chore: back port the new workflow updates from 1.12

.agents/skills/ibm-a11y-level1-audit/SKILL.md

@@ -1,18 +1,21 @@
 ---
 name: ibm-a11y-level1-audit
-description: Audit Langflow frontend UI against IBM Equal Access Level 1 criteria, produce a compliance report, fix violations, and verify with Playwright a11y specs under src/frontend/tests/a11y. Use when the user asks for an IBM Level 1 a11y audit, Level 1 compliance report, accessibility remediation against IBM Able requirements, or to find/report/fix Level 1 WCAG issues.
+description: Perform a scoped IBM Equal Access Level 1 compliance audit of a chosen Langflow frontend surface (routes, components, or a PR) and produce a findings report mapped to WCAG/IBM Level 1 criteria. Default behavior is audit and report only — fixes are applied only when the user explicitly asks for remediation in the same request. Use when the user asks for an IBM Level 1 audit, a Level 1 compliance report, or to find/report Level 1 WCAG issues on a specific surface. For scanning a batch of routes without a report, see ibm-a11y-route-scan. For scanning and fixing an entire PR/branch end-to-end by default, see ibm-a11y-pr-remediation.
 ---
 
 # IBM Accessibility Level 1 Audit
 
-Audit → report → fix → verify. Scope is **IBM Equal Access Toolkit v7.3 Level 1 only**. Do not expand into Level 2/3 unless the user asks.
+Audit → report → (fix only if asked) → verify. Scope is **IBM Equal Access Toolkit v7.3 Level 1 only**. Do not expand into Level 2/3 unless the user asks.
+
+This skill's default deliverable is a **report**, not a diff. If the user wants a full scan-and-fix pass across an entire PR/branch, use `ibm-a11y-pr-remediation` instead — it is fix-by-default. This skill fixes only when the user explicitly asks for remediation of the audited surface in the same request.
 
 ## Related skills
 
 | Skill | Use for |
 |-------|---------|
-| [frontend-a11y-check](../frontend-a11y-check/SKILL.md) | How to write/run axe + IBM scans, baselines, component gotchas |
-| [ibm-a11y-automation](../ibm-a11y-automation/SKILL.md) | Python route scanner + Markdown/HTML report generation |
+| [ibm-a11y-testing-guide](../ibm-a11y-testing-guide/SKILL.md) | How to write/run axe + IBM scans, baselines, component gotchas |
+| [ibm-a11y-route-scan](../ibm-a11y-route-scan/SKILL.md) | Python route scanner + Markdown/HTML report generation |
+| [ibm-a11y-pr-remediation](../ibm-a11y-pr-remediation/SKILL.md) | Fix-by-default scan of an entire PR/branch |
 | [frontend-i18n](../frontend-i18n/SKILL.md) | Any new/changed accessible names or UI strings |
 
 ## Sources of truth
@@ -31,9 +34,9 @@ Level 1 Audit Progress:
 - [ ] 2. Scan (IBM + axe as applicable)
 - [ ] 3. Map findings to Level 1 criteria
 - [ ] 4. Write the report
-- [ ] 5. Fix violations
-- [ ] 6. Verify with tests/a11y
-- [ ] 7. Re-scan and update report status
+- [ ] 5. Fix violations (only if the user asked for remediation)
+- [ ] 6. Verify with tests/a11y (only if step 5 ran)
+- [ ] 7. Re-scan and update report status (only if step 5 ran)
 ```
 
 ### 1. Scope the surface
@@ -48,7 +51,7 @@ Read `src/frontend/tests/a11y/README.md` and list existing specs that already co
 
 ### 2. Scan
 
-Run **both** engines when the surface is interactive UI (see `frontend-a11y-check`):
+Run **both** engines when the surface is interactive UI (see `ibm-a11y-testing-guide`):
 
 ```bash
 # Playwright IBM scans (live DOM / stateful)
@@ -59,7 +62,7 @@ RUN_A11Y=true RUN_A11Y_ASSERT=true npx playwright test tests/a11y/<feature>.a11y
 npm run a11y:html-report --silent
 # → coverage/accessibility-reports/index.html
 
-# Ad-hoc route batch (default-loaded page only)
+# Ad-hoc route batch (default-loaded page only) — see ibm-a11y-route-scan for details
 uv run --with playwright python scripts/a11y/a11y_scan.py \
   --url http://localhost:3000 \
   --routes-file scripts/a11y/a11y_routes.json \
@@ -89,18 +92,18 @@ Use [references/report-template.md](references/report-template.md). Deliver the
 
 Required sections: Summary, Scope, Findings table, Fixes applied / proposed, Verification, Remaining risk / baselines.
 
