{ "url": "https://x.com", "auditedAt": "2026-07-18T13:50:59.100Z", "mode": "report", "status": "completed", "statusDetail": "Coverage complete for the logged-out public experience. Authenticated timelines, compose, messages, settings and purchase flows were not covered because no test account was supplied.", "page": { "appType": "hybrid", "framework": "React-style client application with server-rendered public profile payloads", "notes": "Public entry/auth SPA, server-rich public profiles, separate policy template. Logged-out scope only." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "transition-video", "trace", "har", "discoverability", "headers", "cookies", "trackers", "secrets", "images", "heap-summary", "lighthouse", "Modern Web Guidance 0.0.172" ], "guidanceConsulted": [ "accessibility", "accessible-error-announcement", "adapt-scrollbar-to-contrast-preferences", "agentic-forms", "agentic-javascript-tools", "anchor-positioning-tab-underline", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "animated-select-picker", "apply-webgl-shaders", "autofill-address-form", "autofill-highlight-inputs", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "batch-analytics-events", "brand-consistent-forms", "branded-select-styling", "break-up-long-tasks", "calculate-event-differentials", "calculate-total-foreground-time", "calculate-with-intrinsic-sizes", "capture-location-agnostic-data", "carousel-slide-effects", "carousel-snap-highlights", "child-state-based-styling", "complex-shapes", "component-specific-light-dark-theme", "conditional-async-dependencies", "consistent-cross-document-transitions", "content-based-styling", "coordinate-global-events", "cross-document-transitions", "css", "css-layout", "custom-select-picker-layouts", "customize-scrollbar-color-and-thickness", "dark-mode", "declarative-dialog-popover-control", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "deliver-optimized-decorative-images", "deprioritize-background-fetches", "design-token-reactivity", "detect-initial-visibility-state", "directional-navigation-transitions", "dynamic-sibling-animations", "dynamic-sibling-styling", "efficient-background-processing", "export-html-media-from-canvas", "expose-canvas-content-to-browser-features", "faster-spa-view-transitions", "flicker-free-client-side-ab-testing", "fluid-scaling", "form-fields-automatically-fit-contents", "format-human-readable-durations", "forms", "full-session-analytics", "group-element-transitions", "highlight-text-ranges", "html", "identify-heavy-scripts", "identify-inp-causes", "improve-next-page-load-performance", "improve-text-layout-and-legibility", "individual-transform-properties", "interactions-in-complex-layouts", "interactive-content-in-3d-scenes", "interactive-content-reveal", "interest-triggered-action-previews", "interest-triggered-tooltips", "language-detection", "language-model", "light-dismiss-a-dialog", "manage-recurring-intervals", "model-partial-time-concepts", "move-dom-element-without-losing-state", "navigation-drawer", "optimize-image-priority", "optimize-preload-priority", "optimize-script-priority", "overflow-clipping-control", "parallax-scroll-effects", "passkey-authentication", "passkey-conditional-create", "passkey-management", "passkey-reauthentication", "passkey-registration", "passkeys", "performance", "persistent-app-tours", "persistent-toast-notifications", "persistent-top-layer-ui", "physics-based-easing", "platform-controls-dismiss-dialog", "position-aware-tooltips", "precise-text-alignment", "prevent-text-wrapping", "privacy", "pull-to-reveal", "reduce-style-repetition", "required-field-feedback", "resilient-context-menus-and-nested-dropdowns", "resolution-optimized-pseudo-elements", "rich-media-picker", "same-document-transitions", "schedule-tasks-by-priority", "scroll-entry-exit-effects", "scroll-position-aware-elements", "scroll-progress-indicator", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "scrollability-affordance-hints", "scrollytelling", "search-hidden-content", "security", "select-menu-interaction", "sequence-distributed-events", "shaped-cutouts", "shrinking-header-on-scroll", "size-aware-styling", "soft-edge-content-fade", "stabilize-reactive-state", "stack-drill-down", "style-parent-with-has", "summarizer", "support-global-calendar-systems", "swipe-to-remove", "translator", "validate-input-after-interaction", "visually-stable-font-fallbacks", "visually-stable-mixed-fonts", "visually-texture-content", "webmcp" ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "pass", "confidence": "high", "method": "Screenshots and computed styles under emulated light/dark color schemes", "evidence": "Light and dark emulation produced fully retinted, usable surfaces; computed html color-scheme was dark in dark mode.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/home-light.png", "evidence/home-dark.png" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "getAnimations and CSS media-rule probe under reduced motion", "evidence": "Under prefers-reduced-motion: reduce the page reported no active animations and includes a matching reduce rule.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/reduced-motion.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "Forced-colors/high-contrast screenshot", "evidence": "Forced-colors plus prefers-contrast:more kept text, controls, links and focus boundaries visible.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/home-forced-colors.