End-user (compliance) & accessibility: v2 launch readiness

[sc2ben]

End-user (compliance manager / ISMS owner) and accessibility findings from the pre-v2 review, gating the public launch. [confirmed] = verified; [unverified] = plausible, confirm before acting.

Open items

• [unverified] high — overdue reviews never resurface. Review-overdue is computed at build time (now() in templates/policies/page.html), so a quiet repo never surfaces an overdue review. Add a CI warning step + a scheduled rebuild in the starter workflow.
• [unverified] high — accessibility of interactive/report UI. Compliance report sections are keyboard-inoperable and hidden without JS (templates/reports/base.html); PDFs are produced untagged (typst invoked with no accessibility flag); guide tabs are click-only (static/js/main.js).
• [confirmed] medium — trust metadata & document marking. No draft indicator on the website; every policy page asserts "Last reviewed and approved on …" regardless of build mode; the owner is never displayed. Redacted/draft PDFs carry no in-document marking (filename only); every PDF footer hardcodes "Confidential" regardless of actual classification.
• [unverified] medium — audit deliverable gaps. The artifact is loose PDFs only — no manifest, revision index, or coverage report. The starter ships no review/coverage report pages. Coverage % counts typo'd taxonomy terms as covered (templates/TSC2017/list.html).
• [unverified] medium — a11y sweep. Skip-link targets missing on several page types (the link is defined in base.html, the target is not); no h1 on policy pages; logo <img> has no alt (templates/macros/header.html); search suggestions lack ARIA/results announcement; mermaid images in PDFs have no alt text.
• low/info bulk (~60 items). Naming polish, guide gaps vs current CLI flags, minor styling — in the internal review journal.
• Low - timestamping In addition to the audit pack, PDFs should be crypto-graphically timestamped

Part of the Public Launch gate. Full evidence (file:line) is in the internal review notes.