverable is the auditor conformance block** — theme, criterion + official wording, test(s), WCAG mapping + level, finding, expected state, verification, `file:line` occurrences — rendered identically by the `report` (compliance doc), the `prd` backlog and the GitHub issues, in the active standard's vocabulary and **in your language** (`--lang auto` follows the conversation/repo). **WCAG is the worldwide core; country standards (RGAA, …) are pluggable in-repo packs.**
 
-ultra11y is built around an honest **division of labour**. Automated tools only catch a fraction of accessibility problems, so the engine does the *mechanical* work — 81 machine-detectable static checks tied to the WCAG 2.2 success criteria — and is explicit about everything it can't decide statically. What it can't, the **AI agent adjudicates** (statically, from the evidence, gated by `verify`/`check`) — not a deferral to a human:
+ultra11y is built around an honest **division of labour**. Automated tools only catch a fraction of accessibility problems, so the engine does the *mechanical* work — 91 machine-detectable static checks tied to the WCAG 2.2 success criteria — and is explicit about everything it can't decide statically. What it can't, the **AI agent adjudicates** (statically, from the evidence, gated by `verify`/`check`) — not a deferral to a human:
 
 - **Automatable (engine):** missing `alt`/`lang`/`title`, unlabeled fields, empty links/buttons, icon-only controls, iframes without title, tables without headers, heading-level skips, empty/dangling headings & labels, duplicate ids, invalid/broken ARIA, positive `tabindex`, autoplay/timed-refresh/`blink`/`marquee` media…
 - **Agent judgment (gated):** alt-text relevance, link purpose in context, reading/tab order, caption accuracy — the agent rules on these via `verify --manual` → `--apply`, each verdict carrying a justification (or a groundable NC), never a silent "conforming".
@@ -41,11 +41,11 @@ A self-authored fixture can only prove that a rule fires on the defect written f
 
 | | |
 |---|---|
-| Rules scored | **32** (the ACT rules an equivalent engine check exists for) |
-| `failed` examples caught | **103 / 149** |
-| `passed` / `inapplicable` examples left alone | **291 / 291** — no unexplained false positive |
+| Rules scored | **40** (the ACT rules an equivalent engine check exists for) |
+| `failed` examples caught | **125 / 176** |
+| `passed` / `inapplicable` examples left alone | **364 / 364** — no unexplained false positive |
 | Deliberate divergences | 9, each argued on the record |
-| Declared gaps (statically decidable, not implemented) | 13 |
+| Declared gaps (statically decidable, not implemented) | 5 |
 
 Rules needing a rendered page (computed contrast, keyboard traps) or a human call (is this heading descriptive?) are **declared and routed**, not silently scored zero. The full per-rule matrix — including every gap and every divergence — is generated into [`skills/ultra11y/references/act.md`](skills/ultra11y/references/act.md) and re-checked on every build; the corpus itself is refreshed daily by a workflow, so the numbers cannot quietly go stale.
 
@@ -314,6 +314,42 @@ where a reader goes looking for it.
 others are welcome — adding a country is a single PR (pack JSON + one registration line +
 a test). See [`CONTRIBUTING.md`](CONTRIBUTING.md) and `skills/ultra11y/references/standards.md`.
 