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "medium", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Rendered DOM/CSS and interaction evidence showed ordinary instant SPA state changes and no ::view-transition rules; the platform API exists but was not used by the page.", "pathIds": [ "profile" ], "artifacts": [ "evidence/profile-dom.json", "evidence/login-invalid.mp4" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Recon, feature inventory and applicability judgement", "evidence": "No scroll-linked decorative or scrollytelling animation was present on the audited public templates.", "reason": "No scroll-linked decorative or scrollytelling animation was present on the audited public templates.", "pathIds": [ "home", "profile" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "The public feed uses native scrolling and responsive tab/navigation controls; no custom pointermove gesture override was observed.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/profile-desktop.png" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "The long public profile retains clear sticky/profile navigation and tab state while content scrolls without horizontal drift.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/profile-desktop.png", "evidence/profile-mobile-layout.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Recon, feature inventory and applicability judgement", "evidence": "No tooltip, popover or edge-positioned menu requiring anchored positioning appeared in the audited logged-out and public-profile states.", "reason": "No tooltip, popover or edge-positioned menu requiring anchored positioning appeared in the audited logged-out and public-profile states.", "pathIds": [ "home", "profile" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "The profile clearly marks the selected Posts tab with a high-contrast underline and preserves directional back navigation.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/profile-desktop.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Desktop screenshots show a fixed banner consuming the bottom 153 px; at 360x800 it occupies roughly 276 px and covers the sign-in action. The TOS and profile pages are also covered.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-desktop.png", "evidence/profile-desktop.png", "evidence/tos-desktop.png" ], "findingIds": [ "F01" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "DOM probe found no or [popover] despite the fixed consent surface and the modal authentication surface shown after an unknown route redirect.", "pathIds": [ "home" ], "artifacts": [ "evidence/ui-probe.json", "evidence/error-route.png" ], "findingIds": [ "F02" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Outside the separately reported consent banner, the profile gives the central column to posts and the TOS template prioritizes its document.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/profile-desktop.png", "evidence/tos-desktop.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Both 360px layout captures reported scrollWidth=clientWidth=360 and zero horizontal overflow.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/profile-mobile-layout.json", "evidence/home-mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "The same authentication/profile surfaces visibly recompose between 1440px and 360px without clipping; condition-based component adaptation is directly visible.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/profile-desktop.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Primary buttons are 40-46px high, touch spacing is adequate per Lighthouse, and focus probe showed browser focus indication across controls.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/focus-probe.json", "evidence/ui-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Home says “Happening now” and presents direct phone/Google/Apple/email actions; profile identity and posts are immediately clear.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/home-desktop.png", "evidence/profile-desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Logged-out users can choose a sign-in method and public users can read a profile/feed; the consent prompt offers equally prominent accept/refuse actions.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/home-desktop.png", "evidence/profile-desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Authentication controls expose disabled/enabled state and a focused modal step with Back; invalid-route recovery is separately reported.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/login-invalid.mp4", "evidence/error-route.png" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Lighthouse measured LCP 12.2 s, CLS 0.147, TBT 440 ms and TTI 12.7 s (performance score 0.55). The raw-CDP trace still measured LCP 2.40 s and 84 ms TBT, showing high run variance but a fragile load.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-trace.json" ], "findingIds": [ "F04" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "The 360x800 layout observer recorded CLS 0.135 across three shifts around 1.58-2.11 s; Lighthouse independently measured CLS 0.147 and two large shifts.", "pathIds": [ "home-mobile" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F05" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Lighthouse measured 2.5 s of main-thread work, 1.7 s JS execution and 440 ms TBT; CDP trace recorded three long tasks up to 84.9 ms.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "HAR captured 105 requests and 2.61 MB transferred, including 66 scripts and 1.83 MB script transfer. Several low-priority route bundles took about 1.2 s.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/home.har", "evidence/platform-probe.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Lighthouse estimated 639 KiB unused JS: main was 50% unused, vendor 47%, Google Identity 75%, and modules.common 98.8%.