From e072b9d995516898e49136550705b4703dab4772 Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:34:41 +0000
Subject: [PATCH 01/15] test(a11y): scan the hydrated homepage with axe, track
 tab contrast defect

---
 locators/home_locators.py                     |  9 ++
 pages/home_page.py                            | 20 ++++
 .../test_accessibility_hydrated.py            | 94 +++++++++++++++++++
 3 files changed, 123 insertions(+)
 create mode 100644 tests/accessibility/test_accessibility_hydrated.py

diff --git a/locators/home_locators.py b/locators/home_locators.py
index e5936d0..353fb2d 100644
--- a/locators/home_locators.py
+++ b/locators/home_locators.py
@@ -101,6 +101,15 @@ class HomeLocators:
         "div.flex.flex-col.items-center:has(img)"
     )
 
+    # ── Hydration markers ─────────────────────────────────────────────────────
+    # MainNav / HeroSection / FeatureTabs / MainFooter are loaded with
+    # next/dynamic({ ssr: false }), so at the `load` event the page is only a
+    # skeleton (no <h1>, no footer links). These three nodes only exist once the
+    # client bundles have mounted every section a whole-page scan should cover.
+    HYDRATED_HERO_H1 = "main h1"
+    HYDRATED_FOOTER_LINK = "footer a[href]"
+    HYDRATED_ACTIVE_TAB = "button[class*='E8E4FF']"
+
     # ── Footer ────────────────────────────────────────────────────────────────
     FOOTER = "footer"
     SOCIAL_LINKS = (
diff --git a/pages/home_page.py b/pages/home_page.py
index e841ff3..5fac45e 100644
--- a/pages/home_page.py
+++ b/pages/home_page.py
@@ -32,6 +32,9 @@ class HomePage(BasePage):
     FOOTER = HomeLocators.FOOTER
     SOCIAL_LINKS = HomeLocators.SOCIAL_LINKS
     CIVICDATALAB_LINK = HomeLocators.CIVICDATALAB_LINK
+    HYDRATED_HERO_H1 = HomeLocators.HYDRATED_HERO_H1
+    HYDRATED_FOOTER_LINK = HomeLocators.HYDRATED_FOOTER_LINK
+    HYDRATED_ACTIVE_TAB = HomeLocators.HYDRATED_ACTIVE_TAB
 
     def __init__(self, page: Page) -> None:
         super().__init__(page)
@@ -83,6 +86,23 @@ def go_to_home(self) -> "HomePage":
 
         return self
 
+    def wait_until_hydrated(self, timeout: int = 20_000) -> "HomePage":
+        """Wait until every client-rendered homepage section has mounted.
+
+        `go_to_home()` returns at the `load` event, when only the server-rendered
+        skeleton exists. Whole-page scans (axe, language, tab state) must run
+        after hero, feature tabs and footer are in the DOM, otherwise they
+        inspect a page no user ever sees. Raises a Playwright TimeoutError that
+        names the missing marker rather than letting the caller scan a skeleton.
+        """
+        for marker in (
+            self.HYDRATED_HERO_H1,
+            self.HYDRATED_ACTIVE_TAB,
+            self.HYDRATED_FOOTER_LINK,
+        ):
+            self.page.locator(marker).first.wait_for(state="visible", timeout=timeout)
+        return self
+
     def click_get_started(self) -> None:
         self.click(self.GET_STARTED_BUTTON)
 
diff --git a/tests/accessibility/test_accessibility_hydrated.py b/tests/accessibility/test_accessibility_hydrated.py
new file mode 100644
index 0000000..ac13247
--- /dev/null
+++ b/tests/accessibility/test_accessibility_hydrated.py
@@ -0,0 +1,94 @@
+"""
+Accessibility checks that run against the *hydrated* public homepage.
+
+Why this file exists
+--------------------
+The homepage mounts its nav, hero, feature tabs and footer with
+`next/dynamic({ ssr: false })`. `HomePage.go_to_home()` returns at the `load`
+event, when the page is still a skeleton: no <h1>, no footer links, no tabs.
+`test_accessibility.py::test_homepage_has_no_critical_axe_violations` therefore
+scans that skeleton and passes, while the page a user actually sees has serious
+axe violations (measured on dev, 2026-10-31: `color-contrast` x1 and
+`link-name` x4). Every test below calls `wait_until_hydrated()` first.
+
+Known defects are asserted as the *correct* behaviour under strict xfail and
+are logged in docs/app_bugs.md; the suite goes red when one is fixed (XPASS).
+"""
+
+import json
+
+import pytest
+from playwright.sync_api import Page
+
+from pages.home_page import HomePage
+
+pytestmark = [pytest.mark.accessibility]
+
+try:
+    from axe_playwright_python.sync_playwright import Axe
+except ImportError:  # pragma: no cover - requirements.txt installs it
+    Axe = None
+
+_WCAG_AA_TAGS = ["wcag2a", "wcag2aa", "wcag21a", "wcag21aa"]
+
+
+def _serious_violations(page: Page) -> list[dict]:
+    """Run axe (WCAG 2.0/2.1 A+AA rules) and return critical/serious violations."""
+    if Axe is None:
+        pytest.skip("axe-playwright-python not installed — run: pip install axe-playwright-python")
+    options = {"runOnly": {"type": "tag", "values": _WCAG_AA_TAGS}, "resultTypes": ["violations"]}
+    results = Axe().run(page, options=options).response
+    return [v for v in results.get("violations", []) if v.get("impact") in ("critical", "serious")]
+
+
+def _summarise(violations: list[dict]) -> str:
+    return json.dumps(
+        [
+            {
+                "id": v["id"],
+                "impact": v["impact"],
+                "nodes": [n["target"] for n in v["nodes"][:5]],
+            }
+            for v in violations
+        ],
+        indent=2,
+    )
+
+
+class TestHydratedHomepageAxe:
+    # Rules that have their own dedicated test (or ledger row) and are therefore
+    # excluded here so one known defect cannot mask a different new one:
+    #   link-name       -> docs/app_bugs.md #9 (footer social icons)
+    #   color-contrast  -> docs/app_bugs.md #31 (active feature tab)
+    _TRACKED_ELSEWHERE = {"link-name", "color-contrast"}
+
+    def test_no_untracked_serious_axe_violations(self, page: Page):
+        """The fully rendered homepage has no critical/serious WCAG 2.1 AA axe
+        violations beyond the two defects tracked in the ledger."""
+        HomePage(page).go_to_home().wait_until_hydrated()
+
+        unexpected = [
+            v for v in _serious_violations(page) if v["id"] not in self._TRACKED_ELSEWHERE
+        ]
+        assert not unexpected, (
+            f"{len(unexpected)} new critical/serious axe violation(s) on the hydrated "
+            f"homepage:\n{_summarise(unexpected)}"
+        )
+
+    @pytest.mark.xfail(
+        strict=True,
+        reason="App bug #31: active feature tab text #6849EE on #E8E4FF is 4.49:1 (< 4.5:1) — see docs/app_bugs.md",
+    )
+    def test_color_contrast_meets_aa(self, page: Page):
+        """Every rendered homepage text node meets the 4.5:1 AA contrast ratio (WCAG 1.4.3)."""
+        HomePage(page).go_to_home().wait_until_hydrated()
+
+        contrast = [v for v in _serious_violations(page) if v["id"] == "color-contrast"]
+        assert not contrast, (
+            "Insufficient colour contrast on the hydrated homepage:\n"
+            + "\n".join(
+                f"  {n['target']}: {n['any'][0]['message']}"
+                for v in contrast
+                for n in v["nodes"]
+            )
+        )

From 143d1d6cf617a5c1187903bd849f3bf4b688eac6 Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:35:49 +0000
Subject: [PATCH 02/15] test(a11y): feature tab selected state must be exposed
 programmatically

---
 pages/home_page.py                            | 13 ++++++++++
 .../test_accessibility_hydrated.py            | 25 +++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/pages/home_page.py b/pages/home_page.py
index 5fac45e..7e8ab5c 100644
--- a/pages/home_page.py
+++ b/pages/home_page.py
@@ -149,6 +149,19 @@ def get_all_tab_names(self) -> list[str]:
         tabs = self.page.locator(self.TAB_BUTTON)
         return [tabs.nth(i).inner_text().strip() for i in range(tabs.count())]
 
+    def get_tab_selected_flags(self) -> dict[str, bool]:
+        """Map each feature-tab label to whether its *selected* state is exposed
+        programmatically (aria-selected / aria-pressed / aria-current), which is
+        what assistive technology reads. The lavender background is not enough."""
+        return self.page.locator(self.TAB_BUTTON).evaluate_all(
+            """els => Object.fromEntries(els.map(e => [
+                e.innerText.trim(),
+                e.getAttribute('aria-selected') === 'true'
+                  || e.getAttribute('aria-pressed') === 'true'
+                  || ['true', 'page', 'step', 'location'].includes(e.getAttribute('aria-current'))
+            ]))"""
+        )
+
     def is_feature_content_visible(self) -> bool:
         return self.is_visible(self.TAB_CONTENT)
 
diff --git a/tests/accessibility/test_accessibility_hydrated.py b/tests/accessibility/test_accessibility_hydrated.py
index ac13247..9ace206 100644
--- a/tests/accessibility/test_accessibility_hydrated.py
+++ b/tests/accessibility/test_accessibility_hydrated.py
@@ -92,3 +92,28 @@ def test_color_contrast_meets_aa(self, page: Page):
                 for n in v["nodes"]
             )
         )
+
+
+class TestHydratedHomepageFeatureTabs:
+    @pytest.mark.xfail(
+        strict=True,
+        reason="App bug #32: feature tabs are plain <button>s whose selected state is colour-only — see docs/app_bugs.md",
+    )
+    def test_selected_tab_is_exposed_to_assistive_tech(self, page: Page):
+        """Selecting a feature tab exposes exactly that tab as selected (WCAG 4.1.2, 1.4.1).
+
+        The sibling `test_feature_tabs_have_aria_states` skips on this page
+        because there is no [role='tab']; this one asserts against the real
+        markup (buttons) so it cannot skip its way to green.
+        """
+        home = HomePage(page).go_to_home().wait_until_hydrated()
+
+        for label in home.get_all_tab_names():
+            home.click_feature_tab(label)
+            flags = home.get_tab_selected_flags()
+            selected = [name for name, is_selected in flags.items() if is_selected]
+            assert selected == [label], (
+                f"After selecting the '{label}' tab, tabs exposed as selected via "
+                f"aria-selected/aria-pressed/aria-current: {selected or 'none'} "
+                f"(expected only '{label}')."
+            )