-### 5. Fix violations
+**Stop here by default.** List proposed fixes in the report without editing files, unless the user's request explicitly also asked for remediation (e.g. "audit and fix", "fix what you find"). If they only asked for an audit or report, do not proceed to step 5.
+
+### 5. Fix violations (only when explicitly requested)
 
-When this skill is invoked for audit+fix (default), fix in-scope Level 1 violations:
+Only continue past the report if the user's request explicitly asked for fixes alongside the audit. Otherwise stop after step 4.
 
 - Prefer semantic HTML over ARIA.
-- Follow Langflow patterns in `frontend-a11y-check` (AG Grid, Radix `asChild`, focus restore, icon-only `aria-label`).
+- Follow Langflow patterns in `ibm-a11y-testing-guide` (AG Grid, Radix `asChild`, focus restore, icon-only `aria-label`).
 - Route new UI strings / `aria-label`s through `frontend-i18n`.
-- Do **not** silently disable scans. Use IBM baselines under `src/frontend/tests/a11y/baselines/` only for documented framework debt (see `frontend-a11y-check`).
+- Do **not** silently disable scans. Use IBM baselines under `src/frontend/tests/a11y/baselines/` only for documented framework debt (see `ibm-a11y-testing-guide`).
 - Keep fixes minimal; do not refactor unrelated UI.
 
-If the user asked for **report only**, stop after step 4 and list proposed fixes without editing.
-
 ### 6. Verify with `tests/a11y`
 
 Confirm path: `src/frontend/tests/a11y/`.
@@ -139,7 +142,7 @@ Scanners miss some Level 1 tasks — spot-check when relevant:
 
 ## Best practices (data grids + modals)
 
-When auditing or fixing **settings tables** (especially `/settings/global-variables`) and similar AG Grid + modal flows, treat these as Level 1 best practices (2.1.1 / 2.4.3) — not edge-case gotchas.
+When auditing **settings tables** (especially `/settings/global-variables`) and similar AG Grid + modal flows, treat these as Level 1 best practices (2.1.1 / 2.4.3) — not edge-case gotchas.
 
 ### Selectable-row keyboard map
 
@@ -163,10 +166,11 @@ Implementation notes:
 - Create modal opened from **Add New** should restore to that trigger (Radix default when a real `DialogTrigger` exists).
 - Verify with a Playwright keyboard test: open from a cell → Escape → `document.activeElement` is still that cell (or its `col-id`), then Enter can open again without a manual mouse re-focus.
 
-For AG Grid pagination/tab traps, Radix `asChild`, and popover Esc restore details, see [frontend-a11y-check](../frontend-a11y-check/SKILL.md) (Gotchas vs Best practices sections).
+For AG Grid pagination/tab traps, Radix `asChild`, and popover Esc restore details, see [ibm-a11y-testing-guide](../ibm-a11y-testing-guide/SKILL.md) (Gotchas vs Best practices sections).
 
 ## Out of scope (unless asked)
 
 - IBM Level 2/3 criteria listed as deferred in the criteria reference
 - Section 508 software-only rows (web UI covered via 4.1.2)
 - Media captions (1.2.x) when the surface has no audio/video
+- Fixing violations without an explicit remediation request (report only by default)

