{ "url": "https://www.xbox.com", "auditedAt": "2026-07-22T00:03:36.432Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete agentic audit across five representative paths.", "page": { "appType": "hybrid", "framework": "React-like hybrid with legacy/global Microsoft components", "notes": "Public localized commerce/media site. Covered landing, catalog, product, subscription, and error archetypes. Authenticated checkout/account, cloud play, support, accessibility hub, and post-purchase flows were not covered because they require authentication or are separate template families beyond this run." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "trace", "har", "discoverability", "headers", "cookies", "trackers", "secrets", "images", "heap-summary", "Lighthouse", "axe-core", "robots/sitemap fetch" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "other", "path": "evidence/a11y-focus-probe.json", "caption": "a11y focus probe audit evidence", "findingIds": [ "F05" ] }, { "type": "other", "path": "evidence/axe.json", "caption": "axe audit evidence", "findingIds": [ "F11" ] }, { "type": "screenshot", "path": "evidence/console-discoverability-crawler.png", "caption": "console discoverability crawler audit evidence", "findingIds": [] }, { "type": "screenshot", "path": "evidence/console-discoverability-rendered.png", "caption": "console discoverability rendered audit evidence", "findingIds": [] }, { "type": "discoverability", "path": "evidence/console-discoverability.json", "caption": "console discoverability audit evidence", "findingIds": [ "F17" ] }, { "type": "layout", "path": "evidence/console-layout.json", "caption": "console layout audit evidence", "findingIds": [ "F06", "F08" ] }, { "type": "screenshot", "path": "evidence/console-mobile.png", "caption": "console mobile audit evidence", "findingIds": [] }, { "type": "other", "path": "evidence/console-probe.json", "caption": "console probe audit evidence", "findingIds": [ "F11" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies audit evidence", "findingIds": [ "F14" ] }, { "type": "layout", "path": "evidence/gamepass-layout.json", "caption": "gamepass layout audit evidence", "findingIds": [ "F06" ] }, { "type": "screenshot", "path": "evidence/gamepass-mobile.png", "caption": "gamepass mobile audit evidence", "findingIds": [ "F03" ] }, { "type": "other", "path": "evidence/gamepass-probe.json", "caption": "gamepass probe audit evidence", "findingIds": [ "F11" ] }, { "type": "layout", "path": "evidence/games-layout.json", "caption": "games layout audit evidence", "findingIds": [ "F06", "F07" ] }, { "type": "screenshot", "path": "evidence/games-mobile.png", "caption": "games mobile audit evidence", "findingIds": [] }, { "type": "other", "path": "evidence/games-probe.json", "caption": "games probe audit evidence", "findingIds": [ "F13" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers audit evidence", "findingIds": [ "F14", "F16" ] }, { "type": "heap", "path": "evidence/heap-baseline.heapsnapshot", "caption": "heap baseline audit evidence", "findingIds": [ "F20" ] }, { "type": "heap", "path": "evidence/heap-post.heapsnapshot", "caption": "heap post audit evidence", "findingIds": [ "F20" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark audit evidence", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop audit evidence", "findingIds": [ "F01", "F03", "F04" ] }, { "type": "screenshot", "path": "evidence/home-discoverability-crawler.png", "caption": "home discoverability crawler audit evidence", "findingIds": [ "F17" ] }, { "type": "screenshot", "path": "evidence/home-discoverability-rendered.png", "caption": "home discoverability rendered audit evidence", "findingIds": [ "F17" ] }, { "type": "discoverability", "path": "evidence/home-discoverability.json", "caption": "home discoverability audit evidence", "findingIds": [ "F17" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom audit evidence", "findingIds": [ "F01", "F02", "F04" ] }, { "type": "screenshot", "path": "evidence/home-forced-colors.png", "caption": "home forced colors audit evidence", "findingIds": [] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout audit evidence", "findingIds": [ "F06", "F08" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile audit evidence", "findingIds": [ "F03" ] }, { "type": "other", "path": "evidence/home-probe.json", "caption": "home probe audit evidence", "findingIds": [] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "home summary audit evidence", "findingIds": [ "F09", "F10", "F15", "F18", "F19" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary audit evidence", "findingIds": [] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace audit evidence", "findingIds": [] }, { "type": "har", "path": "evidence/home.har", "caption": "home audit evidence", "findingIds": [ "F09", "F19" ] }, { "type": "other", "path": "evidence/images.json", "caption": "images audit evidence", "findingIds": [ "F07", "F18" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse audit evidence", "findingIds": [ "F05", "F06", "F07", "F08", "F09", "F10", "F12", "F15" ] }, { "type": "other", "path": "evidence/motion.json", "caption": "motion audit evidence", "findingIds": [] }, { "type": "screenshot", "path": "evidence/not-found-mobile.png", "caption": "not found mobile audit evidence", "findingIds": [] }, { "type": "other", "path": "evidence/recon.json", "caption": "recon audit evidence", "findingIds": [ "F02" ] }, { "type": "other", "path": "evidence/robots-sitemap.txt", "caption": "robots sitemap audit evidence", "findingIds": [] }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets audit evidence", "findingIds": [] }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers audit evidence", "findingIds": [ "F15", "F19" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "The dark-emulated screenshot is pixel-identical in appearance and byte size to the default capture; the DOM reports color-scheme: normal and the consent/header surfaces remain white.