Pressroom application: Accessibility Conformance Report

WCAG edition, based on VPAT® 2.5 (Rev, WCAG 2.2).

Name of product and version

Pressroom application: the web pages Pressroom serves, in two scopes that are rated separately.

• Staff application: the editorial web app that editors, contributors, publishers and administrators sign in to: src/app/(auth) (sign-in, password reset, two-factor, invite and join) and src/app/(dashboard) (every signed-in page). The former in-app marketing pages (/about, /welcome) were retired when the public site moved to pressrooom.com, a separate site this report does not cover; both paths now redirect there.
• Reader pages: the public pages a newsletter's readers reach: src/app/(reader) (/subscribe, /n/[slug]/subscribe, /archive, /n/[slug]/archive, /n, the reader 404 and error pages), the subscription confirmation /subscribe/confirm/[token], the unsubscribe and preference pages under /u (/u/[token], /preferences, /stay, /one-click, /u/digest/[token], /u/manage, /u/test/[token]), the web views /v/[token] and /v/test/[token], the shared preview /p/[token], the poll vote, thank-you and survey pages (/api/polls/[id]/vote), the archived edition pages, and the accessibility statement /accessibility.

The body of a newsletter edition, where a reader page shows it (archived edition, /v, /p), is the email's own HTML and is rated in email-acr.md. This report rates the page around it: its title, language, landmarks, headings, navigation bar and the notices those routes serve.

Version: main at 5a87a62c (2026-11-01). This is version 5 of the report. Version 1 rated main at 7e5a5dd7 (2026-10-26), version 2 main at b0c28c6d (2026-10-27), version 3 main at 56733a0f (2026-10-31) and version 4 main at ab9ca8fc (2026-11-01); all four are in the repository history, and "What changed since version 1" to "since version 4" under Notes list what moved.

Report date

Version 1 2026-10-26; version 2 2026-10-27; version 3 2026-11-01; version 4 2026-11-01; version 5 2026-11-01. Last reviewed 2026-11-01.

Product description

Pressroom is a multi-tenant newsletter editorial platform. Staff draft and review articles, assemble editions on a board and a canvas, check and send them, and manage subscribers, templates and integrations. Readers subscribe, confirm, change their preferences or unsubscribe, read past editions in a public archive and vote in polls. The staff application is a Next.js app built on shadcn/ui and Base UI primitives with a TipTap editor and drag-and-drop boards. The reader pages are small server-rendered pages: Next pages under (reader) and HTML that route handlers write directly (src/lib/unsubscribe/pages.ts, src/lib/subscribers/confirm-page.ts, src/lib/reader/web-edition.ts, src/app/api/polls/[id]/vote/route.ts).

The two scopes have different evidence and different results, so each criterion row gives one rating per scope.

Contact information

Report accessibility problems through the route on the public statement page /accessibility (the deployment's HELP_URL, or the newsletter's contact address on a newsletter's own host). Issues are tracked in the Pressroom repository (Gitea chris/pressroom, umbrella #2122).

