Holo-RGAA

Production-ready RGAA 4.1.2 accessibility auditing in Rust — from scan to legally opposable documents, across 12 EU countries.

Holo-RGAA audits a website against all 106 RGAA criteria in one unified pipeline: deterministic checks (axe-core + RGAA-specific heuristics), vision-LLM evaluation for judgment-required criteria, and guided manual tests — then generates the official deliverables: technical audit report, publishable accessibility declaration, and validated JSON payload.

Existing scanners — axe-core, WAVE, Asqatasun — are DOM-only: they parse HTML attributes and never look at the page. That caps them at roughly 50 verifiable criteria and leaves the rest as "manual testing required", which in practice means never tested.

Holo-RGAA covers the full 106-criterion path:

Every finding ships with DOM node, AXTree path, screenshot hash, and justification. rgaa-remediation turns verdicts into framework-aware patches (React/Vue/Angular/vanilla) that the agent re-verifies against a fresh screenshot.

Speed: ~20–40× faster than manual audits (≈1–2h of consultant review for a 15-page site instead of 45–75h), with up to 8 concurrent audits and tiered LLM routing.

An audit is only half the job — Holo-RGAA produces the documents administrations and courts expect:

• Déclaration d'accessibilité — publishable HTML per country: FR 7-section DINUM model, UE 2018/1523 core with EN/DE templates, per-country enforcement blocks. Semantic markup, no intrusive CSS.
• Audit report PDF — tagged PDF via headless Chromium (PDF/A-1a profile for France).
• JSON pivot — schema-validated payload with per-country extensions and registry adapters (Ara, AgID open data, NL register, WAS-Tool DK, PT observatory).
• Guardrails — export is blocked on a short sample, missing feedback contact, unproven non-conformity, incomplete derogation, or a legal pack unreviewed for 12+ months (unless a named, timestamped override is recorded).

Covered: FR, DE, ES, IT, BE, NL, LU, PT, AT, IE, SE, DK. One audit, one set of figures everywhere — a single rgaa-report engine parameterised by national Referentiel, which the orchestrator, CLI and TUI all share.

The Référentiel Général d'Amélioration de l'Accessibilité (RGAA) is France's accessibility standard (law 2005-102, art. 47), mandatory for public-sector sites and many private services. Version 4.1.2 defines 106 criteria across 13 topics. Compliance follows the Taux Global:

Taux Global = Conforme / (Conforme + Non Conforme) × 100   (NA/NT excluded)

Across the EU, directive 2016/2102 and EN 301 549 require the same kind of public accessibility statement with national transpositions — hence the 12-country packs above.

curl -sSL https://raw.githubusercontent.com/jamon8888/Holo-RGAA/master/install.sh | bash

That's it. Launch the TUI with rgaa. Windows (PowerShell):

irm https://raw.githubusercontent.com/jamon8888/Holo-RGAA/master/rgaa-rs/install.ps1 | iex

export PATH="$HOME/.local/bin:$PATH"
rgaa                                # interactive TUI
rgaa audit https://example.com      # headless audit
cp .env.example .env                # then set RGAA_LLM_* for AI-assisted evaluation

TUI shortcuts: a audit, h history, s settings, q quit.

rgaa

┌──────────────────────────────────────┐
│      rgaa — RGAA Accessibility       │
│              Auditor                 │
│                                      │
│    [A]udit URL                      │
│      Run a new accessibility audit   │
│                                      │
│    [H]istory                        │
│      View past audit results         │
│                                      │
│    [S]ettings                       │
│      Configure API key and prefs     │
│                                      │
│    [Q]uit                          │
│      Exit rgaa                       │
└──────────────────────────────────────┘

The Audit Wizard runs the audit live with color-coded scores, per-criterion drill-down (violations, justification, confidence), install wizard, and settings wizard for the MyIA key.

rgaa install                          # install wizard (interactive TUI)
rgaa audit                            # audit wizard (interactive TUI)
rgaa audit https://example.com --export results.json
rgaa history                          # past audits
rgaa config show                      # current configuration
rgaa config set api-key "your-key"    # MyIA API key
rgaa config set base-url "https://api.example.com"

# Policy gate — block CI if non-compliant
rgaa audit --url https://example.com --export audit-bundle.json
rgaa-cli policy --input audit-bundle.json --threshold 85

Audit https://example.com for RGAA compliance and report the global rate.

The Codex plugin packages the same local rgaa-mcp server with seven skills for audits, triage, remediation, verification, reports, guided tests, and criterion reference. From the repository root, add the local marketplace with codex plugin marketplace add ., then install rgaa-accessibility-codex from Codex desktop's Plugin Directory. See the Codex plugin README for setup details.

import requests

resp = requests.post("http://localhost:3000/audit", json={
    "url": "https://example.com",
    "config": {"max_pages": 10, "max_depth": 3}
})
audit_id = resp.json()["audit_id"]

result = requests.get(f"http://localhost:3000/audit/{audit_id}").json()
print(f"Taux Global: {result['taux_global']}%")
print(f"Status: {result['etat_conformite']}")

• Deterministic checks, gap-fix heuristics, and LLM evaluation in a single pass
• Spider crawl with configurable depth and page limits
• Evidence capture at every step (DOM snapshots, AXTree, screenshots with SHA-256 hashes)

• TUI — rgaa Ratatui app: audit wizard, history, install/setup wizards
• CLI — rgaa-cli for terminal audits and CI integration
• MCP Server — rgaa-mcp for Claude Code and Codex workflows
• REST API — rgaa-api for HTTP integration
• Rust Library — direct integration via rgaa-core