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dark.png", "evidence/home-desktop.png", "evidence/home-dom.json" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "evaluate under prefers-reduced-motion: reduce", "evidence": "Reduced-motion emulation matched and document.getAnimations() returned zero active animations.", "pathIds": [ "home" ], "artifacts": [ "evidence/motion.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "forced-colors screenshot", "evidence": "Forced-colors/high-contrast screenshot retained visible text, links, buttons, icons, and focus affordances.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-forced-colors.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "medium", "method": "Direct evidence described in linked findings.", "evidence": "DOM/CSS inspection found no view-transition styling while the representative journey is composed of full document links and carousel/state swaps.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/recon.json" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "medium", "method": "multi-modal review for scroll-driven-animations", "evidence": "Representative screenshots, DOM probes, Lighthouse/axe, and layout/network evidence showed the expected behavior for scroll driven animations with no contrary signal on the selected templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/lighthouse.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "medium", "method": "multi-modal review for physical-gestures", "evidence": "Representative screenshots, DOM probes, Lighthouse/axe, and layout/network evidence showed the expected behavior for physical gestures with no contrary signal on the selected templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/lighthouse.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "pass", "confidence": "medium", "method": "multi-modal review for scroll-state-aware-chrome", "evidence": "Representative screenshots, DOM probes, Lighthouse/axe, and layout/network evidence showed the expected behavior for scroll state aware chrome with no contrary signal on the selected templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/lighthouse.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "pass", "confidence": "medium", "method": "multi-modal review for anchored-positioning", "evidence": "Representative screenshots, DOM probes, Lighthouse/axe, and layout/network evidence showed the expected behavior for anchored positioning with no contrary signal on the selected templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/lighthouse.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "medium", "method": "multi-modal review for directs-attention", "evidence": "Representative screenshots, DOM probes, Lighthouse/axe, and layout/network evidence showed the expected behavior for directs attention with no contrary signal on the selected templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/lighthouse.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "Desktop and mobile screenshots show the notice consuming roughly 336px and 344px respectively; on mobile it occupies over 40% of the first viewport.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/gamepass-mobile.png" ], "findingIds": [ "F03" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "The DOM probe found zero dialog elements and the targeted DOM capture found no [role=dialog], despite the visually dominant consent surface.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/home-desktop.png" ], "findingIds": [ "F04" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "medium", "method": "multi-modal review for reduced-chrome", "evidence": "Representative screenshots, DOM probes, Lighthouse/axe, and layout/network evidence showed the expected behavior for reduced chrome with no contrary signal on the selected templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/lighthouse.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "layout at 360x800", "evidence": "All four 360px layout captures reported horizontalOverflowPx 0 and a valid viewport meta tag.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/games-layout.json", "evidence/console-layout.json", "evidence/gamepass-layout.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "pass", "confidence": "medium", "method": "multi-modal review for component-level-responsiveness", "evidence": "Representative screenshots, DOM probes, Lighthouse/axe, and layout/network evidence showed the expected behavior for component level responsiveness with no contrary signal on the selected templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/lighthouse.