{ "url": "https://myactivity.google.com", "auditedAt": "2026-07-27T19:53:56.642Z", "mode": "report", "status": "blocked", "statusDetail": "The signed-out landing page was inspected, but 14 of 58 atomic checks require authenticated My Activity surfaces or flows and were blocked by the login boundary. This is not a completed audit.", "page": { "appType": "unknown", "framework": "Google internal signed-out shell", "notes": "Public server-rendered sign-in landing; authenticated activity timeline, filters, deletion, account settings, and recovery flows were unavailable." }, "evidenceUsed": [ "screenshot", "dom+computed-styles", "evaluate-probe", "layout-metrics", "trace", "har", "headers", "cookies", "trackers", "secrets", "discoverability", "images", "lighthouse", "heap-summary", "HTTP robots/sitemap probe", "Modern Web Guidance 0.0.172" ], "guidanceConsulted": [ "dark-mode", "accessibility", "same-document-transitions", "scrollability-affordance-hints", "declarative-dialog-popover-control", "fluid-scaling", "forms", "performance", "optimize-image-priority", "security", "privacy", "stabilize-reactive-state", "translator", "deprioritize-background-fetches", "webmcp", "manage-recurring-intervals" ], "artifacts": [ { "type": "other", "path": "evidence/coverage-manifest.json", "caption": "Atomic 58-check coverage manifest with catalog checksum and per-check evidence plan" }, { "type": "screenshot", "path": "evidence/entry-desktop.png", "caption": "Signed-out landing page, desktop", "condition": "default", "findingIds": [ "F5" ] }, { "type": "screenshot", "path": "evidence/mobile.png", "caption": "Signed-out landing page, narrow mobile", "condition": "viewport: 360x800" }, { "type": "screenshot", "path": "evidence/dark.png", "caption": "Signed-out page under dark preference", "condition": "prefers-color-scheme: dark", "findingIds": [ "F1" ] }, { "type": "screenshot", "path": "evidence/contrast.png", "caption": "Signed-out page under increased contrast", "condition": "prefers-contrast: more" }, { "type": "dom", "path": "evidence/entry-dom.json", "caption": "Rendered DOM and computed styles", "findingIds": [ "F1", "F7" ] }, { "type": "other", "path": "evidence/recon.json", "caption": "Purpose, links and auth-wall recon" }, { "type": "other", "path": "evidence/motion-css.json", "caption": "Reduced-motion animation and modern CSS probe", "condition": "prefers-reduced-motion: reduce" }, { "type": "layout", "path": "evidence/layout-mobile.json", "caption": "Mobile overflow, CLS and long-task observation", "condition": "viewport: 360x800" }, { "type": "trace", "path": "evidence/load-trace.json", "caption": "DevTools load performance trace" }, { "type": "trace-summary", "path": "evidence/load-trace-summary.json", "caption": "Compact trace timings and main-thread summary", "findingIds": [ "F2" ] }, { "type": "har", "path": "evidence/load.har", "caption": "Network archive for the signed-out load" }, { "type": "har-summary", "path": "evidence/load-summary.json", "caption": "Compact network weight, third-party and delivery summary", "findingIds": [ "F3", "F4", "F10" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "Security response headers", "findingIds": [ "F9" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "Cookie posture" }, { "type": "other", "path": "evidence/trackers.json", "caption": "Third-party and tracker inventory" }, { "type": "other", "path": "evidence/secrets.json", "caption": "Client-exposed secret scan" }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "Raw HTML versus rendered content comparison", "findingIds": [ "F8" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "Crawler view with JavaScript disabled", "condition": "JavaScript disabled" }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "Rendered browser view", "condition": "JavaScript enabled" }, { "type": "other", "path": "evidence/images.json", "caption": "Image sizing, format and responsive delivery inventory" }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "Lighthouse performance, accessibility, best-practices and SEO audit", "findingIds": [ "F2", "F3", "F4", "F5", "F6", "F10" ] }, { "type": "other", "path": "evidence/page-probe.json", "caption": "Metadata, landmarks, focus targets, manifest and feature probe", "findingIds": [ "F6", "F7", "F8" ] }, { "type": "heap", "path": "evidence/heap-baseline.heapsnapshot", "caption": "Baseline heap summary" }, { "type": "other", "path": "evidence/robots-sitemap.txt", "caption": "robots.txt and sitemap.xml HTTP responses" } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 44, "blocked": 14, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": false }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "dark screenshot plus computed DOM styles", "evidence": "Desktop screenshot under prefers-color-scheme: dark remained white; computed color-scheme was normal.", "artifacts": [ "evidence/dark.png", "evidence/entry-dom.json" ], "findingIds": [ "F1" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "reduced-motion getAnimations and CSS probe", "evidence": "Under prefers-reduced-motion: reduce the signed-out surface exposed no running animations; no auto-advance or nonessential motion was present.", "artifacts": [ "evidence/motion-css.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "high-contrast emulated screenshot", "evidence": "The prefers-contrast: more capture retained visible text, controls, links, and illustration with no missing content.", "artifacts": [ "evidence/contrast.