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "The image probe found 10 of 32 images without alt, including the profile banner and multiple post/video thumbnails. Some may be decorative, but post media requires a text alternative when meaningful.", "pathIds": [ "profile" ], "artifacts": [ "evidence/profile-images.json", "evidence/profile-desktop.png" ], "findingIds": [ "F09" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Lighthouse contrast audit passed and forced-colors screenshot retained legible text and control boundaries.", "pathIds": [ "home", "home-mobile", "profile" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-forced-colors.png" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Home has one h1 plus main/nav landmarks; heading order and Lighthouse focus-related automated audits passed; focus follows DOM order.", "pathIds": [ "home", "home-mobile", "profile" ], "artifacts": [ "evidence/ui-probe.json", "evidence/focus-probe.json", "evidence/lighthouse-home.json" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Desktop, mobile, profile and TOS screenshots show readable line lengths and no clipping or cramped wrapping.", "pathIds": [ "home", "home-mobile", "profile" ], "artifacts": [ "evidence/home-mobile.png", "evidence/profile-desktop.png", "evidence/tos-desktop.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "The live viewport meta contains maximum-scale=1,user-scalable=0; Lighthouse fails the meta-viewport accessibility audit.", "pathIds": [ "home-mobile" ], "artifacts": [ "evidence/recon.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F10" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Lighthouse captured a Google FedCM AbortError, two identity-provider errors, and a blocked inline script caused by the page CSP.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F11" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "27 of 32 images lacked width/height, 11 lacked srcset, five were oversized, and 27 used legacy PNG/JPEG delivery.", "pathIds": [ "profile" ], "artifacts": [ "evidence/profile-images.json" ], "findingIds": [ "F12" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Lighthouse reported a CSP inspector issue and a BFCache failure (SharedWorkerWithNoActiveClient), alongside legacy JavaScript estimated at 54 KiB.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "The entry page has a descriptive title and matching meta description; profile raw HTML preserves template-specific metadata.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/recon.json", "evidence/profile-discoverability.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Visible links use real href values and descriptive text; viewport exists and Lighthouse SEO scored 1.0. Zoom restriction is reported under inclusion.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/recon.json", "evidence/lighthouse-summary.json", "evidence/robots.txt" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "The DOM probe found no canonical URL. robots.txt advertises /sitemap.xml, but fetching that endpoint returned the SPA HTML document rather than an XML sitemap. Generic User-agent:* is disallowed, while Googlebot/Bingbot have selective access.", "pathIds": [ "home" ], "artifacts": [ "evidence/ui-probe.json", "evidence/robots.txt", "evidence/site-files.json" ], "findingIds": [ "F17" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "The homepage exposes matching Open Graph title, description, URL and site-name metadata; the profile has template-specific title/description in server HTML.", "pathIds": [ "home", "profile" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Cookie audit found six cookies flagged insecure by the primitive: g_state and two __cuid cookies were not Secure; all six were SameSite=None; guest_id and __cuid persist about 396-400 days.", "pathIds": [ "home" ], "artifacts": [ "evidence/cookies.json", "evidence/headers.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "HAR attributed 91/105 requests and 2.51/2.61 MB to origins classified as third party relative to x.com, mostly abs.twimg.com, plus Google and Apple identity scripts. Tracker matching found no known analytics tracker.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/home.har", "evidence/trackers.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "No permission prompt fired on load; login offers phone, Google, Apple, username and autocomplete=\"username webauthn\".", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/recon.json", "evidence/platform-probe.json" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Headers include HSTS, nosniff and X-Frame-Options DENY, but omit Referrer-Policy and Permissions-Policy. CSP includes unsafe-inline and produced a blocked-script inspector error.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Discoverability comparison found only 22% rendered-word coverage in raw HTML; title, h1 and meta description were absent from raw content. The public profile performed much better at 93%, showing the gap is template-specific.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png", "evidence/profile-discoverability.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Profile and authentication overlays remained within viewport bounds; no cut-off menu or broken async state was observed.", "pathIds": [ "home", "profile", "error" ], "artifacts": [ "evidence/error-route.png", "evidence/profile-desktop.png" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "A complete manifest with standalone display and shortcuts is linked, but the runtime probe found no service-worker controller or registration.", "pathIds": [ "home" ], "artifacts": [ "evidence/site-files.json", "evidence/platform-probe.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "A deliberately missing URL redirected to /i/jf/onboarding/...mode=login and displayed “See what’s happening,” with no not-found explanation or route recovery.", "pathIds": [ "error" ], "artifacts": [ "evidence/error-route.png", "evidence/error-route.