{
  "url": "https://www.universal-credit.service.gov.uk",
  "auditedAt": "2026-07-28T01:02:19.668Z",
  "mode": "report",
  "status": "partial",
  "statusDetail": "Public surfaces were audited, but protected claimant flows and one stable form-validation state prevented full atomic completion.",
  "page": {
    "appType": "mpa",
    "framework": "Server-rendered GOV.UK-style application",
    "notes": "Public pre-authentication surface. The root redirects to /start. Robots and noindex deliberately exclude the service from public indexing."
  },
  "evidenceUsed": [
    "screenshot",
    "dom",
    "evaluate-probe",
    "layout-metrics",
    "trace",
    "har",
    "discoverability",
    "headers",
    "cookies",
    "trackers",
    "secrets",
    "images",
    "heap-summary",
    "lighthouse",
    "curl-response-inspection",
    "Modern Web Guidance search/retrieve"
  ],
  "guidanceConsulted": [
    "dark-mode",
    "accessibility",
    "forms",
    "performance",
    "security",
    "privacy",
    "html",
    "autofill-sign-in-form",
    "passkey-authentication",
    "optimize-script-priority",
    "identify-heavy-scripts",
    "adapt-scrollbar-to-contrast-preferences"
  ],
  "artifacts": [
    {
      "type": "screenshot",
      "path": "evidence/accessibility.png",
      "caption": "accessibility"
    },
    {
      "type": "other",
      "path": "evidence/auth-probe.json",
      "caption": "auth probe",
      "findingIds": [
        "F04",
        "F06"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/contact.png",
      "caption": "contact"
    },
    {
      "type": "other",
      "path": "evidence/cookies.json",
      "caption": "cookies"
    },
    {
      "type": "screenshot",
      "path": "evidence/create-account-step.png",
      "caption": "create account step"
    },
    {
      "type": "screenshot",
      "path": "evidence/dark.png",
      "caption": "dark",
      "findingIds": [
        "F01"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/desktop.png",
      "caption": "desktop"
    },
    {
      "type": "screenshot",
      "path": "evidence/discoverability-crawler.png",
      "caption": "discoverability crawler"
    },
    {
      "type": "screenshot",
      "path": "evidence/discoverability-rendered.png",
      "caption": "discoverability rendered"
    },
    {
      "type": "discoverability",
      "path": "evidence/discoverability.json",
      "caption": "discoverability",
      "findingIds": [
        "F07"
      ]
    },
    {
      "type": "dom",
      "path": "evidence/dom.json",
      "caption": "dom",
      "findingIds": [
        "F01"
      ]
    },
    {
      "type": "other",
      "path": "evidence/focus-probe.json",
      "caption": "focus probe"
    },
    {
      "type": "other",
      "path": "evidence/guidance-accessibility.md",
      "caption": "guidance accessibility"
    },
    {
      "type": "other",
      "path": "evidence/guidance-autofill-sign-in-form.md",
      "caption": "guidance autofill sign in form"
    },
    {
      "type": "other",
      "path": "evidence/guidance-dark-mode.md",
      "caption": "guidance dark mode"
    },
    {
      "type": "other",
      "path": "evidence/guidance-forms.md",
      "caption": "guidance forms"
    },
    {
      "type": "other",
      "path": "evidence/guidance-html.md",
      "caption": "guidance html"
    },
    {
      "type": "other",
      "path": "evidence/guidance-identify-heavy-scripts.md",
      "caption": "guidance identify heavy scripts"
    },
    {
      "type": "other",
      "path": "evidence/guidance-list.json",
      "caption": "guidance list"
    },
    {
      "type": "other",
      "path": "evidence/guidance-optimize-script-priority.md",
      "caption": "guidance optimize script priority"
    },
    {
      "type": "other",
      "path": "evidence/guidance-passkey-authentication.md",
      "caption": "guidance passkey authentication"
    },
    {
      "type": "other",
      "path": "evidence/guidance-performance.md",
      "caption": "guidance performance"
    },
    {
      "type": "other",
      "path": "evidence/guidance-privacy.md",
      "caption": "guidance privacy"
    },
    {
      "type": "other",
      "path": "evidence/guidance-searches.jsonl",
      "caption": "guidance searches"
    },
    {
      "type": "other",
      "path": "evidence/guidance-security.md",
      "caption": "guidance security"
    },
    {
      "type": "other",
      "path": "evidence/headers-curl.txt",
      "caption": "headers curl",
      "findingIds": [
        "F05"
      ]
    },
    {
      "type": "other",
      "path": "evidence/headers.json",
      "caption": "headers"
    },
    {
      "type": "heap",
      "path": "evidence/heap-baseline.json",
      "caption": "heap baseline"
    },
    {
      "type": "heap",
      "path": "evidence/heap-post.json",
      "caption": "heap post"
    },
    {
      "type": "other",
      "path": "evidence/http-state-probe.json",
      "caption": "http state probe"
    },
    {
      "type": "other",
      "path": "evidence/images.json",
      "caption": "images"
    },
    {
      "type": "layout",
      "path": "evidence/layout-mobile.json",
      "caption": "layout mobile"
    },
    {
      "type": "lighthouse",
      "path": "evidence/lighthouse.json",
      "caption": "lighthouse",
      "findingIds": [
        "F03"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/mobile.png",