• Headless Chromium via CDP; clicks, form fills, wait-for states before scan
• Cookie injection before navigation (catches auth redirects); secrets via RGAA_COOKIE_<NAME>
• Keyboard IGT with stable DOM-path focus identity and trap detection
• Screenshots (PNG/JPEG) with configurable policy

• Patch proposals with diffs per failing criterion (React, Vue, Angular, vanilla)
• Approval states (required / auto-approved / rejected), batching (1–25 issues)
• Visual re-verification of fixes against fresh screenshots

• Configurable compliance thresholds per client/audit
• NeedsReviewPolicy::Fail — deny analysis if any finding requires manual review
• Pass/fail gating for CI/CD pipelines

┌──────────────────────────────────────────────────────┐
│                   rgaa-orchestrator                   │
│         (unified pipeline: axe + LLM + IGT)          │
└─────────────┬──────────────────┬─────────────────────┘
              │                  │
    ┌─────────▼──────┐  ┌──────▼──────┐  ┌────────────▼────────┐
    │   rgaa-rules   │  │  rgaa-holo  │  │   rgaa-obscura      │
    │  axe-core 4.x   │  │   MyIA      │  │  CDP browser        │
    │  + gap-fix JS   │  │   LLM       │  │  automation         │
    └─────────┬──────┘  └──────┬──────┘  └────────────┬────────┘
              │                 │                      │
              └────────────────┬┴─────────────────────┘
                               │
                    ┌──────────▼──────────┐
                    │      rgaa-core       │
                    │  106 criteria domain │
                    └──────────┬───────────┘
                               │
              ┌────────────────┼────────────────────────┐
              │                │                        │
       ┌──────▼─────┐   ┌─────▼──────┐  ┌───────▼───────┐  ┌────────▼────────┐
       │  rgaa-tui  │   │  rgaa-mcp  │  │   rgaa-api    │  │  rgaa-report   │
       │  Ratatui   │   │   MCP 3.x  │  │  HTTP REST    │  │ compliance math │
       │  TUI app   │   └────────────┘  └───────────────┘  │ + documents     │
       └────────────┘                                     └─────────────────┘

1. CDP Launch — headless Chromium via Chrome DevTools Protocol
2. Navigation — cookies injected first, then page load
3. Pre-scan Actions — clicks, fills, wait-for states
4. axe-core Run — in-page violations + gap-fix patches for RGAA false negatives
5. MyIA Evaluation — judgment-required criteria with page context
6. IGT Keyboard Test — tab path capture, trap detection
7. Aggregation — findings merged with evidence, compliance computed once in rgaa-report

Production scale is enforced in code, not documentation: static data built once (OnceLock), up to 8 concurrent audits, LLM tiered routing with capped 8k-char page contexts and circuit breaker, polite streaming crawler, metadata-only history reads, per-request API limits with load shedding.

Total: 73 Deterministe, 32 IaAssiste, 1 Manuel (sums to 106)

Every binary loads a .env file from the working directory (or any parent) at startup; variables already set in the real environment take precedence. Start from .env.example:

cp .env.example .env

Legacy HOLO3_API_KEY, HOLO3_BASE_URL and HOLO3_MODEL remain available for migration. With no explicit provider and no MYIA_API_KEY, they select the historical holo3 route; they do not override another explicitly selected provider.

Cookie values can be injected from RGAA_COOKIE_<NAME> (e.g. session → RGAA_COOKIE_SESSION).

Any OpenAI-compatible provider works without a recompile — only the endpoint, key and model change:

# Fully local, no outbound traffic
RGAA_LLM_PROVIDER=ollama
RGAA_LLM_MODEL=qwen2.5:14b-instruct

# Cheap model for the bulk, strong one for the hard criteria
RGAA_LLM_PROVIDER=groq
RGAA_LLM_API_KEY=gsk_...
RGAA_LLM_MODEL=llama-3.3-70b-versatile
RGAA_LLM_MODEL_TACTICAL=llama-3.1-8b-instant

Anthropic models are reached through openrouter: the Messages API is not OpenAI-compatible, so there is no anthropic provider.

# .rgaa/config.yaml
policy:
  threshold: 85
  fail_on_needs_review: true
  allowed_domains:
    - "*.example.com"
browser:
  timeout_ms: 30000
  viewport_width: 1280
  viewport_height: 720
llm:
  enabled: true
  model: "swift-1.5-27b"
  timeout_ms: 60000

rgaa-rs/
  Cargo.toml              # Workspace root (17 crates)
  crates/
    rgaa-core/           # Domain types, 106-criteria catalog
    rgaa-rules/           # axe-core integration, gap-fix snippets
    rgaa-holo/           # OpenAI-compatible LLM clients
    rgaa-browser-tools/  # Browser automation via CDP
    rgaa-obscura/        # CDP browser automation (Rust-native)
    rgaa-agent/          # Agentic evaluator + RAG stack
    rgaa-orchestrator/   # Pipeline orchestration
    rgaa-tui/            # Interactive TUI (Ratatui)
    rgaa-api/            # Axum HTTP API
    rgaa-mcp/             # MCP server
    rgaa-cli/            # CLI interface
    rgaa-storage/        # PostgreSQL storage
    rgaa-remediation/    # Fix proposal generation
    rgaa-report/         # Compliance engine + official documents
    rgaa-spider/         # Streaming crawler
    rgaa-data/           # Shared static data
    rgaa-test-corpus/    # Test fixtures

See AGENTS.md for development guidelines.

MIT