+### What RGAA automation actually covers
+
+The engine's 91 rules are not 91 RGAA criteria: several rules can evidence the same official
+test, and a rule can detect a useful symptom without exhausting the criterion's alternatives,
+exceptions or relevance checks. The generated contract classifies all **258 official RGAA
+tests**:
+
+- **26 `static` tests across 19 criteria:** `1.1`, `2.1`, `5.7`, `5.8`, `6.2`, `7.1`,
+  `8.2`, `8.3`, `8.4`, `8.5`, `8.10`, `9.3`, `10.1`, `10.12`, `11.1`, `11.5`,
+  `11.6`, `11.8`, `11.9`.
+- **3 `rendered` tests across 3 criteria:** `1.1`, `8.1`, `10.7`.
+- Those two tiers cover **21 distinct criteria that can produce a deterministic `NC`**;
+  `1.1` belongs to both.
+- **49 criteria receive a normative engine signal:** 21 have at least one decisive rule and
+  41 receive candidate evidence, with overlap. One additional criterion receives only an
+  advisory signal. A candidate is forwarded to adjudication and never changes a verdict by
+  itself.
+- Only **8.5 and 10.1** may earn `C` from a complete silent measurement. For the other
+  mechanically detectable tests, silence can mean “no subject found” or “an alternative or
+  exception still needs judging”, so it cannot prove conformity.
+- The remaining **229 `judgment` tests across 92 criteria** all enter the AI worklist,
+  including an apparently absent subject whose `NA` still needs confirmation. Overall,
+  **104 of 106 criteria require adjudication to earn `C`**.
+
+The number can grow, but the useful target is **more observed, exact failures**, not a larger
+marketing count. The best next candidates are complete rendered probes for zoom/reflow and
+hover content (10.4, 10.11, 10.13), and contrast,
+link distinction or orientation checks (3.2, 3.3, 10.6, 13.9) that first rule out every
+official alternative and particular case. The 5 declared ACT gaps are another implementation
+queue, although adding one does not necessarily cover a new RGAA criterion. A candidate is
+promoted only when a narrower rule demonstrably exhausts its cited official test; the two
+`C`-by-silence criteria stay unchanged until an equally complete proof exists.
+
+The generated [106-criterion / 258-test matrix](skills/ultra11y/references/rgaa-automation.md)
+is the source of truth; CI rebuilds it from the vendored DINUM data and rejects drift.
+
 ### Scale, fixes, and repo automation
 
 - **Scale** — the engine streams file-by-file (bounded memory), audits **only markup**,
@@ -372,8 +408,8 @@ a test). See [`CONTRIBUTING.md`](CONTRIBUTING.md) and `skills/ultra11y/reference
   Each can say *"I don't know"*: an unresolvable backdrop, a varied region, a cross-origin
   stylesheet, a `box-shadow` that might be the boundary — all leave the criterion undecided
   rather than guessed, and without signals the rules do not fire, so no pre-existing verdict
-  changes. `tests/rgaa-coverage.test.ts` ratchets the result: **51 of 106** RGAA criteria now
-  map onto an engine rule, up from 43, and the number can only go up.
+  changes. `tests/rgaa-coverage.test.ts` pins a floor of **50 of 106** RGAA criteria mapped
+  onto an engine rule, up from 43 before this tier; silently losing one fails CI.
 - **Every scanned page is a snapshot** — `scan` no longer keeps only findings: each page it
   visits is persisted to `.ultra11y/pages/<id>/` (`--no-snapshot` opts out). That is what turns
   a URL into a real per-page verdict — a page known only by its URL can never be conforming by

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ultra11y",
-  "version": "5.37.0",
+  "version": "5.38.0",
   "description": "Audit HTML/CSS/JSX against WCAG 2.2 AA and produce a dated compliance report, or author/review accessible markup (native-HTML-first). A skills.sh agent skill: an install-free static engine (bundled, no npm install) plus the agent's judgment, with check/verify gates against hallucinated non-conformities, and pluggable in-repo standards packs (RGAA France first; Section 508 & EN 301 549 next).",
   "type": "module",
   "packageManager": "pnpm@10.33.0",