      "caption": "mobile"
    },
    {
      "type": "har-summary",
      "path": "evidence/network-summary.json",
      "caption": "network summary",
      "findingIds": [
        "F02",
        "F03"
      ]
    },
    {
      "type": "har",
      "path": "evidence/network.har",
      "caption": "network",
      "findingIds": [
        "F02"
      ]
    },
    {
      "type": "other",
      "path": "evidence/page-probe.json",
      "caption": "page probe",
      "findingIds": [
        "F07"
      ]
    },
    {
      "type": "other",
      "path": "evidence/preferences-probe.json",
      "caption": "preferences probe"
    },
    {
      "type": "other",
      "path": "evidence/robots.txt",
      "caption": "robots"
    },
    {
      "type": "other",
      "path": "evidence/secrets.json",
      "caption": "secrets"
    },
    {
      "type": "dom",
      "path": "evidence/sign-in-dom.json",
      "caption": "sign in dom",
      "findingIds": [
        "F06"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/sign-in-errors-2.png",
      "caption": "sign in errors 2"
    },
    {
      "type": "screenshot",
      "path": "evidence/sign-in-errors.png",
      "caption": "sign in errors"
    },
    {
      "type": "other",
      "path": "evidence/sign-in-probe.json",
      "caption": "sign in probe",
      "findingIds": [
        "F02"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/sign-in.png",
      "caption": "sign in",
      "findingIds": [
        "F04"
      ]
    },
    {
      "type": "other",
      "path": "evidence/sitemap-response.html",
      "caption": "sitemap response"
    },
    {
      "type": "trace-summary",
      "path": "evidence/trace-summary.json",
      "caption": "trace summary"
    },
    {
      "type": "trace",
      "path": "evidence/trace.json",
      "caption": "trace"
    },
    {
      "type": "other",
      "path": "evidence/trackers.json",
      "caption": "trackers"
    }
  ],
  "config": {
    "loaded": false
  },
  "coverage": {
    "catalogVersion": "modern-web-guidance@0.0.172",
    "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7",
    "expected": 58,
    "recorded": 58,
    "judged": 55,
    "blocked": 3,
    "notRun": 0,
    "missing": 0,
    "unknown": 0,
    "duplicates": 0,
    "complete": false
  },
  "checkOutcomes": [
    {
      "principleId": "respect-user-preferences",
      "checkId": "respects-color-scheme",
      "confidence": "high",
      "method": "Targeted visual/objective probe",
      "evidence": "The dark-condition screenshot is pixel-identical in surface treatment to the desktop screenshot; the DOM reports color-scheme: normal and a white body background.",
      "pathIds": [
        "landing"
      ],
      "status": "issues",
      "artifacts": [
        "evidence/dark.png",
        "evidence/dom.json"
      ],
      "findingIds": [
        "F01"
      ]
    },
    {
      "principleId": "respect-user-preferences",
      "checkId": "respects-reduced-motion",
      "confidence": "high",
      "method": "evaluate under prefers-reduced-motion: reduce",
      "evidence": "No active animations were present, so no non-essential motion remained under the requested reduced-motion condition.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/preferences-probe.json"
      ]
    },
    {
      "principleId": "respect-user-preferences",
      "checkId": "respects-contrast",
      "confidence": "high",
      "method": "Lighthouse accessibility plus preference/focus probes",
      "evidence": "Lighthouse contrast passed; high-visibility yellow/black focus states remained visible and prefers-contrast was active in the probe.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/lighthouse.json",
        "evidence/focus-probe.json"
      ]
    },
    {
      "principleId": "implement-natural-interactions",
      "checkId": "view-transitions",
      "confidence": "high",
      "method": "DOM/CSS probe and page-journey screenshots",
      "evidence": "The simple server-rendered multi-page journey changes at clear document boundaries and does not contain abrupt in-page state swaps requiring animation.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/page-probe.json"
      ]
    },
    {
      "principleId": "implement-natural-interactions",
      "checkId": "scroll-driven-animations",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required.",
      "status": "not-applicable",
      "reason": "The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required."
    },
    {
      "principleId": "implement-natural-interactions",
      "checkId": "physical-gestures",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required.",
      "status": "not-applicable",
      "reason": "The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required."
    },
    {
      "principleId": "provide-guided-navigation",
      "checkId": "scroll-state-aware-chrome",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required.",
      "status": "not-applicable",
      "reason": "The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required."
    },
    {
      "principleId": "provide-guided-navigation",
      "checkId": "anchored-positioning",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required.",
      "status": "not-applicable",
      "reason": "The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required."