From ac3d7a475ca5c7c436d305ce6adbaba3ab2b9c12 Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:36:58 +0000
Subject: [PATCH 03/15] test(a11y): non-English hero text must declare its
 language

---
 pages/home_page.py                            | 24 +++++++++++++++++++
 .../test_accessibility_hydrated.py            | 16 +++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/pages/home_page.py b/pages/home_page.py
index 7e8ab5c..7eb9029 100644
--- a/pages/home_page.py
+++ b/pages/home_page.py
@@ -162,6 +162,30 @@ def get_tab_selected_flags(self) -> dict[str, bool]:
             ]))"""
         )
 
+    def get_non_latin_text_without_own_language(self) -> list[str]:
+        """Return rendered text nodes that contain Indic-script characters but whose
+        nearest `lang` attribute is still the page language (English).
+
+        WCAG 3.1.2 (Language of Parts): passages in another language need their
+        own `lang`, otherwise screen readers pronounce them with English rules.
+        """
+        return self.page.evaluate(
+            """() => {
+                const indic = /[\u0900-\u0DFF]/;
+                const pageLang = (document.documentElement.lang || 'en').split('-')[0].toLowerCase();
+                const out = [];
+                const walker = document.createTreeWalker(document.body, NodeFilter.SHOW_TEXT);
+                for (let n = walker.nextNode(); n; n = walker.nextNode()) {
+                    const el = n.parentElement;
+                    if (!el || el.closest('script,style,noscript') || !indic.test(n.nodeValue)) continue;
+                    const own = el.closest('[lang]');
+                    const lang = own ? own.lang.split('-')[0].toLowerCase() : pageLang;
+                    if (lang === pageLang) out.push(n.nodeValue.trim());
+                }
+                return out;
+            }"""
+        )
+
     def is_feature_content_visible(self) -> bool:
         return self.is_visible(self.TAB_CONTENT)
 
diff --git a/tests/accessibility/test_accessibility_hydrated.py b/tests/accessibility/test_accessibility_hydrated.py
index 9ace206..300c53e 100644
--- a/tests/accessibility/test_accessibility_hydrated.py
+++ b/tests/accessibility/test_accessibility_hydrated.py
@@ -117,3 +117,19 @@ def test_selected_tab_is_exposed_to_assistive_tech(self, page: Page):
                 f"aria-selected/aria-pressed/aria-current: {selected or 'none'} "
                 f"(expected only '{label}')."
             )
+
+
+class TestHydratedHomepageLanguage:
+    @pytest.mark.xfail(
+        strict=True,
+        reason="App bug #33: Hindi/Odia/Assamese words in the hero sub-heading carry no lang attribute — see docs/app_bugs.md",
+    )
+    def test_non_english_passages_declare_their_language(self, page: Page):
+        """Text in another script is marked up with its own lang (WCAG 3.1.2, GIGW 3.0)."""
+        home = HomePage(page).go_to_home().wait_until_hydrated()
+
+        untagged = home.get_non_latin_text_without_own_language()
+        assert not untagged, (
+            "Indic-script text rendered under the page language (en) with no lang attribute "
+            f"of its own: {untagged}"
+        )

From befe37dba97f98142852bcbdbd56ca73d3eb086d Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:37:36 +0000
Subject: [PATCH 04/15] test(a11y): homepage reflows without horizontal scroll
 at 320px

---
 pages/home_page.py                            | 18 +++++++++++++
 .../test_accessibility_hydrated.py            | 26 +++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/pages/home_page.py b/pages/home_page.py
index 7eb9029..7bf0a9b 100644
--- a/pages/home_page.py
+++ b/pages/home_page.py
@@ -186,6 +186,24 @@ def get_non_latin_text_without_own_language(self) -> list[str]:
             }"""
         )
 
+    def get_horizontal_overflow(self) -> dict:
+        """Document scroll width vs viewport width, plus the first few elements that
+        stick out past the right edge (WCAG 1.4.10 Reflow)."""
+        return self.page.evaluate(
+            """() => ({
+                scrollWidth: document.documentElement.scrollWidth,
+                clientWidth: document.documentElement.clientWidth,
+                offenders: [...document.querySelectorAll('body *')]
+                    .filter(e => {
+                        const r = e.getBoundingClientRect();
+                        return r.width > 0 && r.right > window.innerWidth + 1
+                            && getComputedStyle(e).position !== 'fixed';
+                    })
+                    .slice(0, 5)
+                    .map(e => e.tagName.toLowerCase() + '.' + String(e.className).slice(0, 40)),
+            })"""
+        )
+
     def is_feature_content_visible(self) -> bool:
         return self.is_visible(self.TAB_CONTENT)
 
diff --git a/tests/accessibility/test_accessibility_hydrated.py b/tests/accessibility/test_accessibility_hydrated.py
index 300c53e..70704ee 100644
--- a/tests/accessibility/test_accessibility_hydrated.py
+++ b/tests/accessibility/test_accessibility_hydrated.py
@@ -133,3 +133,29 @@ def test_non_english_passages_declare_their_language(self, page: Page):
             "Indic-script text rendered under the page language (en) with no lang attribute "
             f"of its own: {untagged}"
         )
+
+
+@pytest.fixture
+def narrow_page(browser) -> Page:
+    """320 CSS px wide viewport — the WCAG 1.4.10 Reflow reference width."""
+    from utils.config import Config
+
+    context = browser.new_context(
+        viewport={"width": 320, "height": 640}, ignore_https_errors=True, locale="en-US"
+    )
+    context.set_default_timeout(Config.TIMEOUT)
+    yield context.new_page()
+    context.close()
+
+
+class TestHydratedHomepageReflow:
+    def test_no_horizontal_scroll_at_320px(self, narrow_page: Page):
+        """At 320px the whole hydrated homepage fits the viewport width (WCAG 1.4.10)."""
+        home = HomePage(narrow_page).go_to_home().wait_until_hydrated()
+
+        overflow = home.get_horizontal_overflow()
+        assert overflow["scrollWidth"] <= overflow["clientWidth"], (
+            f"Homepage scrolls horizontally at 320px: scrollWidth={overflow['scrollWidth']} > "
+            f"clientWidth={overflow['clientWidth']}; elements past the right edge: "
+            f"{overflow['offenders']}"
+        )

From 34e43d7ce673711a368372d909df6e309d8f8eb3 Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:38:17 +0000
Subject: [PATCH 05/15] test(a11y): NextAuth sign-in provider logo needs an alt
 attribute

---
 locators/login_locators.py                    |  5 +++
 pages/login_page.py                           | 13 +++++++
 .../test_accessibility_signin.py              | 35 +++++++++++++++++++
 3 files changed, 53 insertions(+)
 create mode 100644 tests/accessibility/test_accessibility_signin.py

diff --git a/locators/login_locators.py b/locators/login_locators.py
index fa8c5a3..efa1cab 100644
--- a/locators/login_locators.py
+++ b/locators/login_locators.py
@@ -59,3 +59,8 @@ class LoginLocators:
         "[class*='provider']:has-text('Keycloak'), "
         "[class*='social']:has-text('Keycloak')"
     )
+    # NextAuth's built-in sign-in page renders the provider logo as
+    # <img id="provider-logo"> (+ a dark-mode twin). The page has no lang-less
+    # variants of this markup, so the id is a stable anchor.
+    PROVIDER_LOGO_IMAGES = "form img[id^='provider-logo']"
+    PROVIDER_SIGNIN_PATH = "/api/auth/signin"
diff --git a/pages/login_page.py b/pages/login_page.py
index 02c2def..99d4217 100644
--- a/pages/login_page.py
+++ b/pages/login_page.py
@@ -21,6 +21,7 @@ class LoginPage(BasePage):
     ERROR_MESSAGE = LoginLocators.ERROR_MESSAGE
     FORM = LoginLocators.FORM
     KEYCLOAK_PROVIDER_BUTTON = LoginLocators.KEYCLOAK_PROVIDER_BUTTON
+    PROVIDER_LOGO_IMAGES = LoginLocators.PROVIDER_LOGO_IMAGES
 
     def __init__(self, page: Page) -> None:
         super().__init__(page)
@@ -55,6 +56,18 @@ def click_provider_if_present(self, timeout: int = 3_000) -> bool:
             return True
         return False
 
+    def go_to_provider_signin(self) -> None:
+        """Open NextAuth's provider-selection page directly (what every anonymous
+        deep link to a protected route lands on)."""
+        self.navigate_to_path(LoginLocators.PROVIDER_SIGNIN_PATH)
+        self.page.locator(self.KEYCLOAK_PROVIDER_BUTTON).first.wait_for(state="visible")
+
+    def get_provider_logo_alt_values(self) -> list[str | None]:
+        """`alt` attribute of every provider logo image (None = attribute missing)."""
+        return self.page.locator(self.PROVIDER_LOGO_IMAGES).evaluate_all(
+            "els => els.map(e => e.getAttribute('alt'))"
+        )
+
     def login(self, email: str, password: str) -> None:
         """Fill credentials and submit the login form."""
         self.enter_email(email)
diff --git a/tests/accessibility/test_accessibility_signin.py b/tests/accessibility/test_accessibility_signin.py
new file mode 100644
index 0000000..fe92236
--- /dev/null
+++ b/tests/accessibility/test_accessibility_signin.py
@@ -0,0 +1,35 @@
+"""
+Accessibility of NextAuth's provider-selection page (`/api/auth/signin`).
+
+Every anonymous visit to a protected route (`/dashboard`, `/resources`, any
+unknown URL — see app bug #18) is redirected here, so it is the first screen
+many users see. It is rendered by NextAuth's built-in template, not by the
+Parakh React app.
+"""
+
+import pytest
+from playwright.sync_api import Page
+
+from pages.login_page import LoginPage
+
+pytestmark = [pytest.mark.accessibility]
+
+
+class TestProviderSigninPage:
+    @pytest.mark.xfail(
+        strict=True,
+        reason="App bug #34: NextAuth sign-in page provider logo <img> has no alt attribute — see docs/app_bugs.md",
+    )
+    def test_provider_logo_has_alt_attribute(self, page: Page):
+        """The provider logo image carries an alt attribute — alt="" is fine since the
+        button text already names the provider (WCAG 1.1.1, axe `image-alt`, critical)."""
+        login = LoginPage(page)
+        login.go_to_provider_signin()
+
+        alts = login.get_provider_logo_alt_values()
+        assert alts, "Expected the sign-in page to render at least one provider logo image"
+        missing = [i for i, alt in enumerate(alts) if alt is None]
+        assert not missing, (
+            f"{len(missing)} of {len(alts)} provider logo image(s) on {page.url} have no "
+            "alt attribute (screen readers announce the image file name instead)."
+        )