Notes

• Self-authored. Nobody outside the project has audited the application. A third-party audit is planned only if a procurement process asks for one (owner decision #1352 D-4).
• No screen reader has been used yet, on either scope. Every keyboard verdict comes from synthetic key events in Playwright or in component tests, and every "what a screen reader is given" verdict comes from the accessibility tree (Playwright ariaSnapshot()), component tests and source review. Nobody has listened to these pages with NVDA, JAWS or VoiceOver. That pass is an owner step: for the reader pages the script is written (sr-script-reader.md, target 2026-12-15, #2139); for the staff application it is planned now that the #2138 fixes are in (target 2027-04-02). Rows whose outcome depends on what is announced (4.1.2, 4.1.3, 2.4.3) say so, and a Supports in those rows means "no known defect in what the accessibility tree and the code expose", not "heard and confirmed".
• How ratings were given. "Supports" is used only where source review and a runtime check (axe in e2e/a11y.spec.ts or e2e/a11y-scroll-regions.spec.ts, the 2026-10 reader re-audit's keyboard walk, a measurement, or a component test that renders the fixed component and asserts its role, name, state or key handling) agree and no audit finding against the criterion is open. A criterion with an open or partly finding on this version is never rated Supports. An axe pass on its own was not taken as proof. A fix that exists only in an open pull request does not count: its row is rated as main stands and names the PR.
• Not Evaluated at A and AA. VPAT 2.5 reserves "Not Evaluated" for AAA. This report also uses it at A and AA, for the few criteria nobody has tested on this product, because any other rating would claim a result that no evidence supports. Each such row names the check that would settle it and its target date.
• Content is the customer's. Staff write the articles, choose the images and alt text, and set some colors (newsletter branding). Where an outcome depends on that content, the remark says so.
• What changed since version 1. Version 1 rated main at 7e5a5dd7 and did not count tranche C (#2336) or the /v web-copy structure (#2337), which were open pull requests then. Both are on main at this version, together with the kanban card's visible Delete item (#2348, UI-23), /submit as a real form (#2350, UI-36), the subscribe form's in-page address check (#2360, RD-10), batch D (#2362: UI-09, UI-10, UI-42, UI-55, UI-56) and batch E (#2365: UI-11, UI-19, UI-24). Every reader finding (RD-01 to RD-13) is fixed; on the #2138 checklist only UI-08 is still unticked. Re-rating found three new staff findings, UI-57 to UI-59 (Known limitations, item 3). The reader and email accessibility gate (#2144, PR #2369) is an open pull request at this version and is not counted.
• What changed since version 2. Version 3 re-rates only the five staff rows that UI-08, UI-58 and UI-59 held at Partially Supports (#2609, a child of #2529): 1.3.1, 1.4.3, 1.4.11, 2.4.6 and 2.5.7 are Supports on this version. The fixes merged after version 2 was rated: #2376 (UI-08: opacity stacks, status dots and chart marks measured, held by non-text-contrast.test.ts), #2375 (UI-58: the /articles/[id] h1 and named rails, the /settings/health heading order, and strict staff scans), #2398 (UI-59: Narrower and Wider buttons on kanban columns; UI-60: readiness words beside the dots and bars) and #2404 (UI-61: the team analytics bands at 3:1). #2609 also replaces the last nine decorative opacity stacks with the solid --muted-foreground, so the stack check waives none. #2375 also wired the forms UI-57 names; the rows that finding holds (3.3.1, 3.3.3, 4.1.3) are not re-rated in this version and keep version 2's rating.
• What changed since version 3. Version 4 re-rates only the three staff rows UI-57 held, against main at ab9ca8fc. #2375 (UI-57) tied the errors of the forms #2365 left alone to their fields; 3.3.1 and 3.3.3 are Supports on this version. 4.1.3 stays Partially Supports: the proof dialog's address check shows its error as you type, in no live region (UI-62, new).
• What changed since version 4. Version 5 re-rates only the staff 4.1.3 row, against main at 5a87a62c. #2630 (UI-62, #2629) gives the proof-send dialog's address check a polite role="status" region, so the staff row is Supports on this version; like every row that depends on what is announced, it is not yet heard with a screen reader (the staff pass, target 2027-04-02). Version 5 also re-checked, on main, that the other staff forms the row names still announce their status messages. UI-62 leaves the known limitations and 4.1.3 the remediation targets.

Evaluation methods used

1. Editorial UI audit, 2026-09-13 (11-audit/ui-accessibility-audit-2026-09-13.md). WCAG 2.2 AA; axe-core 4.11.3 via Playwright over 35 reachable routes in light and dark, a 390 px pass, a scripted keyboard sweep, and a source review in five areas. 54 consolidated findings UI-01 to UI-54 (4 critical, 22 serious, 18 moderate, 10 minor). No screen reader.

2. Triage of those findings, 2026-10-26 (#2136, ui-audit-triage-2026-10.md, checked against main at 5b2ed029 by source re-reading): 8 closed, 29 partly, 14 open, 3 obsolete. It also lists the coverage gaps reused under Known limitations.

3. Fixes since the triage, on this version, read from the merged PRs and the #2138 checklist (the finding status this report uses):

   • tranche A (#2324): --ring and --input at 3:1, a solid 2 px focus ring, color-scheme, contrast of the destructive, affirmative and read-more colors, every icon-only button named, and Button icon sizes that require a label at the type level;
   • tranche B (#2327): aria-modal on dialogs, the triage deck and template modal as real dialogs, settings and editor controls labeled, upload errors announced, guided-mode and triage-deck announcements, field-named validator messages, group labels, row-specific control names, presence names;
   • tranche C (#2336): aria-current and aria-pressed for painted state, comment marks as role="mark", a section picker below 1024 px on article types, the APG tabs pattern and aria-expanded disclosures, CardTitle as a heading and a main on the auth pages, sr-only state text on health dots, no button inside a link, no aria-label on generic elements, chart and histogram summaries, the empty /assembly slot as a real button with a menu, DOM focus in the Ready queue and ideas list, scoped single-key shortcuts with an off switch, Move up / Move down on the social queue, sections and blocks, aria-current="date" on the calendar, named strip slots, a keyboard column splitter, Shift+F10 in the kanban help, and table semantics on the people roster and social queue;
   • #2348 (Delete… in the kanban card's visible Move-to menu) and #2350 (/submit as a <form>);
   • batch D (#2362): palette text in both themes, held by a new calculation over every class string, the /audit actor chips measured, 24 px drag and resize targets, a presence pulse that stops after 4 s, and a <title> on global-error.tsx;
   • batch E (#2365): errors tied to their fields on the forms it lists, table semantics on the kanban and calendar grids, and the UI-24 runtime check below.