    },
    {
      "principleId": "provide-guided-navigation",
      "checkId": "directs-attention",
      "confidence": "high",
      "method": "Visual review across representative templates",
      "evidence": "Distinct H1 headings, skip link, recovery links and consistent GOV.UK navigation make the destination and next action clear.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/desktop.png",
        "evidence/sign-in.png"
      ]
    },
    {
      "principleId": "maximize-content-reduce-noise",
      "checkId": "no-intrusive-interruptions",
      "confidence": "high",
      "method": "Desktop/mobile screenshots on first load",
      "evidence": "The consent region pushes content rather than obscuring it, offers equal accept/reject actions, and links to detail.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/desktop.png",
        "evidence/mobile.png"
      ]
    },
    {
      "principleId": "maximize-content-reduce-noise",
      "checkId": "semantic-dismissible-primitives",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required.",
      "status": "not-applicable",
      "reason": "The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required."
    },
    {
      "principleId": "maximize-content-reduce-noise",
      "checkId": "reduced-chrome",
      "confidence": "high",
      "method": "Visual review of first viewport and content templates",
      "evidence": "The restrained GOV.UK shell uses whitespace and a narrow content column; primary content dominates after the explicit consent region.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/desktop.png"
      ]
    },
    {
      "principleId": "adapt-to-the-form-factor",
      "checkId": "responsive-no-horizontal-scroll",
      "confidence": "high",
      "method": "Layout primitive at 360x800",
      "evidence": "scrollWidth, clientWidth and innerWidth were all 360px; horizontalOverflowPx was 0 and CLS was 0.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/layout-mobile.json",
        "evidence/mobile.png"
      ]
    },
    {
      "principleId": "adapt-to-the-form-factor",
      "checkId": "component-level-responsiveness",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required.",
      "status": "not-applicable",
      "reason": "The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required."
    },
    {
      "principleId": "adapt-to-the-form-factor",
      "checkId": "input-modality-aware",
      "confidence": "high",
      "method": "Keyboard focus and target-size probe",
      "evidence": "Visible yellow/black focus treatment appeared on fields, buttons and links; primary controls were 38-40px high with generous surrounding spacing.",
      "pathIds": [
        "sign-in"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/focus-probe.json"
      ]
    },
    {
      "principleId": "support-core-task-success",
      "checkId": "clear-purpose-and-primary-action",
      "confidence": "high",
      "method": "First-viewport visual review",
      "evidence": "The H1 states Universal Credit online and the page immediately explains its uses with clearly differentiated Create an account and Sign in paths.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/desktop.png"
      ]
    },
    {
      "principleId": "support-core-task-success",
      "checkId": "primary-flow-completion",
      "confidence": "high",
      "method": "Attempted public flow walkthrough and protected-state reconnaissance",
      "evidence": "End-to-end account creation/claim completion requires real claimant identity and personal data; the public entry and sign-in surfaces were inspected, but protected completion was not attempted.",
      "pathIds": [
        "landing",
        "sign-in"
      ],
      "status": "blocked",
      "reason": "End-to-end account creation/claim completion requires real claimant identity and personal data; the public entry and sign-in surfaces were inspected, but protected completion was not attempted."
    },
    {
      "principleId": "support-core-task-success",
      "checkId": "clear-system-state-and-recovery",
      "confidence": "high",
      "method": "Sign-in and HTTP-state review",
      "evidence": "Forgotten username/password, contact/help routes and a real 404 response provide clear recovery routes for sampled states.",
      "pathIds": [
        "sign-in"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/sign-in.png",
        "evidence/http-state-probe.json"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "good-core-web-vitals",
      "confidence": "high",
      "method": "Trace, layout and Lighthouse",
      "evidence": "Trace measured FCP 338ms, LCP 391ms, no long tasks and 0ms TBT; Lighthouse lab LCP was 2.3s with CLS effectively 0.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/trace-summary.json",
        "evidence/layout-mobile.json",
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "visual-stability",
      "confidence": "high",
      "method": "Mobile layout and Lighthouse",
      "evidence": "The layout observer measured CLS 0 with no shifts; Lighthouse also reported CLS 0.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/layout-mobile.json",
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "efficient-main-thread",
      "confidence": "high",
      "method": "Trace and Lighthouse",
      "evidence": "The trace recorded no long tasks and 0ms total blocking time; Lighthouse TBT was 10ms.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/trace-summary.json",
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "efficient-resource-delivery",
      "confidence": "high",
      "method": "Targeted visual/objective probe",
      "evidence": "The HAR records a 467,516-byte claimant script plus two other uncompressed scripts; the live DOM confirms all three external scripts have async=false, defer=false and no module type.",
      "pathIds": [
        "landing"
      ],
      "status": "issues",
