TabLocus - Accessibility QA: Keyboard & ARIA

TabLocus is a deterministic developer and QA engineering inspector built to detect keyboard navigation barriers, focus state defects, and broken ARIA relationships on the currently active webpage. Instead of running generic 80-rule scans that generate false positives and obscure priority issues, TabLocus focuses exclusively on the interaction layer: sequential tab order, focus visibility, focus obscuration, modal trapping, and relational ARIA references. Every detected finding provides a stable CSS locator, computed accessible name, exact DOM snippet, reproduction steps, and suggested remediation code. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ KEY AUDIT CAPABILITIES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 1. KEYBOARD TAB ORDER & SEQUENTIAL FLOW - Identifies disruptive positive tabindex attributes that alter natural reading and navigation order. - Validates skip-link targets to verify destination containers exist in the DOM and accept programmatic focus (tabindex="-1"). - Detects unreachable interactive controls, including clickable <div> and <span> elements missing keyboard roles and tabindex. 2. FOCUS VISIBILITY & DUAL-STATE VERIFICATION - Audits active controls for explicit focus outline suppression (outline: none / 0). - Dynamically compares default and active states to verify whether alternative indicators (box-shadow, high-contrast borders, background shifts) exist. - Flags confirmed invisible focus states where keyboard users cannot visually trace navigation. 3. FOCUS OBSCURATION DETECTION (WCAG 2.2 SC 2.4.11) - Calculates 2D bounding rectangle intersections between focusable targets and sticky/fixed headers, navigation bars, and overlays. - Pinpoints 100% full visual occlusions and flags high-risk partial overlaps where focused controls disappear behind floating UI. 4. ARIA RELATIONSHIPS & ACCESSIBLE NAMES - Validates relational ARIA attributes (aria-labelledby, aria-describedby, and aria-controls) to ensure referenced element IDs exist in the live DOM. - Flags unlabelled form controls (<input>, <select>, <textarea>) missing associated <label> elements or accessible names. - Identifies icon buttons and SVG controls lacking computed accessible names. - Flags duplicate ID references that create ambiguous programmatic bindings. 5. MODAL & DIALOG CONTAINMENT - Inspects active <dialog> and ARIA role="dialog" overlays for accessible titles. - Verifies modal containers contain focusable interactive elements. - Detects focus escape conditions where active keyboard focus sits outside an open modal. 6. REPRODUCIBLE QA BUG TICKET EXPORT - Generates structured Markdown bug reports formatted for instant pasting into GitHub Issues, Jira, or Linear. - Computes a deterministic SHA-256 audit fingerprint (TL-xxxx) for each report run. - Redacts form values and placeholders in snippets to prevent accidental token exposure. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ON-DEVICE AI ASSISTANCE (CHROME BUILT-IN AI) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ On supported browsers (Chrome 138+ with built-in LanguageModel enabled), TabLocus offers optional on-device AI triage to summarize high-priority keyboard blockers. If Chrome Built-in AI is unavailable, TabLocus uses its deterministic rule-based priority engine. No external AI APIs are contacted, and no webpage data leaves your machine. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ PRIVACY & SECURITY ARCHITECTURE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ - 100% Local Execution: Analysis runs entirely within your active browser tab. - Zero External Requests: No telemetry, no analytical beacons, no third-party scripts. - No Persistent Host Permissions: Uses activeTab and scripting only. The extension executes only when explicitly triggered by clicking the extension action. - Zero Remote Code: No eval(), no remote script loading, fully compliant with Manifest V3 policies. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ KNOWN TECHNICAL BOUNDARIES ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ - Cross-Origin iframes: Due to browser sandbox security boundaries, content inside cross-origin iframes cannot be traversed without broad host permissions. Inaccessible iframes are explicitly counted and reported in the audit scope. - Closed Shadow DOM: Elements inside closed shadow roots cannot be accessed via standard DOM APIs. - Dynamic Single-Page Applications: Run TabLocus across different interactive application states (e.g., opened menus, modal views) to test each view. - Automated Testing Scope: TabLocus is an automated diagnostic engineering tool. It does not certify legal compliance with WCAG, ADA, Section 508, or EAA. Comprehensive accessibility verification requires manual testing with assistive technologies and human validation.