From 0a92b57032c72a747ce7f548100bc40fdc35f3c7 Mon Sep 17 00:00:00 2001 From: hshum Date: Mon, 1 Jun 2026 23:58:55 -0700 Subject: [PATCH 1/2] =?UTF-8?q?feat(loop):=20cycle=20C003=20=E2=80=94=20an?= =?UTF-8?q?chor-as-button=20a11y=20detector=20+=20fix?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Self-improvement loop, cycle C003. Loop infra (scripts/improvement-loop/scan.mjs): - +detectAnchorButtons: flags with no href and no role — anchors used as buttons that are not keyboard-focusable and are announced as links by screen readers. Product fix (public/proto/home-v5.html): - The "Open wiki", "Take the tour", and "Publish wiki" controls were such anchors. Added role="button" + tabindex="0" and one global Enter/Space keydown delegate for any a[role="button"]. No behavior change for mouse users; keyboard + SR users can now focus and activate them. Integrity note: mid-cycle I caught a self-introduced bug — an inline onkeydown with single quotes broke a JS innerHTML string (one anchor is built in a script). Validated via the inline-script parse check, reverted, and switched to the global delegate before shipping. e2e 7/7 (output-contract + honesty); post-fix scan clean. Co-Authored-By: Claude Opus 4.8 (1M context) --- .claude/rules/self_improvement_loop.md | 2 +- CHANGELOG/pages/proto-home-v5.md | 5 +++++ CHANGELOG/scripts/improvement-loop.md | 5 +++++ public/proto/home-v5.html | 7 ++++--- scripts/improvement-loop/ledger.json | 25 ++++++++++++++++++++++++- scripts/improvement-loop/scan.mjs | 23 +++++++++++++++++++++++ 6 files changed, 62 insertions(+), 5 deletions(-) diff --git a/.claude/rules/self_improvement_loop.md b/.claude/rules/self_improvement_loop.md index 0bf31e57..af1798f0 100644 --- a/.claude/rules/self_improvement_loop.md +++ b/.claude/rules/self_improvement_loop.md @@ -33,7 +33,7 @@ If the change would touch any of these, it is **human-gated** — queue it, do N - Anything you cannot verify locally before shipping. ### 4. IMPLEMENT -- Fresh branch off `origin/main` (`git checkout -b loop/ origin/main`). +- Fresh branch off `origin/main` (`git checkout -b chore/loop- origin/main`). Use a Conventional-Commits type prefix (feat/fix/chore/docs) so the repo branch-name CI check passes — never `loop/...`. - Smallest change that makes the failure mode impossible, not just hidden. - Match surrounding code style. Reduced-motion guard on any new animation. diff --git a/CHANGELOG/pages/proto-home-v5.md b/CHANGELOG/pages/proto-home-v5.md index 62ded50a..58e414f0 100644 --- a/CHANGELOG/pages/proto-home-v5.md +++ b/CHANGELOG/pages/proto-home-v5.md @@ -11,3 +11,8 @@ Centralized lightweight motion tokens and added a visual polish pass across the Self-improvement loop cycle C002 added `type="button"` to the Memory Wall sticky-delete button and the two onboarding-tour buttons (Next/Skip) — they had onclick handlers but no explicit type (implicit-submit footgun). Validated as not inside a
; no behavior change. e2e honesty + output-contract green. **Commit**: `this commit`. **Author**: Homen Shum + Claude. + +## 2026-06-02 — a11y: anchors-as-buttons keyboard/SR accessible (loop C003) +The "Open wiki", "Take the tour", and "Publish wiki" controls were with no href/role — keyboard users could not focus/activate them and screen readers announced them as links. Added role="button" + tabindex="0" and a global Enter/Space keydown delegate for any a[role=button]. No behavior change for mouse users. e2e green. + +**Commit**: `this commit`. **Author**: Homen Shum + Claude. diff --git a/CHANGELOG/scripts/improvement-loop.md b/CHANGELOG/scripts/improvement-loop.md index d46fb36a..203ff030 100644 --- a/CHANGELOG/scripts/improvement-loop.md +++ b/CHANGELOG/scripts/improvement-loop.md @@ -11,3 +11,8 @@ Created the loop substrate (`scan.mjs` deterministic opportunity detectors + sco Added 3 detectors (button-without-type w/ form-context safety gating, target=_blank missing rel=noopener, img missing alt) and CSS/HTML comment-masking so example markup in comments is not flagged. The cycle found 1 false positive (rejected -> hardened) and 3 real button fixes (shipped). Demonstrates the loop converging: post-fix scan is clean. **Commit**: `this commit`. **Author**: Homen Shum + Claude. + +## 2026-06-02 — Cycle C003: anchor-as-button a11y detector + fix +Added detectAnchorButtons (flags with no href/role). Found + fixed 3 real instances (openWiki, startTour, snPublishWiki) by adding role="button" tabindex="0" + a global Enter/Space keydown delegate. Mid-cycle I caught a self-introduced bug (inline onkeydown single-quotes broke a JS innerHTML string) and corrected it before shipping — the validate-before-ship discipline in action. Post-fix scan clean. + +**Commit**: `this commit`. **Author**: Homen Shum + Claude. diff --git a/public/proto/home-v5.html b/public/proto/home-v5.html index 269252df..36e0b4eb 100644 --- a/public/proto/home-v5.html +++ b/public/proto/home-v5.html @@ -1934,7 +1934,7 @@

A disposable sidecar room for live event memory.

- Open wiki → + Open wiki →
@@ -1943,7 +1943,7 @@

A disposable sidecar room for live event memory.

