{ "url": "https://services.gst.gov.in", "auditedAt": "2026-07-21T16:22:39.724Z", "mode": "report", "status": "completed", "statusDetail": "Coverage complete for 58 checks across four representative public templates plus an invalid-route recovery state. Authenticated taxpayer-only screens were excluded because credentials were not supplied.", "page": { "appType": "spa", "framework": "AngularJS 1.5.6", "notes": "The entry origin redirects through HTTP back to HTTPS /services/login. Public routes are client-rendered AngularJS templates." }, "evidenceUsed": [ "screenshot", "dom+computed-css", "layout-metrics", "evaluate focus/target probe", "Lighthouse", "trace", "HAR", "discoverability/no-JS", "headers", "cookies", "trackers", "secrets", "images", "heap-summary before/after", "curl robots/sitemap" ], "guidanceConsulted": [ "dark-mode", "accessibility", "same-document-transitions", "light-dismiss-a-dialog", "size-aware-styling", "forms", "performance", "security", "privacy", "improve-text-layout-and-legibility", "optimize-image-priority", "webmcp", "manage-recurring-intervals", "adapt-scrollbar-to-contrast-preferences", "shrinking-header-on-scroll", "accessible-error-announcement", "visually-stable-font-fallbacks", "break-up-long-tasks", "optimize-script-priority", "identify-heavy-scripts", "html", "passkeys", "stabilize-reactive-state", "translator", "autofill-sign-in-form", "passkey-authentication", "efficient-background-processing" ], "artifacts": [ { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "Desktop login page", "condition": "1440x1000", "findingIds": [ "F01", "F23", "F26", "F29" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "Mobile login page", "condition": "360x800", "findingIds": [ "F16" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "Login under dark preference", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-contrast.png", "caption": "Login under increased contrast", "condition": "prefers-contrast: more", "findingIds": [ "F03" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "Rendered login DOM and CSS", "findingIds": [ "F02", "F03", "F04", "F05", "F06", "F12", "F19", "F20", "F21", "F23", "F26", "F28" ] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "Mobile login layout metrics", "condition": "360x800", "findingIds": [ "F10" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "Full Lighthouse report", "findingIds": [] }, { "type": "lighthouse", "path": "evidence/lighthouse-summary.json", "caption": "Compact Lighthouse failures and metrics", "findingIds": [ "F09", "F10", "F11", "F12", "F13", "F14", "F15", "F17", "F18", "F19", "F20", "F22", "F23", "F28", "F29", "F30" ] }, { "type": "har", "path": "evidence/home.har", "caption": "Network capture", "findingIds": [] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "Network summary", "findingIds": [ "F12", "F13", "F30" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "DevTools performance trace", "findingIds": [] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "Trace timing and long-task summary", "findingIds": [ "F09", "F11" ] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "Raw HTML versus rendered DOM analysis", "findingIds": [ "F25" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "Crawler/no-JavaScript view", "condition": "JavaScript disabled", "findingIds": [ "F25" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "Rendered browser view", "condition": "JavaScript enabled", "findingIds": [ "F25" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "Security headers audit", "findingIds": [ "F22", "F24" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "Cookie audit", "findingIds": [ "F22" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "Tracker/origin audit", "findingIds": [] }, { "type": "other", "path": "evidence/secrets.json", "caption": "Client secret scan", "findingIds": [] }, { "type": "other", "path": "evidence/images.json", "caption": "Image audit", "findingIds": [ "F14", "F18" ] }, { "type": "other", "path": "evidence/focus-target-probe.json", "caption": "Keyboard focus and target-size probe", "findingIds": [ "F07", "F15", "F16" ] }, { "type": "screenshot", "path": "evidence/login-invalid.png", "caption": "Login after empty submission", "findingIds": [ "F08", "F27" ] }, { "type": "screenshot", "path": "evidence/arnstatus.png", "caption": "Track Application Status template", "findingIds": [] }, { "type": "screenshot", "path": "evidence/searchhsn.png", "caption": "Search HSN template", "findingIds": [] }, { "type": "screenshot", "path": "evidence/grievance.png", "caption": "Grievance form template", "findingIds": [ "F05" ] }, { "type": "screenshot", "path": "evidence/not-found.png", "caption": "Invalid-route recovery state", "findingIds": [] }, { "type": "layout", "path": "evidence/arnstatus-mobile-layout.json", "caption": "Track Application mobile layout", "condition": "360x800", "findingIds": [] }, { "type": "layout", "path": "evidence/searchhsn-mobile-layout.json", "caption": "HSN search mobile layout", "condition": "360x800", "findingIds": [ "F10" ] }, { "type": "layout", "path": "evidence/grievance-mobile-layout.json", "caption": "Grievance mobile layout", "condition": "360x800", "findingIds": [ "F10" ] }, { "type": "other", "path": "evidence/robots.txt", "caption": "Response returned for robots.txt", "findingIds": [ "F21" ] }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "Response returned for sitemap.xml", "findingIds": [ "F21" ] }, { "type": "heap", "path": "evidence/heap-baseline.heapsnapshot", "caption": "Baseline heap summary", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-post.heapsnapshot", "caption": "Heap summary after ten empty-login submissions", "findingIds": [] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "The dark-mode screenshot is byte-identical to the default capture and retains white form surfaces; rendered CSS contains no prefers-color-scheme rule.", "artifacts": [ "evidence/home-dark.png", "evidence/home-desktop.png" ], "findingIds": [ "F01" ], "pathIds": [ "login" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "DOM/CSS inspection found no prefers-reduced-motion handling on a page that uses Angular transition/loading effects.", "artifacts": [ "evidence/home-dom.json" ], "findingIds": [ "F02" ], "pathIds": [ "login" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "The prefers-contrast capture is byte-identical to default and CSS contains no prefers-contrast or forced-colors handling.", "artifacts": [ "evidence/home-contrast.png", "evidence/home-dom.json" ], "findingIds": [ "F03" ], "pathIds": [ "login" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "DOM/CSS inspection found no view-transition declarations in this multi-route Angular portal.", "artifacts": [ "evidence/home-dom.json" ], "findingIds": [ "F04" ], "pathIds": [ "login" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from route and interaction recon", "evidence": "No scroll-linked animation or scrollytelling surface exists on the audited templates.", "reason": "No scroll-linked animation or scrollytelling surface exists on the audited templates." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from route and interaction recon", "evidence": "No swipe, pull, carousel or gesture-driven control exists on the audited desktop/mobile templates.", "reason": "No swipe, pull, carousel or gesture-driven control exists on the audited desktop/mobile templates." }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Screenshots show a tall fixed header/navigation/footer frame and DOM/CSS contains no scroll-state query or progress affordance.", "artifacts": [ "evidence/grievance.png", "evidence/home-dom.json" ], "findingIds": [ "F05" ], "pathIds": [ "login" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from route and interaction recon", "evidence": "No tooltip/popover/menu requiring viewport-edge anchored positioning was opened or present on the audited task surfaces.", "reason": "No tooltip/popover/menu requiring viewport-edge anchored positioning was opened or present on the audited task surfaces." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "Breadcrumbs, selected navigation states and specific page headings consistently identify the current route across the four representative templates.", "artifacts": [ "evidence/home-desktop.png", "evidence/arnstatus.png", "evidence/searchhsn.png", "evidence/grievance.png" ], "pathIds": [ "login" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "Desktop/mobile first-load screenshots across four templates show no popup, consent wall or content-obscuring interstitial.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/arnstatus.png", "evidence/searchhsn.png", "evidence/grievance.png" ], "pathIds": [ "login" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from route and interaction recon", "evidence": "No modal or transient overlay appears on load or in the exercised empty-submit flow.", "reason": "No modal or transient overlay appears on load or in the exercised empty-submit flow." }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "Screenshots show task forms as the dominant central content with consistent shared navigation and no advertising.", "artifacts": [ "evidence/home-desktop.png", "evidence/grievance.png" ], "pathIds": [ "login" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "All four 360 px layout captures report scrollWidth 360, clientWidth 360, viewport meta present and zero horizontal overflow.", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/arnstatus-mobile-layout.json", "evidence/searchhsn-mobile-layout.json", "evidence/grievance-mobile-layout.json" ], "pathIds": [ "login" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Rendered CSS uses global media queries but no container queries across reusable forms and navigation components.", "artifacts": [ "evidence/home-dom.json" ], "findingIds": [ "F06" ], "pathIds": [ "login" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "The focus probe found the visible Services anchor with outline none and many zero-size menu links in the focus sequence; the toggle button was also zero-size at desktop.", "artifacts": [ "evidence/focus-target-probe.json" ], "findingIds": [ "F07" ], "pathIds": [ "login" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "Login, Track Application Status, Search HSN Code and Grievance screenshots each have a specific heading and a visually identifiable primary form/action.", "artifacts": [ "evidence/home-desktop.png", "evidence/arnstatus.png", "evidence/searchhsn.png", "evidence/grievance.png" ], "pathIds": [ "login" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "The audited public entry states expose predictable labelled controls and login recovery/register links; authenticated transaction completion was explicitly outside coverage without credentials.", "artifacts": [ "evidence/home-desktop.png", "evidence/arnstatus.png", "evidence/searchhsn.png", "evidence/grievance.png" ], "pathIds": [ "login" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "After activating Login with both required fields empty, the captured form showed no visible error summary or field messages.", "artifacts": [ "evidence/login-invalid.png" ], "findingIds": [ "F08" ], "pathIds": [ "login" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Mobile Lighthouse measured LCP 8.5 s, TBT 770 ms and CLS 0.146; the first-party trace corroborated LCP 2.50 s and TBT 305 ms on the local run.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F09" ], "pathIds": [ "login" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Layout observers measured CLS 0.151 on login, 0.143 on status, 0.303 on grievance and 0.990 on HSN search; Lighthouse identified form/footer shifts and unsized icons.", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/searchhsn-mobile-layout.json", "evidence/grievance-mobile-layout.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F10" ], "pathIds": [ "login" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Trace recorded a 355 ms long task and 305 ms TBT; Lighthouse measured 2.6 s main-thread work with 1.79 s script evaluation.", "artifacts": [ "evidence/home-trace-summary.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F11" ], "pathIds": [ "login" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "HAR recorded two redirects and parser-inserted high-priority scripts; Lighthouse estimates 1.51 s redirect savings, including an HTTP hop.", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-summary.json", "evidence/home-dom.json" ], "findingIds": [ "F12" ], "pathIds": [ "login" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Lighthouse estimates 235 KiB unused JavaScript, including 77% of a 220 KiB bundle, plus 22 KiB unused CSS and 22 KiB minification savings.