Status: The current workflow sponsor has authorized Phase 1 planning and collector implementation for an independent Zivtech pilot. No live collection, evaluation, Accessibility Conformance Report (ACR), or publication workflow is authorized yet.
No endorsement: This is an independent proposal. Drupal core, the Drupal Association, GSA/OpenACR, and Mike Gifford have not endorsed or approved it.
Zivtech operates this repository as an independent Drupal 11 issue-traceability pilot. The Phase 0 package is also under community review in mgifford/drupal-core PR #57. Neither the Zivtech repository nor that pull request is an official Drupal project artifact. The pilot tests whether a frozen set of public Drupal.org issues can support remediation traceability without becoming evidence of conformance.
The short version:
- Drupal.org issues are remediation records and an evidence index. They do not determine Web Content Accessibility Guidelines (WCAG) outcomes or OpenACR terms.
- The proposed selection is limited to 25 public Drupal core issues. Comments are excluded.
- Mike Gifford is the proposed pilot release-scope owner. His acceptance of that role is still required.
- The current issuer state is
no issuer. The Drupal Association is the proposed future issuer, acting on behalf of the Drupal core project, but it has not accepted that role or named an authorized representative. No ACR publication handoff is allowed. - Any release evaluation must be commissioned separately and must define its own exact version, scope, baseline, sample, methods, and conformance target.
- Pilot charter
- Engagement record template
- Threat and provenance review
- Raw-response retention record template
- Independent critic review
- License and attribution policy
The profiling-only path is implemented and tested with synthetic inputs only.
Its source-level provenance renderer distinguishes profiled from
unavailable, records exact observation and cleanup times, keeps encoded and
decoded response-byte domains separate, and records the reviewed configuration,
authorization, and retention-record hashes. It states that no candidate is
created and excludes source values from the profile contract.
The authorization field maximum_requests: 1 means one top-level profiling
action. Any low-level retry remains bounded by the reviewed configuration and is
recorded as a separate transport attempt in the profile receipt; it does not
authorize another profiling action or another page.
After every live gate closes, the production command contract is:
node dist/src/profile-cli.js \
--config config/pilot.drupal11.json \
--authorization <reviewed-profile-authorization.json> \
--profile-root var/profiles
No production profiling authorization exists in this repository. Do not run this command against Drupal.org unless the named human reviews and the separate executable authorization are complete.
This is implementation/test evidence only. It does not authorize a Drupal.org request or establish a live profile, candidate, snapshot, evaluation, ACR, publication, rendered WCAG conformance, or assistive-technology coverage.
The sponsor's authorization permits a Phase 1 data plan and implementation of a read-only collector in this repository. A live collection run and promotion of a snapshot remain blocked until the collector, repository maintainer, evidence reviewer, and raw-response custodian are recorded, the retention controls are reviewed, and the specific live action is separately authorized. Mike Gifford's acceptance is still required before the work is described as an upstream or community pilot.
An official Drupal core ACR would additionally require the Drupal Association to accept the issuer role and name a representative, plus technical-scope approval from the Drupal Core Leadership Team and a separately commissioned evaluation.
Related guidance:
- Drupal core ACR process guidance
- Drupal.org REST and other APIs
- GSA OpenACR
- Community-review pull request
OpenAI Codex materially assisted with research and drafting. Humans remain responsible for the scope, source licensing, release ownership, evaluation, and any public claim.