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/recon.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "high", "method": "layout and CSS capability probe", "evidence": "The signed-out page has no scroll-linked experience, scroll handlers, parallax, or scrollytelling; the 800px mobile layout fits without page scroll.", "artifacts": [ "evidence/layout-mobile.json", "evidence/motion-css.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/recon.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/recon.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/entry-dom.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/recon.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "load screenshots", "evidence": "Default desktop and mobile captures show no popup, interstitial, consent wall, or banner obscuring the sign-in content.", "artifacts": [ "evidence/entry-desktop.png", "evidence/mobile.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "not-applicable", "confidence": "high", "method": "DOM inspection found no relevant component", "evidence": "No overlay, disclosure, picker, or rich transient control exists on the signed-out landing page.", "artifacts": [ "evidence/entry-dom.json" ], "reason": "No overlay, disclosure, picker, or rich transient control exists on the signed-out landing page." }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "desktop and mobile visual inspection", "evidence": "The first viewport is content-first: a compact header, centered explanation and action, and small footer with no heavy framing.", "artifacts": [ "evidence/entry-desktop.png", "evidence/mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "mobile layout primitive", "evidence": "At 360x800, scrollWidth, clientWidth and innerWidth were all 360px; horizontal overflow was 0 and viewport meta was present.", "artifacts": [ "evidence/layout-mobile.json", "evidence/mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/entry-dom.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "pass", "confidence": "high", "method": "DOM target/focus probe plus Lighthouse", "evidence": "Visible signed-out controls are at least 40px high for primary header targets; Lighthouse target-size audits passed and native links retain keyboard focus behavior.", "artifacts": [ "evidence/page-probe.json", "evidence/lighthouse.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "desktop/mobile task walkthrough", "evidence": "The first viewport says “Welcome to My Activity”, explains the data-management purpose, and presents prominent Sign in actions.", "artifacts": [ "evidence/entry-desktop.png", "evidence/mobile.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/recon.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/recon.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Lighthouse plus trace summary", "evidence": "Lighthouse lab LCP was 2.7 s, just outside the good <=2.5 s range; CLS was 0 and TBT 24 ms. A separate raw-CDP trace measured LCP 1.18 s and zero blocking, showing variance but not clearing the slower result.", "artifacts": [ "evidence/lighthouse.json", "evidence/load-trace-summary.json" ], "findingIds": [ "F2" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "layout primitive and Lighthouse", "evidence": "Mobile layout observation reported CLS 0 with no shift entries; Lighthouse also measured CLS 0.", "artifacts": [ "evidence/layout-mobile.json", "evidence/lighthouse.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "trace summary and Lighthouse", "evidence": "Trace reported zero long tasks and 0 ms total blocking time; Lighthouse TBT was 24 ms.", "artifacts": [ "evidence/load-trace-summary.json", "evidence/lighthouse.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "HAR summary and Lighthouse", "evidence": "HAR transferred 505,713 bytes; Lighthouse found missing high fetch priority on LCP, font-display delay and a short cache lifetime.", "artifacts": [ "evidence/load-summary.json", "evidence/lighthouse.json" ], "findingIds": [ "F3" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Lighthouse coverage diagnostics", "evidence": "Lighthouse estimated 159KiB unused JavaScript and 13KiB unused CSS on the static signed-out route.", "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F4" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "pass", "confidence": "high", "method": "Lighthouse and DOM probes", "evidence": "Lighthouse accessible-name/role audits passed; the sole illustration is decorative with empty alt in rendered DOM and controls have names.", "artifacts": [ "evidence/lighthouse.json", "evidence/page-probe.json" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Lighthouse accessibility audit", "evidence": "Lighthouse found the inline Learn more link has only 1.23:1 contrast with surrounding text and no non-color distinction.", "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F5" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "heading/landmark/focus probe", "evidence": "DOM has no h1 or main landmark and begins with an h2; interactive controls otherwise expose names and native focus behavior.", "artifacts": [ "evidence/page-probe.json" ], "findingIds": [ "F7" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "visual screenshots", "evidence": "Desktop and mobile captures show unclipped, comfortably spaced text with a readable measure and no cramped wrapping.", "artifacts": [ "evidence/entry-desktop.png", "evidence/mobile.