Rule catalogue

axe-core, IBM Equal Access and our own ARC engine test every page a scan visits. pa11y runs on every page too, except very large pages its browser cannot load safely. Lighthouse audits the start page only. In-house analyzers run alongside them, some on every page and some only where a plan or a setting switches them on; the Where it runs column says which. Rule metadata comes from axe-core 4.12.1 and Lighthouse 13.4.1, the versions the scanner runs.

Findings then pass through a filter chain before anything reaches a report: engine output is normalised to one field contract, elements are re-queried against the live DOM so a finding the page contradicts is dropped, invisible and framework-managed markup is tagged, per-page caps stop one repeated defect from burying the rest, and the same defect found by several engines is collapsed into a single row that carries every selector it was seen on.

That collapse is why a rule below can list more than one engine, and why the Same defect as column exists: two engines with different rule names for one problem fold into one row rather than counting twice. Rules with a fix class go on to patch generation, where the candidate fix is applied in a sandbox and re-scanned, and is only offered if it removes the finding without introducing a new one.

There is no branded name for this stack. It is five engines, a set of in-house per-page analyzers, and the filter chain between them and you.

A rule list is not coverage. Automated testing finds roughly a third of WCAG problems. The rest need a person: whether captions are accurate, whether a focus order preserves meaning, whether an error message actually explains the error. We report which criteria were evaluated on each scan and mark the rest as not tested, rather than counting them as passes. No scan, ours included, can tell you a site conforms.

Seen firing and declared are different claims. 17 of 287 rules have been seen firing in our own test runs, against broken markup committed to this repository. The other 270 are declared by the engine that owns them, in its own rule metadata, and we have not yet watched them fire ourselves. The fix guides are where that demonstration lives.

Not every rule runs on every scan. 17 rules do not run on every page: Lighthouse audits the start page only, the mobile sweep runs on the start page and only on some plans, a few rules run only when a scan targets AAA, and a check that is built but not switched on yet says so. The Where it runs column assumes the default WCAG AA target; a scan that targets Level A skips the AA rules.

Rules are not the whole scanner. Contrast measurement, focus-graph analysis and the keyboard walk report through the same field but are measurements rather than named rules, so they are represented here only where they stamp a rule id. Engine-level accuracy is measured separately on the benchmark and in the field audits.