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "html uses lang=en-GB and dir=ltr; inspected CSS includes explicit ltr/rtl variants for directional layout.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/recon.json", "evidence/profile-dom.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Visible profile dates use localized day-month rendering (for example “16 Jul”) rather than ambiguous numeric formatting.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/profile-desktop.png" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "No time-zone-sensitive scheduling or cross-zone event flow appears in the audited logged-out/public-profile templates.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/profile-desktop.png" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Consent accept and refuse actions have equal prominence and account terms are linked; no confirmshaming or forced continuity was observed.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Authentication preserves the entered-field context and uses disabled states rather than premature blame; no hostile validation copy was observed.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/login-invalid.mp4" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Username input declares autocomplete=\"username webauthn\" and provides Google/Apple/phone alternatives.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/recon.json" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "The visible account entry offers multiple methods and linked terms/privacy, with a Back control; no purchase or subscription commitment appears.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/error-route.png" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "Image probe found five oversized images, 11 without responsive sources, and 27 legacy-format assets among 32 images.", "pathIds": [ "profile" ], "artifacts": [ "evidence/profile-images.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "pass", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "No continuous autoplay media or idle animation was observed after load; expensive initial delivery is captured by the separate budget finding.", "pathIds": [ "home", "profile" ], "artifacts": [ "evidence/home-trace-summary.json", "evidence/trackers.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Visual screenshots, rendered DOM/evaluate probes, Lighthouse and targeted CDP evidence across representative paths", "evidence": "A text-and-authentication surface transferred 2.61 MB across 105 requests; 2.51 MB and 91 requests were cross-origin by host classification, with 66 scripts.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "findingIds": [ "F22" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Recon, feature inventory and applicability judgement", "evidence": "X explicitly blocks generic and named AI crawlers in robots.txt and exposes no declared agent-facing intent; emerging agent capability is therefore judged out of scope.", "reason": "X explicitly blocks generic and named AI crawlers in robots.txt and exposes no declared agent-facing intent; emerging agent capability is therefore judged out of scope.", "pathIds": [ "home", "profile" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Recon, feature inventory and applicability judgement", "evidence": "No user-facing task in the audited logged-out/public-profile scope requires on-device inference, and no agent-facing intent is declared.", "reason": "No user-facing task in the audited logged-out/public-profile scope requires on-device inference, and no agent-facing intent is declared.", "pathIds": [ "home", "profile" ] }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "Ten repeated feed scroll cycles plus same-page metrics and baseline/post heap summaries", "evidence": "After ten full-feed scroll cycles DOM elements fell from 4,029 to 2,143 as virtualization reclaimed nodes; JS heap settled at about 112 MB after lazy loading rather than DOM growing without bound.", "pathIds": [ "profile" ], "artifacts": [ "evidence/profile-memory-metrics.json", "evidence/profile-heap-baseline.heapsnapshot", "evidence/profile-heap-repeated.heapsnapshot" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "Heap summary totals and Performance memory metrics", "evidence": "Repeated-interaction heap summary was 42.6 MB self size for a media feed and same-page JS heap was about 112 MB, proportionate though worth monitoring.", "pathIds": [ "profile" ], "artifacts": [ "evidence/profile-memory-metrics.json", "evidence/profile-heap-repeated.heapsnapshot" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "Before/after heap constructor summaries plus live DOM-count comparison", "evidence": "Neither heap constructor summary surfaced Detached* among dominant populations, and live DOM count decreased after repeated scrolling.", "pathIds": [ "profile" ], "artifacts": [ "evidence/profile-heap-baseline.heapsnapshot", "evidence/profile-heap-repeated.heapsnapshot" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "pass" }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "pass" }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F04", "F05", "F06", "F07", "F08" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F09", "F10" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F11", "F12", "F13" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F17" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F14", "F15", "F16" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F18", "F19", "F20" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "pass" }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F21", "F22" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "No declared agent-facing intent; robots policy explicitly excludes generic/AI agents and the emerging capabilities are outside this audited public scope." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "home", "description": "Logged-out homepage and authentication entry, the primary public entry and consent experience.", "url": "https://x.com/", "conditions": [ "1440x900", "light scheme", "dark scheme", "reduced motion", "forced colors", "keyboard focus" ], "result": "issues" }, { "id": "home-mobile", "description": "Narrow logged-out entry, representing mobile installation/sign-in and responsive consent.", "url": "https://x.com/", "conditions": [ "360x800" ], "result": "issues" }, { "id": "profile", "description": "Public profile/feed template, representing publicly readable account content and repeated scrolling.", "url": "https://x.com/GoogleChrome", "conditions": [ "1440x900", "360x800", "no JavaScript crawler view", "10 repeated scroll cycles" ], "result": "issues" }, { "id": "policy", "description": "Terms of Service content template, representing long-form policy content.", "url": "https://x.com/tos", "conditions": [ "1440x900" ], "result": "issues" }, { "id": "error", "description": "Unknown route, representing HTTP/routing failure and recovery behavior.", "url": "https://x.com/__web_uplift_missing_route_404__", "conditions": [ "1440x900" ], "result": "issues" } ], "findings": [ { "id": "F01", "severity": "high", "confidence": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "pathId": "home", "url": "https://x.com/", "guidanceId": "light-dismiss-a-dialog", "guidanceCategory": "user-experience", "summary": "The cookie prompt obscures primary content on every public surface.", "evidence": "Desktop screenshots show a fixed banner consuming the bottom 153 px; at 360x800 it occupies roughly 276 px and covers the sign-in action. The TOS and profile pages are also covered.", "artifacts": [ "evidence/home-mobile.png", "evidence/home-desktop.png", "evidence/profile-desktop.png", "evidence/tos-desktop.png" ], "suggestedFix": "Use a compact, non-blocking consent control that preserves access to the primary task, with an equally prominent refusal action and persistent settings access.", "effort": "medium" }, { "id": "F02", "severity": "medium", "confidence": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "pathId": "home", "url": "https://x.com/", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "user-experience", "summary": "Consent and authentication overlays are custom role-based structures rather than native dialog/popover primitives.", "evidence": "DOM probe found no or [popover] despite the fixed consent surface and the modal authentication surface shown after an unknown route redirect.", "artifacts": [ "evidence/ui-probe.json", "evidence/error-route.png" ], "suggestedFix": "Use for modal authentication and popover or a non-modal region for transient consent UI; preserve native focus, Escape and top-layer behavior.", "effort": "medium" }, { "id": "F03", "severity": "low", "confidence": "medium", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "pathId": "profile", "url": "https://x.com/GoogleChrome", "guidanceId": "same-document-transitions", "guidanceCategory": "user-experience", "summary": "State and route changes do not expose evidence of View Transition use.", "evidence": "Rendered DOM/CSS and interaction evidence showed ordinary instant SPA state changes and no ::view-transition rules; the platform API exists but was not used by the page.", "artifacts": [ "evidence/profile-dom.json", "evidence/login-invalid.mp4" ], "suggestedFix": "Add same-document View Transitions to route/tab/modal state changes, with reduced-motion behavior.", "effort": "medium" }, { "id": "F04", "severity": "high", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "pathId": "home", "url": "https://x.com/", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "The logged-out home misses Core Web Vitals and interactivity targets.", "evidence": "Lighthouse measured LCP 12.2 s, CLS 0.147, TBT 440 ms and TTI 12.7 s (performance score 0.55). The raw-CDP trace still measured LCP 2.40 s and 84 ms TBT, showing high run variance but a fragile load.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-trace.json" ], "suggestedFix": "Prioritize the actual LCP element, render the logged-out shell from HTML, and delay non-critical authentication and feature bundles.", "effort": "large" }, { "id": "F05", "severity": "medium", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "visual-stability", "pathId": "home-mobile", "url": "https://x.com/", "guidanceId": "visually-stable-font-fallbacks", "guidanceCategory": "performance", "summary": "The logged-out mobile page shifts materially during load.", "evidence": "The 360x800 layout observer recorded CLS 0.135 across three shifts around 1.58-2.11 s; Lighthouse independently measured CLS 0.147 and two large shifts.", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Reserve stable space for authentication providers and consent UI, and align fallback/font metrics before late content appears.", "effort": "medium" }, { "id": "F06", "severity": "medium", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-main-thread", "pathId": "home", "url": "https://x.com/", "guidanceId": "break-up-long-tasks", "guidanceCategory": "performance", "summary": "JavaScript blocks the main thread during startup.", "evidence": "Lighthouse measured 2.5 s of main-thread work, 1.7 s JS execution and 440 ms TBT; CDP trace recorded three long tasks up to 84.9 ms.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json" ], "suggestedFix": "Break startup work into prioritized tasks and avoid initializing logged-in-only modules on the logged-out route.", "effort": "large" }, { "id": "F07", "severity": "high", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "pathId": "home", "url": "https://x.com/", "guidanceId": "optimize-script-priority", "guidanceCategory": "performance", "summary": "The simple logged-out page requires an oversized dependency graph.", "evidence": "HAR captured 105 requests and 2.61 MB transferred, including 66 scripts and 1.83 MB script transfer. Several low-priority route bundles took about 1.2 s.