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-summary.json" ], "findingIds": [ "F13" ], "pathIds": [ "login" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Lighthouse and the images probe found four social images without alt text; their links therefore lack robust accessible names.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/images.json" ], "findingIds": [ "F14" ], "pathIds": [ "login" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "Lighthouse accessibility score was 0.89 and reported no automated color-contrast failure; preference screenshots keep text and controls visible.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-contrast.png" ], "pathIds": [ "login" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Lighthouse found no main landmark and a heading-order failure (Login begins at h4); the focus probe also found hidden and outline-less controls.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/focus-target-probe.json" ], "findingIds": [ "F15" ], "pathIds": [ "login" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "Desktop/mobile screenshots show unclipped body copy and labels at readable sizes with no horizontal overflow.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/grievance.png" ], "pathIds": [ "login" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "The focus probe measured visible login/register controls at only 34 px high and found a zero-size navigation toggle and many zero-size focusable menu links.", "artifacts": [ "evidence/focus-target-probe.json", "evidence/home-mobile.png" ], "findingIds": [ "F16" ], "pathIds": [ "login" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Lighthouse captured Angular $compile:nodomevents from angular-all1.0.js during the login load.", "artifacts": [ "evidence/lighthouse-summary.json" ], "findingIds": [ "F17" ], "pathIds": [ "login" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "All five images lack explicit width and height; Lighthouse ties the social icons to observed layout shifts.", "artifacts": [ "evidence/images.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F18" ], "pathIds": [ "login" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "The password input has autocomplete=\"off\" and data-ng-paste=\"$event.preventDefault()\"; Lighthouse flags paste prevention, and three large scripts reference missing source maps.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-dom.json" ], "findingIds": [ "F19" ], "pathIds": [ "login" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "DOM records a descriptive title “Goods & Services Tax (GST) | Login” and meta description “Login to GST Portal”.", "artifacts": [ "evidence/home-dom.json" ], "pathIds": [ "login" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Lighthouse found JavaScript/# anchors and the link text “here”; DOM extraction also found the Skip to Main Content link implemented as javascript:void(0).", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-dom.json" ], "findingIds": [ "F20" ], "pathIds": [ "login" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "The rendered login document exposes no canonical link; requests for robots.txt/sitemap.xml returned the application shell rather than machine-readable control files.", "artifacts": [ "evidence/home-dom.json", "evidence/robots.txt", "evidence/sitemap.xml" ], "findingIds": [ "F21" ], "pathIds": [ "login" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from route and interaction recon", "evidence": "The audited routes are utility forms rather than article/product/event/entity detail pages requiring rich structured/share metadata.", "reason": "The audited routes are utility forms rather than article/product/event/entity detail pages requiring rich structured/share metadata." }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Lighthouse observed an HTTP redirect hop; the cookie audit found Lang without Secure and both cookies set SameSite=None.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/cookies.json", "evidence/headers.json" ], "findingIds": [ "F22" ], "pathIds": [ "login" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "Tracker scan found no known trackers; all observed origins are GST government subdomains and secrets scan found no exposed credentials.", "artifacts": [ "evidence/trackers.json", "evidence/secrets.json", "evidence/home-summary.json" ], "pathIds": [ "login" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "The login surface exposes only username/password, disables autocomplete and blocks password paste; no WebAuthn/passkey affordance was observed.", "artifacts": [ "evidence/home-desktop.png", "evidence/lighthouse-summary.json", "evidence/home-dom.json" ], "findingIds": [ "F23" ], "pathIds": [ "login" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Headers include unsafe-inline and unsafe-eval in script-src; Referrer-Policy and Permissions-Policy are missing.", "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F24" ], "pathIds": [ "login" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Discoverability measured only 3% raw/rendered content overlap and classified the page as a JS shell; the crawler view only says JavaScript is required.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png", "evidence/discoverability-rendered.png" ], "findingIds": [ "F25" ], "pathIds": [ "login" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "Four public templates rendered complete forms without cut-off overlays or failed async shells at desktop and mobile widths.", "artifacts": [ "evidence/home-desktop.png", "evidence/arnstatus.png", "evidence/searchhsn.png", "evidence/grievance.png" ], "pathIds": [ "login" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from route and interaction recon", "evidence": "Tax filing, identity and live status services are intrinsically online; offline transaction completion is not appropriate, though progressive enhancement remains applicable.", "reason": "Tax filing, identity and live status services are intrinsically online; offline transaction completion is not appropriate, though progressive enhancement remains applicable." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "A deliberately invalid route renders a clear Page not found panel with guidance to return Home or choose another menu page.", "artifacts": [ "evidence/not-found.png" ], "pathIds": [ "login" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "The rendered documents declare lang=\"en\" but the audited login and public-service templates expose no language selector or alternate-language links; CSS contains many physical left/right offsets.