WCAG 2.2 AA Automated Scan (s56-audit)¶

Companion to wcag-audit-2026-04.md (the original static-source audit) and wcag-remediation-log.md (s52-s54 closure passes). This document is the first real automated tool pass against the built site, performed s56-audit (2026-04-24).

It deliberately overlaps with the audited surface so that prior closures can be confirmed (or caught regressing) and so that the unaudited surface (tools/temporal-knowledge-graph.html, tools/cross-system-link-matrix.html, tools/content-versioning.html, tools/skill-tree-viz.html, microsims/sim01-alert-triage.html) gets its first automated look.

Scope and method¶

Tools.

Pages scanned (12).

Procedure. Built site served from python -m http.server 8765 --directory site. Each page scanned with both tools, JSON saved to .cache/wcag-scan/ (gitignored). Aggregator script at .cache/wcag-scan/aggregate.py.

Tool sanity check. Before the real run, both tools were validated against a synthetic known-bad page (missing alt, missing <label>, no lang, low-contrast text). pa11y flagged 6 issues including all four expected categories; axe flagged 1 (color-contrast). axe is stricter about WCAG-only rule scope and does not flag everything pa11y catches — both are kept in the run for that reason.

Per-page summary¶

Grand total raw findings: 130. Note the asymmetry — pa11y catches form-label gaps that axe explicitly excludes from wcag2aa tags; axe catches target-size (WCAG 2.5.8) and per-instance contrast that pa11y under-reports. Together they cover more than either alone.

Top 11 deduplicated unique findings (all rules surfaced)¶

NEW vs KNOWN vs REGRESSION breakdown¶

Specific regressions worth fixing first:

• R1. did-web date inputs #iss-from / #iss-until — s53 said "label-input association gaps closed", these two were missed. ✅ CLOSED s56-audit (added for= attributes; rescan confirms zero F68/H91 errors on these IDs)
• R2. did-web textareas #ver-input / #vp-paste — same root cause as R1. ✅ CLOSED s56-audit (same fix)
• R3. incident-cost .icc-info button text at 4.44:1 — s53 introduced these buttons but didn't measure post-conversion contrast. ✅ CLOSED s56-audit (color #8892b0 → #b8c2d4 on #2a2a4a = 6.72:1, safely AAA)
• R4. incident-cost #icc-incident-type / #icc-regions / #icc-revenue — selects/number-input missing labels. ✅ CLOSED s56-audit (added for= to those 3 plus #icc-industry and #icc-detection which the post-fix rescan revealed had the same gap)
• R5. skill-portfolio .verify-pill "Locked" badge — 14 instances below contrast threshold. ✅ CLOSED s56-audit (color #8892b0 → #cbd5e0 on #1e3a5f = 6.93:1, safely AAA)

All five regressions closed in the same s56-audit pass. The fix work also exposed two additional unlabeled fields beyond the R-list (#icc-industry, #icc-detection in incident-cost; #vp-holder in did-web-vc-demo) — those were also fixed. Final post-fix rescan via pa11y on the 3 fixed pages: 0 F68 / H91 / G18 errors.

Honest scope disclosure¶

Automated tools catch ~30-40% of WCAG 2.2 AA issues. The remaining 60-70% require human evaluation. Specifically these classes are not detected by pa11y or axe and are therefore not flagged by this scan:

• Reading order (1.3.2) — DOM order vs visual order divergence
• Label clarity (3.3.2) — "click here" vs descriptive text
• Focus-trap behavior in modals (2.4.3, 2.4.11) — automated tools can't navigate
• Cognitive accessibility (3.1.5, 3.2.4 — readability, consistent identification)
• Screen-reader announcement quality — what NVDA/JAWS/VoiceOver actually says aloud
• Live-region timing (4.1.3) — does the AT actually pick up the update at the right moment
• Color-only meaning (1.4.1) — both tools see contrast but not "is color the only signal"
• Form-error recovery (3.3.3, 3.3.4) — the test would need to submit with bad data

These remain the scope of the manual third-party AT test (verification-debt-status.md item 10).

Cross-reference to remediation log¶

Prior closures verified holding (axe / pa11y silent on these surfaces in this scan):

• s52 keyboard-trap fix on pattern-hunter.example-pill (not in scan scope, but the fix pattern is verified by absence of role/keyboard violations on skill-mastery-map which got the same treatment — though skill-mastery-map itself is not in this scan).
• s52 tab ARIA refactor across 6 audited tools — no ARIA-tab violations in did-web / incident-cost.
• s53 color-contrast on gradient buttons — no axe color-contrast violations on did-web / incident-cost for the buttons that were re-styled (the new contrast violations are on different elements: .icc-info, .verify-pill).
• s54 prefers-reduced-motion — no automated rule for this in either tool, so neither confirmed nor refuted.
• s54 sr-only utility class — present in DOM, not measured.
• s54 JSON-LD URI announcements — not measured (pa11y/axe don't probe live-region announcements).

Recommended next session actions¶

1. Close the 5 regressions (R1-R5 above) — small CSS / aria-label additions, ~30 min total.
2. Sweep label associations on the 5 unaudited tools (temporal-graph, xsys-link, content-vers, skill-tree, digital-twin) — promotes them to "audited / closed" status. ~1 hour.
3. Microsim audit pass kickoff — sim01 produced 16 raw findings (8 pa11y + 8 axe). Extrapolate to 47 microsims = ~750 raw findings, but most are likely the same 4-5 rules repeating. Start with a single per-microsim systemic pass.
4. Wire pa11y + axe-core into CI — once GitHub Actions billing/quota clears (see CLAUDE.md). The script .cache/wcag-scan/run-scans.sh is the prototype; it just needs the chromedriver-path argument and a JSON-aggregation step in a workflow.
5. Manual third-party AT test still required for the human-only WCAG verification claim (verification-debt-status.md item 10).

Reproducing this scan¶

# Build the site (if not already)
python -m mkdocs build --strict

# Serve
python -m http.server 8765 --directory site &

# Install ChromeDriver matching local Chrome version
npx browser-driver-manager install chrome@$(node -e "console.log(require('child_process').execSync('chrome --version').toString())")

# Run scans (writes to .cache/wcag-scan/)
bash .cache/wcag-scan/run-scans.sh

# Aggregate
python .cache/wcag-scan/aggregate.py

Raw outputs (gitignored): .cache/wcag-scan/pa11y-*.json, .cache/wcag-scan/axe-*.json, .cache/wcag-scan/aggregated.json.

References¶

• pa11y: https://github.com/pa11y/pa11y
• axe-core: https://github.com/dequelabs/axe-core
• WCAG 2.2 spec: https://www.w3.org/TR/WCAG22/
• Companion documents: wcag-audit-2026-04.md - wcag-remediation-log.md - verification-debt-status.md