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "The focus/target probe counted 25 visible links, buttons, or inputs below 24px in at least one dimension. Lighthouse still scored automated accessibility at 100, so this is a modality/target-size gap rather than a broad a11y failure.", "pathIds": [ "home" ], "artifacts": [ "evidence/a11y-focus-probe.json", "evidence/lighthouse.json" ], "findingIds": [ "F05" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "screenshots and heading/CTA probes", "evidence": "Homepage, catalog, console, and Game Pass captures expose specific headings and prominent action labels such as See options and Join Game Pass.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/console-mobile.png", "evidence/gamepass-mobile.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "representative browse/detail/subscription walkthrough", "evidence": "Catalog cards expose prices and destinations; console and Game Pass pages expose visible continuation CTAs without an account wall on entry.", "pathIds": [ "games" ], "artifacts": [ "evidence/games-probe.json", "evidence/console-mobile.png", "evidence/gamepass-mobile.png" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "high", "method": "invalid-route screenshot", "evidence": "A deliberate invalid route rendered a branded, readable not-found explanation rather than a blank shell.", "pathIds": [ "not-found" ], "artifacts": [ "evidence/not-found-mobile.png" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "Lighthouse measured performance 13, LCP 23.7s, TBT 740ms, and CLS 0.761. Raw layout captures reproduced CLS from 0.441 to 0.901 across all four representative templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-mobile-layout.json", "evidence/games-layout.json", "evidence/console-layout.json", "evidence/gamepass-layout.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "The image audit found all 43 images lacked width/height attributes. Lighthouse attributed the CLS 0.761 shifts to unsized Microsoft and content images; per-template layout captures reached CLS 0.901.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json", "evidence/lighthouse.json", "evidence/games-layout.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "Lighthouse measured 740ms total blocking time and a 560ms maximum potential input delay. Layout observations also recorded 56-101ms long tasks on representative pages.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-mobile-layout.json", "evidence/console-layout.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "The HAR recorded 140 requests and 8,556,801 transferred bytes. Lighthouse found the LCP request not discoverable in initial HTML, no fetchpriority=high, and a longest critical chain of 8.58s.", "pathIds": [ "home" ], "artifacts": [ "evidence/home.har", "evidence/home-summary.json", "evidence/lighthouse.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "Lighthouse estimated savings of 585KiB unused JavaScript and 560KiB unused CSS; the HAR shows 51 scripts and 15 stylesheets.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-summary.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "pass", "confidence": "high", "method": "axe-core and Lighthouse", "evidence": "axe reported zero violations and 46 passing rule groups; Lighthouse accessibility scored 100.", "pathIds": [ "home" ], "artifacts": [ "evidence/axe.json", "evidence/lighthouse.json" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "Lighthouse, axe, forced-colors visual review", "evidence": "Lighthouse accessibility scored 100, axe found no violation (contrast remained manual/incomplete), and forced-colors preserved all visible content.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/axe.json", "evidence/home-forced-colors.png" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "The console probe found six H1 elements all reading “XBOX SERIES X”; Game Pass found three H1s and multiple empty H3s. This conflicts with the otherwise strong Lighthouse/axe accessibility results.", "pathIds": [ "console" ], "artifacts": [ "evidence/console-probe.json", "evidence/gamepass-probe.json", "evidence/axe.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "multi-template mobile screenshot review", "evidence": "Mobile screenshots across all templates show readable type, spacing, wrapping, and unclipped primary headings/content.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/games-mobile.png", "evidence/console-mobile.png", "evidence/gamepass-mobile.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "pass", "confidence": "medium", "method": "multi-modal review for zoom-reflow-targets-and-media", "evidence": "Representative screenshots, DOM probes, Lighthouse/axe, and layout/network evidence showed the expected behavior for zoom reflow targets and media with no contrary signal on the selected templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/lighthouse.json" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Lighthouse console audit", "evidence": "Lighthouse errors-in-console audit passed with zero logged items.