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-dom.json" ], "findingIds": [ "F26" ], "pathIds": [ "login" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from route and interaction recon", "evidence": "The audited public forms did not display dates, currencies, locale-formatted numbers or durations.", "reason": "The audited public forms did not display dates, currencies, locale-formatted numbers or durations." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from route and interaction recon", "evidence": "The audited routes did not expose events, schedules, timestamps or recurring time concepts.", "reason": "The audited routes did not expose events, schedules, timestamps or recurring time concepts." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "Audited login, lookup, search and grievance screenshots show no ads, confirmshaming, forced continuity or preselected commercial consent.", "artifacts": [ "evidence/home-desktop.png", "evidence/arnstatus.png", "evidence/searchhsn.png", "evidence/grievance.png" ], "pathIds": [ "login" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Empty login submission produced no visible field-level message or error summary despite required fields.", "artifacts": [ "evidence/login-invalid.png" ], "findingIds": [ "F27" ], "pathIds": [ "login" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "DOM/Lighthouse show autocomplete=\"off\" on login fields and active paste prevention on the password field.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-dom.json" ], "findingIds": [ "F28" ], "pathIds": [ "login" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "The account entry point provides password-only authentication while blocking paste/autofill, with no observed passkey option.", "artifacts": [ "evidence/home-desktop.png", "evidence/lighthouse-summary.json" ], "findingIds": [ "F29" ], "pathIds": [ "login" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "Image probe found five SVG assets, no oversized raster images and no legacy image formats.", "artifacts": [ "evidence/images.json" ], "pathIds": [ "login" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Direct rendered evidence plus targeted objective probe", "evidence": "Lighthouse estimates 235 KiB unused JavaScript and 22 KiB unused CSS while HAR attributes 454 KiB transferred to scripts.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-summary.json" ], "findingIds": [ "F30" ], "pathIds": [ "login" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "pass", "confidence": "high", "method": "Direct visual/objective inspection under the planned condition", "evidence": "HAR contains no video/audio and only GST-operated subdomains; total transfer is 639 kB, although script waste is separately reported.", "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ], "pathIds": [ "login" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from route and interaction recon", "evidence": "This emerging capability was judged out of scope because the portal declares no agent-facing intent and exposes sensitive government transactions.", "reason": "This emerging capability was judged out of scope because the portal declares no agent-facing intent and exposes sensitive government transactions." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from route and interaction recon", "evidence": "No summarisation or language-model task is necessary on the audited utility forms; absence is not a failure.", "reason": "No summarisation or language-model task is necessary on the audited utility forms; absence is not a failure." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "Direct visual/objective inspection under the planned condition", "evidence": "After ten repeated empty-login submissions, heap self size rose 296,355 bytes (2.3%) and constructors remained broadly stable, consistent with bounded one-time compilation rather than clear unbounded growth.", "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot" ], "pathIds": [ "login" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "medium", "method": "Direct visual/objective inspection under the planned condition", "evidence": "Baseline heap summary is 12.6 MB self size and 224,169 nodes for the shared Angular portal shell, a proportionate current footprint.", "artifacts": [ "evidence/heap-baseline.heapsnapshot" ], "pathIds": [ "login" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Direct visual/objective inspection under the planned condition", "evidence": "Baseline/post summaries show no Detached* constructor among dominant populations and only small changes after ten submissions; no accumulating detached-DOM signal was observed.", "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot" ], "pathIds": [ "login" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02", "F03" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F04" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F05" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "pass" }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F06", "F07" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F09", "F10", "F11", "F12", "F13" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F14", "F15", "F16" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F17", "F18", "F19" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F20", "F21" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F22", "F23", "F24" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F25" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F26" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F27", "F28", "F29" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F30" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "This emerging capability was judged out of scope because the portal declares no agent-facing intent and exposes sensitive government transactions. No summarisation or language-model task is necessary on the audited utility forms; absence is not a failure." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "login", "description": "Entry URL redirects to the public login template, representing authentication and account recovery. Authenticated taxpayer-only routes were not covered because no credentials were supplied.", "url": "https://services.gst.gov.in/services/login", "conditions": [ "desktop 1440x1000", "mobile 360x800", "prefers-color-scheme: dark", "prefers-contrast: more", "prefers-reduced-motion: reduce", "keyboard focus", "invalid empty submit" ], "result": "issues" }, { "id": "application-status", "description": "Public Track Application Status form, representing a short status lookup journey.", "url": "https://services.gst.gov.in/services/arnstatus", "conditions": [ "desktop 1440x1000", "mobile 360x800" ], "result": "issues" }, { "id": "hsn-search", "description": "Public Search HSN Code form, representing search and content-heavy results guidance.", "url": "https://services.gst.gov.in/services/searchhsnsac", "conditions": [ "desktop 1440x1000", "mobile 360x800" ], "result": "issues" }, { "id": "grievance", "description": "Public grievance form, representing the longest high-risk data-entry flow.", "url": "https://services.gst.gov.in/services/grievance", "conditions": [ "desktop 1440x1000", "mobile 360x800" ], "result": "issues" }, { "id": "not-found", "description": "Deliberately invalid route, representing HTTP/navigation failure recovery.", "url": "https://services.gst.gov.in/services/not-a-real-route-web-uplift", "conditions": [ "desktop" ], "result": "pass" } ], "findings": [ { "id": "F07", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "Keyboard focus can disappear and hidden controls remain tabbable", "evidence": "The focus probe found the visible Services anchor with outline none and many zero-size menu links in the focus sequence; the toggle button was also zero-size at desktop.", "artifacts": [ "evidence/focus-target-probe.json" ], "suggestedFix": "Use :focus-visible with a persistent high-contrast indicator and remove hidden menu descendants from the tab order.", "effort": "large" }, { "id": "F09", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "Load performance misses the Core Web Vitals bar", "evidence": "Mobile Lighthouse measured LCP 8.5 s, TBT 770 ms and CLS 0.146; the first-party trace corroborated LCP 2.50 s and TBT 305 ms on the local run.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-trace-summary.json" ], "suggestedFix": "Profile the LCP chain, remove redirect latency, defer non-critical scripts and reserve layout space.", "effort": "large" }, { "id": "F10", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-fast-and-stable", "principleCheckId": "visual-stability", "guidanceId": "visually-stable-font-fallbacks", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "Templates shift substantially during load", "evidence": "Layout observers measured CLS 0.151 on login, 0.143 on status, 0.303 on grievance and 0.990 on HSN search; Lighthouse identified form/footer shifts and unsized icons.", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/searchhsn-mobile-layout.json", "evidence/grievance-mobile-layout.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Reserve dimensions for header, form and footer regions and add explicit image dimensions and stable font fallbacks.", "effort": "large" }, { "id": "F11", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-main-thread", "guidanceId": "break-up-long-tasks", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "Legacy script work blocks the main thread", "evidence": "Trace recorded a 355 ms long task and 305 ms TBT; Lighthouse measured 2.6 s main-thread work with 1.79 s script evaluation.", "artifacts": [ "evidence/home-trace-summary.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Split the monolithic framework bundle, defer route-specific code and break expensive initialization into scheduled tasks.", "effort": "large" }, { "id": "F13", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "Most of large shared bundles are unused on login", "evidence": "Lighthouse estimates 235 KiB unused JavaScript, including 77% of a 220 KiB bundle, plus 22 KiB unused CSS and 22 KiB minification savings.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-summary.json" ], "suggestedFix": "Ship route-level bundles, remove legacy/duplicate framework code and purge unused CSS.", "effort": "large" }, { "id": "F15", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "Landmark and heading structure is incomplete", "evidence": "Lighthouse found no main landmark and a heading-order failure (Login begins at h4); the focus probe also found hidden and outline-less controls.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/focus-target-probe.json" ], "suggestedFix": "Add a main landmark, use a sequential heading hierarchy and repair visibility-aware focus management.", "effort": "large" }, { "id": "F19", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "forms", "guidanceCategory": "forms", "severity": "high", "confidence": "high", "summary": "Password managers are deliberately obstructed", "evidence": "The password input has autocomplete=\"off\" and data-ng-paste=\"$event.preventDefault()\"; Lighthouse flags paste prevention, and three large scripts reference missing source maps.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-dom.json" ], "suggestedFix": "Allow paste, use autocomplete=\"current-password\", support password managers and publish valid source maps.", "effort": "large" }, { "id": "F22", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "severity": "high", "confidence": "high", "summary": "An insecure redirect and cookie weaken an HTTPS login", "evidence": "Lighthouse observed an HTTP redirect hop; the cookie audit found Lang without Secure and both cookies set SameSite=None.