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har", "evidence/platform-probe.json" ], "suggestedFix": "Ship a minimal logged-out entry bundle, retain defer for parser scripts, and load identity and product modules only after intent.", "effort": "large" }, { "id": "F08", "severity": "high", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "pathId": "home", "url": "https://x.com/", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance", "summary": "The logged-out route ships hundreds of KiB of unused JavaScript.", "evidence": "Lighthouse estimated 639 KiB unused JS: main was 50% unused, vendor 47%, Google Identity 75%, and modules.common 98.8%.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Split logged-out/auth code from feed, Grok, chat and logged-in modules; import optional dependencies only after the triggering action.", "effort": "large" }, { "id": "F09", "severity": "medium", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "pathId": "profile", "url": "https://x.com/GoogleChrome", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "Profile media includes images without alternative text.", "evidence": "The image probe found 10 of 32 images without alt, including the profile banner and multiple post/video thumbnails. Some may be decorative, but post media requires a text alternative when meaningful.", "artifacts": [ "evidence/profile-images.json", "evidence/profile-desktop.png" ], "suggestedFix": "Require author alt text for meaningful post media and use alt=\"\" for intentionally decorative imagery.", "effort": "medium" }, { "id": "F10", "severity": "high", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "pathId": "home-mobile", "url": "https://x.com/", "guidanceId": "fluid-scaling", "guidanceCategory": "accessibility", "summary": "The viewport explicitly disables user zoom.", "evidence": "The live viewport meta contains maximum-scale=1,user-scalable=0; Lighthouse fails the meta-viewport accessibility audit.", "artifacts": [ "evidence/recon.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Remove maximum-scale and user-scalable restrictions so pinch zoom remains available.", "effort": "trivial" }, { "id": "F11", "severity": "low", "confidence": "high", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "pathId": "home", "url": "https://x.com/", "guidanceId": "html", "guidanceCategory": "html", "summary": "The logged-out page emits console and CSP errors.", "evidence": "Lighthouse captured a Google FedCM AbortError, two identity-provider errors, and a blocked inline script caused by the page CSP.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Treat expected identity cancellation as a handled state and align inline bootstrap execution with the nonce-based CSP.", "effort": "small" }, { "id": "F12", "severity": "medium", "confidence": "high", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "pathId": "profile", "url": "https://x.com/GoogleChrome", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance", "summary": "Profile images lack intrinsic dimensions and responsive delivery.", "evidence": "27 of 32 images lacked width/height, 11 lacked srcset, five were oversized, and 27 used legacy PNG/JPEG delivery.", "artifacts": [ "evidence/profile-images.json" ], "suggestedFix": "Emit intrinsic dimensions/aspect-ratio and responsive srcset/sizes for avatars, banners and post media; negotiate AVIF/WebP where useful.", "effort": "large" }, { "id": "F13", "severity": "medium", "confidence": "high", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "pathId": "home", "url": "https://x.com/", "guidanceId": "html", "guidanceCategory": "html", "summary": "Browser inspector and lifecycle hygiene are not clean.", "evidence": "Lighthouse reported a CSP inspector issue and a BFCache failure (SharedWorkerWithNoActiveClient), alongside legacy JavaScript estimated at 54 KiB.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Remove avoidable inspector issues, modernize bundle targets, and review shared-worker lifecycle for BFCache compatibility.", "effort": "medium" }, { "id": "F14", "severity": "high", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "pathId": "home", "url": "https://x.com/", "guidanceId": "security", "guidanceCategory": "security", "summary": "Several first-party cookies use weak transport and cross-site settings.", "evidence": "Cookie audit found six cookies flagged insecure by the primitive: g_state and two __cuid cookies were not Secure; all six were SameSite=None; guest_id and __cuid persist about 396-400 days.", "artifacts": [ "evidence/cookies.json", "evidence/headers.json" ], "suggestedFix": "Mark every HTTPS cookie Secure, use Lax/Strict unless cross-site behavior is essential, and reduce identifier lifetimes.", "effort": "medium" }, { "id": "F15", "severity": "medium", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "pathId": "home", "url": "https://x.com/", "guidanceId": "privacy", "guidanceCategory": "privacy", "summary": "Most logged-out network traffic goes to additional origins before user intent.", "evidence": "HAR attributed 91/105 requests and 2.51/2.61 MB to origins classified as third party relative to x.com, mostly abs.twimg.com, plus Google and Apple identity scripts. Tracker matching found no known analytics tracker.