- New to ScratchNode? This is the sidecar room: chat publicly, /ask for sourced answers, or lock the composer for private notes. Take the 20-second tour → + New to ScratchNode? This is the sidecar room: chat publicly, /ask for sourced answers, or lock the composer for private notes. Take the 20-second tour →
@@ -3427,7 +3427,7 @@

Keyboard shortcuts

return '

' + escapeHtml(EVENT_TITLE) + ' · Wiki

live Convex
' + '
' + '
' + window._sn_published_wiki_body + '
' + - '
'; + ''; } if (window._sn_live && window._sn_live.eventId) { return '

' + escapeHtml(EVENT_TITLE) + ' · Wiki

not published
' + @@ -8994,5 +8994,6 @@

Keyboard shortcuts

} catch (e) { /* no-op */ } })(); + diff --git a/scripts/improvement-loop/ledger.json b/scripts/improvement-loop/ledger.json index 97efc5ff..1fb9410a 100644 --- a/scripts/improvement-loop/ledger.json +++ b/scripts/improvement-loop/ledger.json @@ -47,7 +47,30 @@ "scripts/improvement-loop/scan.mjs" ] } + }, + { + "cycleId": "C003", + "at": "2026-06-02T06:51:32.941Z", + "scan": { + "total": 3, + "autoSafe": 3, + "humanGated": 0 + }, + "selected": { + "id": "OPP-001", + "title": "Anchor used as a button (onclick, no href/role)", + "score": 1.275, + "file": "public/proto/home-v5.html:1937" + }, + "outcome": "shipped", + "note": "Added detectAnchorButtons (a11y). Found 3 anchors-as-buttons (openWiki, startTour, snPublishWiki): onclick but no href/role -> not keyboard-focusable, screen-reader announces as link. Fixed with role=\"button\" tabindex=\"0\" + one global Enter/Space keydown delegate. Caught my own bug mid-cycle (inline onkeydown single-quotes broke a JS innerHTML string) and switched to the delegate. e2e 7/7. Post-fix scan clean.", + "shipped": { + "files": [ + "public/proto/home-v5.html", + "scripts/improvement-loop/scan.mjs" + ] + } } ], - "updatedAt": "2026-06-02T02:34:38.978Z" + "updatedAt": "2026-06-02T06:51:32.941Z" } diff --git a/scripts/improvement-loop/scan.mjs b/scripts/improvement-loop/scan.mjs index 081f3e48..9d478fc7 100644 --- a/scripts/improvement-loop/scan.mjs +++ b/scripts/improvement-loop/scan.mjs @@ -216,6 +216,28 @@ function detectImagesWithoutAlt(surface, lines) { return out; } +// Anchor used as a button: with no href and no role. Not keyboard- +// focusable and announced as a link by screen readers. Auto-safe fix: role/tabindex/keydown. +function detectAnchorButtons(surface, lines) { + const out = []; + const text = maskComments(lines.join('\n')); + const re = /]*)>/g; + let m; + while ((m = re.exec(text))) { + const a = m[1]; + if (!/\bonclick\s*=/.test(a)) continue; + if (/\bhref\s*=/.test(a)) continue; + if (/\brole\s*=/.test(a)) continue; + out.push(opp({ + title: 'Anchor used as a button (onclick, no href/role) — not keyboard/SR accessible', + surface: surface.id, source: 'a11y-scan', file: surface.file + ':' + lineOf(text, m.index), + evidence: ('').slice(0, 140), + impact: 3, confidence: 0.85, effort: 2, safety: 'auto', + })); + } + return out; +} + /** Honesty-contract-adjacent zones — recorded so the agent knows changes there are human-gated. */ function detectSafetyGatedZones(surface, lines) { const text = lines.join('\n'); @@ -240,6 +262,7 @@ function main() { ...detectButtonsWithoutType(surface, lines), ...detectUnsafeBlankLinks(surface, lines), ...detectImagesWithoutAlt(surface, lines), + ...detectAnchorButtons(surface, lines), ); safetyZones[surface.id] = detectSafetyGatedZones(surface, lines); } From 3ccf7fa6cf011fd41d11785c2bb4529ea181b6f3 Mon Sep 17 00:00:00 2001 From: hshum Date: Tue, 2 Jun 2026 00:40:17 -0700 Subject: [PATCH 2/2] =?UTF-8?q?feat(loop):=20cycle=20C004=20=E2=80=94=20un?= =?UTF-8?q?labeled-input=20a11y=20detector=20+=202=20fixes?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Added detectUnlabeledInputs (aware of with no href/role — keyboard users could not focus/activate them and screen readers announced them as links. Added role="button" + tabindex="0" and a global Enter/Space keydown delegate for any a[role=button]. No behavior change for mouse users. e2e green. **Commit**: `this commit`. **Author**: Homen Shum + Claude. + +## 2026-06-02 — a11y: accessible names on 2 inputs (loop C004) +The notes-search and note-title inputs had only placeholders (not an accessible name for screen readers). Added aria-label to both. The other text inputs already had with no href/role). Found + fixed 3 real instances (openWiki, startTour, snPublishWiki) by adding role="button" tabindex="0" + a global Enter/Space keydown delegate. Mid-cycle I caught a self-introduced bug (inline onkeydown single-quotes broke a JS innerHTML string) and corrected it before shipping — the validate-before-ship discipline in action. Post-fix scan clean. **Commit**: `this commit`. **Author**: Homen Shum + Claude. + +## 2026-06-02 — Cycle C004: unlabeled-input a11y detector + fix +Added detectUnlabeledInputs (aware of