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/cookies.json", "evidence/headers.json" ], "suggestedFix": "Redirect directly over HTTPS and set Secure with the least-permissive appropriate SameSite value on all cookies.", "effort": "large" }, { "id": "F23", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkeys", "guidanceCategory": "security", "severity": "high", "confidence": "high", "summary": "Authentication is password-only and blocks secure assistance", "evidence": "The login surface exposes only username/password, disables autocomplete and blocks password paste; no WebAuthn/passkey affordance was observed.", "artifacts": [ "evidence/home-desktop.png", "evidence/lighthouse-summary.json", "evidence/home-dom.json" ], "suggestedFix": "Allow password managers immediately and add phishing-resistant passkey/WebAuthn sign-in and recovery.", "effort": "large" }, { "id": "F24", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "security", "severity": "high", "confidence": "high", "summary": "CSP is permissive and privacy headers are absent", "evidence": "Headers include unsafe-inline and unsafe-eval in script-src; Referrer-Policy and Permissions-Policy are missing.", "artifacts": [ "evidence/headers.json" ], "suggestedFix": "Remove unsafe-eval/unsafe-inline using nonces or hashes, then add strict Referrer-Policy and Permissions-Policy.", "effort": "large" }, { "id": "F25", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "stabilize-reactive-state", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "Core content disappears without JavaScript", "evidence": "Discoverability measured only 3% raw/rendered content overlap and classified the page as a JS shell; the crawler view only says JavaScript is required.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png", "evidence/discoverability-rendered.png" ], "suggestedFix": "Server-render core forms/content and use JavaScript as progressive enhancement, with functional HTML submissions where feasible.", "effort": "large" }, { "id": "F27", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-trustworthy", "principleCheckId": "humane-error-handling", "guidanceId": "accessible-error-announcement", "guidanceCategory": "forms", "severity": "high", "confidence": "high", "summary": "Required-field errors are not surfaced humanely", "evidence": "Empty login submission produced no visible field-level message or error summary despite required fields.", "artifacts": [ "evidence/login-invalid.png" ], "suggestedFix": "Use interaction-timed validation, persistent associated messages and accessible error announcement.", "effort": "large" }, { "id": "F28", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-in-form", "guidanceCategory": "forms", "severity": "high", "confidence": "high", "summary": "Login disables autofill and paste", "evidence": "DOM/Lighthouse show autocomplete=\"off\" on login fields and active paste prevention on the password field.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-dom.json" ], "suggestedFix": "Use username and current-password autocomplete tokens and never intercept paste.", "effort": "large" }, { "id": "F29", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-trustworthy", "principleCheckId": "safe-commercial-and-account-flows", "guidanceId": "passkey-authentication", "guidanceCategory": "security", "severity": "high", "confidence": "high", "summary": "Account access relies on a hostile password flow", "evidence": "The account entry point provides password-only authentication while blocking paste/autofill, with no observed passkey option.", "artifacts": [ "evidence/home-desktop.png", "evidence/lighthouse-summary.json" ], "suggestedFix": "Add passkeys, preserve password-manager compatibility and keep recovery paths clear and reversible.", "effort": "large" }, { "id": "F01", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "severity": "medium", "confidence": "high", "summary": "Dark preference leaves the portal light-only", "evidence": "The dark-mode screenshot is byte-identical to the default capture and retains white form surfaces; rendered CSS contains no prefers-color-scheme rule.", "artifacts": [ "evidence/home-dark.png", "evidence/home-desktop.png" ], "suggestedFix": "Declare color-scheme and provide preference-driven light/dark surface, text, border and form-control tokens.", "effort": "medium" }, { "id": "F08", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "accessible-error-announcement", "guidanceCategory": "forms", "severity": "medium", "confidence": "high", "summary": "Empty login submission gives no clear field-level recovery", "evidence": "After activating Login with both required fields empty, the captured form showed no visible error summary or field messages.", "artifacts": [ "evidence/login-invalid.png" ], "suggestedFix": "Validate after interaction, mark fields with aria-invalid, associate concise errors, focus an error summary and announce it through a live region.", "effort": "medium" }, { "id": "F12", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "guidanceCategory": "performance", "severity": "medium", "confidence": "high", "summary": "Redirects and parser-blocking resources delay content", "evidence": "HAR recorded two redirects and parser-inserted high-priority scripts; Lighthouse estimates 1.51 s redirect savings, including an HTTP hop.", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-summary.json", "evidence/home-dom.json" ], "suggestedFix": "Redirect directly to HTTPS login, defer non-critical scripts and shorten the parser-blocking dependency chain.", "effort": "medium" }, { "id": "F14", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "medium", "confidence": "high", "summary": "Footer icons lack accessible alternatives", "evidence": "Lighthouse and the images probe found four social images without alt text; their links therefore lack robust accessible names.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/images.json" ], "suggestedFix": "Give each social link an accessible name and mark redundant icon images alt=\"\".", "effort": "medium" }, { "id": "F16", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "medium", "confidence": "high", "summary": "Several interactive targets are too small or zero-sized", "evidence": "The focus probe measured visible login/register controls at only 34 px high and found a zero-size navigation toggle and many zero-size focusable menu links.", "artifacts": [ "evidence/focus-target-probe.json", "evidence/home-mobile.png" ], "suggestedFix": "Meet a 44 by 44 CSS pixel target where possible and ensure collapsed controls are neither focusable nor exposed.", "effort": "medium" }, { "id": "F17", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "guidanceId": "html", "guidanceCategory": "html", "severity": "medium", "confidence": "high", "summary": "Angular throws a console error during load", "evidence": "Lighthouse captured Angular $compile:nodomevents from angular-all1.0.js during the login load.", "artifacts": [ "evidence/lighthouse-summary.json" ], "suggestedFix": "Fix the invalid event directive and add console-error monitoring to prevent regressions.", "effort": "medium" }, { "id": "F18", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "guidanceCategory": "html", "severity": "medium", "confidence": "high", "summary": "Images omit intrinsic dimensions", "evidence": "All five images lack explicit width and height; Lighthouse ties the social icons to observed layout shifts.", "artifacts": [ "evidence/images.