Establish WCAG 2.2 AA patterns and verify every critical flow

Parent epics: #8, #11

PM disposition

GROOMED / P0 / OPEN. The shared automated pattern baseline is accepted and merged; one bounded source-side accessibility evidence-producer lane and the separately owned HUMAN matrix remain.

The old “blocked on #115” status is obsolete: #115 and #118 are closed. Do not rebuild the accepted
shared accessibility system. Issue #65 now has two explicit remaining obligations:

1. publish a deterministic, versioned, redacted accessibility producer contract that #76 can consume; and
2. complete the independent real keyboard/screen-reader/visual/manual evidence before #65 itself can
   close.

The source producer can be accepted and merged with Refs #65 while the HUMAN rows remain required,
pending, and no-go. Neither source automation nor #76 may turn a pending HUMAN row into a pass.

Normative authority

• 07 — Accessibility
• 10 — Verification strategy
• Development process
• the accepted deterministic local harness from #75
• the #76 verification-producer graph contract
• the current design-system and application-boundary specifications

WCAG 2.2 Level AA is a page-and-state claim. Axe, component tests, screenshots, a browser
accessibility tree, or a producer artifact alone never establishes conformance.

Accepted foundation — preserve, do not reimplement

Commit 58932b4
merged the independently tested automated/product slice using Refs #65. The recorded exact-SHA
deployment was green in run 31444623581.
That accepted slice provides:

• shared shell, skip link, navigation, focus, target, form/error, status, date/media, visually-hidden,
  responsive/reflow, reduced-motion, forced-colors, and transactional-email patterns;
• a code-owned critical-state registry and six executable scenario families;
• a local pinned axe-core Playwright harness, explicit non-axe assertions, synthetic SQLite fixtures,
  JavaScript-off public reads, desktop/mobile coverage, and an exact exception registry;
• current accessibility documentation and a deliberately blank manual-evidence template; and
• historical technical evidence for the exact merged candidate only.

The accepted record did not complete a real screen-reader/manual matrix and is not evergreen proof
that later routes or current main conform. Subsequent user-facing work must register and verify every
new or materially changed critical state under its owning issue.

Remaining source-side producer contract

Implement one bounded source-only accessibility evidence producer in this issue. It adapts the
accepted registry/harness; it does not redesign pages or duplicate #76/#77.

The producer must emit canonical JSON conforming to a versioned schema. From explicit bounded inputs
only, it records:

• full source SHA, producer/schema version, explicit evaluation time, test configuration and
  environment class;
• registry digest, exact state count and identifiers, scenario/group ownership, rendered versus
  route-contract classification, JavaScript requirements, viewport/mode matrix, and exact axe
  engine/tag/exception-registry identity;
• selected, executed, passed, failed, skipped, reused, and not-applicable counts for every required
  accessibility test family, with complete bounded diagnostics for all observed failures;
• desktop/mobile, JavaScript-on/off, 200%/320px reflow, text-spacing, reduced-motion, forced-colors,
  focus/target/overflow, form/error/status, image/media/date, email, and browser-accessibility-tree
  dispositions;
• graph-selected screenshot paths and SHA-256 values plus an independent-inspection disposition;
• the named local browser/engine/protocol as browser-engine evidence, explicitly distinct from a
  real screen reader;
• one schema-backed row for every required HUMAN procedure, including owner/role, OS/browser/assistive
  technology/version where performed, route/state, result, evidence digest, date, freshness and any
  approved bounded exception; and
• a derived automated verdict and an overall release-input verdict. Required pending/absent HUMAN
  evidence must keep the overall result no-go without making a source-only automated pass ambiguous.

Output must be byte-identical for identical source, explicit time, policy, registry, result, and
manual inputs regardless of filesystem or execution ordering. No implicit wall clock, mutable Git
ref, network lookup, or ambient environment value may affect canonical output.

Missing, partial, red, stale, duplicate, unowned, unknown-schema, wrong-source, checksum-mismatched,
uninspected, contaminated, or unexplained skipped evidence fails closed. Axe exceptions retain exact
rule, selector, state, reason, owner, approval reference, review/expiry date, and disposition; an
expired or incomplete exception fails. The producer and diagnostics must reject rather than echo
secret, token, credential, email/profile/registration value, provider payload, protected-source
locator, or reversible identity canaries.