   Their tests include src/lib/__tests__/design-token-contrast.test.ts, src/lib/__tests__/palette-text-contrast.test.ts, src/components/__tests__/icon-button-names-2138.test.tsx, src/components/__tests__/a11y-forms-overlays-2138.test.tsx, src/components/__tests__/a11y-state-reorder-2138c.test.tsx, src/components/__tests__/a11y-forms-2138e.test.tsx, src/components/articles/__tests__/kanban-board-table.test.tsx, kanban-board-keys.test.tsx, kanban-card-actions.test.tsx, kanban-target-size.test.tsx and submit-form-2335.test.tsx, and, for this version, src/components/__tests__/acr-app-v2-checks.test.tsx (health-dot state text and chart names, which had no test of their own).

4. Reader-page re-audit, 2026-10-26 (#2137, reader-reaudit-2026-10.md, on main at 5b2ed029): axe-core 4.14.0 at serious through minor on 46 route states, at 1280 and 390 px, in both color schemes (184 runs); reflow at 320 px; a keyboard walk measuring order, viewport and focus-indicator contrast at every stop; scripted keyboard flows; the accessibility tree and <title> of each route. Thirteen findings RD-01 to RD-13, then the "Status after #2139" table for the fixes in #2331, #2337 and #2360, all marked fixed.

5. Regression scan in CI, e2e/a11y.spec.ts: axe with the tags wcag2a wcag2aa wcag21a wcag21aa wcag22aa best-practice, blocking on serious and critical, logging moderate and minor. It scans about 30 staff routes in both themes and the reader routes at 1280 and 390 px (list under Known limitations), and asserts the /v and /v/test structure (one main holding an h1, no unhidden empty paragraph) and the subscribe form's in-page error. On this version's run on main (CI run 8667, b0c28c6d, green) the logged moderate and minor findings were on staff routes only: heading-order on /settings/health, and landmark-unique and page-has-heading-one on /articles/[id], in both themes (UI-58). Since #2375 the staff and auth scans are strict as well: a moderate finding fails the job, and MODERATE_ALLOW_LIST is empty, so on version 3 those three rules pass on both routes in both themes. e2e/a11y-scroll-regions.spec.ts (#2365) stages enough stories and ideas that every inner scroll region on /pipeline (both views), /assembly and /ideas overflows, then runs axe's scrollable-region-focusable: 12 regions judged, none unreachable (UI-24).

6. Source review for this report. Version 1: autoComplete on the sign-in, account and subscribe forms, session lifetime (src/lib/auth/config.ts), and aria-modal on src/components/ui/dialog.tsx. Version 2, on b0c28c6d: each fix the #2138 and #2139 checklists tick, re-read in the files their PRs changed; the forms #2365 left alone because batch D was changing their files; the kanban column splitter's pointer handling (src/components/articles/kanban-column.tsx); the remaining text-muted-foreground/NN opacity sites (UI-08); and the remaining infinite animations (loading skeletons and progress steps). Version 4, on ab9ca8fc: every form #2375 lists for UI-57, re-read on main for the field the error marks (aria-invalid), what describes it (aria-describedby), how the message is announced and what it tells the user to do (the 3.3.1, 3.3.3 and 4.1.3 rows name the files). Version 5, on 5a87a62c: proof-send's ProofAddressAnnouncer (src/components/newsletter/proof-send.tsx), and again each staff form the 4.1.3 row names for how its status message is announced (the alerts, live statuses and toasts listed there, the settings save bar's role="status" and the Toaster the dashboard mounts).

Applicable standards and guidelines

Conformance target: WCAG 2.2 Level AA. The legal bar this report is most often read against is WCAG 2.1 Level AA (ADA Title II, below). Every 2.1 A and AA criterion is a 2.2 criterion, except 4.1.1 Parsing, which 2.2 removed and which is listed anyway. The six criteria new in 2.2 are marked (2.2 only) in the tables, so the 2.1 AA result is the tables with those rows left out. The summary gives both.