      "artifacts": [
        "evidence/network-summary.json",
        "evidence/network.har",
        "evidence/sign-in-probe.json"
      ],
      "findingIds": [
        "F02"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "trim-unused-and-duplicate-code",
      "confidence": "high",
      "method": "Targeted visual/objective probe",
      "evidence": "Lighthouse estimates 272 KiB of unused JavaScript in claimant.js and 42 KiB of unused CSS; the HAR shows 650,809 transferred bytes for a simple text/form entry page.",
      "pathIds": [
        "landing"
      ],
      "status": "issues",
      "artifacts": [
        "evidence/lighthouse.json",
        "evidence/network-summary.json"
      ],
      "findingIds": [
        "F03"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "names-roles-labels",
      "confidence": "high",
      "method": "Lighthouse accessibility and DOM review",
      "evidence": "Lighthouse accessibility scored 100; links/buttons had names and sign-in fields had explicit labels.",
      "pathIds": [
        "sign-in"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/lighthouse.json",
        "evidence/sign-in-dom.json"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "sufficient-contrast",
      "confidence": "high",
      "method": "Lighthouse contrast audit",
      "evidence": "Lighthouse reported no colour-contrast failures.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "structure-and-focus",
      "confidence": "high",
      "method": "Lighthouse and focus-walk probe",
      "evidence": "Logical H1/landmark structure and highly visible focus styles were observed on all sampled visible controls.",
      "pathIds": [
        "sign-in"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/lighthouse.json",
        "evidence/focus-probe.json"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "legible-text",
      "confidence": "high",
      "method": "Desktop/mobile visual review",
      "evidence": "Text uses comfortable GOV.UK sizing, line length, spacing and strong hierarchy without clipping on sampled viewports.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/desktop.png",
        "evidence/mobile.png"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "zoom-reflow-targets-and-media",
      "confidence": "high",
      "method": "Mobile layout, viewport and media probe",
      "evidence": "Viewport permits scaling, the 360px layout reflows without overflow, and no audio/video required alternatives.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/layout-mobile.json",
        "evidence/page-probe.json"
      ]
    },
    {
      "principleId": "follow-best-practices",
      "checkId": "no-console-errors",
      "confidence": "high",
      "method": "Lighthouse best-practices audit",
      "evidence": "Lighthouse found no errors logged to the console.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "follow-best-practices",
      "checkId": "sound-document-and-assets",
      "confidence": "high",
      "method": "DOM, image and Lighthouse review",
      "evidence": "HTML doctype, UTF-8 charset and viewport are present; no img elements had sizing/alt defects; Lighthouse best practices scored 100.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/page-probe.json",
        "evidence/images.json",
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "follow-best-practices",
      "checkId": "browser-platform-hygiene",
      "confidence": "high",
      "method": "Lighthouse and DOM review",
      "evidence": "Lighthouse best practices scored 100; no permission prompt appeared on load and no paste prevention was observed. The no-store BFCache limitation is proportionate for a sensitive benefits service.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/lighthouse.json",
        "evidence/auth-probe.json"
      ]
    },
    {
      "principleId": "be-discoverable",
      "checkId": "title-and-description",
      "confidence": "high",
      "method": "Targeted visual/objective probe",
      "evidence": "The page probe and discoverability primitive found a descriptive title and H1 but no meta[name=description].",
      "pathIds": [
        "landing"
      ],
      "status": "issues",
      "artifacts": [
        "evidence/page-probe.json",
        "evidence/discoverability.json"
      ],
      "findingIds": [
        "F07"
      ]
    },
    {
      "principleId": "be-discoverable",
      "checkId": "crawlable-and-mobile-friendly",
      "confidence": "high",
      "method": "DOM, robots and viewport inspection",
      "evidence": "Links use real href values, the viewport meta is correct, and robots Disallow plus noindex are consistent with this deliberately gated account service rather than accidental indexing loss.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/page-probe.json",
        "evidence/robots.txt"
      ]
    },
    {
      "principleId": "be-discoverable",
      "checkId": "canonical-and-indexing-signals",
      "confidence": "high",
      "method": "HTTP and indexing-policy inspection",
      "evidence": "The entry document returns 200 and its robots/noindex signals consistently exclude the private application; the absence of a sitemap is intentional for the gated service.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/robots.txt",
        "evidence/http-state-probe.json"
      ]
    },
    {
      "principleId": "be-discoverable",
      "checkId": "structured-and-shareable-metadata",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "This authenticated benefits application explicitly returns robots Disallow: / and page-level noindex; public indexing, rich metadata and share previews are intentionally out of scope.",
      "status": "not-applicable",
      "reason": "This authenticated benefits application explicitly returns robots Disallow: / and page-level noindex; public indexing, rich metadata and share previews are intentionally out of scope."
