CEO-BASE: WCAG 2.1 AA mandatory for all products (EU Accessibility Act)

memory/2026-02-20.md

@@ -0,0 +1,25 @@
+# 2026-02-20 — Friday
+
+## Morning
+- Cleaned stale Postfix/old server references from CEO memory files (sessions.md, decisions.md, security-audit.md)
+- Fixed support agent cron — removed SSH access to old server entirely
+- Triggered DocFast CEO run to test cleaned memory → CEO behaved, no SMTP shenanigans ✅
+- DocFast CEO Session 65: v0.3.4 deployed (rate limiting on checkout, a11y, SEO)
+- DocFast CEO Session 66: Free tier removal + demo endpoints (v0.4.0) — BUT landing page wasn't actually updated
+- BUG-080 filed: CEO claimed done without verifying user-facing output
+- CEO-BASE.md updated with verification rules (verify live output, don't claim done without proof)
+- DocFast CEO Session 68: Actually fixed landing page on staging, verified with URL fetch
+- DocFast CEO Session 69: Playground redesign (split-pane, templates, before/after comparison)
+- DocFast CEO Session 70: Fixing download button + de-emphasizing rate limits (running)
+- SnapAPI CEO Session 9: OpenAPI docs audit — found 4 missing endpoints + unmounted signup route, switched to swagger-jsdoc
+- SnapAPI CEO Session 10: Fixing FAQ accordion + QA audit + rate limit de-emphasis (running)
+- Deployment policy added to both CEO skills: staging only, investor approves production
+- Anti-patterns added to CEO-BASE: featuring constraints instead of value, skipping interactive QA
+- Client libraries idea added to DocFast CEO directives
+- User was up late last night (ate too much too late — poke bowl + 2x müsli at 21:30)
+- User asked about FSR 4 (no RDNA 3 support, AMD blocking Valve's efforts), PS5 adaptive triggers (work on PC natively, not via Moonlight streaming)
+
+## Calendar
+- 10:00-15:00 Reinigungshilfe
+- 15:00-16:00 AMZ upgrade auf Laravel 12
+- 17:00-20:00 Marie

skills/ceo-common/CEO-BASE.md

@@ -81,9 +81,23 @@ Your default response to ANY problem: "How can I solve this myself?"
 ## Business Context
 
 - **Company:** Cloonar Technologies GmbH, FN 631089y, ATU81280034, Linzer Straße 192/1/2, 1140 Wien
-- **Legal:** Austria / EU — GDPR, Impressum §5 ECG, consumer protection
+- **Legal:** Austria / EU — GDPR, Impressum §5 ECG, consumer protection, **EU Accessibility Act (EAA)**
 - **Selling point:** EU-hosted, GDPR compliant — market this prominently
 
+## Accessibility — MANDATORY
+
+**All products must meet WCAG 2.1 AA compliance.** This is a legal requirement under the European Accessibility Act (EAA), enforceable from June 2025.
+
+Every frontend change must maintain or improve accessibility:
+- Proper semantic HTML (headings, landmarks, labels)
+- Sufficient color contrast (4.5:1 text, 3:1 large text/UI)
+- Keyboard navigable (all interactive elements reachable and operable)
+- Screen reader compatible (ARIA labels, alt text, live regions)
+- Focus indicators visible
+- Forms with associated labels and error messages
+
+**QA must include accessibility checks.** Use automated tools (axe, Lighthouse) AND manual keyboard/screen reader testing. If a sub-agent ships inaccessible frontend code, that's a bug — file it and fix it.
+
 ## What "Done" Means
 
 1. Works end-to-end for the user