From 6c9b152c0aadaad2ea19d367e9d85848a47da21a Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:38:44 +0000
Subject: [PATCH 06/15] test(api): sitemap.xml must be XML or 404, not a 200
 HTML shell

---
 tests/api/test_sitemap_content.py | 46 +++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 tests/api/test_sitemap_content.py

diff --git a/tests/api/test_sitemap_content.py b/tests/api/test_sitemap_content.py
new file mode 100644
index 0000000..0bdc470
--- /dev/null
+++ b/tests/api/test_sitemap_content.py
@@ -0,0 +1,46 @@
+"""
+Content checks for crawler-facing static endpoints.
+
+`test_api.py::test_sitemap_accessible` only asserts HTTP 200 and so passes when
+`/sitemap.xml` is answered with the homepage HTML shell (a "soft 404"). These
+tests assert what the response actually *is*.
+"""
+
+import xml.etree.ElementTree as ET
+
+import pytest
+import requests
+
+from utils.config import Config
+
+pytestmark = [pytest.mark.api, pytest.mark.regression]
+
+BASE = Config.BASE_URL.rstrip("/")
+_SITEMAP_ROOTS = {"urlset", "sitemapindex"}
+
+
+class TestSitemap:
+    @pytest.mark.xfail(
+        strict=True,
+        reason="App bug #35: /sitemap.xml answers 200 with the HTML app shell instead of a sitemap or a 404 — see docs/app_bugs.md",
+    )
+    def test_sitemap_is_xml_or_not_found(self, api_client: requests.Session):
+        """/sitemap.xml is either a real sitemap document or a 404 — never a 200 HTML page."""
+        try:
+            resp = api_client.get(BASE + "/sitemap.xml", timeout=15, allow_redirects=False)
+        except requests.exceptions.ConnectionError:
+            pytest.skip("Frontend unreachable")
+
+        if resp.status_code == 404:
+            return  # no sitemap published: an honest 404 is acceptable
+        assert resp.status_code == 200, f"/sitemap.xml returned {resp.status_code}"
+
+        content_type = resp.headers.get("content-type", "")
+        assert "xml" in content_type.lower(), (
+            f"/sitemap.xml returned 200 with Content-Type '{content_type}' "
+            f"(body starts: {resp.text[:60]!r}) — crawlers expect XML or a 404."
+        )
+        root = ET.fromstring(resp.content)  # raises ParseError on HTML
+        assert root.tag.rsplit("}", 1)[-1] in _SITEMAP_ROOTS, (
+            f"/sitemap.xml root element is <{root.tag}>, expected <urlset> or <sitemapindex>"
+        )

From aa57fbfa69e1001748fd5bedb8e7114797e9bb7e Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:39:39 +0000
Subject: [PATCH 07/15] test(api): API host Server header and duplicate
 security headers

---
 tests/api/test_api_host_headers.py | 66 ++++++++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 tests/api/test_api_host_headers.py

diff --git a/tests/api/test_api_host_headers.py b/tests/api/test_api_host_headers.py
new file mode 100644
index 0000000..b1477df
--- /dev/null
+++ b/tests/api/test_api_host_headers.py
@@ -0,0 +1,66 @@
+"""
+Response-header hygiene of the GraphQL API host (`dev.api.parakh...`).
+
+`test_security.py` checks the *frontend* host (SEC-003 `Server` header is fixed
+there). The API host sits behind a different nginx, so the same checks have to
+be repeated against it.
+"""
+
+import pytest
+import requests
+
+from utils.config import Config
+
+pytestmark = [pytest.mark.api, pytest.mark.security]
+
+GRAPHQL = Config.graphql_endpoint()
+
+# Headers where two different values in one response make browsers drop or
+# pick a value unpredictably.
+_SINGLE_VALUE_HEADERS = ("X-Frame-Options", "Referrer-Policy", "X-Content-Type-Options")
+
+
+def _get_graphql(api_client: requests.Session) -> requests.Response:
+    try:
+        resp = api_client.get(
+            GRAPHQL,
+            params={"query": "{ __typename }"},
+            headers={"Accept": "application/json"},
+            timeout=15,
+        )
+    except requests.exceptions.ConnectionError:
+        pytest.skip("GraphQL endpoint unreachable")
+    assert resp.status_code == 200, f"GraphQL endpoint returned {resp.status_code}"
+    return resp
+
+
+class TestApiHostHeaders:
+    @pytest.mark.xfail(
+        strict=True,
+        reason="App bug #36: API host Server header discloses 'nginx/1.24.0 (Ubuntu)' — see docs/app_bugs.md",
+    )
+    def test_server_header_does_not_disclose_version(self, api_client: requests.Session):
+        """The API host's Server header carries no nginx version or OS string."""
+        server = _get_graphql(api_client).headers.get("Server", "")
+        assert "/" not in server and "ubuntu" not in server.lower(), (
+            f"API host Server header discloses software details: '{server}'. "
+            "Set 'server_tokens off;' in the API host's nginx config."
+        )
+
+    @pytest.mark.xfail(
+        strict=True,
+        reason="App bug #37: API host sends conflicting duplicate X-Frame-Options / Referrer-Policy headers — see docs/app_bugs.md",
+    )
+    def test_security_headers_are_not_duplicated_with_conflicting_values(
+        self, api_client: requests.Session
+    ):
+        """Each of X-Frame-Options / Referrer-Policy / X-Content-Type-Options is sent
+        with one consistent value (two layers each adding their own copy conflict)."""
+        resp = _get_graphql(api_client)
+
+        conflicts = {}
+        for name in _SINGLE_VALUE_HEADERS:
+            values = [v.strip() for v in resp.raw.headers.getlist(name)]
+            if len(set(values)) > 1:
+                conflicts[name] = values
+        assert not conflicts, f"Conflicting duplicate response headers on {GRAPHQL}: {conflicts}"

From 6934124dee6c20a76158a35cf9a9c82a1fd4b901 Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:41:33 +0000
Subject: [PATCH 08/15] test(a11y): mobile menu sheet needs an accessible name

---
 locators/home_locators.py                     |  4 ++
 pages/home_page.py                            | 43 +++++++++++++++++++
 .../test_accessibility_mobile_menu.py         | 32 ++++++++++++++
 3 files changed, 79 insertions(+)
 create mode 100644 tests/accessibility/test_accessibility_mobile_menu.py

diff --git a/locators/home_locators.py b/locators/home_locators.py
index 353fb2d..081d377 100644
--- a/locators/home_locators.py
+++ b/locators/home_locators.py
@@ -28,6 +28,10 @@ class HomeLocators:
         "[data-testid='mobile-menu-button']"
     )
     MOBILE_NAV_ITEMS = "nav a, [role='navigation'] a"
+    # The hamburger opens a Radix Sheet rendered as role="dialog".
+    MOBILE_MENU_DIALOG = "[role='dialog']"
+    # Icon-only (X) button inside the sheet: it holds an <svg> and no text.
+    MOBILE_MENU_CLOSE_BUTTON = "[role='dialog'] button:has(svg)"
 
     # ── Hero section ──────────────────────────────────────────────────────────
     # Include h2 as fallback — some builds promote h2 as the visual hero heading.
diff --git a/pages/home_page.py b/pages/home_page.py
index 7bf0a9b..0c878f5 100644
--- a/pages/home_page.py
+++ b/pages/home_page.py
@@ -32,6 +32,8 @@ class HomePage(BasePage):
     FOOTER = HomeLocators.FOOTER
     SOCIAL_LINKS = HomeLocators.SOCIAL_LINKS
     CIVICDATALAB_LINK = HomeLocators.CIVICDATALAB_LINK
+    MOBILE_MENU_DIALOG = HomeLocators.MOBILE_MENU_DIALOG
+    MOBILE_MENU_CLOSE_BUTTON = HomeLocators.MOBILE_MENU_CLOSE_BUTTON
     HYDRATED_HERO_H1 = HomeLocators.HYDRATED_HERO_H1
     HYDRATED_FOOTER_LINK = HomeLocators.HYDRATED_FOOTER_LINK
     HYDRATED_ACTIVE_TAB = HomeLocators.HYDRATED_ACTIVE_TAB
@@ -218,6 +220,47 @@ def open_hamburger_menu(self) -> None:
     def click_hamburger(self) -> None:
         self.open_hamburger_menu()
 
