[Swissystem7]

CT-010 (owner: Goza). Health pass for ScoutAI. Draft only, nothing merged.

Scope limit: overlap with open PR #206

Before starting I checked open PRs. Draft PR #206 (CT-007 health pass) already changes ARCHITECTURE.md (new), README.md, demo.js, package-lock.json (new) and test/byod.test.js. Per the CT-010 rules this PR does not touch any of those files. So the ARCHITECTURE.md and README parts of CT-010 are left to #206, and the one bug I found in demo.js is reported below, not fixed. #16 is a decision issue, not a PR. This PR does not change product direction.

What changed

• Tap targets, 44×44 px (WCAG 2.5.5), on index.html, trap/index.html, licence.html, offer.html. Measured at a 375px mobile viewport before → after: index 31 → 0, trap 46 → 0, licence 7 → 0, offer 7 → 0 targets under 44px. Checkboxes and radios are now 24px and sit inside labels that are at least 44px tall, so the label is the tap target.
  • skip links: 34px → 44px tall
  • lesson/course step buttons ("1", "2", …): 31–35px wide → at least 44px
  • range sliders: 16–32px → 44px tall
  • checkbox/radio labels: at least 44px tall
  • footer and nav links ("רישיון", "סדנה", "חזרה למעבדה"): 16px → 44px
• Keyboard access (WCAG 2.1.1). axe scrollable-region-focusable (serious) flagged 5 scrollable boxes that keyboard users could not scroll: #explorerTable, #methodText, #exportJson, #atticRank, #archiveDump. Each now has tabindex="0", role="region" and a Hebrew aria-label. axe WCAG 2.1 A/AA now reports 0 violations on all four pages, contrast included.
• Install and run cleanly. Added npm start (tools/serve.js), a zero-dependency static server on 127.0.0.1:8080. The lab can't run from file:// because it fetches data/*.json. The server only serves the shipped product: it refuses .git, attic/, tools/, test/ and node_modules/, and it can't be tricked into reading files outside the repo. Added engines: node >=18. Runtime dependencies are still zero.
• Tests. New test/ct010-health.test.js covers the server (serves the page, the dataset and trap/; 404 for missing files; refuses paths outside the repo or in blocked folders), the 44px CSS rules on each page, and the keyboard regions. npm test (one command): 155 pass, 0 fail. Before this PR it was 147/147.
• TEST_EVIDENCE.md: replaced the stale "runs 3 files" command with the current node --test run.

Checked, nothing to fix

• Secrets: none found in the code (I searched for keys, tokens and private keys). .gitignore already covers .env, *.key and *.pem.
• Input validation / XSS: I fuzzed it in Chromium with a file upload (JSON and ;-CSV) whose names, teams, positions and provenance contain "><img onerror> / <svg onload>, plus the same payload in #sel=, #cmp= and #out=, then clicked every button. No script ran and there were no page errors. Every innerHTML sink goes through escapeHtml.
• Dependencies: there are none, so there was nothing to upgrade.
• .github/workflows was not touched.

Bugs found but not fixed (file is locked by #206)

• demo.js parseMetricHash: a non-numeric value in a shared link sets that weight to 0 instead of the default. For example, #g=abc gives Grit 0, not 40, and Clutch then dominates. The comment above pick() says a missing key keeps its default, but a malformed key doesn't. Fix: in pick(), fall back when !Number.isFinite(Number(value)). Belongs in CT-007: ScoutAI health pass #206 or a follow-up after it merges.

Needs Aviran's decision

• Merge order: CT-007: ScoutAI health pass #206 first, then this PR. They share no files, so either order merges cleanly.
• Should the parseMetricHash fix go into CT-007: ScoutAI health pass #206 or a separate follow-up PR?
• ARCHITECTURE.md and the README run instructions for this repo come from CT-007: ScoutAI health pass #206. Please confirm that covers CT-010, or ask for a README line about npm start once CT-007: ScoutAI health pass #206 merges.
• .github/copilot-instructions.md still says npm test runs only three files. That is stale, but agent-instruction files were outside my brief, so I didn't touch it.

How to verify

npm test
npm start   # then open http://localhost:8080/

---

Generated by Claude Code

[Swissystem7]

Duplicate of #206 (CT-007). Work stopped; keep #206. Do not merge.

[Swissystem7]

Superseded by #206. The commit from this PR (44px targets, keyboard scroll regions, npm start with tools/serve.js, TEST_EVIDENCE.md, test/ct010-health.test.js) was cherry-picked onto #206 as cbb97d5, with no conflicts. The parseMetricHash bug this PR reported in demo.js is now fixed on #206 too (8291079, with a test that fails without the fix). On that branch: npm test 156 pass, 0 fail. Leaving this PR open for Aviran to close; nothing merged.