    },
    {
      "principleId": "be-private-and-secure",
      "checkId": "secure-transport-and-headers",
      "confidence": "high",
      "method": "Direct final-response headers, cookies and secret scan",
      "evidence": "HTTPS, one-year HSTS, nonce/hash CSP, frame-ancestors DENY, nosniff, Secure+HttpOnly cookies and zero exposed secrets were observed.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/headers-curl.txt",
        "evidence/cookies.json",
        "evidence/secrets.json"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "checkId": "data-minimisation-and-third-parties",
      "confidence": "high",
      "method": "Tracker and HAR review before consent",
      "evidence": "No third-party origin, tracker or third-party byte was requested before analytics consent.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/trackers.json",
        "evidence/network-summary.json"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "checkId": "in-context-permissions-and-modern-auth",
      "confidence": "high",
      "method": "Targeted visual/objective probe",
      "evidence": "The sign-in DOM contains username and password controls; the auth probe found no navigator.credentials usage or other passkey affordance on the page.",
      "pathIds": [
        "sign-in"
      ],
      "status": "issues",
      "artifacts": [
        "evidence/sign-in.png",
        "evidence/auth-probe.json"
      ],
      "findingIds": [
        "F04"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "checkId": "defensive-browser-policies",
      "confidence": "high",
      "method": "Targeted visual/objective probe",
      "evidence": "The final /start response has HSTS, nosniff, DENY/frame-ancestors and a nonce/hash CSP, but script-src includes unsafe-eval and no Referrer-Policy or Permissions-Policy headers are present.",
      "pathIds": [
        "landing"
      ],
      "status": "issues",
      "artifacts": [
        "evidence/headers-curl.txt"
      ],
      "findingIds": [
        "F05"
      ]
    },
    {
      "principleId": "be-resilient",
      "checkId": "progressive-enhancement",
      "confidence": "high",
      "method": "Discoverability no-JS comparison",
      "evidence": "Raw HTML retained 100% of rendered content words with title and H1 present; the site is not a JS shell.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/discoverability.json",
        "evidence/discoverability-crawler.png"
      ]
    },
    {
      "principleId": "be-resilient",
      "checkId": "resilient-runtime-behaviour",
      "confidence": "high",
      "method": "Representative template and interaction review",
      "evidence": "Simple server-rendered pages, native links/forms and no custom overlay positioning reduced runtime fragility on sampled public routes.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/dom.json",
        "evidence/sign-in-dom.json"
      ]
    },
    {
      "principleId": "be-resilient",
      "checkId": "offline-and-installable",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "This benefits account service is intrinsically online and handles live private account state; offline/installable behavior is not a reasonable requirement for the sampled public surface.",
      "status": "not-applicable",
      "reason": "This benefits account service is intrinsically online and handles live private account state; offline/installable behavior is not a reasonable requirement for the sampled public surface."
    },
    {
      "principleId": "be-resilient",
      "checkId": "network-and-http-failure-states",
      "confidence": "high",
      "method": "HTTP failure probe",
      "evidence": "A non-existent route returned HTTP 404 with a Page not found document rather than a blank shell.",
      "pathIds": [
        "not-found"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/http-state-probe.json",
        "evidence/sitemap-response.html"
      ]
    },
    {
      "principleId": "be-internationalised",
      "checkId": "lang-dir-and-logical-properties",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "The sampled public service is deliberately UK English (en-GB) and contains no locale-sensitive dates, numbers, currencies or time-zone data; multilingual/localized operation was not part of the public surface.",
      "status": "not-applicable",
      "reason": "The sampled public service is deliberately UK English (en-GB) and contains no locale-sensitive dates, numbers, currencies or time-zone data; multilingual/localized operation was not part of the public surface."
    },
    {
      "principleId": "be-internationalised",
      "checkId": "locale-aware-data",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "The sampled public service is deliberately UK English (en-GB) and contains no locale-sensitive dates, numbers, currencies or time-zone data; multilingual/localized operation was not part of the public surface.",
      "status": "not-applicable",
      "reason": "The sampled public service is deliberately UK English (en-GB) and contains no locale-sensitive dates, numbers, currencies or time-zone data; multilingual/localized operation was not part of the public surface."
    },
    {
      "principleId": "be-internationalised",
      "checkId": "time-zone-correctness",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "The sampled public service is deliberately UK English (en-GB) and contains no locale-sensitive dates, numbers, currencies or time-zone data; multilingual/localized operation was not part of the public surface.",
      "status": "not-applicable",
      "reason": "The sampled public service is deliberately UK English (en-GB) and contains no locale-sensitive dates, numbers, currencies or time-zone data; multilingual/localized operation was not part of the public surface."
    },
    {
      "principleId": "be-trustworthy",
      "checkId": "no-dark-patterns",
      "confidence": "high",
      "method": "Consent and entry-page visual review",
      "evidence": "Accept and Reject analytics choices have equal visual weight; no forced continuity, disguised advertising or confirmshaming was observed.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/desktop.png",
        "evidence/mobile.png"
      ]
    },
    {
      "principleId": "be-trustworthy",
      "checkId": "humane-error-handling",
      "confidence": "high",
      "method": "Attempted public flow walkthrough and protected-state reconnaissance",
      "evidence": "A blank-submit interaction was attempted, but the evidence primitive did not capture a stable post-validation state before browser teardown; no pass or failure is asserted.",
      "pathIds": [
        "sign-in"
      ],
      "status": "blocked",
      "reason": "A blank-submit interaction was attempted, but the evidence primitive did not capture a stable post-validation state before browser teardown; no pass or failure is asserted."