The source lane performs no provider, production, protected-data, AWS, deployment, email, credential,
DNS, Search Console, or other external action. Synthetic HUMAN fixtures may prove schema and no-go
behavior but can never satisfy a real HUMAN row.

Current critical accessibility coverage

The registry must reconcile to all code-owned user-facing surfaces present at the exact candidate,
including:

• public/editorial hubs and representative detail, query/zero-result, graph, media, redirect, and 404
  states;
• account/authentication/settings plus invalid, unavailable, conflict, logout/revoked, and denial
  states;
• distinct Django admin and Studio access, credentials, audit, empty/filter/detail/error/denied
  states;
• historical-registration list/detail/mapping/validation/exclusion/source/stale/conflict/preview/
  rollback/empty/denied states;
• learner discovery, registration, dashboard/enrollment, curriculum/homework/project/review,
  score/leaderboard/complaint/certificate, long/empty/success/invalid/stale/denied states;
• canonical Studio Courses list/form/table/confirmation/error/denied and safe legacy redirects; and
• every active transactional-email definition, with exact current HTML/plain alternatives.

A template-root classification is not proof that every material route/state is registered. The
producer must fail when a code-owned shared surface is unclassified, a registered state disappears,
a scenario fails to report its exact states, or a later accepted product change leaves the registry
or fixture ownership stale.

Shared component and product boundary

#65 owns only accessibility primitives, registry/harness behavior, evidence production, and the
manual accessibility gate. Domain validation and mutation remain in application services and their
owning issues. Do not change route, SEO, authorization, privacy, idempotency, content, course, event,
registration-total, email-delivery, or management behavior to make an accessibility test pass.

The adopted design system remains visual authority. Accessibility remediation may correct a token or
shared pattern when required, but is not an unrelated redesign. A domain-specific pattern remains in
its owning app unless multiple surfaces genuinely share it.

HUMAN acceptance boundary

Automation does not close #65. A tester who did not implement the candidate must complete a dated
matrix with exact candidate/source/registry/producer fingerprints and synthetic-only evidence:

• keyboard-only skip, order, activation, Escape, focus placement/restoration, traps, and visible
  unobscured focus across every distinct shared pattern and critical mutation flow;
• at least one named real screen-reader/browser/OS/version pairing for landmarks/headings,
  navigation, tables, instructions/errors, state, dates/timezones, media alternatives, polite and
  urgent announcements, and one-time-copy status;
• hands-on normal and 200% zoom, 390px mobile, 320 CSS-pixel reflow, WCAG text spacing, contrast,
  focus, target spacing, reduced motion, forced colors, long/empty/success/error/stale/conflict/
  denied, and legitimate contained-scroll states; and
• representative HTML/plain transactional email at narrow/wide widths with images disabled.

Chromium/Blink AX-tree evidence is browser-engine evidence only. It is never copied into a real
assistive-technology row. Screenshots belong only below .tmp/screenshots/issue-65/; the tester
opens every original and rejects error/debug/broken layout or any private/secret-bearing value.

Dependencies and downstream consumers

• #1, #75, #115, and #118 are closed foundations.
• #72 owns the ten-spec/current-decision classification. It does not define #65 behavior.
• #65 supplies the accepted, versioned automated accessibility producer contract to #76 and
  separately owns the required HUMAN procedure/evidence contract.
• #76 records the automated producer and the HUMAN rows in its graph. It may accept a schema-valid
  pending HUMAN row only as required/no-go metadata, never as passed evidence.
• #77 aggregates the frozen #76 graph. #73/#74 own separately authorized environment/report
  instances and cannot infer accessibility acceptance from source-only evidence.
• Later product issues must extend the registry and produce their own browser/manual evidence before
  their acceptance; they do not silently widen a frozen #65 result.

No open route owner is an automatic dependency merely because #65 covers its current accepted state.
Freeze the candidate from a clean selected current main. Any relevant source, registry, product
surface, test policy, browser, or evidence-input change invalidates the envelope and returns it to
engineering/testing.