+    def open_mobile_menu_and_wait(self) -> None:
+        """Open the hamburger sheet and wait until its dialog is visible."""
+        self.page.locator(self.HAMBURGER_MENU).first.wait_for(state="visible")
+        self.open_hamburger_menu()
+        self.page.locator(self.MOBILE_MENU_DIALOG).first.wait_for(state="visible")
+
+    def get_mobile_menu_dialog_name(self) -> str:
+        """Accessible name of the open sheet: aria-label, else the text of the
+        element(s) referenced by aria-labelledby, else empty."""
+        return self.page.locator(self.MOBILE_MENU_DIALOG).first.evaluate(
+            """el => {
+                const label = (el.getAttribute('aria-label') || '').trim();
+                if (label) return label;
+                const ids = (el.getAttribute('aria-labelledby') || '').split(/\s+/).filter(Boolean);
+                return ids.map(id => (document.getElementById(id)?.textContent || '').trim())
+                          .join(' ').trim();
+            }"""
+        )
+
+    def get_mobile_menu_close_button_name(self) -> str:
+        """Accessible name of the sheet's icon-only close button (empty if unnamed)."""
+        return self.page.locator(self.MOBILE_MENU_CLOSE_BUTTON).first.evaluate(
+            """el => {
+                const label = (el.getAttribute('aria-label') || '').trim();
+                if (label) return label;
+                const ids = (el.getAttribute('aria-labelledby') || '').split(/\s+/).filter(Boolean);
+                const byRef = ids.map(id => (document.getElementById(id)?.textContent || '').trim())
+                                 .join(' ').trim();
+                return byRef || (el.textContent || '').trim() || (el.getAttribute('title') || '').trim();
+            }"""
+        )
+
+    def close_mobile_menu_with_escape(self) -> None:
+        self.page.keyboard.press("Escape")
+        self.page.locator(self.MOBILE_MENU_DIALOG).first.wait_for(state="detached")
+
+    def is_hamburger_focused(self) -> bool:
+        return self.page.locator(self.HAMBURGER_MENU).first.evaluate(
+            "el => el === document.activeElement"
+        )
+
     def is_mobile_menu_open(self) -> bool:
         return self.is_visible(self.MOBILE_NAV_ITEMS, timeout=3_000)
 
diff --git a/tests/accessibility/test_accessibility_mobile_menu.py b/tests/accessibility/test_accessibility_mobile_menu.py
new file mode 100644
index 0000000..85f3b01
--- /dev/null
+++ b/tests/accessibility/test_accessibility_mobile_menu.py
@@ -0,0 +1,32 @@
+"""
+Accessibility of the mobile navigation sheet (hamburger menu, 390px).
+
+`test_accessibility.py::test_buttons_have_accessible_names` only inspects the
+page with the menu *closed*, so nothing in the open sheet was being checked.
+Measured on dev 2026-10-31 with the sheet open: axe `aria-dialog-name`
+(serious) and `button-name` (critical).
+"""
+
+import pytest
+from playwright.sync_api import Page
+
+from pages.home_page import HomePage
+
+pytestmark = [pytest.mark.accessibility, pytest.mark.mobile]
+
+
+class TestMobileMenuSheet:
+    @pytest.mark.xfail(
+        strict=True,
+        reason="App bug #38: mobile menu sheet (role=dialog) has no accessible name — see docs/app_bugs.md",
+    )
+    def test_dialog_has_accessible_name(self, mobile_page: Page):
+        """The open mobile menu is announced with a name (WCAG 4.1.2, axe `aria-dialog-name`)."""
+        home = HomePage(mobile_page).go_to_home()
+        home.open_mobile_menu_and_wait()
+
+        name = home.get_mobile_menu_dialog_name()
+        assert name, (
+            "The mobile menu <div role=dialog> has neither aria-label nor a resolvable "
+            "aria-labelledby, so screen readers announce an unnamed dialog."
+        )

From 3f62729313ae9ae1a2585ec751d40dae40b95ba7 Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:42:23 +0000
Subject: [PATCH 09/15] test(a11y): mobile menu close button needs an
 accessible name

---
 .../test_accessibility_mobile_menu.py             | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tests/accessibility/test_accessibility_mobile_menu.py b/tests/accessibility/test_accessibility_mobile_menu.py
index 85f3b01..64ab7b3 100644
--- a/tests/accessibility/test_accessibility_mobile_menu.py
+++ b/tests/accessibility/test_accessibility_mobile_menu.py
@@ -30,3 +30,18 @@ def test_dialog_has_accessible_name(self, mobile_page: Page):
             "The mobile menu <div role=dialog> has neither aria-label nor a resolvable "
             "aria-labelledby, so screen readers announce an unnamed dialog."
         )
+
+    @pytest.mark.xfail(
+        strict=True,
+        reason="App bug #39: mobile menu close (X) button has no accessible name — see docs/app_bugs.md",
+    )
+    def test_close_button_has_accessible_name(self, mobile_page: Page):
+        """The icon-only close button in the open sheet is named (WCAG 4.1.2, axe `button-name`, critical)."""
+        home = HomePage(mobile_page).go_to_home()
+        home.open_mobile_menu_and_wait()
+
+        name = home.get_mobile_menu_close_button_name()
+        assert name, (
+            "The icon-only close button in the mobile menu has no aria-label, "
+            "aria-labelledby, text or title — its only text node is an empty visually-hidden span."
+        )

From 15cec85132cd88400bd9143893b6d45e0d532b07 Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:43:23 +0000
Subject: [PATCH 10/15] test(a11y): Escape closes the mobile menu

---
 pages/home_page.py                                  | 13 +++++++++++--
 .../accessibility/test_accessibility_mobile_menu.py | 11 +++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/pages/home_page.py b/pages/home_page.py
index 0c878f5..ebe5af6 100644
--- a/pages/home_page.py
+++ b/pages/home_page.py
@@ -252,9 +252,18 @@ def get_mobile_menu_close_button_name(self) -> str:
             }"""
         )
 
-    def close_mobile_menu_with_escape(self) -> None:
+    def press_escape(self) -> None:
         self.page.keyboard.press("Escape")
-        self.page.locator(self.MOBILE_MENU_DIALOG).first.wait_for(state="detached")
+
+    def is_mobile_menu_dialog_open(self, timeout: int = 3_000) -> bool:
+        """True while the sheet's dialog is still visible after `timeout` ms."""
+        try:
+            self.page.locator(self.MOBILE_MENU_DIALOG).first.wait_for(
+                state="hidden", timeout=timeout
+            )
+        except Exception:
+            return True
+        return False
 
     def is_hamburger_focused(self) -> bool:
         return self.page.locator(self.HAMBURGER_MENU).first.evaluate(
diff --git a/tests/accessibility/test_accessibility_mobile_menu.py b/tests/accessibility/test_accessibility_mobile_menu.py
index 64ab7b3..5771d09 100644
--- a/tests/accessibility/test_accessibility_mobile_menu.py
+++ b/tests/accessibility/test_accessibility_mobile_menu.py
@@ -45,3 +45,14 @@ def test_close_button_has_accessible_name(self, mobile_page: Page):
             "The icon-only close button in the mobile menu has no aria-label, "
             "aria-labelledby, text or title — its only text node is an empty visually-hidden span."
         )
+
+    def test_escape_closes_menu(self, mobile_page: Page):
+        """Pressing Escape dismisses the open mobile menu (keyboard operability, WCAG 2.1.1)."""
+        home = HomePage(mobile_page).go_to_home()
+        home.open_mobile_menu_and_wait()
+
+        home.press_escape()
+
+        assert not home.is_mobile_menu_dialog_open(), (
+            "The mobile menu dialog is still visible after pressing Escape"
+        )

From 92aabecd214d5cc56db6c69511cd0d864784717d Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:44:14 +0000
Subject: [PATCH 11/15] test(a11y): focus returns to hamburger after the menu
 closes

---
 .../test_accessibility_mobile_menu.py            | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/tests/accessibility/test_accessibility_mobile_menu.py b/tests/accessibility/test_accessibility_mobile_menu.py
index 5771d09..07bdb65 100644
--- a/tests/accessibility/test_accessibility_mobile_menu.py
+++ b/tests/accessibility/test_accessibility_mobile_menu.py
@@ -56,3 +56,19 @@ def test_escape_closes_menu(self, mobile_page: Page):
         assert not home.is_mobile_menu_dialog_open(), (
             "The mobile menu dialog is still visible after pressing Escape"
         )
+
+    @pytest.mark.xfail(
+        strict=True,
+        reason="App bug #40: closing the mobile menu drops keyboard focus to <body> instead of the hamburger — see docs/app_bugs.md",
+    )
+    def test_focus_returns_to_hamburger_after_close(self, mobile_page: Page):
+        """After the sheet closes, keyboard focus is back on the button that opened it (WCAG 2.4.3)."""
+        home = HomePage(mobile_page).go_to_home()
+        home.open_mobile_menu_and_wait()
+        home.press_escape()
+        assert not home.is_mobile_menu_dialog_open(), "precondition: Escape must close the menu"
+
+        assert home.is_hamburger_focused(), (
+            "Keyboard focus was not returned to the hamburger button after the menu closed; "
+            "keyboard users restart from the top of the page."
+        )

From f844742c63abfc6db661bafe31118d09eef48dae Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:47:50 +0000
Subject: [PATCH 12/15] chore: use raw strings for JS snippets in HomePage

---
 pages/home_page.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pages/home_page.py b/pages/home_page.py
index ebe5af6..1ceb91f 100644
--- a/pages/home_page.py
+++ b/pages/home_page.py
@@ -172,7 +172,7 @@ def get_non_latin_text_without_own_language(self) -> list[str]:
         own `lang`, otherwise screen readers pronounce them with English rules.
         """
         return self.page.evaluate(
-            """() => {
+            r"""() => {
                 const indic = /[\u0900-\u0DFF]/;
                 const pageLang = (document.documentElement.lang || 'en').split('-')[0].toLowerCase();
                 const out = [];
@@ -230,7 +230,7 @@ def get_mobile_menu_dialog_name(self) -> str:
         """Accessible name of the open sheet: aria-label, else the text of the
         element(s) referenced by aria-labelledby, else empty."""
         return self.page.locator(self.MOBILE_MENU_DIALOG).first.evaluate(
-            """el => {
+            r"""el => {
                 const label = (el.getAttribute('aria-label') || '').trim();
                 if (label) return label;
                 const ids = (el.getAttribute('aria-labelledby') || '').split(/\s+/).filter(Boolean);
@@ -242,7 +242,7 @@ def get_mobile_menu_dialog_name(self) -> str:
     def get_mobile_menu_close_button_name(self) -> str:
         """Accessible name of the sheet's icon-only close button (empty if unnamed)."""
         return self.page.locator(self.MOBILE_MENU_CLOSE_BUTTON).first.evaluate(
-            """el => {
+            r"""el => {
                 const label = (el.getAttribute('aria-label') || '').trim();
                 if (label) return label;
                 const ids = (el.getAttribute('aria-labelledby') || '').split(/\s+/).filter(Boolean);

From 92692d7aa4d610f85bed61ef6b5515d4ca41135a Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Sat, 31 Oct 2026 11:48:21 +0000
Subject: [PATCH 13/15] docs: log bugs #31-#40 and a11y findings a5-a12,
 annotate #16