    },
    {
      "principleId": "be-trustworthy",
      "checkId": "trustworthy-input-assistance",
      "confidence": "high",
      "method": "Targeted visual/objective probe",
      "evidence": "The auth and sign-in probes show no autocomplete attribute on either userName or password.",
      "pathIds": [
        "sign-in"
      ],
      "status": "issues",
      "artifacts": [
        "evidence/auth-probe.json",
        "evidence/sign-in-dom.json"
      ],
      "findingIds": [
        "F06"
      ]
    },
    {
      "principleId": "be-trustworthy",
      "checkId": "safe-commercial-and-account-flows",
      "confidence": "high",
      "method": "Attempted public flow walkthrough and protected-state reconnaissance",
      "evidence": "Protected account-management and reauthentication states require a real claimant account and credentials, which were unavailable and were not fabricated.",
      "pathIds": [
        "sign-in"
      ],
      "status": "blocked",
      "reason": "Protected account-management and reauthentication states require a real claimant account and credentials, which were unavailable and were not fabricated."
    },
    {
      "principleId": "be-sustainable",
      "checkId": "optimised-assets",
      "confidence": "high",
      "method": "HAR and image inspection",
      "evidence": "No img elements were shipped; the only image resource is a reusable vector crest and there is no heavy media.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/images.json",
        "evidence/network-summary.json"
      ]
    },
    {
      "principleId": "be-sustainable",
      "checkId": "no-wasteful-work",
      "confidence": "high",
      "method": "Trace and network review",
      "evidence": "No long tasks, background third-party calls or media work ran during the sampled load.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/trace-summary.json",
        "evidence/trackers.json"
      ]
    },
    {
      "principleId": "be-sustainable",
      "checkId": "third-party-and-media-budget",
      "confidence": "high",
      "method": "HAR/trackers/media probe",
      "evidence": "Zero third-party bytes and no audio/video were observed; fonts and the crest are first-party.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/network-summary.json",
        "evidence/trackers.json",
        "evidence/page-probe.json"
      ]
    },
    {
      "principleId": "be-agent-ready",
      "checkId": "structured-agent-capabilities",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "No declared agent-facing intent exists for this sensitive benefits/account service; exposing transactional tools is an emerging contextual capability, not assumed safe.",
      "status": "not-applicable",
      "reason": "No declared agent-facing intent exists for this sensitive benefits/account service; exposing transactional tools is an emerging contextual capability, not assumed safe."
    },
    {
      "principleId": "be-agent-ready",
      "checkId": "on-device-inference",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "No declared agent-facing intent exists for this sensitive benefits/account service; exposing transactional tools is an emerging contextual capability, not assumed safe.",
      "status": "not-applicable",
      "reason": "No declared agent-facing intent exists for this sensitive benefits/account service; exposing transactional tools is an emerging contextual capability, not assumed safe."
    },
    {
      "principleId": "be-memory-efficient",
      "checkId": "no-leak-under-repeated-interaction",
      "confidence": "high",
      "method": "Applicability judgement from recon and page feature inventory",
      "evidence": "No safe, repeatable client-side interaction exists on the sampled server-rendered public pages; account submission requires real claimant data, so a synthetic ten-cycle interaction was not fabricated.",
      "status": "not-applicable",
      "reason": "No safe, repeatable client-side interaction exists on the sampled server-rendered public pages; account submission requires real claimant data, so a synthetic ten-cycle interaction was not fabricated."
    },
    {
      "principleId": "be-memory-efficient",
      "checkId": "bounded-footprint",
      "confidence": "high",
      "method": "Heap summary",
      "evidence": "The static entry page used about 5.8MB self size with 113,959 heap nodes, proportionate to the simple page and with no dominant application-object population.",
      "pathIds": [
        "landing"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/heap-baseline.json"
      ]
    },
    {
      "principleId": "be-memory-efficient",
      "checkId": "no-detached-dom-or-unbounded-listeners",
      "confidence": "high",
      "method": "Two independent heap summaries and constructor review",
      "evidence": "Baseline and post-attempt snapshots were close (5,818,314 vs 5,862,606 bytes; 113,959 vs 114,487 nodes) and no Detached* constructor appeared among retained top constructors.",
      "pathIds": [
        "sign-in"
      ],
      "status": "pass",
      "artifacts": [
        "evidence/heap-baseline.json",
        "evidence/heap-post.json"
      ]
    }
  ],
  "principleOutcomes": [
    {
      "principleId": "respect-user-preferences",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F01"
      ]
    },
    {
      "principleId": "implement-natural-interactions",
      "expectation": "default",
      "status": "pass"
    },
    {
      "principleId": "provide-guided-navigation",
      "expectation": "default",
      "status": "pass"
    },
    {
      "principleId": "maximize-content-reduce-noise",
      "expectation": "default",
      "status": "pass"
    },
    {
      "principleId": "adapt-to-the-form-factor",
      "expectation": "default",
      "status": "pass"
    },
    {
      "principleId": "support-core-task-success",
      "expectation": "default",
      "status": "incomplete",
      "reason": "One or more required checks were blocked by protected claimant/account state or an uncaptured validation state."