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "viewport probe, mobile layout and Lighthouse", "evidence": "Viewport content is user-scalable=no with maximum-scale=1; Lighthouse fails zoom. Mobile reflow itself has no overflow and no media requires captions.", "artifacts": [ "evidence/page-probe.json", "evidence/layout-mobile.json", "evidence/lighthouse.json" ], "findingIds": [ "F6" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Lighthouse best-practices audit", "evidence": "Lighthouse best-practices score was 1.0 and did not report console errors or uncaught exceptions.", "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "pass", "confidence": "high", "method": "DOM/images/Lighthouse inspection", "evidence": "Document has HTML doctype, UTF-8 charset, correctly dimensioned 360x200 image, and no aspect-ratio issue; Lighthouse best practices scored 1.0.", "artifacts": [ "evidence/page-probe.json", "evidence/images.json", "evidence/lighthouse.json" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "pass", "confidence": "high", "method": "Lighthouse platform audits", "evidence": "Lighthouse best practices scored 1.0 with no deprecated API, vulnerable library, paste-prevention, source-map, or permission-on-load finding. BFCache no-store is proportionate for a privacy-sensitive account property.", "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "metadata and discoverability probes", "evidence": "Title is descriptive but no meta description exists in rendered or raw content.", "artifacts": [ "evidence/page-probe.json", "evidence/discoverability.json" ], "findingIds": [ "F8" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "high", "method": "DOM and discoverability probes", "evidence": "All visible navigation uses real href links with descriptive text; viewport meta is present. The signed-out page returns 200 and raw content coverage is 100%.", "artifacts": [ "evidence/recon.json", "evidence/page-probe.json", "evidence/discoverability.json" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "high", "method": "metadata plus robots/sitemap HTTP inspection", "evidence": "Main page returns 200, declares canonical https://myactivity.google.com/, has no accidental noindex, and its absent robots/sitemap endpoints return explicit 404s rather than contradictory rules. Localized variants were not exposed on this signed-out route.", "artifacts": [ "evidence/page-probe.json", "evidence/robots-sitemap.txt" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "not-applicable", "confidence": "high", "method": "entity and metadata inspection", "evidence": "The signed-out account utility page does not represent an article, product, organization, event, place, or other public rich entity.", "artifacts": [ "evidence/page-probe.json" ], "reason": "The signed-out account utility page does not represent an article, product, organization, event, place, or other public rich entity." }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "pass", "confidence": "high", "method": "headers, cookies and secrets inspection", "evidence": "HTTPS, HSTS, nosniff, SAMEORIGIN, CSP, Trusted Types enforcement and secure cookies are present; no mixed-content or sensitive-secret finding was observed.", "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/secrets.json" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "pass", "confidence": "high", "method": "trackers, HAR and secrets reasoning", "evidence": "No known tracker origin was detected and no sensitive secret was exposed. Five other Google-operated origins loaded supporting assets/services; the scanner’s Google API keys are public client keys, not credentials.", "artifacts": [ "evidence/trackers.json", "evidence/load-summary.json", "evidence/secrets.json" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/recon.json", "evidence/page-probe.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "security header inspection", "evidence": "CSP/Trusted Types, HSTS, SAMEORIGIN and Permissions-Policy are present, but one script policy allows unsafe-eval and Referrer-Policy is absent.", "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F9" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "high", "method": "discoverability raw-vs-rendered comparison", "evidence": "Raw HTML returned 200 with 100% rendered-word coverage; the crawler screenshot preserves the complete signed-out message and actions without JavaScript.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png", "evidence/discoverability-rendered.png" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/entry-dom.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "manifest/service-worker probe", "evidence": "My Activity is a private, server-backed account-data tool whose core value depends on authenticated live data; no offline/installability intent was declared and no manifest/service worker exists on the signed-out page.", "artifacts": [ "evidence/page-probe.json" ], "reason": "My Activity is a private, server-backed account-data tool whose core value depends on authenticated live data; no offline/installability intent was declared and no manifest/service worker exists on the signed-out page." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/recon.