---
 docs/a11y_findings.md |  9 +++++++++
 docs/app_bugs.md      | 13 ++++++++++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/docs/a11y_findings.md b/docs/a11y_findings.md
index af94fc3..6a6a535 100644
--- a/docs/a11y_findings.md
+++ b/docs/a11y_findings.md
@@ -10,6 +10,14 @@ Each row links to the WCAG criterion and the axe rule id (helpful when filing ti
 | a2 | color-contrast | 1.4.3 (AA) | serious | Keycloak login (`opub-kc.civicdatalab.in/auth/realms/DataSpace/...`) | form labels / placeholder text | Foreground/background contrast below 4.5:1 for body text. Third-party (Keycloak) — see bug #5. | open (third-party) | 2026-05-08 |
 | a3 | link-name | 4.1.2 (A) / 2.4.4 (A) | serious | Keycloak login (footer) | `<a>` containing only `<svg>` (4 social media links) | Icon-only links with no `aria-label` or visible text. Affects GitHub, LinkedIn, Twitter, Facebook links. Third-party — see bug #5. | open (third-party) | 2026-05-08 |
 | a4 | heading-order / page-has-heading-one | 1.3.1 (A) | serious | `/dashboard/ai-maker/1` (auth) | `<main>` (no h1/h2/h3 anywhere) | No heading elements at all — the Overview widget that would host the page heading never mounts because its data fetch hangs indefinitely. Linked to bug #14 (and bug #13's backend root cause). | open | 2026-07-10 |
+| a5 | color-contrast | 1.4.3 (AA) | serious | `/` (anonymous, hydrated) | `button.bg-[#E8E4FF]` | Active feature tab text #6849EE on #E8E4FF = 4.49:1. Linked to bug #31. | open | 2026-10-31 |
+| a6 | link-name | 4.1.2 (A) / 2.4.4 (A) | serious | `/` (anonymous, hydrated) | `footer a.w-10.h-10` x4 | Footer social icons unnamed; only visible after hydration. Same as bug #9. | open | 2026-10-31 |
+| a7 | (manual) name-role-value | 4.1.2 (A) / 1.4.1 (A) | serious | `/` | feature tab `<button>`s | Selected tab not exposed via aria-pressed/selected/current. Bug #32. | open | 2026-10-31 |
+| a8 | (manual) language of parts | 3.1.2 (AA) | moderate | `/` | hero `h2 span.block` | Hindi/Odia/Assamese words with no `lang`. Bug #33. | open | 2026-10-31 |
+| a9 | image-alt | 1.1.1 (A) | critical | `/api/auth/signin` | `img#provider-logo` | NextAuth provider logo has no alt. Bug #34. | open | 2026-10-31 |
+| a10 | aria-dialog-name | 4.1.2 (A) | serious | `/` at 390px, menu open | `[role=dialog]` | Mobile menu sheet unnamed. Bug #38. | open | 2026-10-31 |
+| a11 | button-name | 4.1.2 (A) | critical | `/` at 390px, menu open | `.Button-module_kindTertiary__p3qgr` | Close (X) button unnamed. Bug #39. | open | 2026-10-31 |
+| a12 | (manual) focus order | 2.4.3 (A) | moderate | `/` at 390px | hamburger button | Focus drops to `<body>` after the menu closes. Bug #40. | open | 2026-10-31 |
 
 ## How to interpret
 
@@ -23,3 +31,4 @@ Each row links to the WCAG criterion and the axe rule id (helpful when filing ti
 