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har", "evidence/trackers.json" ], "suggestedFix": "Defer identity-provider and optional product traffic until chosen; document and minimize every cross-origin request on the logged-out route.", "effort": "large" }, { "id": "F16", "severity": "medium", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "pathId": "home", "url": "https://x.com/", "guidanceId": "security", "guidanceCategory": "security", "summary": "Defensive headers are incomplete and CSP still permits unsafe inline styling/script patterns.", "evidence": "Headers include HSTS, nosniff and X-Frame-Options DENY, but omit Referrer-Policy and Permissions-Policy. CSP includes unsafe-inline and produced a blocked-script inspector error.", "artifacts": [ "evidence/headers.json", "evidence/lighthouse-home.json" ], "suggestedFix": "Set explicit Referrer-Policy and Permissions-Policy, remove unnecessary unsafe-inline allowances, and keep nonce/hash authorization consistent.", "effort": "medium" }, { "id": "F17", "severity": "medium", "confidence": "high", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "pathId": "home", "url": "https://x.com/", "guidanceId": "html", "guidanceCategory": "html", "summary": "Canonical and sitemap signals are inconsistent on the public entry surface.", "evidence": "The DOM probe found no canonical URL. robots.txt advertises /sitemap.xml, but fetching that endpoint returned the SPA HTML document rather than an XML sitemap. Generic User-agent:* is disallowed, while Googlebot/Bingbot have selective access.", "artifacts": [ "evidence/ui-probe.json", "evidence/robots.txt", "evidence/site-files.json" ], "suggestedFix": "Serve a valid XML sitemap, add self-referential canonicals to public templates, and keep robots directives aligned with intended public discovery.", "effort": "medium" }, { "id": "F18", "severity": "medium", "confidence": "high", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "pathId": "home", "url": "https://x.com/", "guidanceId": "stabilize-reactive-state", "guidanceCategory": "javascript", "summary": "The logged-out home is mostly unavailable to no-JavaScript clients.", "evidence": "Discoverability comparison found only 22% rendered-word coverage in raw HTML; title, h1 and meta description were absent from raw content. The public profile performed much better at 93%, showing the gap is template-specific.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png", "evidence/profile-discoverability.json" ], "suggestedFix": "Server-render the logged-out heading, explanation and authentication links/form fallback, then enhance them with JavaScript.", "effort": "large" }, { "id": "F19", "severity": "medium", "confidence": "high", "principleId": "be-resilient", "principleCheckId": "offline-and-installable", "pathId": "home", "url": "https://x.com/", "guidanceId": "conditional-async-dependencies", "guidanceCategory": "performance", "summary": "The app advertises installability but has no service-worker offline fallback.", "evidence": "A complete manifest with standalone display and shortcuts is linked, but the runtime probe found no service-worker controller or registration.", "artifacts": [ "evidence/site-files.json", "evidence/platform-probe.json" ], "suggestedFix": "Register a service worker with a small offline shell and explicit offline/error messaging for already-visited public content.", "effort": "large" }, { "id": "F20", "severity": "medium", "confidence": "high", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "pathId": "error", "url": "https://x.com/__web_uplift_missing_route_404__", "guidanceId": "persistent-toast-notifications", "guidanceCategory": "user-experience", "summary": "Unknown routes are converted into an authentication prompt instead of a truthful recoverable 404.", "evidence": "A deliberately missing URL redirected to /i/jf/onboarding/...mode=login and displayed “See what’s happening,” with no not-found explanation or route recovery.", "artifacts": [ "evidence/error-route.png", "evidence/error-route.json" ], "suggestedFix": "Return a real 404 status and a clear not-found page with Home, Search and Back actions; do not imply authentication will resolve an invalid route.", "effort": "small" }, { "id": "F21", "severity": "medium", "confidence": "high", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "pathId": "profile", "url": "https://x.com/GoogleChrome", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance", "summary": "Public feed imagery is not consistently resolution- or format-optimized.", "evidence": "Image probe found five oversized images, 11 without responsive sources, and 27 legacy-format assets among 32 images.", "artifacts": [ "evidence/profile-images.json" ], "suggestedFix": "Serve responsive variants near display size and modern formats, retaining originals only when needed.", "effort": "large" }, { "id": "F22", "severity": "medium", "confidence": "high", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "pathId": "home", "url": "https://x.com/", "guidanceId": "deprioritize-background-fetches", "guidanceCategory": "performance", "summary": "The logged-out page spends a disproportionate resource budget before interaction.", "evidence": "A text-and-authentication surface transferred 2.61 MB across 105 requests; 2.51 MB and 91 requests were cross-origin by host classification, with 66 scripts.", "artifacts": [ "evidence/home-summary.json", "evidence/home.har" ], "suggestedFix": "Adopt a logged-out page-weight budget, delay identity/product integrations until intent, and remove nonessential preloaded route code.", "effort": "large" } ], "taskList": [ { "id": "T01", "title": "Ship a server-rendered, minimal logged-out shell and defer optional product/identity bundles", "priority": 1, "findingIds": [ "F04", "F06", "F07", "F08", "F15", "F18", "F22" ], "guidanceId": "performance", "status": "open" }, { "id": "T02", "title": "Restore user zoom and reserve stable layout space", "priority": 2, "findingIds": [ "F05", "F10", "F12" ], "guidanceId": "fluid-scaling", "status": "open" }, { "id": "T03", "title": "Replace the obstructive custom consent surface with compact