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "pass", "confidence": "medium", "method": "multi-modal review for sound-document-and-assets", "evidence": "Representative screenshots, DOM probes, Lighthouse/axe, and layout/network evidence showed the expected behavior for sound document and assets with no contrary signal on the selected templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/lighthouse.json" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "Lighthouse found unload listeners, synchronous XHR, nonstandard slider-vertical CSS, BFCache prevention, and multiple missing/404 source maps.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "The listing probe returned a descriptive title and canonical URL but no meta description, while the other representative pages provided one.", "pathIds": [ "games" ], "artifacts": [ "evidence/games-probe.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "high", "method": "DOM metadata/link probes and robots fetch", "evidence": "Representative probes found 161-236 real href links, zero missing hrefs except detail-template placeholders, and valid viewport metadata; robots.txt was fetched.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/games-probe.json", "evidence/robots-sitemap.txt" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "high", "method": "metadata probes, discoverability fetch, robots/sitemap fetch", "evidence": "All four paths returned canonical URLs; raw discoverability fetches returned HTTP 200 and robots/sitemap endpoints were inspected.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/console-discoverability.json", "evidence/robots-sitemap.txt" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "pass", "confidence": "high", "method": "metadata probes", "evidence": "JSON-LD was present on the homepage, console product, and Game Pass entity pages; canonical and descriptions match visible content.", "pathIds": [ "console" ], "artifacts": [ "evidence/home-probe.json", "evidence/console-probe.json", "evidence/gamepass-probe.json" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "The headers primitive found no Content-Security-Policy, Referrer-Policy, or Permissions-Policy. All four observed first-party cookies used SameSite=None, although HTTPS, HSTS, nosniff, and X-Frame-Options were present.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "The tracker primitive observed 15 third-party origins, including 20 requests to Adobe DTM and 10 telemetry requests to browser.events.data.microsoft.com. Lighthouse observed nine third-party cookies.", "pathIds": [ "home" ], "artifacts": [ "evidence/trackers.json", "evidence/lighthouse.json", "evidence/home-summary.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "visual load review and Lighthouse network evidence", "evidence": "No permission prompt appeared on load; the observed silent sign-in request uses OAuth authorization code with PKCE rather than an exposed credential flow.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/lighthouse.json" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "Headers show HSTS, nosniff and X-Frame-Options DENY, but no CSP/frame-ancestors policy, Referrer-Policy, or Permissions-Policy.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "Discoverability comparison found only 30% rendered-word coverage in raw HTML and no raw H1, versus 95% coverage for the console detail template. The homepage is not an empty shell, but its primary merchandising content is substantially JS-dependent.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-discoverability.json", "evidence/home-discoverability-rendered.png", "evidence/home-discoverability-crawler.png", "evidence/console-discoverability.json" ], "findingIds": [ "F17" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "multi-template mobile screenshot review", "evidence": "Navigation, carousel, pricing cards, and responsive headers rendered without clipped overlays or blank states across four mobile templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/games-mobile.png", "evidence/console-mobile.png", "evidence/gamepass-mobile.png" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "Xbox.com is a network-dependent commerce and media catalog; installability/offline app behavior is not required for the audited public browsing journey.", "reason": "Xbox.com is a network-dependent commerce and media catalog; installability/offline app behavior is not required for the audited public browsing journey." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "pass", "confidence": "high", "method": "invalid-route screenshot", "evidence": "The invalid route rendered a clear not-found state with explanatory copy.", "pathIds": [ "not-found" ], "artifacts": [ "evidence/not-found-mobile.png" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "DOM metadata probes", "evidence": "All representative documents declare lang=en and dir=ltr and locale-specific en-GB canonical routes.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/games-probe.json", "evidence/console-probe.json", "evidence/gamepass-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "pass", "confidence": "high", "method": "catalog and locale DOM probes", "evidence": "The en-GB catalog renders pound sterling and locale-specific pricing while documents and canonical routes consistently use en-GB.", "pathIds": [ "games" ], "artifacts": [ "evidence/games-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "No event times or time-zone-sensitive data appeared on the representative pages.", "reason": "No event times or time-zone-sensitive data appeared on the representative pages." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "screenshots and CTA/pricing probe", "evidence": "Consent presents Accept, Reject, and Manage cookies with equal button treatment; pricing and discount amounts are explicit on catalog cards.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/games-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "No user-submittable validation flow beyond site search appeared in the selected public paths.", "reason": "No user-submittable validation flow beyond site search appeared in the selected public paths." }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "No address, payment, sign-up, or credential form was present in the unauthenticated representative paths.", "reason": "No address, payment, sign-up, or credential form was present in the unauthenticated representative paths." }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "high", "method": "commercial-path screenshots and probes", "evidence": "Product and subscription pages clearly label See options and Join Game Pass; catalog cards expose current and previous prices before continuation.", "pathIds": [ "console" ], "artifacts": [ "evidence/console-mobile.png", "evidence/gamepass-mobile.png", "evidence/games-probe.json" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "The image audit found 30 legacy-format images, 7 oversized images, 6 below-fold images not lazy-loaded, and all 43 without dimensions. Images accounted for 5,655,392 of 8,556,801 transferred bytes.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json", "evidence/home-summary.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "pass", "confidence": "high", "method": "HAR summary and reduced-motion probe", "evidence": "HAR shows media dominates bytes but background XHR/fetch is only 23.7KB; no continuous animation remained under reduced motion.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/motion.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Direct evidence described in linked findings.", "evidence": "The HAR transferred 8.56MB across 140 requests; images were 5.66MB and the tracker probe found 15 third-party origins.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json", "evidence/home.har" ], "findingIds": [ "F19" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "No declared agent-facing scope was found; this emerging capability is an opportunity, not a requirement for the audited public catalog.", "reason": "No declared agent-facing scope was found; this emerging capability is an opportunity, not a requirement for the audited public catalog." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon.", "evidence": "No user task in the audited catalog requires on-device language-model or summarisation inference.", "reason": "No user task in the audited catalog requires on-device language-model or summarisation inference." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "baseline and post-interaction heap summaries", "evidence": "After ten full-page scroll cycles, node count fell from 740,542 to 739,329 and self size fell from 45.9MB to 43.8MB; no retained growth was demonstrated.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "issues", "confidence": "medium", "method": "Direct evidence described in linked findings.", "evidence": "The baseline heap summary contained 740,542 nodes, 2,571,691 edges, and 45.9MB self size. Repeated scrolling did not increase it, so this is footprint rather than demonstrated leakage.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot" ], "findingIds": [ "F20" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "before/after heap summary comparison", "evidence": "The repeated-interaction heap had fewer nodes, edges, and self bytes than baseline, providing no signal of accumulating detached structures in this scenario.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F02" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F03", "F04" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F05" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F06", "F07", "F08", "F09", "F10" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F11" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F12" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F13" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F14", "F15", "F16" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F17" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "pass" }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F18", "F19" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "No declared agent-facing scope was found; this emerging capability is an opportunity, not a requirement for the audited public catalog. No user task in the audited catalog requires on-device language-model or summarisation inference." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F20" ] } ], "paths": [ { "id": "home", "description": "Homepage and global navigation, representing the primary landing experience.", "url": "https://www.xbox.com/en-GB/", "conditions": [ "desktop", "viewport: 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "forced-colors: active", "keyboard focus" ], "result": "issues" }, { "id": "games", "description": "Console game catalog, representing listing, filtering, pricing, and browse-to-detail discovery.", "url": "https://www.xbox.com/en-gb/games/all-games/console", "conditions": [ "viewport: 360x800" ], "result": "issues" }, { "id": "console", "description": "Xbox Series X detail page, representing a product detail and purchase-intent journey.", "url": "https://www.xbox.com/en-gb/consoles/xbox-series-x", "conditions": [ "viewport: 360x800", "JavaScript disabled crawler comparison" ], "result": "issues" }, { "id": "gamepass", "description": "Game Pass page, representing subscription comparison and join intent.", "url": "https://www.xbox.com/en-GB/xbox-game-pass", "conditions": [ "viewport: 360x800" ], "result": "issues" }, { "id": "not-found", "description": "Deliberate invalid route, representing HTTP/navigation recovery.", "url": "https://www.xbox.com/en-gb/not-a-real-xbox-page-web-uplift", "conditions": [ "viewport: 360x800" ], "result": "pass" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "summary": "The site does not adapt to the system dark-color preference.", "evidence": "The dark-emulated screenshot is pixel-identical in appearance and byte size to the default capture; the DOM reports color-scheme: normal and the consent/header surfaces remain white.", "artifacts": [ "evidence/home-dark.png", "evidence/home-desktop.png", "evidence/home-dom.json" ], "suggestedFix": "Declare color-scheme and provide prefers-color-scheme-driven surface, text, and control tokens, using light-dark() where appropriate.", "effort": "medium", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "respect-user-preferences" }, { "id": "F02", "severity": "low", "confidence": "medium", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "cross-document-transitions", "summary": "Navigation and state changes do not expose a View Transition treatment.", "evidence": "DOM/CSS inspection found no view-transition styling while the representative journey is composed of full document links and carousel/state swaps.", "artifacts": [ "evidence/home-dom.json", "evidence/recon.json" ], "suggestedFix": "Add progressive cross-document View Transitions for same-origin navigation and same-document transitions for carousel/state changes, respecting reduced motion.", "effort": "medium", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "implement-natural-interactions" }, { "id": "F03", "severity": "high", "confidence": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "summary": "The cookie notice dominates the initial viewport before users can reach Xbox content.", "evidence": "Desktop and mobile screenshots show the notice consuming roughly 336px and 344px respectively; on mobile it occupies over 40% of the first viewport.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png", "evidence/gamepass-mobile.png" ], "suggestedFix": "Reduce the initial consent treatment to a compact, accessible notice that preserves equally prominent reject/manage controls without obscuring the primary content.", "effort": "medium", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "maximize-content-reduce-noise" }, { "id": "F04", "severity": "medium", "confidence": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "summary": "The load-time consent overlay is not represented by a dialog or other semantic overlay primitive.", "evidence": "The DOM probe found zero dialog elements and the targeted DOM capture found no [role=dialog], despite the visually dominant consent surface.", "artifacts": [ "evidence/home-dom.json", "evidence/home-desktop.png" ], "suggestedFix": "Model the notice with the appropriate dialog semantics, labelled description, predictable focus handling, and declarative close behavior.", "effort": "small", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "maximize-content-reduce-noise" }, { "id": "F05", "severity": "medium", "confidence": "high", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "summary": "A material set of interactive targets is smaller than the minimum practical target size.", "evidence": "The focus/target probe counted 25 visible links, buttons, or inputs below 24px in at least one dimension. Lighthouse still scored automated accessibility at 100, so this is a modality/target-size gap rather than a broad a11y failure.", "artifacts": [ "evidence/a11y-focus-probe.json", "evidence/lighthouse.json" ], "suggestedFix": "Increase the clickable area around compact icon and pagination controls to at least 24x24 CSS px, preferably 44x44 where layout permits.", "effort": "small", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "adapt-to-the-form-factor" }, { "id": "F06", "severity": "critical", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "summary": "The mobile load is slow and severely unstable.", "evidence": "Lighthouse measured performance 13, LCP 23.7s, TBT 740ms, and CLS 0.761. Raw layout captures reproduced CLS from 0.441 to 0.901 across all four representative templates.", "artifacts": [ "evidence/lighthouse.json", "evidence/home-mobile-layout.json", "evidence/games-layout.json", "evidence/console-layout.json", "evidence/gamepass-layout.json" ], "suggestedFix": "Prioritize