 - **Phase 2 run 2026-05-08:** 11 a11y tests → 3 fail (1 flake fixed in test code, 2 real bugs filed → bugs #4, #5). 4 pass / 5 skip (env / no-creds) / 2 xfail / 0 fail after fixes.
 - **Phase 7 run 2026-07-10:** 34 a11y tests (public + authenticated) → 1 fail, reproduced consistently (not flaky). Root-caused to dashboard overview widget hang; filed bug #14 / finding a4 and xfailed. 14 pass / 9 skip / 10 xfail / 0 fail after triage.
+- **Phase 14 run 2026-10-31:** anonymous review of the hydrated homepage, sign-in page and mobile menu. a5-a12 added (bugs #31-#34, #38-#40). The pre-existing homepage axe test scans the pre-hydration skeleton, so a5/a6 were invisible to it.
diff --git a/docs/app_bugs.md b/docs/app_bugs.md
index d5db3de..33d36d4 100644
--- a/docs/app_bugs.md
+++ b/docs/app_bugs.md
@@ -22,7 +22,7 @@ Format: append-only. When a bug is fixed in the app, mark `status: fixed` and th
 | 13 | evaluations list / backend perf | The frontend `GetAudits` query that powers the AI-Maker Evaluations list (`/dashboard/ai-maker/{org}/evaluations`) **hangs and never returns** on dev — the page sits on "Loading evaluations…" indefinitely (still up at 90 s). Root-caused 2026-06-12 via live Playwright + direct GraphQL probing on org 1 (981 total audits): requesting the **light** field set (`id name status modelId`, `limit:100`) returns in ~10.6 s, and `metrics`-only or `modules`-only at `limit:100` each return in ~16–18 s, but the **full field set the frontend actually requests** (`name modelName status modules metrics evaluationMode auditType totalTests passedTests failedTests createdAt startedAt completedAt`) **times out past 30 s even at `limit:5`** — so it is the combined per-row resolver cost (likely N+1 on `metrics`/`modules`/test-count fields), not row volume. Backend should batch/precompute these fields or paginate server-side. Also observed intermittent `ERR_NETWORK_CHANGED` / "Backend server is not available" GraphQL errors on dev during the same session (degraded backend). **Not a test defect** — no client-side timeout bump can help since the query never completes. | fixed 2026-08-12 (see verification note) | Log in → AI Maker → CivicDataLab → Evaluations. Page stays on "Loading evaluations…". In DevTools, the `GetAudits` POST to `dev.api.parakh.civicdataspace.in/graphql/` has no response after 90 s. Confirmed via Playwright MCP 2026-06-12: full-field `audits` query aborts at 30 s even with `limit:5`, while light-field returns in ~10 s. | `tests/e2e/test_evaluations.py::TestStatusFilterTabs::*` (all 6 — tabs/column/rows render only after the list query resolves); transitively any test that asserts on rendered evaluations-list content for org 1; `tests/e2e/test_evaluations.py::TestEvaluationsListPage::test_table_column_headers_are_present` (added 2026-07-31 — re-run isolated, no concurrent CI load: page still stuck on "Loading evaluations..." past 40s, confirming the hang reproduces without concurrent-shard traffic) | 2026-06-12 |
 | 14 | a11y / dashboard heading | The AI Maker Dashboard (`/dashboard/ai-maker/1`) never renders any `<h1>`/`<h2>`/`<h3>` heading — `document.querySelectorAll('h1,h2,h3').length` is `0` even after a 30s wait. Root cause: the "Overview" widget (which appears to be where the page heading lives) is permanently stuck on "Loading overview..." and never resolves — the same failure shape as bug #13 (backend `GetAudits`/overview resolver hang), just surfacing on the dashboard-home overview query instead of the evaluations-list query. Because the widget never mounts, the page has zero heading elements, violating WCAG 1.3.1 (Info and Relationships) / a broken document outline for screen-reader users. **Update 2026-08-13:** Phase 12 (2026-08-12) marked this `fixed` after a clean re-verification, but noted the xfails referencing it hadn't been removed pending a re-run. That re-run surfaced different evidence: in a full e2e run (`--splits 12 --group 2`), `test_add_new_model_button_is_visible` and `test_model_cards_are_rendered` genuinely XFAILED (the bug fired), while `test_civicdatalab_name_visible_in_sidebar` and `test_text_generation_badge_is_present` XPASSED in the same run. Re-running the two XFAILing tests in true isolation (`-n 1 --reruns 0`, no other suite active) immediately afterward, both XPASSED cleanly. This is NOT the bug #3 concurrency-noise shape (isolation didn't consistently clear it either way) — it's a genuinely intermittent defect, not a fixed-vs-broken binary. **Do not remove the `strict=False` xfails on any of the four related tests** — they correctly tolerate a defect that still recurs some fraction of the time. | intermittent (re-opened 2026-08-13 — was marked fixed 2026-08-12, see update above; keep the xfails) | Log in as `TEST_EMAIL_1` → navigate directly to `https://dev.parakh.civicdataspace.in/dashboard/ai-maker/1`. Page loads nav/sidebar/breadcrumbs but the main content area shows only "Loading overview..." indefinitely (confirmed stuck past 30s). Run `document.querySelectorAll('h1,h2,h3').length` → `0`. Confirmed via Playwright 2026-07-10. | `tests/accessibility/test_accessibility_auth.py::TestDashboardAccessibility::test_dashboard_has_exactly_one_h1`; `tests/e2e/test_ai_maker_dashboard.py::TestAIMakerDashboardLoads::test_civicdatalab_name_visible_in_sidebar`, `TestModelCardsonHome::test_add_new_model_button_is_visible`, `TestModelCardsonHome::test_model_cards_are_rendered`, `TestModelCardsonHome::test_text_generation_badge_is_present` (added 2026-07-31 — re-run isolated (no concurrent CI load), direct repro script confirmed the whole home content area, not just the heading, is gated behind the same stuck "Loading overview..." widget: org identity block (`CivicdataLab` text), model cards, `Add A New Model` button, and model-type badges never render because they all read from the same overview payload) | 2026-07-10 |
 | 15 | routing / auth deep-link | Direct navigation to authenticated AI-Maker / Auditor sub-routes (`/dashboard/ai-maker/1/ai-models`, `/dashboard/ai-maker/1/evaluations/new`, `/dashboard/ai-maker/1/auditors`, `/dashboard/ai-maker/1/prompt-libraries`, `/dashboard/auditor`) **intermittently renders the public marketing homepage** (hero "Build AI that's trustworthy from day one.", feature tabs, CTA cards, footer) instead of the requested dashboard page, even though the user is authenticated (avatar/session valid) and the URL bar shows the correct path. Root-caused 2026-07-10 via a scripted repro: a fresh browser context seeded with a valid `storage_state` (cookies + localStorage from a real Keycloak login) navigating straight to `/dashboard/ai-maker/1/ai-models` with `wait_until="load"` + 2.5s settle reproduced the homepage fallback in **1 of 6 trials (~17%)**; the same repro against `/dashboard/ai-maker/1/prompt-libraries` reproduced it in **1 of 4 trials (~25%)**, and a further capture landed in a visibly half-transitioned state (both "Prompt Libraries" page chrome and homepage CTA/footer content stacked in the same viewport — see `screenshots/DIFF_auth_prompt_libraries_desktop_1440x900.png`). When it does NOT reproduce, the correct page renders fully and correctly (light theme, correct heading, working sidebar, "Loading AI models…" spinner resolving normally). This is a materially different and more severe symptom than the "non-deterministic async content" (live stats, model dropdown ordering) that `_NON_DETERMINISTIC_VISUAL` in `tests/visual/test_visual_regression.py` currently attributes these routes' diffs to — the wizard/models/auditors/auditor-dashboard visual tests see ~43% pixel diffs because they are sporadically capturing the wrong page entirely, not just varying live data. Likely a client-side routing/auth-guard race on hard navigation (the route guard falls through to the default/public route before the session check resolves), since it only reproduces on deep-link/full-page loads, not in-app client-side navigation. | open | Using a Playwright context seeded with a valid Keycloak `storage_state`, repeatedly `page.goto()` directly to `/dashboard/ai-maker/1/ai-models` (or any route in the list above) with `wait_until="load"` and a 2.5s+ settle delay; repeat ~5-6 times. Roughly 1 in 5-6 loads renders the homepage hero/CTA/footer instead of the dashboard page content. Confirmed via ad hoc Playwright script 2026-07-10 (not yet encoded as a standing test — see `docs/visual_diffs.md` Run 2026-07-10 for the diff images that first surfaced it). | `tests/visual/test_visual_regression.py::TestAuthenticatedPageVisuals::test_authenticated_page_desktop[chromium-models_list]`, `[chromium-new_evaluation_wizard]`, `[chromium-auditors_management]`, `[chromium-auditor_dashboard]`, `[chromium-prompt_libraries]` (all xfail under VISUAL-002 — the xfail reason text should be revisited given this finding); `tests/e2e/test_user_flows.py::TestFlow04_EvaluationDetailAndReport::test_evaluation_detail_shows_full_results` (added 2026-07-13 — deep-link to `/evaluations/{id}` rendered the public homepage; avatar/session chrome still present, confirming auth was intact); `tests/visual/test_visual_regression.py::TestAuthenticatedPageVisuals::*` (2026-08-12 — the new capture-integrity gate in `utils/visual_guards.py` now detects this automatically and skips instead of baselining it) **— SEVERITY UPDATE 2026-08-12: observed at ~50%, far above the 17-25% recorded above.** Two consecutive full visual runs hit the logged-out fallback on **12 of 24 authenticated captures** (5/12 then 7/12). Affected: `/dashboard/ai-maker/1`, `/ai-models`, `/evaluations`, `/evaluations/new`, `/auditors`, `/prompt-libraries`, `/dashboard/auditor`. NOT affected in either run: `/dashboard` (role selector), `/dashboard/ai-maker` (org selector), `/dashboard/auditor/evaluations` — so it is not uniform across depth. New detail vs the 2026-07-10 characterisation: the fallback now renders **logged-out chrome (LOGIN / SIGN UP)**, i.e. the session is not merely failing to apply to the route — the shell itself renders unauthenticated. Caveat on the comparison: both figures are small samples (the original was 1/6 and 1/4 trials) and load conditions differed, so treat this as "materially worse under current conditions" rather than a precise regression measurement. Independent confirmation that it also fired historically: four baselines were byte-identical copies of the logged-out homepage. `test_evaluation_detail_shows_full_results`'s xfail was missing `strict=False` (this repo's `pytest.ini` sets `xfail_strict = true` globally) — added 2026-08-13 so a lucky run's XPASS is tolerated instead of failing the suite, consistent with bug #14's established convention for intermittent (not always-reproducing) bugs. | 2026-07-10 |
-| 16 | SEO / homepage content | Homepage `<meta name="description">` contains a spelling error: `"Paricipatory AI Evaluation"` (missing the first `t` in "Participatory"). Root-caused in frontend source: `app/layout.tsx` line 180, `export const metadata = { ..., description: "Paricipatory AI Evaluation" }`. One-line content fix. | open | Load `https://dev.parakh.civicdataspace.in/`. Run `document.querySelector('meta[name="description"]').content` → `"Paricipatory AI Evaluation"`. Confirmed against `ParakhAI-frontend/app/layout.tsx:180` 2026-07-13. | `tests/e2e/test_platform_issues.py::TestHomepageSEO::test_meta_description_has_no_typo` | 2026-07-13 |
+| 16 | SEO / homepage content | Homepage `<meta name="description">` contains a spelling error: `"Paricipatory AI Evaluation"` (missing the first `t` in "Participatory"). Root-caused in frontend source: `app/layout.tsx` line 180, `export const metadata = { ..., description: "Paricipatory AI Evaluation" }`. One-line content fix. | open on dev; fixed on `main` and prod by ParakhAI-frontend#437 (merged 2026-07-15) — the `dev` branch does not contain commit 9919bdb, so dev still serves the typo and `https://parakh.civicdataspace.in/` serves the corrected text (checked 2026-10-31; against prod this test XPASSes strict, which is the expected signal to retire the xfail once dev is merged). | Load `https://dev.parakh.civicdataspace.in/`. Run `document.querySelector('meta[name="description"]').content` → `"Paricipatory AI Evaluation"`. Confirmed against `ParakhAI-frontend/app/layout.tsx:180` 2026-07-13. | `tests/e2e/test_platform_issues.py::TestHomepageSEO::test_meta_description_has_no_typo` | 2026-07-13 |
 | 17 | SEO / homepage content | Homepage has no Open Graph `<meta property="og:title">` tag (or any other `og:*` tags) — the root `metadata` export in `app/layout.tsx` only sets `title` and `description`, no `openGraph` block. Links to the homepage shared on social media / chat apps will render with no title card. | open | Load `https://dev.parakh.civicdataspace.in/`. Run `document.querySelector('meta[property="og:title"]')` → `null`. Confirmed against `ParakhAI-frontend/app/layout.tsx` (metadata export has no `openGraph` key) 2026-07-13. | `tests/e2e/test_platform_issues.py::TestHomepageSEO::test_og_title_is_present` | 2026-07-13 |
 | 18 | routing / 404 | Visiting any non-existent URL as an anonymous user does not show a 404/not-found message — it silently redirects to the generic NextAuth "sign in with Keycloak" page instead, with no indication the URL was invalid. Root cause confirmed in `middleware.ts`: `publicPages = ['/']` is the *only* unauthenticated route; the matcher (`'/((?!_next|api|.*\\..*).*)'`) sends every other path — including typos and genuinely nonexistent routes — through `withAuth`, which redirects unauthenticated requests to `/api/auth/signin` before Next.js ever gets a chance to render a not-found page. This is a distinct, more severe variant of the two existing sibling xfails in this file (`test_404_page_has_home_navigation_link` / `test_404_page_has_logo_or_branding`), which assumed a bare-but-present Next.js 404 page — there isn't one for anonymous users at all. | open | As an anonymous user, navigate to `https://dev.parakh.civicdataspace.in/this-page-does-not-exist-xyz-123`. Observe the generic Keycloak/NextAuth sign-in screen, not a 404 page. Confirmed against `ParakhAI-frontend/middleware.ts` (`publicPages = ['/']`) 2026-07-13. | `tests/e2e/test_platform_issues.py::TestNotFoundPage::test_404_page_shows_not_found_message` | 2026-07-13 |
 | 19 | ai-maker / org-selection race | Clicking the "AI Maker" role card intermittently shows a **"Redirect to CivicDataSpace — you are being redirected to add an organisation"** modal instead of the organization-selection list, even for accounts with real org memberships. Confirmed via direct GraphQL: `TEST_EMAIL_1`'s `myOrganizations` query returns **11 real organizations** (including `CivicDataLab`, id `1`) — this is not a data/membership issue. Root cause confirmed in `app/[locale]/dashboard/ai-maker/page.tsx:98-102`: `useEffect(() => { if (!isLoading && organizations.length === 0) setShowRedirectPrompt(true); }, [isLoading, organizations.length])` fires whenever `useMyOrganizations()`'s React Query `isLoading` flips to `false` with a still-empty `organizations` array — a data-arrival race, same family as bug #15's auth-guard race (the query is `enabled: isAuthenticated`, so an auth-hydration timing gap can produce exactly this transient empty-then-populated sequence). Worse: once triggered, the modal **never auto-dismisses** — `setShowRedirectPrompt(false)` only exists inside the two dialog button handlers (`page.tsx:160`, `173`), not as a reactive effect keyed off `organizations.length` becoming non-zero, so a real user who hits the race is stuck looking at a false "you have no orgs" prompt with no path back to their actual org list short of a page reload. | open | Log in as `TEST_EMAIL_1` (has 11 real orgs) → navigate to `/dashboard` → click "AI Maker" role card. Intermittently (reproduced during a live E2E run 2026-07-28) the "Redirect to CivicDataSpace" modal appears over an org-selection screen with zero cards, instead of the real 11-org grid. Verify org membership independently via `python -c "from scripts._api_client import get_access_token, graphql; t=get_access_token(); print(graphql(t, org_id='1', query='query{myOrganizations{id name slug}}'))"` — returns 11 orgs, confirming the frontend, not the account, is at fault. | `tests/e2e/test_evaluation_workspace.py::TestAIMakerRoleNavigation::test_clicking_ai_maker_goes_to_org_selection`, `test_org_selection_shows_civicdatalab`, `test_org_selection_has_multiple_orgs`, `test_selecting_civicdatalab_navigates_to_dashboard`; `tests/e2e/test_evaluation_workspace.py::TestEvaluatorRoleNavigation::test_switch_roles_returns_to_role_selection` (reclassified 2026-07-31 from bug #3 — a scripted repro isolated from concurrent CI load showed the `/dashboard/ai-maker` org-selection screen stuck on a bare "Loading" state for 40s+ after clicking the AI Maker card, with no redirect modal and no session loss; this is a more severe sibling of this row's race — instead of `isLoading` flipping to `false` with an empty array, the `myOrganizations` query itself never resolves within the observation window, so `isLoading` never flips at all. Same query, same family, worse symptom.) | 2026-07-28 |
@@ -42,6 +42,16 @@ Format: append-only. When a bug is fixed in the app, mark `status: fixed` and th
 | 28 | evaluations list / sorting | Clicking a sortable column header (e.g. "Evaluation Name") on the evaluations table's first click does **nothing at all** — no visual reorder, and the header's `aria-sort` attribute stays `None`/absent. The second click (and every click after) does re-sort the rows correctly. Confirmed live 2026-08-13 with a scripted repro that clicked the "Evaluation Name" header 3 times in a row with a 3s settle between each: click 1 → row order and `aria-sort` unchanged from the pre-click state; click 2 → rows visibly reordered; click 3 → rows reordered again — but `aria-sort` never changes from `None` across all three clicks, so screen-reader users get no indication a sort is active even once engaged (a secondary a11y defect on top of the primary one-click-eaten defect). The `DataTable-module_Heading__*` header button is rendered by the shared `opub-ui` `DataTable` component (no local source in `ParakhAI-frontend` — it's a compiled dependency), so the root cause could not be pinned to an exact line; likely a debounce/state-init bug where the component's internal sort-state only starts reacting to clicks after the first one initializes it. | open | Log in as `TEST_EMAIL_1` → AI Maker → CivicDataLab → Evaluations. Click the "Evaluation Name" column header once. Row order is unchanged and `document.querySelector("th button:has-text('Evaluation Name')").getAttribute('aria-sort')` stays `null`. Click it again — rows now visibly reorder. | `tests/e2e/test_evaluations_list_controls.py::TestSortableHeaders::test_sort_by_name_toggles_order` | 2026-08-13 |
 