package/scripts/build-pack-rgaa.mjs

@@ -130,6 +130,10 @@ const RULE_SC = {
   "clickable-noninteractive": ["4.1.2", "2.1.1"], "contrast-literal": ["1.4.3"], "control-label-missing": ["4.1.2"],
   "rendered-contrast": ["1.4.3"], "rendered-contrast-pixel": ["1.4.3"], "rendered-link-colour-only": ["1.4.1"],
   "rendered-nontext-contrast": ["1.4.11"], "rendered-focus-not-visible": ["2.4.7"], "rendered-orientation-lock": ["1.3.4"],
+  "document-language-missing": ["3.1.1"], "html-lang-xml-lang-mismatch": ["3.1.1"], "duplicate-attribute": ["4.1.2"],
+  "presentational-children-focusable": ["4.1.2"], "decorative-marked-exposed": ["1.1.1", "4.1.2"], "menuitem-empty-name": ["4.1.2"],
+  "letter-spacing-important": ["1.4.12"], "word-spacing-important": ["1.4.12"], "line-height-important": ["1.4.12"],
+  "table-scope-invalid": ["1.3.1"],
   "css-generated-content-informative": ["1.3.1"], "date-fields-ungrouped": ["3.3.2"], "disabled-context-content": ["4.1.2"],
   "control-name-title-only": ["4.1.2"], "cross-icon-only-unnamed": ["4.1.2"],
   "cross-prop-drilled-name-lost": ["4.1.2"], "data-table-no-headers": ["1.3.1"],
@@ -180,6 +184,7 @@ const RULE_TO_CRITERIA = {
   "chart-no-accessible-name": ["1.1"], "canvas-fallback-missing": ["1.1"], "axe:image-alt": ["1.1"],
   "axe:input-image-alt": ["1.1"], "axe:area-alt": ["1.1"], "axe:role-img-alt": ["1.1"], "axe:svg-img-alt": ["1.1"],
   "axe:object-alt": ["1.1"], "decorative-alt-misuse": ["1.2"], "axe:image-redundant-alt": ["1.2"],
+  "decorative-marked-exposed": ["1.2"],
   // Theme 2 — frames (2.1 frame title)
   "iframe-title-missing": ["2.1"], "axe:frame-title": ["2.1"], "axe:frame-title-unique": ["2.1"],
   // Theme 3 — colour contrast. RGAA 10.5 asks about paired CSS declarations, not the
@@ -206,6 +211,7 @@ const RULE_TO_CRITERIA = {
   // Theme 5 — tables (5.4 title, 5.6/5.7 headers, 5.8 layout-table markup)
   "table-caption-missing": ["5.4"], "data-table-no-headers": ["5.6", "5.7"],
   "layout-table-data-markup": ["5.8"], "axe:td-headers-attr": ["5.7"], "axe:th-has-data-cells": ["5.6"],
+  "headers-attr-dangling": ["5.7"], "table-scope-invalid": ["5.7"], "th-no-data-cells": ["5.6"],
   "axe:scope-attr-valid": ["5.7"], "axe:td-has-header": ["5.6"], "axe:table-fake-caption": ["5.8"],
   // Theme 6 — links (6.2 link label)
   "link-empty-name": ["6.2"], "icon-only-control-unnamed": ["6.2", "11.9"], "cross-icon-only-unnamed": ["11.9"],
@@ -214,6 +220,7 @@ const RULE_TO_CRITERIA = {
   "invalid-aria-role": ["7.1"], "aria-ref-missing-id": ["7.1"], "aria-required-children": ["7.1"],
   "aria-hidden-focusable": ["7.1"], "redundant-aria": ["7.1"], "nested-interactive": ["7.1"],
   "cross-prop-drilled-name-lost": ["7.1"],
+  "presentational-children-focusable": ["7.1"], "menuitem-empty-name": ["7.1"],
   "clickable-noninteractive": ["7.3"], "live-region-conflict": ["7.5"], "status-message-not-assertive": ["7.5"],
   // Dynamic tier (scan --local): the live-region probe projects onto WCAG 4.1.3 → RGAA 7.5
   // (status messages) — the WCAG-faithful home. Ara ALSO classifies the source finding under
@@ -229,7 +236,9 @@ const RULE_TO_CRITERIA = {
   // Theme 8 — document (8.2 valid code, 8.3 default lang, 8.4 lang relevant, 8.5 title, 8.7/8.8 lang changes)
   "duplicate-id": ["8.2"], "axe:duplicate-id": ["8.2"], "axe:duplicate-id-aria": ["8.2"], "axe:duplicate-id-active": ["8.2"],
   "html-lang-missing": ["8.3"], "axe:html-has-lang": ["8.3"],
+  "document-language-missing": ["8.3"],
   "lang-invalid": ["8.4", "8.8"], "axe:html-lang-valid": ["8.4"], "axe:html-xml-lang-mismatch": ["8.4"], "axe:valid-lang": ["8.8"],
+  "html-lang-xml-lang-mismatch": ["8.4"], "duplicate-attribute": ["8.2"],
   "title-missing-empty": ["8.5"], "axe:document-title": ["8.5"], "inline-lang-change-missing": ["8.7"],
   // Theme 9 — structure (9.1 headings, 9.2 doc structure, 9.3 lists)
   "h1-missing": ["9.1"], "h1-multiple": ["9.1"], "heading-order-skip": ["9.1"], "empty-heading": ["9.1"],
@@ -241,6 +250,7 @@ const RULE_TO_CRITERIA = {
   "css-generated-content-informative": ["10.2"],
   "meta-viewport-zoom-block": ["10.4"], "axe:meta-viewport": ["10.4"], "axe:meta-viewport-large": ["10.4"],
   "dyn-reflow": ["10.11"], "dyn-reflow-zoom": ["10.4"], "dyn-focus-visible": ["10.7"], "dyn-text-spacing": ["10.12"], "dyn-hover": ["10.13"],
+  "letter-spacing-important": ["10.12"], "word-spacing-important": ["10.12"], "line-height-important": ["10.12"],
   // Stateful input-overflow probes — a filled input clipped under each stress, same RGAA
   // theme as the corresponding reflow/zoom/text-spacing residual probe above.
   "dyn-input-overflow-reflow": ["10.11"], "dyn-input-overflow-zoom": ["10.4"], "dyn-input-overflow-spacing": ["10.12"],
@@ -249,6 +259,7 @@ const RULE_TO_CRITERIA = {
   "form-field-multiple-labels": ["11.1"], "select-has-option": ["11.1"], "control-name-title-only": ["11.1"],
   "radio-checkbox-group-ungrouped": ["11.5"], "date-fields-ungrouped": ["11.5"],
   "field-purpose-incomplete": ["11.1", "11.13"], "fieldset-legend-missing": ["11.6"], "button-empty-name": ["11.9"],
+  "autocomplete-token-invalid": ["11.13"], "label-in-name-mismatch": ["11.9"],
   "error-not-associated": ["11.10"], "aria-invalid-no-description": ["11.10"],
   "axe:label": ["11.1"], "axe:form-field-multiple-labels": ["11.1"], "axe:select-name": ["11.1"], "axe:label-title-only": ["11.1"],
   "axe:autocomplete-valid": ["11.13"], "axe:fieldset": ["11.6"], "axe:input-button-name": ["11.9"], "axe:button-name": ["11.9"],
@@ -284,8 +295,11 @@ const DECISIVE_RULE_TESTS = {
   "8.2|axe:duplicate-id": ["1"],
   "8.2|axe:duplicate-id-aria": ["1"],
   "8.2|axe:duplicate-id-active": ["1"],
+  "8.2|duplicate-attribute": ["1"],
+  "8.3|document-language-missing": ["1"],
   "8.4|axe:html-lang-valid": ["1"],
   "8.4|lang-invalid": ["1"],
+  "8.4|html-lang-xml-lang-mismatch": ["1"],
   "8.5|title-missing-empty": ["1"],
   "8.5|axe:document-title": ["1"],
   "9.3|list-structure": ["1", "2", "3"],
@@ -294,6 +308,9 @@ const DECISIVE_RULE_TESTS = {
   "9.3|axe:definition-list": ["3"],
   "9.3|axe:dlitem": ["3"],
   "10.7|dyn-focus-visible": ["1"],
+  "10.12|letter-spacing-important": ["1"],
+  "10.12|word-spacing-important": ["1"],
+  "10.12|line-height-important": ["1"],
   "11.1|axe:label": ["1"],
   "11.1|axe:select-name": ["1"],
   "11.1|control-label-missing": ["1"],
@@ -302,6 +319,12 @@ const DECISIVE_RULE_TESTS = {
   "11.9|axe:button-name": ["1"],
   "11.9|axe:input-button-name": ["1"],
   "11.9|button-empty-name": ["1"],
+  "11.9|label-in-name-mismatch": ["2"],
+  "11.5|radio-checkbox-group-ungrouped": ["1"],
+  "5.7|headers-attr-dangling": ["4"],
+  "5.7|table-scope-invalid": ["2", "3"],
+  "5.8|layout-table-data-markup": ["1"],
+  "7.1|menuitem-empty-name": ["3"],
 };
 