semantic UI", "priority": 3, "findingIds": [ "F01", "F02" ], "guidanceId": "declarative-dialog-popover-control", "status": "open" }, { "id": "T04", "title": "Harden cookies, CSP and browser policy headers", "priority": 4, "findingIds": [ "F14", "F16" ], "guidanceId": "security", "status": "open" }, { "id": "T05", "title": "Optimize profile media delivery and require meaningful alt text", "priority": 5, "findingIds": [ "F09", "F12", "F21" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T06", "title": "Return truthful recoverable 404 states and add an offline fallback", "priority": 6, "findingIds": [ "F19", "F20" ], "guidanceId": "persistent-toast-notifications", "status": "open" }, { "id": "T07", "title": "Repair canonical and sitemap discovery signals", "priority": 7, "findingIds": [ "F17" ], "guidanceId": "html", "status": "open" }, { "id": "T08", "title": "Clean console, inspector and lifecycle errors", "priority": 8, "findingIds": [ "F11", "F13" ], "guidanceId": "html", "status": "open" }, { "id": "T09", "title": "Add reduced-motion-aware View Transitions for major state changes", "priority": 9, "findingIds": [ "F03" ], "guidanceId": "same-document-transitions", "status": "open" } ], "artifacts": [ { "type": "other", "path": "evidence/cookies.json", "caption": "cookies", "findingIds": [ "F14" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler", "findingIds": [ "F18" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered", "findingIds": [ "F18" ] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "discoverability", "findingIds": [ "F18" ] }, { "type": "other", "path": "evidence/error-route.json", "caption": "error route", "findingIds": [ "F20" ] }, { "type": "screenshot", "path": "evidence/error-route.png", "caption": "error route", "findingIds": [ "F02", "F20" ] }, { "type": "other", "path": "evidence/focus-probe.json", "caption": "focus probe", "findingIds": [] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers", "findingIds": [ "F14", "F16" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop", "findingIds": [ "F01" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-forced-colors.png", "caption": "home forced colors", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-light.png", "caption": "home light", "findingIds": [] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout", "findingIds": [ "F05" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "findingIds": [ "F01" ] }, { "type": "other", "path": "evidence/home-summary.json", "caption": "home summary", "findingIds": [ "F07", "F15", "F22" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary", "findingIds": [ "F04", "F06" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace", "findingIds": [ "F04" ] }, { "type": "har", "path": "evidence/home.har", "caption": "home", "findingIds": [ "F07", "F15", "F22" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-home.json", "caption": "lighthouse home", "findingIds": [ "F04", "F08", "F11", "F13", "F16" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-summary.json", "caption": "lighthouse summary", "findingIds": [ "F04", "F05", "F06", "F08", "F10", "F11", "F13" ] }, { "type": "video", "path": "evidence/login-invalid.mp4", "caption": "login invalid", "findingIds": [ "F03" ] }, { "type": "screenshot", "path": "evidence/login-invalid.png", "caption": "login invalid", "findingIds": [] }, { "type": "other", "path": "evidence/platform-probe.json", "caption": "platform probe", "findingIds": [ "F07", "F19" ] }, { "type": "screenshot", "path": "evidence/profile-desktop.png", "caption": "profile desktop", "findingIds": [ "F01", "F09" ] }, { "type": "screenshot", "path": "evidence/profile-discoverability-crawler.png", "caption": "profile discoverability crawler", "findingIds": [] }, { "type": "screenshot", "path": "evidence/profile-discoverability-rendered.png", "caption": "profile discoverability rendered", "findingIds": [] }, { "type": "discoverability", "path": "evidence/profile-discoverability.json", "caption": "profile discoverability", "findingIds": [ "F18" ] }, { "type": "dom", "path": "evidence/profile-dom.json", "caption": "profile dom", "findingIds": [ "F03" ] }, { "type": "heap", "path": "evidence/profile-heap-baseline.heapsnapshot", "caption": "profile heap baseline", "findingIds": [] }, { "type": "heap", "path": "evidence/profile-heap-post.heapsnapshot", "caption": "profile heap post", "findingIds": [] }, { "type": "heap", "path": "evidence/profile-heap-repeated.heapsnapshot", "caption": "profile heap repeated", "findingIds": [] }, { "type": "other", "path": "evidence/profile-images.json", "caption": "profile images", "findingIds": [ "F09", "F12", "F21" ] }, { "type": "other", "path": "evidence/profile-memory-metrics.json", "caption": "profile memory metrics", "findingIds": [] }, { "type": "layout", "path": "evidence/profile-mobile-layout.json", "caption": "profile mobile layout", "findingIds": [] }, { "type": "other", "path": "evidence/recon.json", "caption": "recon", "findingIds": [ "F10" ] }, { "type": "other", "path": "evidence/reduced-motion.json", "caption": "reduced motion", "findingIds": [] }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots", "findingIds": [ "F17" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets", "findingIds": [] }, { "type": "other", "path": "evidence/site-files.json", "caption": "site files", "findingIds": [ "F17", "F19" ] }, { "type": "screenshot", "path": "evidence/tos-desktop.png", "caption": "tos desktop", "findingIds": [ "F01" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers", "findingIds": [ "F15" ] }, { "type": "other", "path": "evidence/ui-probe.json", "caption": "ui probe", "findingIds": [ "F02", "F17" ] } ], "budget": { "wallClockSeconds": 1500, "pathCount": 5, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-18T13-50-59-100Z" }