 | 30 | evaluations list / default sort | The default (unfiltered, unsorted) `audits` GraphQL query the evaluations list loads with does **not** order by recency — a newly created draft never appears on the list's landing page, no matter how long you wait or how many times you hard-reload. Root-caused 2026-08-17 via a live network capture of the actual `GetAudits` response (not a synthetic probe): four separate fresh-draft creations in the same org (audit ids 2042–2045, confirmed to exist individually via `audit(auditId)` and to rank at the top of a raw `audits(limit:20)` GraphQL call with no `sortOptions`) each produced an identical captured frontend response — `ids=['1916','1957','1953','1943','1944','1954','1961','1909','1964','1958']`, `total=141` — completely unrelated to the just-created id and byte-identical across all four runs, including after a full `page.reload()` + 45s app-ready wait. Response headers carried no `cache-control`/`age`/`x-cache` (200, no HTTP caching), so this isn't a CDN/browser cache — the frontend's actual `GetAudits` call (with its real field selection, distinct from a bare `id name status` probe) is deterministically returning the same fixed page of ~10 rows regardless of what's been created since, meaning its effective sort key is something other than recency (or a query-plan/index quirk that happens to be stable across requests). User impact: creating an evaluation and clicking "Back to List" gives no way to find your own draft without knowing to search or filter — among 141 rows it could be anywhere. Related to bug #13 (same `audits`/`GetAudits` query family, full-field-vs-light-field behavior) but a distinct symptom — not a hang, a wrong/stale-looking default ordering. | open | Log in as `TEST_EMAIL_1` → AI Maker → CivicDataLab → New Evaluation → Bulk → Start (creates a draft, capture its `auditId` from the URL) → Back to List. The draft's row (`a[href*='auditId=<id>']`) is absent from the table even after a full page reload and a 45s wait. Confirm via GraphQL that the audit exists (`audit(auditId: "<id>")`) and that a raw `audits(limit:20)` call (no `sortOptions`) ranks it near the top — yet the frontend's own list request returns a fixed, unrelated set of older ids. Reproduced 4/4 times in complete isolation (`-n 1 --reruns 0`, no concurrent suite load) 2026-08-17. | `tests/e2e/test_add_evaluation_bulk.py::TestBulkDraftPersistence::test_new_draft_appears_in_draft_tab_with_wizard_link` | 2026-08-17 |
+| 31 | a11y / homepage contrast | The active feature tab on the homepage ("Automation-assisted Evaluation Environment", classes `bg-[#E8E4FF] text-[#6849EE]`) has a contrast ratio of 4.49:1 against the 4.5:1 AA minimum for 16px normal-weight text (WCAG 1.4.3). axe `color-contrast`, serious. Only visible once the client-rendered tabs have mounted — the pre-existing homepage axe test scans the pre-hydration skeleton and never sees it. Darkening the text (e.g. `#6242E6`) fixes it. | open | Load `https://dev.parakh.civicdataspace.in/`, wait for the tab row, run axe with tags `wcag2aa`: one `color-contrast` node `.bg-\[\#E8E4FF\]`, "contrast of 4.49 (foreground #6849ee, background #e8e4ff)". | `tests/accessibility/test_accessibility_hydrated.py::TestHydratedHomepageAxe::test_color_contrast_meets_aa` | 2026-10-31 |
+| 32 | a11y / homepage feature tabs | The four feature "tabs" are plain `<button type=button>` elements; the selected one is shown only by a lavender background class. None carries `aria-pressed`, `aria-selected` or `aria-current`, and there is no `role=tab`/`tabpanel`, so assistive tech cannot tell which view is active (WCAG 4.1.2, 1.4.1). The older `test_feature_tabs_have_aria_states` skips on this page because it looks for `[role=tab]`. | open | Load `/`, click "Expert-led Evaluations", inspect the four buttons: no ARIA state attribute changes. | `tests/accessibility/test_accessibility_hydrated.py::TestHydratedHomepageFeatureTabs::test_selected_tab_is_exposed_to_assistive_tech` | 2026-10-31 |
+| 33 | a11y / homepage language of parts | The hero sub-heading "Improving AI across English, हिन्दी, ଓଡ଼ିଆ, অসমীয়া and more" mixes Hindi, Odia and Assamese words into English text with no `lang` attribute on them (only `<html lang="en">` exists on the page). Screen readers pronounce them with English rules (WCAG 3.1.2 Language of Parts, AA; GIGW 3.0). Wrap each word in `<span lang="hi">` etc. | open | Load `/`, inspect `h2` under the hero: two `span.block` with no `lang`; `document.querySelectorAll('[lang]')` returns only `html`. | `tests/accessibility/test_accessibility_hydrated.py::TestHydratedHomepageLanguage::test_non_english_passages_declare_their_language` | 2026-10-31 |
+| 34 | a11y / NextAuth sign-in page | `/api/auth/signin` (the page every anonymous deep link redirects to) renders the Keycloak provider logo as `<img id="provider-logo">` (and a dark-mode twin) without an `alt` attribute. axe `image-alt`, critical, WCAG 1.1.1. The logo is loaded from `authjs.dev`. A custom NextAuth `signIn` page or `theme` config would let the frontend control this markup. | open | Open `https://dev.parakh.civicdataspace.in/api/auth/signin`; `[...document.querySelectorAll('img')].map(i => i.getAttribute('alt'))` → `[null, null]`. | `tests/accessibility/test_accessibility_signin.py::TestProviderSigninPage::test_provider_logo_has_alt_attribute` | 2026-10-31 |
+| 35 | SEO / sitemap | `GET /sitemap.xml` returns HTTP 200 with `Content-Type: text/html` and the homepage HTML shell (a soft 404). Crawlers expect either a sitemap XML document or a 404. The old `test_sitemap_accessible` only asserts 200 so it passes on this. | open | `curl -A 'Mozilla/5.0' -i https://dev.parakh.civicdataspace.in/sitemap.xml` → `200 text/html; charset=utf-8`, body `<!DOCTYPE html>...`. | `tests/api/test_sitemap_content.py::TestSitemap::test_sitemap_is_xml_or_not_found` | 2026-10-31 |
+| 36 | security / API host Server header | The GraphQL API host `dev.api.parakh.civicdataspace.in` answers with `Server: nginx/1.24.0 (Ubuntu)`, disclosing nginx version and OS. The frontend host was fixed for the same issue (SEC-003, 2026-07-03); the API host's nginx still has `server_tokens on`. | open | `curl -A 'Mozilla/5.0' -I 'https://dev.api.parakh.civicdataspace.in/graphql/?query=%7B__typename%7D' -H 'Accept: application/json'` → `server: nginx/1.24.0 (Ubuntu)`. | `tests/api/test_api_host_headers.py::TestApiHostHeaders::test_server_header_does_not_disclose_version` | 2026-10-31 |
+| 37 | security / API host duplicate headers | Responses from the API host carry two copies of `X-Frame-Options` (`DENY` and `SAMEORIGIN`), `Referrer-Policy` (`same-origin` and `strict-origin-when-cross-origin`) and `X-Content-Type-Options` (identical). Two layers (app + nginx) each add their own; conflicting copies are invalid and browsers resolve them inconsistently. | open | Same request as #36; inspect raw response headers (`requests` `resp.raw.headers.getlist('X-Frame-Options')` → `['DENY', 'SAMEORIGIN']`). | `tests/api/test_api_host_headers.py::TestApiHostHeaders::test_security_headers_are_not_duplicated_with_conflicting_values` | 2026-10-31 |
+| 38 | a11y / mobile menu dialog name | The mobile hamburger menu opens a Radix sheet `<div role="dialog">` with no `aria-label`/`aria-labelledby`/title. axe `aria-dialog-name`, serious, WCAG 4.1.2. | open | At 390px width load `/`, click "Open menu", run axe: `aria-dialog-name` on `#radix-:rN:`. | `tests/accessibility/test_accessibility_mobile_menu.py::TestMobileMenuSheet::test_dialog_has_accessible_name` | 2026-10-31 |
+| 39 | a11y / mobile menu close button | The close (X) button inside the open mobile menu is icon-only; its only text is an empty visually-hidden `<span>`, so it has no accessible name. axe `button-name`, critical, WCAG 4.1.2. | open | At 390px load `/`, click "Open menu", run axe: `button-name` on `.Button-module_kindTertiary__p3qgr`. | `tests/accessibility/test_accessibility_mobile_menu.py::TestMobileMenuSheet::test_close_button_has_accessible_name` | 2026-10-31 |
+| 40 | a11y / mobile menu focus return | After the mobile menu is dismissed (Escape or close), keyboard focus lands on `<body>` instead of returning to the "Open menu" button that opened it, so keyboard and screen-reader users lose their place (WCAG 2.4.3). Likely the sheet is opened from external state rather than a Radix `Trigger`. | open | At 390px load `/`, Tab/click "Open menu", press Escape, `document.activeElement.tagName` → `BODY`. | `tests/accessibility/test_accessibility_mobile_menu.py::TestMobileMenuSheet::test_focus_returns_to_hamburger_after_close` | 2026-10-31 |
 