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "DOM language/direction probe", "evidence": "The page declares lang=en-US and dir=ltr; the public copy and reading order are coherent. Authenticated locale variants and authored CSS were not available.", "artifacts": [ "evidence/page-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "rendered-content inspection", "evidence": "The signed-out page renders no dates, numbers, currencies, durations, calendars, or user-entered locale-sensitive data.", "artifacts": [ "evidence/recon.json", "evidence/page-probe.json" ], "reason": "The signed-out page renders no dates, numbers, currencies, durations, calendars, or user-entered locale-sensitive data." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "rendered-content inspection", "evidence": "The signed-out page renders and accepts no time or event data.", "artifacts": [ "evidence/recon.json" ], "reason": "The signed-out page renders and accepts no time or event data." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "visual/task inspection", "evidence": "The landing page plainly explains why sign-in is needed, provides direct Privacy and Terms links, and shows no upsell, forced continuity, confirmshaming, or consent wall.", "artifacts": [ "evidence/entry-desktop.png", "evidence/mobile.png" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/recon.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/recon.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "blocked", "confidence": "high", "method": "Attempted signed-out recon, DOM/link inspection, screenshots, and representative-path discovery; authenticated controls were not reachable.", "evidence": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available, so this check was attempted through recon/DOM inspection but could not be executed on the core surface.", "artifacts": [ "evidence/recon.json" ], "reason": "The requested URL exposes only a signed-out landing page. The authenticated My Activity application and its stateful controls require credentials that were not available." }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "pass", "confidence": "high", "method": "images and HAR inspection", "evidence": "The only visible image is dimensioned, 10.7KiB transferred, exactly 2x its 360px display width, and not oversized; no media or heavy decorative assets exist.", "artifacts": [ "evidence/images.json", "evidence/load-summary.json" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "HAR summary and Lighthouse", "evidence": "The small signed-out prompt transfers 505,713 bytes across 22 requests; Lighthouse estimates 159 KiB unused JS and 13 KiB unused CSS.", "artifacts": [ "evidence/load-summary.json", "evidence/lighthouse.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "pass", "confidence": "high", "method": "HAR, tracker and screenshot inspection", "evidence": "No audio/video/autoplay exists, no known tracker was found, and supporting non-page-origin bytes are static Google assets; total load is moderate though reducible.", "artifacts": [ "evidence/load-summary.json", "evidence/trackers.json", "evidence/entry-desktop.png" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "WebMCP capability and page-intent probe", "evidence": "This is a privacy-sensitive authenticated account-data surface with no declared agent-facing intent; exposing capabilities without an explicit authorization design would be inappropriate.", "artifacts": [ "evidence/page-probe.json" ], "reason": "This is a privacy-sensitive authenticated account-data surface with no declared agent-facing intent; exposing capabilities without an explicit authorization design would be inappropriate." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "feature and task inspection", "evidence": "The signed-out page has no summarization, generation, or language-processing task that would benefit from on-device inference. Browser API availability alone is not application use.", "artifacts": [ "evidence/page-probe.json", "evidence/recon.json" ], "reason": "The signed-out page has no summarization, generation, or language-processing task that would benefit from on-device inference. Browser API availability alone is not application use." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "not-applicable", "confidence": "high", "method": "interaction inventory", "evidence": "The accessible signed-out page has no representative repeated stateful interaction; the only primary action navigates into credential-gated authentication, so a synthetic loop was not fabricated.", "artifacts": [ "evidence/recon.json" ], "reason": "The accessible signed-out page has no representative repeated stateful interaction; the only primary action navigates into credential-gated authentication, so a synthetic loop was not fabricated." }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "heap baseline summary", "evidence": "Baseline heap summary reported 164,709 nodes, 617,630 edges and 7,406,126 bytes total self size, proportionate and bounded for the loaded Google shell in the observed single state.", "artifacts": [ "evidence/heap-baseline.heapsnapshot" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "heap baseline plus interaction inventory", "evidence": "The baseline heap capture completed without a Detached* population surfaced in its compact summary; no repeated public interaction exists to produce listener/timer accumulation. Confidence is medium because the authenticated long-lived app was inaccessible.", "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/recon.