Neither scope conforms to WCAG 2.1 AA or 2.2 AA on this version. The reader pages have no open audit finding; what stands between them and 2.1 AA is language of parts (3.1.2), four criteria not yet evaluated (five at 2.2), and the screen-reader pass. The staff application rates 2 criteria Partially Supports (2 at 2.1 AA) and none Does Not Support; six criteria are not yet evaluated (three at 2.1 AA).

Terms

• Supports: the functionality of the product has at least one method that meets the criterion without known defects, or meets it with an equivalent facilitation.
• Partially Supports: some functionality of the product does not meet the criterion.
• Does Not Support: the majority of product functionality does not meet the criterion.
• Not Applicable: the criterion is not relevant to the product.
• Not Evaluated: the product has not been evaluated against the criterion (see Notes on its use at A and AA).

Summary

WCAG 2.2

WCAG 2.1 AA (2.2-only rows left out)

WCAG 2.2 report

Columns: the staff application's rating, then the reader pages'. Finding IDs are UI-nn (triage memo and the #2138 checklist) and RD-nn (reader re-audit). Target dates for every row below Supports are collected under Known limitations.

Table 1: Success Criteria, Level A

Table 2: Success Criteria, Level AA

Legal context

These two paragraphs describe the rules this report is usually read against. They are not legal advice; a covered entity's counsel decides how the rules apply to it.

ADA Title II. The U.S. Department of Justice's rule on the web content and mobile apps of state and local governments (28 CFR part 35, subpart H, §§ 35.200–35.205, published 2024-04-24) adopts WCAG 2.1 Level AA as the technical standard. Under the interim final rule of 2026-04-20 (91 FR 20902, effective on publication; comments closed 2026-06-22, so the dates could still change when it is finalized), a public entity with a total population of 50,000 or more must comply by 2027-04-26; smaller entities and special district governments by 2028-04-26. The rule applies to web content an entity provides or makes available, directly or through contractual, licensing or other arrangements, so content a vendor builds or posts for the entity is covered. The third-party exception is only for a third party that is not posting under a contractual, licensing or other arrangement with the entity (28 CFR 35.201(d)). In that arrangement Pressroom is the vendor and the newsletter office is the covered entity, and the reader pages (sign-up, archive, preferences, polls) and the archived editions would ordinarily fall within the web content the office makes available to the public. The archived-content exception applies only to content that was created before the compliance date, is kept only for reference, research or recordkeeping, is held in an area clearly designated as an archive, and has not been changed since it was archived. An edition sent after the office's own compliance date (2027-04-26 or 2028-04-26, by population), or edited after it was archived, does not qualify. Neither the rule text nor DOJ's ada.gov guidance mentions email; the email output is rated separately in email-acr.md. Sources: ada.gov, "Fact Sheet: New Rule on the Accessibility of Web Content and Mobile Apps Provided by State and Local Governments"; the interim final rule, 91 FR 20902 (2026-04-20); and the rule text at eCFR, 28 CFR 35.200.

Colorado HB21-1110 (signed 2021-06-30) requires the Office of Information Technology to set accessibility standards for state information technology from the most recent WCAG. A state agency not in full compliance by 2024-07-01 is in violation of the state's laws against disability discrimination and subject to their remedies. It allocates liability between public bodies: "Liability for noncompliance as to content lies with the public entity or state agency that manages the content, whereas noncompliance of the platform hosting the content lies with the public entity or state agency that manages the platform." On Pressroom the office manages its content (articles, images, alt text, the colors it chooses) and Pressroom supplies the platform (templates, reader pages, the staff application) as the office's vendor; what the vendor owes the office is a matter for the contract and the office's counsel, not something this report decides. HB24-1454 (signed 2024-05-24) gave a public body that showed good-faith efforts, posted quarterly progress reports and ran a redress process immunity from liability until 2025-07-01, one year past the 2024-07-01 deadline; that period has ended, so the Colorado deadline has passed. Sources: leg.colorado.gov, HB21-1110 and leg.colorado.gov, HB24-1454.