    },
    {
      "principleId": "be-fast-and-stable",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F02",
        "F03"
      ]
    },
    {
      "principleId": "be-inclusive",
      "expectation": "default",
      "status": "pass"
    },
    {
      "principleId": "follow-best-practices",
      "expectation": "default",
      "status": "pass"
    },
    {
      "principleId": "be-discoverable",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F07"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F04",
        "F05"
      ]
    },
    {
      "principleId": "be-resilient",
      "expectation": "contextual",
      "status": "pass"
    },
    {
      "principleId": "be-internationalised",
      "expectation": "contextual",
      "status": "not-applicable",
      "reason": "The sampled public service is deliberately UK English (en-GB) and contains no locale-sensitive dates, numbers, currencies or time-zone data; multilingual/localized operation was not part of the public surface."
    },
    {
      "principleId": "be-trustworthy",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F06"
      ]
    },
    {
      "principleId": "be-sustainable",
      "expectation": "contextual",
      "status": "pass"
    },
    {
      "principleId": "be-agent-ready",
      "expectation": "contextual",
      "status": "not-applicable",
      "reason": "No declared agent-facing intent exists for this sensitive benefits/account service; exposing transactional tools is an emerging contextual capability, not assumed safe."
    },
    {
      "principleId": "be-memory-efficient",
      "expectation": "default",
      "status": "pass"
    }
  ],
  "paths": [
    {
      "id": "landing",
      "description": "Public service entry page and primary account-creation/sign-in choice; represents the common GOV.UK service shell.",
      "url": "https://www.universal-credit.service.gov.uk/start",
      "conditions": [
        "desktop 1440x1000",
        "mobile 360x800",
        "prefers-color-scheme: dark",
        "prefers-reduced-motion: reduce",
        "prefers-contrast: more",
        "JavaScript disabled crawler view"
      ],
      "result": "issues"
    },
    {
      "id": "sign-in",
      "description": "Authentication form, keyboard focus, input-assistance and recovery-link surface.",
      "url": "https://www.universal-credit.service.gov.uk/sign-in",
      "conditions": [
        "desktop 1440x1000",
        "keyboard focus probe",
        "blank-submit attempt"
      ],
      "result": "issues"
    },
    {
      "id": "contact",
      "description": "Support/contact content template and recovery route.",
      "url": "https://www.universal-credit.service.gov.uk/contact",
      "conditions": [
        "desktop 1440x1000"
      ],
      "result": "pass"
    },
    {
      "id": "accessibility",
      "description": "Long-form policy/content template.",
      "url": "https://www.universal-credit.service.gov.uk/accessibility-statement",
      "conditions": [
        "desktop 1440x1000"
      ],
      "result": "pass"
    },
    {
      "id": "not-found",
      "description": "Representative HTTP failure state sampled with a non-existent route.",
      "url": "https://www.universal-credit.service.gov.uk/this-page-does-not-exist",
      "conditions": [
        "HTTP status and returned document title"
      ],
      "result": "pass"
    }
  ],
  "findings": [
    {
      "id": "F01",
      "pathId": "landing",
      "url": "https://www.universal-credit.service.gov.uk/start",
      "principleId": "respect-user-preferences",
      "principleCheckId": "respects-color-scheme",
      "guidanceId": "dark-mode",
      "guidanceCategory": "user-experience",
      "severity": "medium",
      "confidence": "high",
      "summary": "The service remains light-only when the user requests a dark colour scheme.",
      "evidence": "The dark-condition screenshot is pixel-identical in surface treatment to the desktop screenshot; the DOM reports color-scheme: normal and a white body background.",
      "artifacts": [
        "evidence/dark.png",
        "evidence/dom.json"
      ],
      "suggestedFix": "Declare color-scheme: light dark and map GOV.UK surface, text, link, border and focus tokens to preference-aware values, preserving contrast in both schemes.",
      "effort": "medium"
    },
    {
      "id": "F02",
      "pathId": "landing",
      "url": "https://www.universal-credit.service.gov.uk/start",
      "principleId": "be-fast-and-stable",
      "principleCheckId": "efficient-resource-delivery",
      "guidanceId": "optimize-script-priority",
      "guidanceCategory": "performance",
      "severity": "medium",
      "confidence": "high",
      "summary": "Large parser-inserted scripts are delivered uncompressed and without async, defer or module semantics.",
      "evidence": "The HAR records a 467,516-byte claimant script plus two other uncompressed scripts; the live DOM confirms all three external scripts have async=false, defer=false and no module type.",
      "artifacts": [
        "evidence/network-summary.json",
        "evidence/network.har",
        "evidence/sign-in-probe.json"
      ],
      "suggestedFix": "Compress text resources at the edge and defer non-critical scripts, splitting route-specific code so the entry page only loads what it needs.",
      "effort": "medium"
    },
    {
      "id": "F03",
      "pathId": "landing",
      "url": "https://www.universal-credit.service.gov.uk/start",
      "principleId": "be-fast-and-stable",
      "principleCheckId": "trim-unused-and-duplicate-code",