 // Candidate evidence is test-scoped too. The fallback remains all tests only when one rule id
@@ -316,6 +339,7 @@ const CANDIDATE_RULE_TESTS = {
   "1.1|object-embed-no-name": ["6", "7"],
   "1.1|canvas-fallback-missing": ["8"],
   "1.1|chart-no-accessible-name": ["1", "5", "8"],
+  "1.2|decorative-marked-exposed": ["1", "2", "3", "4", "5", "6"],
   "4.3|axe:audio-caption": ["1"],
   "4.3|axe:video-caption": ["1"],
   "4.3|media-no-track": ["1"],
@@ -325,6 +349,7 @@ const CANDIDATE_RULE_TESTS = {
   "5.7|axe:scope-attr-valid": ["2", "3"],
   "5.7|axe:td-headers-attr": ["4"],
   "7.3|clickable-noninteractive": ["1"],
+  "7.1|presentational-children-focusable": ["1", "2"],
   "8.4|axe:html-xml-lang-mismatch": ["1"],
   "9.1|axe:empty-heading": ["2"],
   "9.1|empty-heading": ["2"],
@@ -348,6 +373,7 @@ const CANDIDATE_RULE_TESTS = {
   "11.1|placeholder-as-label": ["1", "3"],
   "11.1|field-purpose-incomplete": ["1", "3"],
   "11.1|select-has-option": ["1"],
+  "11.13|autocomplete-token-invalid": ["1"],
   "11.9|cross-icon-only-unnamed": ["1"],
   "11.9|icon-only-control-unnamed": ["1"],
   "11.10|aria-invalid-no-description": ["3", "4", "6", "7"],

