Verification

Verification

What has actually been checked, by what, and what has not.

The long form lives in the repository as docs/AFFIRMATION.adoc, which states every claim alongside the command that produced it and the timestamp it ran at. This page is the summary and the pointer.

What is checked automatically

The workspace builds and its tests pass. 13 crates; the suite runs 429 assertions across 42 suites with zero failures and zero ignored. cargo test --workspace is the whole contract — there is no suite that has to be remembered and run by hand.

The rendered HTML is audited for structural accessibility. Every route the server exposes is swept twice, from a unit test and from an integration test, and the resulting HTML is put through fourteen structural rules:

a11y.button-text · a11y.control-label · a11y.duplicate-id · a11y.fake-widget · a11y.h1-count · a11y.heading-skip · a11y.img-alt · a11y.landmark-name · a11y.lang · a11y.link-text · a11y.main · a11y.positive-tabindex · a11y.skip-link · a11y.title

This is a dev-dependency; no shipped binary links it. It exists as its own crate rather than a test helper precisely so the unit sweep and the integration sweep cannot drift apart.

This wiki is checked by BerryWiki itself. The pages you are reading carry the metadata blocks described in Page Format, berrywiki check reports them clean, and _Sidebar.md is generated by berrywiki sidebar --write rather than hand-edited.

What that audit deliberately cannot tell you

It answers the only part of accessibility a program can answer alone: whether the structure a screen reader and a keyboard depend on is present. It cannot tell you whether the reading order makes sense, whether a label is a good label, whether the focus ring is visible against its background, or whether the page is usable.

Colour contrast is out of scope by decision, not by omission: contrast is a property of the stylesheet rather than the document, so the ratios are recorded by hand in ADR-0012.

What has never been verified

These are the gaps that matter, stated plainly rather than buried:

• Token-authenticated clone and push has never been exercised. This wiki is pushed over SSH, so ADR-0002's token path remains a plan. (The other three GitHub assumptions — comment stripping, _Sidebar.md rendering on every page — were confirmed on 2026-09-15, while the -- filename-to-title mapping was partly refuted by publishing this wiki and reading the rendered HTML back. See Compatibility and Limits for the evidence and its positive control. docs/AFFIRMATION.adoc predates that check and still records all four as unverified.)
• The declared minimum supported Rust version has never been built. Cargo.toml declares rust-version = "1.89" and CI carries a 1.89.0 matrix leg, but no green run on that leg is cited here. Treat 1.89 as declared, not demonstrated.
• BerryWiki has never been tested with a screen reader. Nothing in the automated audit should be read as evidence that it has. The manual walkthrough is specified in docs/execution/a11y-walkthrough.adoc and has not been run.
• There are no proofs, despite the intent to have them.
• Two decisions are still open. ADR-0001 (page filename strategy) and ADR-0002 (authentication strategy) remain Proposed, because both turn on the live-GitHub spike that has not happened. See Decisions.

Why this page exists

A tool that tells you what it has verified, and is equally specific about what it has not, can be trusted about the first list. One that only advertises the first list cannot be trusted about either.