 ## Conventions
 
@@ -92,3 +102,4 @@ Format: append-only. When a bug is fixed in the app, mark `status: fixed` and th
   - **Three pure framework bugs fixed in `test_regression_new_features.py`**: two locators mixed a `text=/regex/flags` selector with plain CSS in one comma-joined string (documented anti-pattern, `tasks/lessons.md` 2026-05-18/2026-07-28 — Playwright's flags-parser consumes past the comma) — rewrote both with `.or_(get_by_text(re.compile(...)))`; the shared `_nav_to_eval_detail` helper's fixed 3.5s wait was far short of the documented 15-30s+ curtain and only survived because most of its callers soft-retry-then-xfail on an empty result — fixed to poll for curtain-absence **and** a positive `"Evaluation Overview"` content marker (content can flash empty in between, same caveat `NewEvaluationPage.wait_for_wizard_loaded` already documents).
   - **Everything else that failed in a concurrent group but passed cleanly in isolation was pure bug #3/#12-family noise** — worker crashes (`node down: Not properly terminated`, resource contention from running 2 headless Chromium instances concurrently on this dev machine), `Page.goto` timeouts hitting the shared dev backend, one `net::ERR_INTERNET_DISCONNECTED`, and one 100%-skip group (group 5's first pass) traced to a transient Keycloak/login blip that cleared on an immediate re-run of the same single test. None of these were touched, filed, or fixed, per this file's own convention.
   - Final state: all 12 groups re-verified clean (0 unexplained failures) after fixes; 12 local commits, not pushed (see final report for the full list). No `.github/workflows/ci.yml` changes.
+- **Phase 14 — public-surface coverage queue** (2026-10-31): live review of `https://dev.parakh.civicdataspace.in` without credentials (`/`, `/api/auth/signin`, protected-route redirects, mobile menu, API host headers, robots/sitemap). Key finding: `HomePage.go_to_home()` returns at the `load` event, when nav/hero/tabs/footer (all `next/dynamic` `ssr:false`) are not mounted yet, so the pre-existing homepage axe scan inspects an empty skeleton and passes while the hydrated page has `color-contrast` (#31) and `link-name` (#9) violations. New tests wait for hydration first. Filed #31-#40, each asserted as correct behaviour under strict xfail. #16 note: the fix (ParakhAI-frontend#437) is on `main`/prod but not on the `dev` branch.

From 32673c41e08df023f861daa560afad2c355b2e04 Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Thu, 5 Nov 2026 18:40:26 +0530
Subject: [PATCH 14/15] test(a11y): drop the mobile menu dialog-name xfail; PR
 #16 covers it once frontend#442 ships

---
 pages/home_page.py                                | 13 -------------
 .../test_accessibility_mobile_menu.py             | 15 ---------------
 2 files changed, 28 deletions(-)

diff --git a/pages/home_page.py b/pages/home_page.py
index 1ceb91f..dae058c 100644
--- a/pages/home_page.py
+++ b/pages/home_page.py
@@ -226,19 +226,6 @@ def open_mobile_menu_and_wait(self) -> None:
         self.open_hamburger_menu()
         self.page.locator(self.MOBILE_MENU_DIALOG).first.wait_for(state="visible")
 
-    def get_mobile_menu_dialog_name(self) -> str:
-        """Accessible name of the open sheet: aria-label, else the text of the
-        element(s) referenced by aria-labelledby, else empty."""
-        return self.page.locator(self.MOBILE_MENU_DIALOG).first.evaluate(
-            r"""el => {
-                const label = (el.getAttribute('aria-label') || '').trim();
-                if (label) return label;
-                const ids = (el.getAttribute('aria-labelledby') || '').split(/\s+/).filter(Boolean);
-                return ids.map(id => (document.getElementById(id)?.textContent || '').trim())
-                          .join(' ').trim();
-            }"""
-        )
-
     def get_mobile_menu_close_button_name(self) -> str:
         """Accessible name of the sheet's icon-only close button (empty if unnamed)."""
         return self.page.locator(self.MOBILE_MENU_CLOSE_BUTTON).first.evaluate(
diff --git a/tests/accessibility/test_accessibility_mobile_menu.py b/tests/accessibility/test_accessibility_mobile_menu.py
index 07bdb65..74d33c5 100644
--- a/tests/accessibility/test_accessibility_mobile_menu.py
+++ b/tests/accessibility/test_accessibility_mobile_menu.py
@@ -16,21 +16,6 @@
 
 
 class TestMobileMenuSheet:
-    @pytest.mark.xfail(
-        strict=True,
-        reason="App bug #38: mobile menu sheet (role=dialog) has no accessible name — see docs/app_bugs.md",
-    )
-    def test_dialog_has_accessible_name(self, mobile_page: Page):
-        """The open mobile menu is announced with a name (WCAG 4.1.2, axe `aria-dialog-name`)."""
-        home = HomePage(mobile_page).go_to_home()
-        home.open_mobile_menu_and_wait()
-
-        name = home.get_mobile_menu_dialog_name()
-        assert name, (
-            "The mobile menu <div role=dialog> has neither aria-label nor a resolvable "
-            "aria-labelledby, so screen readers announce an unnamed dialog."
-        )
-
     @pytest.mark.xfail(
         strict=True,
         reason="App bug #39: mobile menu close (X) button has no accessible name — see docs/app_bugs.md",

From efd69c1b45d475648f1c894051aa3b7b00f92b8c Mon Sep 17 00:00:00 2001
From: Saqib <saqibmanan6@gmail.com>
Date: Thu, 5 Nov 2026 18:40:26 +0530
Subject: [PATCH 15/15] docs: point bug #38 at the dialog-name test in PR #16

---
 docs/app_bugs.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/app_bugs.md b/docs/app_bugs.md
index 33d36d4..3031345 100644
--- a/docs/app_bugs.md
+++ b/docs/app_bugs.md
@@ -49,7 +49,7 @@ Format: append-only. When a bug is fixed in the app, mark `status: fixed` and th
 | 35 | SEO / sitemap | `GET /sitemap.xml` returns HTTP 200 with `Content-Type: text/html` and the homepage HTML shell (a soft 404). Crawlers expect either a sitemap XML document or a 404. The old `test_sitemap_accessible` only asserts 200 so it passes on this. | open | `curl -A 'Mozilla/5.0' -i https://dev.parakh.civicdataspace.in/sitemap.xml` → `200 text/html; charset=utf-8`, body `<!DOCTYPE html>...`. | `tests/api/test_sitemap_content.py::TestSitemap::test_sitemap_is_xml_or_not_found` | 2026-10-31 |
 | 36 | security / API host Server header | The GraphQL API host `dev.api.parakh.civicdataspace.in` answers with `Server: nginx/1.24.0 (Ubuntu)`, disclosing nginx version and OS. The frontend host was fixed for the same issue (SEC-003, 2026-07-03); the API host's nginx still has `server_tokens on`. | open | `curl -A 'Mozilla/5.0' -I 'https://dev.api.parakh.civicdataspace.in/graphql/?query=%7B__typename%7D' -H 'Accept: application/json'` → `server: nginx/1.24.0 (Ubuntu)`. | `tests/api/test_api_host_headers.py::TestApiHostHeaders::test_server_header_does_not_disclose_version` | 2026-10-31 |
 | 37 | security / API host duplicate headers | Responses from the API host carry two copies of `X-Frame-Options` (`DENY` and `SAMEORIGIN`), `Referrer-Policy` (`same-origin` and `strict-origin-when-cross-origin`) and `X-Content-Type-Options` (identical). Two layers (app + nginx) each add their own; conflicting copies are invalid and browsers resolve them inconsistently. | open | Same request as #36; inspect raw response headers (`requests` `resp.raw.headers.getlist('X-Frame-Options')` → `['DENY', 'SAMEORIGIN']`). | `tests/api/test_api_host_headers.py::TestApiHostHeaders::test_security_headers_are_not_duplicated_with_conflicting_values` | 2026-10-31 |
-| 38 | a11y / mobile menu dialog name | The mobile hamburger menu opens a Radix sheet `<div role="dialog">` with no `aria-label`/`aria-labelledby`/title. axe `aria-dialog-name`, serious, WCAG 4.1.2. | open | At 390px width load `/`, click "Open menu", run axe: `aria-dialog-name` on `#radix-:rN:`. | `tests/accessibility/test_accessibility_mobile_menu.py::TestMobileMenuSheet::test_dialog_has_accessible_name` | 2026-10-31 |
+| 38 | a11y / mobile menu dialog name | The mobile hamburger menu opens a Radix sheet `<div role="dialog">` with no `aria-label`/`aria-labelledby`/title. axe `aria-dialog-name`, serious, WCAG 4.1.2. | open | At 390px width load `/`, click "Open menu", run axe: `aria-dialog-name` on `#radix-:rN:`. | `tests/accessibility/test_mobile_nav_accessible_name.py::TestMobileNavAccessibleName::test_mobile_nav_dialog_has_accessible_name` (PR #16, gated on ParakhAI-frontend#442) | 2026-10-31 |
 | 39 | a11y / mobile menu close button | The close (X) button inside the open mobile menu is icon-only; its only text is an empty visually-hidden `<span>`, so it has no accessible name. axe `button-name`, critical, WCAG 4.1.2. | open | At 390px load `/`, click "Open menu", run axe: `button-name` on `.Button-module_kindTertiary__p3qgr`. | `tests/accessibility/test_accessibility_mobile_menu.py::TestMobileMenuSheet::test_close_button_has_accessible_name` | 2026-10-31 |
 | 40 | a11y / mobile menu focus return | After the mobile menu is dismissed (Escape or close), keyboard focus lands on `<body>` instead of returning to the "Open menu" button that opened it, so keyboard and screen-reader users lose their place (WCAG 2.4.3). Likely the sheet is opened from external state rather than a Radix `Trigger`. | open | At 390px load `/`, Tab/click "Open menu", press Escape, `document.activeElement.tagName` → `BODY`. | `tests/accessibility/test_accessibility_mobile_menu.py::TestMobileMenuSheet::test_focus_returns_to_hamburger_after_close` | 2026-10-31 |