Known limitations

1. Self-authored, and no screen reader has been used on either scope (see Notes). Owner steps: the reader script by 2026-12-15, a staff pass on the four formerly critical flows (palette, /assembly, kanban, settings) and UI-28 by 2027-04-02. Until then a Supports in 2.4.3, 4.1.2 and 4.1.3 rests on the accessibility tree, component tests and the code.
2. Open pull requests are not counted. The reader and email gate (#2144, PR #2369: strict reader scans, more reader routes in CI, keyboard checks of the reader forms) was open at version 3. It has merged since, but versions 4 and 5 re-rate only the UI-57 and UI-62 rows, so its evidence is not yet counted elsewhere. It adds evidence; it changes no rating here.
3. New findings on this version, to be added to the #2138 checklist (proposed in PR #2372, which publishes this version):
   • UI-57 (3.3.1, 3.3.3, 4.1.3): #2365 tied errors to their fields on the forms it lists but left alone every form in a file batch D (#2362) was changing at the time (the media picker, manual send, the template structure tab, newsletter forms, reader host, automation rules, the poll card, the add-idea dialog and others). Closed in version 4 (#2375).
   • UI-58 (1.3.1, 2.4.6): the CI scan's moderate findings on main: /articles/[id], the article editor, has no h1 and a landmark that repeats another's role and name; /settings/health skips a heading level. Closed in version 3 (#2375).
   • UI-59 (2.5.7): kanban column resize has a keyboard splitter (UI-51) but no single-pointer alternative to the drag, for example a width setting or wider and narrower buttons. Closed in version 3 (#2398).
4. Routes the audits did not reach.
   • Staff, never scanned at runtime: the architect-gated /settings/workflow and /settings/webhooks, and /settings/newsletters/[id]/website (where /settings/links now redirects).
   • Staff, not in e2e/a11y.spec.ts (scanned only in the 2026-09 pass, if at all, on older code): /calendar, /search, /media, /audit, /discovery, /editions, /editions/[id]/analytics, /ideas/brainstorm, /notifications and its preferences, /qa/email, /snippets, /setup, /article-preview/[id], /login/two-factor, /two-factor-setup, /onboarding, and every settings page except /settings, /settings/subscribers, /settings/health and /settings/house-style (among them article types, integrations, users, branding, newsletters, account and security). Fixes on these routes rest on source review and component tests. /ideas, /pipeline and /assembly are also in the scroll-region scan.
   • Staff states never scanned: empty and error states, validation-error markup, popovers and hover cards, the AI assist bar, the comment thread, the crop editor, drag in progress; one tenant and one data shape only. There has been no browser keyboard walk of the staff app since the 2026-09 audit; key handling since then is tested in components.
   • Reader: error.tsx was reviewed from source only (it needs a server fault). /u/test, /u/manage, /u/[token]/one-click, the bad-token notices and most ?signup= results were audited once but are not in the CI scan (#2144, open PR #2369). Only Chromium was used.
5. Not measured: 200% text resize (1.4.4), text spacing (1.4.12), help placement (3.2.6), reader navigation order and multiple ways (3.2.3, 2.4.5), content on hover (1.4.13, staff), focus obscured by sticky content (2.4.11, staff), redundant entry in the staff multi-step flows (3.3.7) and the staff app at 320 px. (Opacity-stacked muted text and icons, and graphics colored outside the text classes, are measured since version 3: UI-08, #2376.)
6. Customer content. Alt text, images and the colors an office picks are the office's; the email ACR covers the checks Pressroom runs on them.
7. Language. English only in the interface; no language-of-parts control.

Remediation targets

Every row rated below Supports, with what closes it and the target date. All dates are before 2027-04-26. Dates come from the #2138 and #2139 checklists; "evaluate" means a check that decides the rating, not a known defect.

Closed since version 1 (rated Supports on this version): staff 1.1.1, 1.4.1, 2.1.1, 2.1.4 (was Does Not Support), 2.2.2, 2.4.1, 2.4.2, 2.4.3, 3.3.2, 4.1.2, 2.4.7 and 2.5.8; reader 1.3.1, 1.3.3, 2.4.1, 3.3.1, 3.3.2 and 2.4.6. Closed since version 2 (rated Supports on version 3): staff 1.3.1, 1.4.3, 1.4.11, 2.4.6 and 2.5.7 (#2609). Closed since version 3 (rated Supports on version 4): staff 3.3.1 and 3.3.3 (UI-57, #2375). Closed since version 4 (rated Supports on version 5): staff 4.1.3 (UI-62, #2630).

Legal disclaimer

This report is self-authored by the Pressroom project. It describes the application as of the version and date above, from the evidence listed under Evaluation methods. It is not a third-party certification, and the Legal context section is a summary of public sources, not legal advice.