How a walk works

A Greenroom run is a pipeline of specialized roles. Each role is played by whichever model measured best at it for your app, and the final report is assembled deterministically from their outputs, so no single model narrates its own homework.

Scope

The mapper reads your diff against the screen graph. When your state contract declares a routerKind, the graph is extracted deterministically from your source at the base revision, and scoping is exact: changed file, changed screens, affected states. Without a contract, the mapper works from the diff alone and scopes conservatively. Deleted files map too; a deletion that the graph says touches a screen widens scope rather than narrowing it.

The output of scoping is a set of goals: concrete things a user should still be able to do on the changed screens.

Walk

A driver pursues each goal against the real build: a Playwright-controlled browser for web, a dedicated iOS Simulator with a fresh install for iOS. The driver sees what a user of assistive technology would see (the accessibility tree plus screenshots), decides one committed step at a time, and records evidence before and after every action.

Two properties of the walk are absolute:

• It runs to a verdict. A production walk never gives up early. If the goal cannot be completed, the walk ends blocked with the reason, not abandoned.
• It stays inside policy. Off-allowlist network requests are contained, purchases and account creation are refused unless the goal explicitly grants them, and a policy violation is itself a recorded outcome.

Judge

Two judges read the walk's evidence independently of the driver:

• The verification judge checks claimed outcomes against captured evidence. It receives no goal text, only the checkpoint record, so it cannot rubber-stamp intent; it must find the proof in the evidence or say the claim is unverifiable.
• The UX audit judge compares the rendered screenshots against the accessibility tree and flags what a user would experience as broken: contradictions between what is shown and what is announced, unreadable contrast, broken layout arithmetic.

Findings that survive judgment go to the code locator, which points each one at the source location most likely responsible, or says honestly that no supportable location exists.

Handoff

The report assembler is deterministic code, not a model. It orders findings by severity, attaches the evidence for each claim, states the coverage achieved, and posts the handoff to the PR. Anything a model asserted without evidence never reaches the report.