Remaining acceptance criteria

Source producer

• A versioned, deterministic, canonical accessibility evidence schema/producer covers every
  current registered state and required automated and HUMAN row without an external side effect.
• The candidate reconciles all current code-owned user-facing surfaces and active transactional
  email definitions to exact registry/scenario ownership; missing, duplicate, stale, or unclassified
  coverage fails closed.
• The producer records exact immutable source/policy/registry/engine/environment identities,
  state and result counts, complete bounded failures, digests, freshness, redaction, exceptions,
  screenshots, and downstream verdict semantics.
• Automated-pass and overall-release-input verdicts are distinct; pending or invalid HUMAN
  evidence is explicit and keeps the overall result no-go.
• Canonical output is byte-identical for identical explicit inputs, and every semantic input
  change that affects evidence changes the digest.
• Secret/private/protected canaries are rejected without being echoed in output or diagnostics.
• Focused units, accessibility Playwright, graph-selected full browser verification, current
  Django/compatibility/quality gates, migration drift, database portability, and git diff --check
  pass through uv-backed commands on the exact candidate.
• A separate tester recomputes the change-selective plan and all producer/registry/artifact
  digests, verifies every acceptance criterion, captures and opens required graph-selected
  desktop/mobile screenshots, and reports no unexplained skip or stale evidence.
• PM accepts the exact frozen source candidate; it is committed with Refs #65, merged/pushed
  through the normal lifecycle, and on-call reports the exact resulting CI verdict. #65 remains open
  and human while manual evidence is pending.

HUMAN closure

• The independent manual matrix records the exact candidate and named keyboard,
  screen-reader/browser/OS/version, zoom/reflow, text-spacing, contrast/focus/targets, motion,
  forced-colors, forms/status, long/empty/error/denied, and email results.
• Every manual failure is fixed and reverified or has an owner-approved bounded exception with
  risk, mitigation, review/expiry, and approval reference.
• Every required original screenshot is stored below .tmp/screenshots/issue-65/, opened,
  visually accepted, digest-bound, and free of private or secret-bearing values.
• A separate tester and PM accept the complete current-head source plus HUMAN evidence. Only
  then may the final focused commit use Closes #65 and the human label be removed.

Required verification scenarios

1. Generate twice from identical explicitly ordered and shuffled inputs and prove byte-identical JSON
   and digest; change source, registry, engine, policy, explicit time, result, exception, screenshot,
   or manual evidence and prove the appropriate identity changes.
2. Remove, duplicate, mis-own, stale, checksum-mismatch, skip, or fail one state/result/HUMAN row and
   prove complete deterministic diagnostics and no-go.
3. Inject one failure for every harness class: axe, landmark/H1, skip target, keyboard order/trap,
   focus visibility/obstruction, accessible name/state, field-error linkage/value preservation,
   status, target, overflow/reflow/text spacing, motion/forced colors, alt/transcript, timezone,
   email, screenshot inspection, and readable template.
4. Exercise the exact current registry at desktop/mobile and meaningful JavaScript-off public reads;
   prove scenario/state equality and fail on an unregistered current surface.
5. Supply pending, browser-tree-only, incomplete, wrong-candidate, stale, and genuinely performed
   synthetic HUMAN records; prove only a valid owning real record can satisfy its row and no HUMAN
   result can override failed automation.
6. Inject prohibited secret/private/protected values at input, output, diagnostic, screenshot
   metadata, and manual-record boundaries; prove publication fails without echo.
7. Re-run current route/SEO/privacy/authorization/business regression contracts. Accessibility work
   must not weaken them.

Lifecycle status

The issue is open with P0, human, frontend, accessibility, testing, and
integration. needs grooming and decision remain absent.

The next source action is one isolated engineer lane from the selected clean current main for the
producer contract and current registry reconciliation, uncommitted until independent testing and PM
acceptance. The separate HUMAN gate follows on the exact accepted current candidate. No pull request,
production access, or inferred WCAG claim.

Start with the accepted deterministic local harness from #75, the verification-producer graph contract in #76, and the accessibility and verification specifications linked in the issue. Define the versioned canonical producer around the existing registry and harness, preserving the separate HUMAN evidence boundary. Done means deterministic redacted output, closed-fail validation and distinct automated versus overall no-go verdicts, with focused and browser verification passing.