.agents/skills/ibm-a11y-pr-remediation/SKILL.md

@@ -0,0 +1,156 @@
+---
+name: ibm-a11y-pr-remediation
+description: Scan every frontend surface touched by the current PR/branch for IBM Equal Access Level 1 accessibility issues and fix all in-scope violations by default. Discovers changed files, maps them to routes/components/states, runs both axe and IBM engines, remediates until both are green (or only documented baselines remain), and reports back. Use when the user asks to check, scan, or clean up accessibility for "this PR", "my branch", or "my changes" and wants fixes applied, not just a report. For a single scoped audit report without a default fix pass, use ibm-a11y-level1-audit; for a route batch scan only, use ibm-a11y-route-scan.
+disable-model-invocation: true
+---
+
+# IBM Level 1 PR Accessibility Remediation
+
+Scope is **IBM Equal Access Level 1 only**. **Default mode is fix, not report-only.** Scan every frontend surface touched by the PR/branch and remediate all in-scope issues until both engines are green (or only documented baselines remain).
+
+This skill is a PR-scoped orchestrator. It does not duplicate detailed engine/pattern guidance — read the linked skills for that:
+
+- [ibm-a11y-testing-guide](../ibm-a11y-testing-guide/SKILL.md) — which engine/test layer to use, POUR checklist, axe-vs-IBM gaps, Radix/AG-Grid gotchas, baselines.
+- [ibm-a11y-route-scan](../ibm-a11y-route-scan/SKILL.md) — Python scanner options for ad-hoc route batches.
+- [ibm-a11y-level1-audit](../ibm-a11y-level1-audit/SKILL.md) — Level 1 criteria references and report template, useful when the user wants a formal audit report for the PR instead of (or in addition to) fixes.
+- [frontend-i18n](../frontend-i18n/SKILL.md) — accessible names / UI strings must go through i18n.
+
+## Mandate
+
+1. Diff the PR (or current branch vs its merge base) for `src/frontend/**` changes.
+2. Map changed files → UI surfaces → routes / components / states to scan.
+3. Run **both** axe (Jest where applicable) and IBM Equal Access (Playwright `page.runA11yScan` and/or `scripts/a11y/a11y_scan.py` — see `ibm-a11y-testing-guide` / `ibm-a11y-route-scan`).
+4. **Fix every in-scope Level 1 violation** in the changed surfaces. Do not stop at a findings list unless the user says **report only** (in that case, hand off to `ibm-a11y-level1-audit`).
+5. Re-scan until assert mode passes. Add/update a11y specs when coverage is missing.
+6. Report what changed, commands run, and any baselined/deferred debt.
+
+Do **not** invent new tag names, silently disable scans, or expand into IBM Level 2/3 unless asked.
+
+## Progress checklist
+
+```
+IBM L1 PR A11y:
+- [ ] 1. Collect changed frontend files
+- [ ] 2. Map files → surfaces / routes / states
+- [ ] 3. Scan (IBM + axe)
+- [ ] 4. Fix all in-scope violations
+- [ ] 5. Add/update tests if needed
+- [ ] 6. Re-scan assert-green
+- [ ] 7. Report back
+```
+
+## 1. Collect changed frontend files
+
+Prefer the PR merge base when a PR exists; otherwise the branch merge base vs `main`/`master`.
+
+```bash
+# PR number known
+gh pr diff <n> --name-only | grep -E '^src/frontend/' || true
+
+# Current branch vs upstream default
+BASE=$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD origin/master)
+git diff --name-only "$BASE"...HEAD -- 'src/frontend/**'
+
+# Include uncommitted work when the user is mid-change
+git diff --name-only HEAD -- 'src/frontend/**'
+git diff --name-only --cached -- 'src/frontend/**'
+git ls-files --others --exclude-standard 'src/frontend/**'
+```
+
+Include:
+- `src/frontend/src/**/*.{tsx,ts,jsx,js,css}` (UI)
+- `src/frontend/tests/a11y/**` (existing coverage)
+- Locale files only when they change accessible names / labels
+
+Skip pure non-UI churn unless it affects a11y (e.g. test helpers that change focus / ARIA). If **no** frontend files changed, say so and stop.
+
+## 2. Map files → surfaces
+
+For each changed file, identify:
+
+| Change type | Scan target |
+|-------------|-------------|
+| Page / route | That route + meaningful states (empty/populated/modal/mobile) |
+| Shared component (`TableComponent`, dialogs, menus) | **Every** consumer page that uses it — not only the file you touched |
+| Primitive | Jest axe on the primitive + any Playwright surface that embeds it |
+| Spec / baseline only | Re-run that spec; no product fix unless it fails |
+| `a11y_routes.json` | Update static coverage; run static or route scan |
+
+List interactive controls and states (default, empty, populated, open modal / menu, selected row, error, mobile). Prefer existing specs under `src/frontend/tests/a11y/`.
+
+## 3. Scan (both engines must pass)
+
+Automated a11y is not one tool — see `ibm-a11y-testing-guide` for the full engine comparison and gotchas. Summary:
+
+- **axe-core** — Jest `axe()` (`@/utils/a11y-test`), jsdom-only.
+- **IBM Equal Access** — stricter on ARIA structure and keyboard semantics. Playwright `page.runA11yScan(label)` for stateful surfaces (modals/menus/selected/editing); `scripts/a11y/a11y_scan.py` for default-loaded page only.
+
+```bash
+cd src/frontend
+RUN_A11Y=true RUN_A11Y_ASSERT=true npx playwright test tests/a11y/<feature>.a11y.spec.ts --project=chromium --workers=5
+
+# Python scanner playwright deps are NOT in default uv sync.
+# One-time: uv run --with playwright playwright install chromium
+uv run --with playwright python scripts/a11y/a11y_scan.py \
+  --url http://localhost:3000 \
+  --routes /settings/<route> \
+  --out /tmp/a11y.json --markdown /tmp/a11y.md --timeout-ms 45000
+```
+
+`RUN_A11Y=true` runs the scan; `RUN_A11Y_ASSERT=true` fails on new violations. After changing a shared component, re-scan every page that uses it.
+
+For component-only changes:
+
+```bash
+cd src/frontend
+npx jest path/to/<name>.a11y.test.tsx --runInBand
+```
+
+Do not invent findings — prefer scanner output plus manual Level 1 spot checks scanners miss (keyboard trap both ways, focus restore, 320px reflow, color-not-only).
+
+## 4. Fix all in-scope Level 1 violations
+
+Default: **fix**. Only list proposed fixes without editing if the user asked **report only** — then hand off to `ibm-a11y-level1-audit` for the formal report format.
+
+Rules:
+- Prefer semantic HTML over ARIA.
+- Follow the Langflow patterns in `ibm-a11y-testing-guide` (AG Grid, Radix `asChild`, focus restore, icon-only `aria-label`).
+- Route new UI strings / `aria-label`s through i18n (`t(...)`, all locale files) per `frontend-i18n`.
+- Keep fixes minimal; do not refactor unrelated UI.
+- Do **not** silently disable scans. Use IBM baselines under `src/frontend/tests/a11y/baselines/` only for documented framework debt.
+- Map each issue to a Level 1 WCAG/IBM id; defer anything listed as Level 2/3 in the criteria guide (`ibm-a11y-level1-audit/references/ibm-level1-criteria.md`) unless the user expands scope.
+
+### Manual Level 1 spot checks (when relevant)
+
+- **2.1.1 / 2.1.2:** Tab and Shift+Tab; Escape closes overlays; no trap.
+- **2.4.3 / 2.4.7:** Focus order matches visual order; focus ring visible.
+- **1.4.10:** 320px / ~400% zoom — no essential horizontal scroll.
+- **1.4.1:** Status/errors not color-only.
+- **3.3.1 / 3.3.2:** Errors in text and tied to fields; inputs labeled.
+
+## 5. Tests / coverage
+
+| Surface | Spec |
+|---------|------|
+| Static routes | `static-routes.a11y.spec.ts` (+ `scripts/a11y/a11y_routes.json`) |
+| Auth | `auth-pages.a11y.spec.ts` |
+| Core pages | `core-pages.a11y.spec.ts` |
+| Data-rich | `files.a11y.spec.ts`, `api-keys.a11y.spec.ts`, `global-variables.a11y.spec.ts` |
+| Other data-rich | `data-rich-routes.a11y.spec.ts` |
+
+If you fixed a state with no scan, add one (and keyboard tests for custom keyboard behavior) following `files.a11y.spec.ts` / `api-keys.a11y.spec.ts` patterns.
+
+Tag every Playwright a11y test `@release` plus a domain tag (`@workspace` / `@api` / `@database` / `@components` / `@starter-projects`). Import `test`/`expect` from `../fixtures`.
+
+## 6. Re-scan and report
+
+Re-run the same scans with `RUN_A11Y_ASSERT=true`. Each finding → `fixed` | `baselined` | `open`.
+
+When done, state:
+- Changed frontend files considered
+- Surfaces / states scanned
+- Fixes applied (files + what)
+- Commands run — whether **both** axe and IBM ran and both reported zero
+- Specs / baselines added or updated
+- States skipped and why
+- Remaining risk or accepted limitation