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F1" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "incomplete", "reason": "One or more atomic checks are blocked by the authenticated application boundary." }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "incomplete", "reason": "One or more atomic checks are blocked by the authenticated application boundary." }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "pass" }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "incomplete", "reason": "One or more atomic checks are blocked by the authenticated application boundary." }, { "principleId": "support-core-task-success", "expectation": "default", "status": "incomplete", "reason": "One or more atomic checks are blocked by the authenticated application boundary." }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F2", "F3", "F4" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F5", "F7", "F6" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "pass" }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F8" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F9" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "incomplete", "reason": "One or more atomic checks are blocked by the authenticated application boundary." }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "incomplete", "reason": "One or more atomic checks are blocked by the authenticated application boundary." }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F10" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "All checks were judged not applicable to this signed-out, privacy-sensitive surface." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "signed-out", "description": "Public signed-out landing, representing the only reachable same-origin archetype; inspected for purpose, accessibility, preferences, responsive layout, security, performance and no-JS rendering.", "url": "https://myactivity.google.com/", "conditions": [ "desktop default", "viewport: 360x800", "prefers-color-scheme: dark", "prefers-contrast: more", "prefers-reduced-motion: reduce", "JavaScript disabled" ], "result": "issues" }, { "id": "authenticated-core", "description": "Authenticated timeline, search/filter, deletion, account, error/recovery and repeated-interaction journeys; selected because these are the service core and highest-risk surfaces.", "url": "https://myactivity.google.com/", "conditions": [ "authentication required" ], "result": "failed" } ], "findings": [ { "id": "F1", "severity": "medium", "confidence": "high", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "summary": "The signed-out page does not honor the user’s dark color-scheme preference.", "evidence": "The dark-emulated screenshot is pixel-identical in appearance to the default capture; the DOM reports white surfaces and color-scheme: normal.", "suggestedFix": "Declare color-scheme: light dark and provide preference-driven surface, text, control, and illustration colors, with a stable light fallback.", "artifacts": [ "evidence/dark.png", "evidence/entry-dom.json" ], "effort": "small", "pathId": "signed-out-landing", "url": "https://myactivity.google.com/" }, { "id": "F2", "severity": "medium", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "Mobile lab LCP is outside the good range on a very small signed-out page.", "evidence": "Lighthouse measured lab LCP at 2.7 s, just outside the good <=2.5 s range, while CLS was 0 and TBT 24 ms. The separate raw-CDP trace measured LCP 1.18 s and 0 ms blocking, showing run variance but not clearing the slower mobile-style lab result.", "suggestedFix": "Prioritize the LCP illustration with fetchpriority=\"high\", reduce critical script/font competition, and retest under mobile throttling.", "artifacts": [ "evidence/lighthouse.json", "evidence/load-trace-summary.json" ], "effort": "small", "pathId": "signed-out-landing", "url": "https://myactivity.google.com/" }, { "id": "F3", "severity": "medium", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance", "summary": "Critical delivery is heavier and less prioritized than the signed-out surface requires.", "evidence": "HAR recorded 505,713 transferred bytes, including 299,897 bytes of script and 127,775 bytes of fonts. Lighthouse found the LCP image lacked fetchpriority=\"high\", font-display could save about 70 ms, and one cache lifetime could save about 32 KiB.", "suggestedFix": "Prioritize the LCP image, use non-blocking font-display with metric-compatible fallbacks, and lengthen immutable static-asset caching where safe.", "artifacts": [ "evidence/load-summary.json", "evidence/lighthouse.json" ], "effort": "small", "pathId": "signed-out-landing", "url": "https://myactivity.google.com/" }, { "id": "F4", "severity": "medium", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance", "summary": "The signed-out page ships substantial unused JavaScript and CSS.", "evidence": "Lighthouse estimated 159 KiB of unused JavaScript across four bundles and 13 KiB of unused CSS; HAR shows seven scripts for a mostly static sign-in prompt.", "suggestedFix": "Split the signed-out route from account and feedback features, conditionally load nonessential modules, and remove unused signed-out CSS.", "artifacts": [ "evidence/lighthouse.json", "evidence/load-summary.json" ], "effort": "small", "pathId": "signed-out-landing", "url": "https://myactivity.google.com/" }, { "id": "F5", "severity": "medium", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "The inline “Learn more” link is distinguishable only by a low-contrast color difference.", "evidence": "Lighthouse reports only 1.23:1 contrast between the #2962ff link and surrounding #5f6368 text, below the 3:1 non-color distinction requirement, with no underline.", "suggestedFix": "Underline inline links by default and ensure a non-color affordance plus sufficient contrast in every preference mode.", "artifacts": [ "evidence/lighthouse.json", "evidence/entry-desktop.png" ], "effort": "small", "pathId": "signed-out-landing", "url": "https://myactivity.google.com/" }, { "id": "F6", "severity": "high", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "The viewport explicitly prevents mobile zoom.", "evidence": "The live DOM contains maximum-scale=1 and user-scalable=no; Lighthouse fails the meta-viewport audit. This blocks a key low-vision adaptation.", "suggestedFix": "Remove maximum-scale=1 and user-scalable=no. Keep width=device-width, initial-scale=1 and verify reflow at 200% and 400%.", "artifacts": [ "evidence/page-probe.json", "evidence/lighthouse.json" ], "effort": "small", "pathId": "signed-out-landing", "url": "https://myactivity.google.com/" }, { "id": "F7", "severity": "low", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "The main page title starts at h2 and there is no h1/main landmark.", "evidence": "The DOM probe found one H2 (“Welcome to My Activity”), no H1, a banner and footer, but no main landmark.", "suggestedFix": "Wrap the primary content in
and promote the page title to a single descriptive

.", "artifacts": [ "evidence/page-probe.json", "evidence/entry-dom.json" ], "effort": "small", "pathId": "signed-out-landing", "url": "https://myactivity.google.com/" }, { "id": "F8", "severity": "low", "confidence": "high", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "html", "guidanceCategory": "html", "summary": "The public signed-out landing page has no meta description.", "evidence": "The rendered DOM and discoverability primitive both report no meta description, although the title is descriptive and raw HTML coverage is 100%.", "suggestedFix": "Add a concise, unique meta description explaining that users can sign in to review and manage Google activity.", "artifacts": [ "evidence/page-probe.json", "evidence/discoverability.json" ], "effort": "small", "pathId": "signed-out-landing", "url": "https://myactivity.google.com/" }, { "id": "F9", "severity": "medium", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "security", "summary": "The signed-out response has avoidable policy gaps.", "evidence": "Headers evidence shows CSP includes unsafe-eval in one policy and no Referrer-Policy header. HSTS, nosniff, SAMEORIGIN, Trusted Types enforcement, and Permissions-Policy are present.", "suggestedFix": "Remove unsafe-eval from the applicable script policy if compatibility permits and send an explicit strict-origin-when-cross-origin or stricter Referrer-Policy.", "artifacts": [ "evidence/headers.json" ], "effort": "small", "pathId": "signed-out-landing", "url": "https://myactivity.google.com/" }, { "id": "F10", "severity": "medium", "confidence": "high", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "deprioritize-background-fetches", "guidanceCategory": "performance", "summary": "The public sign-in prompt performs disproportionate background and unused work.", "evidence": "HAR recorded 22 requests and 505,713 transferred bytes for a small static prompt, while Lighthouse estimated 159 KiB unused JavaScript and 13 KiB unused CSS. Twenty requests and 447,510 bytes came from other Google origins.", "suggestedFix": "Create a lean signed-out bundle and defer feedback, app-menu, analytics/logging, and account-only modules until requested or authenticated.", "artifacts": [ "evidence/load-summary.json", "evidence/lighthouse.json" ], "effort": "small", "pathId": "signed-out-landing", "url": "https://myactivity.google.com/" } ], "taskList": [ { "id": "T1", "title": "Restore user zoom and verify 200%/400% reflow", "priority": 1, "findingIds": [ "F6" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T2", "title": "Slim and defer signed-out JavaScript, CSS and background modules", "priority": 2, "findingIds": [ "F4", "F10" ], "guidanceId": "conditional-async-dependencies", "status": "open" }, { "id": "T3", "title": "Improve LCP discovery, font delivery and cache lifetimes", "priority": 3, "findingIds": [ "F2", "F3" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T4", "title": "Add preference-driven dark theme", "priority": 4, "findingIds": [ "F1" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T5", "title": "Fix inline-link distinction and document structure", "priority": 5, "findingIds": [ "F5", "F7" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T6", "title": "Tighten CSP/referrer policy", "priority": 6, "findingIds": [ "F9" ], "guidanceId": "security", "status": "open" }, { "id": "T7", "title": "Add a signed-out meta description", "priority": 7, "findingIds": [ "F8" ], "guidanceId": "html", "status": "open" } ], "budget": { "wallClockSeconds": 720, "pathCount": 2, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-26T04-47-06-539Z" }