Source authority policy | Accessibility Test Cases

Purpose

This policy controls how sources may influence a procedure. A citation does not make a procedure accurate, and a successful link check does not mean the source was read or reviewed.

The machine-readable registry is Source/source-registry.json. It records authority, publication status, access and check dates, content-review state, supersession and procedure dependencies separately.

Authority matrix

Tier	Authority	Permitted use	Prohibited interpretation
1	WCAG 2.2, applicable WAI-ARIA and web-platform specifications, ACT Rules Format 1.1, ISO 14289-1:2014 and ISO 14289-2:2024	Normative requirements for the technology and claim to which the source applies	Guidance, vendor behaviour or an ACT result may not override these requirements
2	WCAG Understanding documents, Techniques and Failures, W3C-approved ACT Rules, ARIA Authoring Practices Guide, W3C accessibility-support and disabled-user guidance	Interpretation, examples, supporting checks and practical guidance	These sources do not add WCAG requirements; techniques are not mandatory methods; ACT passes normally cover only part of a criterion
3	WCAG-EM 1.0 and WCAG-EM 2.0	WCAG-EM 1.0 is stable informative website-evaluation guidance; WCAG-EM 2.0 may be labelled draft input for broader digital-product methodology	WCAG-EM 2.0 is not W3C-endorsed, mandatory or settled methodology
4	Current first-party product documentation from NV Access, Freedom Scientific, Apple, Google, Microsoft, Adobe and relevant tool vendors	Commands, settings, terminology, supported versions and product behaviour	Vendor guidance may not redefine WCAG or prove cross-platform support
5	Government service manuals, PDF Association material and other respected industry guidance	Supplementary practice, implementation and quality guidance	Industry material is not called official for a standard unless it is issued by the authority for that standard

Requirement mappings

Each procedure mapping records:

source and requirement identifier;
requirement level;
conformance, secondary, advisory, platform or usability type;
full, partial, diagnostic or supporting coverage;
canonical source, status, version and verification date;
reviewer notes, limitations and fields that depend on the source.

An ACT rule is always a secondary, partial or diagnostic mapping in this library. Its result cannot directly set a WCAG success-criterion decision.

Source checks and content review

last_accessed means only that a retrieval was attempted. last_successfully_checked means that the source responded successfully to the source checker. Neither field proves that the source content was reviewed.

content_review_state, content_last_reviewed, review_notes and the procedure review record provide the content-review evidence. Access-controlled, rate-limited and timed-out sources require manual review and must not be reported as definitively broken.

After the code commit and a current source check, run npm run prepare:release-evidence to create reports/source-review/source-review.json with one row for each unresolved signal. Each resolution must identify the registered source, exact reviewed URL, reviewer, date, review method, disposition and evidence reference. Run:

python3 Source/check-official-links.py --review-record reports/source-review/source-review.json --require-resolved --report reports/source-check-release.json

The checker retains the original network classification. It records resolved_by_human_review only when a valid record matches the registered or final URL. A note that a source was unavailable does not resolve its content status.

Rights and commercial use

Source authority and source rights are separate. Source/source-registry.json records why a source may influence a method; Source/source-rights.json records the still-unresolved legal basis for commercial use, attribution, modification and redistribution. An authoritative or publicly accessible source is not automatically reusable in a commercial product.

Run npm run rights:check and npm run check:rights-schema for inventory integrity. Run npm run rights:scan to queue local wording candidates. The scan does not compare full external publications and is not a legal determination. npm run verify:commercial-rights fails until a qualified authorised reviewer completes every disposition and the ownership/licensing decision. See Rights and attribution.

PDF standards

PDF/UA-1 and PDF/UA-2 are separate profiles:

ISO 14289-1:2014 applies to PDF/UA-1.
ISO 14289-2:2024 applies to PDF/UA-2 and PDF 2.0.
Matterhorn Protocol 1.1 is an industry conformance-testing model for PDF/UA-1. It is not a PDF/UA-2 protocol.

Evidence for one ISO part must not be relabelled as evidence for the other.