.agents/skills/ibm-a11y-automation/SKILL.md → .agents/skills/ibm-a11y-route-scan/SKILL.md

@@ -1,11 +1,11 @@
 ---
-name: ibm-a11y-automation
-description: Run Langflow's local accessibility scanner script against frontend routes from src/frontend/src/routes.tsx and summarize the JSON report.
+name: ibm-a11y-route-scan
+description: Batch-scan Langflow frontend routes for accessibility issues using the Python IBM Equal Access scanner (scripts/a11y/a11y_scan.py) and produce JSON/Markdown/HTML reports. Scans the default-loaded state of each route only (use explicit state files for modals). Use when asked to scan one or more routes, produce an accessibility report for pages, or batch-check static routes. Reports findings only — does not fix code, run Playwright/axe tests, or perform a formal Level 1 audit; see ibm-a11y-testing-guide, ibm-a11y-level1-audit, and ibm-a11y-pr-remediation for those.
 ---
 
-# Langflow Accessibility Scanner
+# IBM Route Scanner
 
-Use this skill when asked to scan Langflow frontend pages for accessibility issues.
+Use this skill when asked to scan Langflow frontend pages for accessibility issues with the local Python scanner. This skill only reports — it does not modify code. For test-writing guidance, formal audits, or PR-wide fixes, see `ibm-a11y-testing-guide`, `ibm-a11y-level1-audit`, and `ibm-a11y-pr-remediation`.
 
 ## Scanner
 
@@ -181,4 +181,4 @@ Use report fields directly:
 - Do not auto-click arbitrary buttons to find modals. Use explicit state actions.
 - Avoid destructive modal actions unless the user explicitly asks and data is safe.
 - If a route has zero API requests, mention that scan quality may be limited.
-- Ask before fixing files unless the user explicitly asks for fixes.
+- This skill reports only; do not edit files. If the user also wants fixes applied, hand off to `ibm-a11y-pr-remediation` or `ibm-a11y-level1-audit`.