feat(enrichment): flag accessibility regressions in added markup

[galuis116]

Summary

• Adds a new local REES analyzer (a11y-regression) that scans PR-added JSX/HTML/Vue markup for four common accessibility regressions the no-checkout reviewer otherwise misses: an <img> without alt, an onClick handler added to a non-interactive element with no keyboard handler or role, a form control with no way to associate a label, and a positive tabindex that breaks natural tab order.
• Pure diff-local compute (no network, no GitHub token) over self-contained added tags (open through close on one line), following the established local-analyzer descriptor pattern (iac-misconfig.ts / size-smell.ts).
• Reports only { file, line, rule } — never markup content.

Fixes #2026

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

Also ran npm run rees:test (review-enrichment package's own node:test suite, 1049/1049 passing, including the new test/a11y-regression.test.ts) and regenerated analyzer-metadata.json, the UI's generated rees-analyzers.ts, and .env.example's generated analyzer-list comments via npm run rees:metadata.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests. — N/A, no auth/session/CORS surface touched.
• API/OpenAPI/MCP behavior is updated and tested where needed. — no OpenAPI/MCP-facing schema change; this is an internal analyzer registry addition.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks. — N/A, no UI surface change beyond the generated analyzer-docs data file.
• Visible UI changes include a UI Evidence section below — N/A, no visible/UI change.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Not applicable — this PR only adds a backend REES analyzer and its generated metadata; there is no visible UI change.

Notes

• Only self-contained tags (the full <tag ...> opening through its closing > on one added line) are scanned, so a tag whose attributes wrap across multiple lines is not matched — kept intentionally diff-local to avoid false positives from partial tags, matching the scope in the issue.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-05 16:23:20 UTC}

10 files · 1 AI reviewer · no blockers · readiness 62/100 · CI pending · dirty

⏸️ Suggested Action - Manual Review

Review summary
Clean, well-scoped addition of a local a11y analyzer covering four meaningful regressions (img-alt, click-events-have-key-events, label-control, positive-tabindex). All wiring points are correctly updated — `A11yFinding` type, `BriefFindings`, registry descriptor, render order, name registry, UI metadata, and env docs. The diff-local regex approach (single-line tag constraint, `MAX_LINE_CHARS` guard, `TAG_RE.lastIndex = 0` reset before each line) is sound and correctly bounded; tests cover both arms of all four rules plus the scanner's limit/comment/extension/line-number logic. No correctness blockers.

Nits — 6 non-blocking

• review-enrichment/src/analyzers/registry.ts:1099 and apps/gittensory-ui/src/lib/rees-analyzers.ts:1016–1017 hard-code `25` and `2000` as plain numeric literals in the `limits` block and UI metadata, while the authoritative named constants (`MAX_FINDINGS`, `MAX_LINE_CHARS`) live only in `a11y-regression.ts` — if either constant changes, the metadata copies silently diverge; export the constants and reference them in the descriptor to keep them in sync.
• `KEY_HANDLER_OR_ROLE_RE` in `a11y-regression.ts` includes `onKeyPress` as a satisfying keyboard handler, but `onKeyPress` is deprecated and being removed by browsers — relying on it alone should still trip the rule; remove `\bonKeyPress\s*=` from the pattern so only `onKeyDown` / `onKeyUp` / `role` satisfy the check.
• The `limits.signal?.aborted` throw-path in `scanPatchForA11y` and the `signal?.aborted` path in `scanA11y` have no test exercising the abort branch — at the repo's ≥97% branch-coverage target these uncovered arms are worth a quick abort-signal test case.
• Export `MAX_FINDINGS` and `MAX_LINE_CHARS` from `a11y-regression.ts` and import them into the registry descriptor's `limits` block so the operational cap and the metadata value share one source of truth without duplication.
• Remove `onKeyPress` from `KEY_HANDLER_OR_ROLE_RE` — the correct remediation for `click-events-have-key-events` is `onKeyDown` or `onKeyUp`; accepting the deprecated event silently passes code that modern accessibility tooling would still flag.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2026
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 1881 registered-repo PR(s), 1242 merged, 59 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	galuis116; Gittensor profile; 1881 PR(s), 59 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: galuis116
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 1881 PR(s), 59 issue(s).
• Related work: Titles/paths share 8 meaningful terms. (issue #2029, issue #2026)
• Related work: Titles/paths share 7 meaningful terms. (issue #2023, issue #2026)
• Related work: Titles/paths share 7 meaningful terms. (issue #2033, issue #2026)

Contributor next steps

• Review top overlaps.
• Add a concise scope and risk note.
• Await review-lane availability.
• Refresh registry data or choose a registered active repo.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[loopover-orb]

Gittensory is closing this pull request on the maintainer's behalf (conflicts with the base branch — resolve and open a fresh PR). This is an automated maintenance action — to pursue this change, please open a new pull request with the issues resolved. Closed PRs may be analyzed later to improve review accuracy, but they are not automatically reopened or re-reviewed.