      "guidanceId": "identify-heavy-scripts",
      "guidanceCategory": "performance",
      "severity": "medium",
      "confidence": "high",
      "summary": "The entry page ships substantial unused JavaScript and CSS.",
      "evidence": "Lighthouse estimates 272 KiB of unused JavaScript in claimant.js and 42 KiB of unused CSS; the HAR shows 650,809 transferred bytes for a simple text/form entry page.",
      "artifacts": [
        "evidence/lighthouse.json",
        "evidence/network-summary.json"
      ],
      "suggestedFix": "Split claimant.js by route and build smaller page-level style bundles; load shared code only when the relevant journey needs it.",
      "effort": "large"
    },
    {
      "id": "F04",
      "pathId": "sign-in",
      "url": "https://www.universal-credit.service.gov.uk/sign-in",
      "principleId": "be-private-and-secure",
      "principleCheckId": "in-context-permissions-and-modern-auth",
      "guidanceId": "passkey-authentication",
      "guidanceCategory": "passkeys",
      "severity": "high",
      "confidence": "medium",
      "summary": "The public sign-in surface exposes password-only authentication with no passkey option.",
      "evidence": "The sign-in DOM contains username and password controls; the auth probe found no navigator.credentials usage or other passkey affordance on the page.",
      "artifacts": [
        "evidence/sign-in.png",
        "evidence/auth-probe.json"
      ],
      "suggestedFix": "Offer WebAuthn passkeys as a phishing-resistant primary or step-up sign-in method while retaining an accessible recovery path.",
      "effort": "large"
    },
    {
      "id": "F05",
      "pathId": "landing",
      "url": "https://www.universal-credit.service.gov.uk/start",
      "principleId": "be-private-and-secure",
      "principleCheckId": "defensive-browser-policies",
      "guidanceId": "security",
      "guidanceCategory": "security",
      "severity": "medium",
      "confidence": "high",
      "summary": "The otherwise strong browser-security headers retain unsafe-eval and omit Referrer-Policy and Permissions-Policy.",
      "evidence": "The final /start response has HSTS, nosniff, DENY/frame-ancestors and a nonce/hash CSP, but script-src includes unsafe-eval and no Referrer-Policy or Permissions-Policy headers are present.",
      "artifacts": [
        "evidence/headers-curl.txt"
      ],
      "suggestedFix": "Remove unsafe-eval after dependency testing; add a strict Referrer-Policy and a least-privilege Permissions-Policy appropriate to this service.",
      "effort": "medium"
    },
    {
      "id": "F06",
      "pathId": "sign-in",
      "url": "https://www.universal-credit.service.gov.uk/sign-in",
      "principleId": "be-trustworthy",
      "principleCheckId": "trustworthy-input-assistance",
      "guidanceId": "autofill-sign-in-form",
      "guidanceCategory": "forms",
      "severity": "medium",
      "confidence": "high",
      "summary": "The sign-in fields omit standard autocomplete tokens.",
      "evidence": "The auth and sign-in probes show no autocomplete attribute on either userName or password.",
      "artifacts": [
        "evidence/auth-probe.json",
        "evidence/sign-in-dom.json"
      ],
      "suggestedFix": "Add autocomplete=\"username\" to the username field and autocomplete=\"current-password\" to the password field; preserve stable names and labels.",
      "effort": "trivial"
    },
    {
      "id": "F07",
      "pathId": "landing",
      "url": "https://www.universal-credit.service.gov.uk/start",
      "principleId": "be-discoverable",
      "principleCheckId": "title-and-description",
      "guidanceId": "html",
      "guidanceCategory": "html",
      "severity": "low",
      "confidence": "high",
      "summary": "The public entry document has no meta description.",
      "evidence": "The page probe and discoverability primitive found a descriptive title and H1 but no meta[name=description].",
      "artifacts": [
        "evidence/page-probe.json",
        "evidence/discoverability.json"
      ],
      "suggestedFix": "Add a concise description of the Universal Credit online service; retain the intentional noindex policy for private application routes.",
      "effort": "trivial"
    }
  ],
  "taskList": [
    {
      "id": "T01",
      "title": "Add passkey authentication and correct sign-in autocomplete tokens",
      "priority": 1,
      "findingIds": [
        "F04",
        "F06"
      ],
      "guidanceId": "passkey-authentication",
      "status": "open"
    },
    {
      "id": "T02",
      "title": "Split, compress and defer entry-page JavaScript/CSS",
      "priority": 2,
      "findingIds": [
        "F02",
        "F03"
      ],
      "guidanceId": "optimize-script-priority",
      "status": "open"
    },
    {
      "id": "T03",
      "title": "Tighten CSP and add Referrer-Policy and Permissions-Policy",
      "priority": 3,
      "findingIds": [
        "F05"
      ],
      "guidanceId": "security",
      "status": "open"
    },
    {
      "id": "T04",
      "title": "Add a preference-driven dark colour scheme",
      "priority": 4,
      "findingIds": [
        "F01"
      ],
      "guidanceId": "dark-mode",
      "status": "open"
    },
    {
      "id": "T05",
      "title": "Add a concise meta description to the public entry page",
      "priority": 5,
      "findingIds": [
        "F07"
      ],
      "guidanceId": "html",
      "status": "open"
    }
  ],
  "budget": {
    "pathCount": 5,
    "auditPasses": 1
  },
  "agent": "pi",
  "runId": "2026-07-28T01-02-19-668Z"
}