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Set width and height (or equivalent intrinsic aspect-ratio) on every image.", "effort": "medium" }, { "id": "F20", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "guidanceCategory": "html", "severity": "medium", "confidence": "high", "summary": "Some navigation is not crawlable or descriptive", "evidence": "Lighthouse found JavaScript/# anchors and the link text “here”; DOM extraction also found the Skip to Main Content link implemented as javascript:void(0).", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-dom.json" ], "suggestedFix": "Use real href targets and descriptive link text for every navigation action.", "effort": "medium" }, { "id": "F21", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "guidanceCategory": "html", "severity": "medium", "confidence": "high", "summary": "Canonical and sitemap signals are missing or inconsistent", "evidence": "The rendered login document exposes no canonical link; requests for robots.txt/sitemap.xml returned the application shell rather than machine-readable control files.", "artifacts": [ "evidence/home-dom.json", "evidence/robots.txt", "evidence/sitemap.xml" ], "suggestedFix": "Publish a canonical URL, valid robots.txt and XML sitemap with consistent indexing policy.", "effort": "medium" }, { "id": "F26", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-internationalised", "principleCheckId": "lang-dir-and-logical-properties", "guidanceId": "translator", "guidanceCategory": "internationalization", "severity": "medium", "confidence": "high", "summary": "A nationwide public service is exposed as English-only on audited routes", "evidence": "The rendered documents declare lang=\"en\" but the audited login and public-service templates expose no language selector or alternate-language links; CSS contains many physical left/right offsets.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-dom.json" ], "suggestedFix": "Offer supported Indian-language alternatives, publish hreflang, set lang/dir per locale and migrate layout to logical properties.", "effort": "medium" }, { "id": "F30", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "efficient-background-processing", "guidanceCategory": "performance", "severity": "medium", "confidence": "high", "summary": "The login route ships substantial unused code", "evidence": "Lighthouse estimates 235 KiB unused JavaScript and 22 KiB unused CSS while HAR attributes 454 KiB transferred to scripts.", "artifacts": [ "evidence/lighthouse-summary.json", "evidence/home-summary.json" ], "suggestedFix": "Code-split by route, remove unused dependencies and avoid initializing features absent from the current page.", "effort": "medium" }, { "id": "F02", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "low", "confidence": "high", "summary": "Reduced-motion preference is not implemented", "evidence": "DOM/CSS inspection found no prefers-reduced-motion handling on a page that uses Angular transition/loading effects.", "artifacts": [ "evidence/home-dom.json" ], "suggestedFix": "Wrap non-essential transitions and loading motion in prefers-reduced-motion safeguards.", "effort": "small" }, { "id": "F03", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "respect-user-preferences", "principleCheckId": "respects-contrast", "guidanceId": "adapt-scrollbar-to-contrast-preferences", "guidanceCategory": "accessibility", "severity": "low", "confidence": "high", "summary": "High-contrast preferences receive no explicit adaptation", "evidence": "The prefers-contrast capture is byte-identical to default and CSS contains no prefers-contrast or forced-colors handling.", "artifacts": [ "evidence/home-contrast.png", "evidence/home-dom.json" ], "suggestedFix": "Add forced-colors and prefers-contrast styles that preserve control boundaries and focus visibility.", "effort": "small" }, { "id": "F04", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "guidanceCategory": "user-experience", "severity": "low", "confidence": "high", "summary": "Route and tab changes use abrupt legacy swaps", "evidence": "DOM/CSS inspection found no view-transition declarations in this multi-route Angular portal.", "artifacts": [ "evidence/home-dom.json" ], "suggestedFix": "Progressively enhance route and tab state changes with same-document/cross-document View Transitions, with reduced-motion fallback.", "effort": "small" }, { "id": "F05", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "guidanceId": "shrinking-header-on-scroll", "guidanceCategory": "user-experience", "severity": "low", "confidence": "high", "summary": "Large persistent chrome does not respond to scroll state", "evidence": "Screenshots show a tall fixed header/navigation/footer frame and DOM/CSS contains no scroll-state query or progress affordance.", "artifacts": [ "evidence/grievance.png", "evidence/home-dom.json" ], "suggestedFix": "Use scroll-state-aware, compact chrome where long forms scroll, while preserving orientation.", "effort": "small" }, { "id": "F06", "pathId": "login", "url": "https://services.gst.gov.in/services/login", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "guidanceCategory": "css", "severity": "low", "confidence": "high", "summary": "Responsive behavior is viewport-only", "evidence": "Rendered CSS uses global media queries but no container queries across reusable forms and navigation components.", "artifacts": [ "evidence/home-dom.json" ], "suggestedFix": "Introduce container-type and component-local @container rules for reused form and navigation modules.", "effort": "small" } ], "taskList": [ { "id": "T01", "title": "Use :focus-visible with a persistent high-contrast indicator and remove hidden menu descendants from the tab order.", "priority": 1, "findingIds": [ "F07" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T02", "title": "Profile the LCP chain, remove redirect latency, defer non-critical scripts and reserve layout space.", "priority": 2, "findingIds": [ "F09" ], "guidanceId": "performance", "status": "open" }, { "id": "T03", "title": "Reserve