package/scripts/build-standards.mjs

@@ -637,14 +637,14 @@ const NEEDS_RENDERING = new Set([
 // icon-only-control-unnamed) appear under BOTH their SCs so registry's bidirectional
 // rule↔dataset cross-check holds.
 const RULE_SC_COVERAGE = {
-  "1.1.1": ["img-alt-missing", "canvas-fallback-missing", "decorative-alt-misuse", "input-image-alt-missing", "object-embed-no-name", "chart-no-accessible-name"],
+  "1.1.1": ["img-alt-missing", "canvas-fallback-missing", "decorative-alt-misuse", "decorative-marked-exposed", "input-image-alt-missing", "object-embed-no-name", "chart-no-accessible-name"],
   "1.2.2": ["media-no-track"],
   "1.3.1": [
     "fieldset-legend-missing", "data-table-no-headers", "table-caption-missing",
     "layout-table-data-markup", "heading-order-skip", "h1-missing", "h1-multiple", "list-structure", "dl-structure",
     "empty-heading", "label-for-dangling", "missing-main-landmark", "multiple-main-landmark",
     "sortable-header-no-aria-sort", "nav-landmark-missing", "nav-landmark-unnamed", "aria-required-parent",
-    "headers-attr-dangling", "th-no-data-cells",
+    "headers-attr-dangling", "th-no-data-cells", "table-scope-invalid",
     "radio-checkbox-group-ungrouped", "table-empty-data-cell", "css-generated-content-informative",
     "presentational-element", "presentational-attribute", "presentational-spacing",
   ],
@@ -654,6 +654,7 @@ const RULE_SC_COVERAGE = {
   "1.4.1": ["rendered-link-colour-only"],
   "1.4.3": ["contrast-literal", "rendered-contrast", "rendered-contrast-pixel"],
   "1.4.11": ["rendered-nontext-contrast"],
+  "1.4.12": ["letter-spacing-important", "word-spacing-important", "line-height-important"],
   "1.4.4": ["meta-viewport-zoom-block"],
   "2.1.1": ["clickable-noninteractive"],
   "2.2.1": ["meta-refresh-redirect"],
@@ -666,16 +667,17 @@ const RULE_SC_COVERAGE = {
   "2.5.3": ["label-in-name-mismatch"],
   "3.2.2": ["on-input-context-change"],
   "3.3.8": ["credential-entry-blocked"],
-  "3.1.1": ["html-lang-missing", "lang-invalid"],
+  "3.1.1": ["html-lang-missing", "document-language-missing", "html-lang-xml-lang-mismatch", "lang-invalid"],
   "3.1.2": ["inline-lang-change-missing", "lang-invalid"],
   "3.3.1": ["aria-invalid-no-description", "error-not-associated"],
   "3.3.2": ["radio-checkbox-group-ungrouped", "date-fields-ungrouped"],
   "4.1.2": [
     "iframe-title-missing", "invalid-aria-role", "aria-ref-missing-id", "redundant-aria",
     "clickable-noninteractive", "aria-required-children", "aria-hidden-focusable", "nested-interactive", "invalid-aria-attr", "invalid-aria-value", "aria-required-attr", "aria-prohibited-attr",
-    "duplicate-id", "control-label-missing", "placeholder-as-label", "form-field-multiple-labels",
+    "duplicate-id", "duplicate-attribute", "control-label-missing", "placeholder-as-label", "form-field-multiple-labels",
     "select-has-option", "button-empty-name", "icon-only-control-unnamed", "control-name-title-only",
-    "field-purpose-incomplete", "disabled-context-content",
+    "field-purpose-incomplete", "disabled-context-content", "presentational-children-focusable",
+    "decorative-marked-exposed", "menuitem-empty-name",
   ],
   "4.1.3": ["live-region-conflict", "status-message-not-assertive"],
 };