Specify a permissioned accessibility authoring tool and deterministic a11y_check engine

[mattheliu]

Outcome

Help every DSH user produce more accessible digital content while preventing automated output from being mistaken for certification.

Design requirements

• Separate deterministic checks from model interpretation and remediation suggestions.
• Require explicit, least-privilege access to files, pages, screenshots, or running applications.
• Report standards mapping, exact engine versions, reproducible evidence, uncertainty, and checks that require human or AT review.
• Never silently rewrite user content or upload private project material.
• Support extensible rules for web first, with document and mobile boundaries designed explicitly.

Acceptance evidence

• Public RFC includes permissions, data flow, threat model, result schema, severity model, extension API, and rollback.
• At least one accessible sample project demonstrates detection, explanation, suggested repair, and verification.
• Results distinguish automated review, AT testing, and disabled-user validation.
• Disabled developers review the workflow before any stable release claim.

[mattheliu]

Implemented the first experimental authoring slice in #17 (commit 8af05c6):

• opt-in a11y_check, disabled by default;
• explicit canonical roots plus default one-time approval, failing closed when approval is unavailable;
• read-only/offline static UTF-8 HTML input with byte and finding caps;
• exact html-validate@11.4.0 and versioned web-static-1 rule inventory;
• enforced report schema 1.0.0 with source SHA-256/byte length, exact engine/config identities, standards mapping, uncertainty, limitations, human-review requirements, and separate automated/AT/disabled-user evidence fields;
• trusted installed Host engine extension seam; no project/model-selected provider loading;
• bilingual RFC/threat model and synthetic detect–explain–user-approved-repair–verify sample.

Verification at the pushed commit:

• full suite: 7 files / 18 tests pass;
• typecheck and Host/client build pass on local Node 24.3.0;
• Host typecheck and all 9 authoring tests pass on Node 22.19.0;
• production dependency audit reports no known vulnerabilities;
• package dry run contains 40 expected files (60.5 kB) including the RFC/sample and no tests;
• cross-platform GitHub CI is running on Linux, macOS, and Windows with Node 22.19.0 and 24.x.

This remains experimental automated evidence only. The issue stays open for public/privacy review, a disabled-developer workflow round, named real AT testing, and any resulting permission/schema changes. No npm release, stable tag, or “fully accessible” claim is part of this update.

[mattheliu]

Cross-platform evidence has completed successfully: all six Linux/macOS/Windows × Node 22.19.0/24.x jobs and the required aggregate gate passed for #17.

CI: https://github.com/omdsh-dev/dsh-accessibility/actions/runs/33266868782

The remaining gate is qualitative and external, not another automated test: public/privacy review, a disabled-developer end-to-end authoring workflow round, and named real assistive-technology evidence. The issue therefore remains open and no npm/stable release is being claimed.