dimensions for header, form and footer regions and add explicit image dimensions and stable font fallbacks.", "priority": 3, "findingIds": [ "F10" ], "guidanceId": "visually-stable-font-fallbacks", "status": "open" }, { "id": "T04", "title": "Split the monolithic framework bundle, defer route-specific code and break expensive initialization into scheduled tasks.", "priority": 4, "findingIds": [ "F11" ], "guidanceId": "break-up-long-tasks", "status": "open" }, { "id": "T05", "title": "Ship route-level bundles, remove legacy/duplicate framework code and purge unused CSS.", "priority": 5, "findingIds": [ "F13" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T06", "title": "Add a main landmark, use a sequential heading hierarchy and repair visibility-aware focus management.", "priority": 6, "findingIds": [ "F15" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T07", "title": "Allow paste, use autocomplete=\"current-password\", support password managers and publish valid source maps.", "priority": 7, "findingIds": [ "F19" ], "guidanceId": "forms", "status": "open" }, { "id": "T08", "title": "Redirect directly over HTTPS and set Secure with the least-permissive appropriate SameSite value on all cookies.", "priority": 8, "findingIds": [ "F22" ], "guidanceId": "security", "status": "open" }, { "id": "T09", "title": "Allow password managers immediately and add phishing-resistant passkey/WebAuthn sign-in and recovery.", "priority": 9, "findingIds": [ "F23" ], "guidanceId": "passkeys", "status": "open" }, { "id": "T10", "title": "Remove unsafe-eval/unsafe-inline using nonces or hashes, then add strict Referrer-Policy and Permissions-Policy.", "priority": 10, "findingIds": [ "F24" ], "guidanceId": "security", "status": "open" }, { "id": "T11", "title": "Server-render core forms/content and use JavaScript as progressive enhancement, with functional HTML submissions where feasible.", "priority": 11, "findingIds": [ "F25" ], "guidanceId": "stabilize-reactive-state", "status": "open" }, { "id": "T12", "title": "Use interaction-timed validation, persistent associated messages and accessible error announcement.", "priority": 12, "findingIds": [ "F27" ], "guidanceId": "accessible-error-announcement", "status": "open" }, { "id": "T13", "title": "Use username and current-password autocomplete tokens and never intercept paste.", "priority": 13, "findingIds": [ "F28" ], "guidanceId": "autofill-sign-in-form", "status": "open" }, { "id": "T14", "title": "Add passkeys, preserve password-manager compatibility and keep recovery paths clear and reversible.", "priority": 14, "findingIds": [ "F29" ], "guidanceId": "passkey-authentication", "status": "open" }, { "id": "T15", "title": "Declare color-scheme and provide preference-driven light/dark surface, text, border and form-control tokens.", "priority": 15, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T16", "title": "Validate after interaction, mark fields with aria-invalid, associate concise errors, focus an error summary and announce it through a live region.", "priority": 16, "findingIds": [ "F08" ], "guidanceId": "accessible-error-announcement", "status": "open" }, { "id": "T17", "title": "Redirect directly to HTTPS login, defer non-critical scripts and shorten the parser-blocking dependency chain.", "priority": 17, "findingIds": [ "F12" ], "guidanceId": "optimize-script-priority", "status": "open" }, { "id": "T18", "title": "Give each social link an accessible name and mark redundant icon images alt=\"\".", "priority": 18, "findingIds": [ "F14" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T19", "title": "Meet a 44 by 44 CSS pixel target where possible and ensure collapsed controls are neither focusable nor exposed.", "priority": 19, "findingIds": [ "F16" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T20", "title": "Fix the invalid event directive and add console-error monitoring to prevent regressions.", "priority": 20, "findingIds": [ "F17" ], "guidanceId": "html", "status": "open" }, { "id": "T21", "title": "Set width and height (or equivalent intrinsic aspect-ratio) on every image.", "priority": 21, "findingIds": [ "F18" ], "guidanceId": "html", "status": "open" }, { "id": "T22", "title": "Use real href targets and descriptive link text for every navigation action.", "priority": 22, "findingIds": [ "F20" ], "guidanceId": "html", "status": "open" }, { "id": "T23", "title": "Publish a canonical URL, valid robots.txt and XML sitemap with consistent indexing policy.", "priority": 23, "findingIds": [ "F21" ], "guidanceId": "html", "status": "open" }, { "id": "T24", "title": "Offer supported Indian-language alternatives, publish hreflang, set lang/dir per locale and migrate layout to logical properties.", "priority": 24, "findingIds": [ "F26" ], "guidanceId": "translator", "status": "open" }, { "id": "T25", "title": "Code-split by route, remove unused dependencies and avoid initializing features absent from the current page.", "priority": 25, "findingIds": [ "F30" ], "guidanceId": "efficient-background-processing", "status": "open" }, { "id": "T26", "title": "Wrap non-essential transitions and loading motion in prefers-reduced-motion safeguards.", "priority": 26, "findingIds": [ "F02" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T27", "title": "Add forced-colors and prefers-contrast styles that preserve control boundaries and focus visibility.", "priority": 27, "findingIds": [ "F03" ], "guidanceId": "adapt-scrollbar-to-contrast-preferences", "status": "open" }, { "id": "T28", "title": "Progressively enhance route and tab state changes with same-document/cross-document View Transitions, with reduced-motion fallback.", "priority": 28, "findingIds": [ "F04" ], "guidanceId": "same-document-transitions", "status": "open" }, { "id": "T29", "title": "Use scroll-state-aware, compact chrome where long forms scroll, while preserving orientation.", "priority": 29, "findingIds": [ "F05" ], "guidanceId": "shrinking-header-on-scroll", "status": "open" }, { "id": "T30", "title": "Introduce container-type and component-local @container rules for reused form and navigation modules.", "priority": 30, "findingIds": [ "F06" ], "guidanceId": "size-aware-styling", "status": "open" } ], "budget": { "wallClockSeconds": 1500, "pathCount": 5, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-21T16-22-39-724Z" }