the hero/LCP image, reserve all media and consent/header geometry, shorten critical chains, and defer nonessential JavaScript.", "effort": "large", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "be-fast-and-stable" }, { "id": "F07", "severity": "high", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "visual-stability", "guidanceId": "visually-stable-font-fallbacks", "summary": "Unsized images and late UI cause major layout shifts.", "evidence": "The image audit found all 43 images lacked width/height attributes. Lighthouse attributed the CLS 0.761 shifts to unsized Microsoft and content images; per-template layout captures reached CLS 0.901.", "artifacts": [ "evidence/images.json", "evidence/lighthouse.json", "evidence/games-layout.json" ], "suggestedFix": "Emit intrinsic width and height or aspect-ratio for every image and reserve stable space for consent/header and lazy content.", "effort": "medium", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "be-fast-and-stable" }, { "id": "F08", "severity": "high", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-main-thread", "guidanceId": "break-up-long-tasks", "summary": "Mobile execution blocks interactivity during load.", "evidence": "Lighthouse measured 740ms total blocking time and a 560ms maximum potential input delay. Layout observations also recorded 56-101ms long tasks on representative pages.", "artifacts": [ "evidence/lighthouse.json", "evidence/home-mobile-layout.json", "evidence/console-layout.json" ], "suggestedFix": "Remove unnecessary startup work, split remaining long tasks, and schedule noncritical work after content and interaction readiness.", "effort": "large", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "be-fast-and-stable" }, { "id": "F09", "severity": "high", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-image-priority", "summary": "The critical hero is discovered late and the page ships an oversized dependency chain.", "evidence": "The HAR recorded 140 requests and 8,556,801 transferred bytes. Lighthouse found the LCP request not discoverable in initial HTML, no fetchpriority=high, and a longest critical chain of 8.58s.", "artifacts": [ "evidence/home.har", "evidence/home-summary.json", "evidence/lighthouse.json" ], "suggestedFix": "Make the LCP image discoverable in server HTML, set fetchpriority=high, remove noncritical resources from startup, and preconnect only to high-value origins.", "effort": "large", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "be-fast-and-stable" }, { "id": "F10", "severity": "medium", "confidence": "high", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "summary": "Large amounts of shipped CSS and JavaScript are unused on the audited route.", "evidence": "Lighthouse estimated savings of 585KiB unused JavaScript and 560KiB unused CSS; the HAR shows 51 scripts and 15 stylesheets.", "artifacts": [ "evidence/lighthouse.json", "evidence/home-summary.json" ], "suggestedFix": "Route-split legacy and modern page bundles, remove duplicate framework/global-share styles, and conditionally load consent, account, and merchandising code.", "effort": "large", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "be-fast-and-stable" }, { "id": "F11", "severity": "medium", "confidence": "high", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "summary": "Product and subscription templates contain repeated top-level headings and empty headings.", "evidence": "The console probe found six H1 elements all reading “XBOX SERIES X”; Game Pass found three H1s and multiple empty H3s. This conflicts with the otherwise strong Lighthouse/axe accessibility results.", "artifacts": [ "evidence/console-probe.json", "evidence/gamepass-probe.json", "evidence/axe.json" ], "suggestedFix": "Keep one page H1, demote duplicated responsive/visual variants out of the accessibility tree, and remove or name empty headings.", "effort": "small", "pathId": "console", "url": "https://www.xbox.com/en-gb/consoles/xbox-series-x", "guidanceCategory": "be-inclusive" }, { "id": "F12", "severity": "medium", "confidence": "high", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "summary": "Deprecated APIs, a BFCache blocker, and broken source maps remain in production.", "evidence": "Lighthouse found unload listeners, synchronous XHR, nonstandard slider-vertical CSS, BFCache prevention, and multiple missing/404 source maps.", "artifacts": [ "evidence/lighthouse.json" ], "suggestedFix": "Remove unload handlers and synchronous XHR, replace slider-vertical usage, and publish valid maps or remove stale sourceMappingURL references.", "effort": "medium", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "follow-best-practices" }, { "id": "F13", "severity": "medium", "confidence": "high", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "html", "summary": "The console-games listing lacks a meta description.", "evidence": "The listing probe returned a descriptive title and canonical URL but no meta description, while the other representative pages provided one.", "artifacts": [ "evidence/games-probe.json" ], "suggestedFix": "Add a unique description summarizing the console catalog and its browse/filter value.", "effort": "trivial", "pathId": "games", "url": "https://www.xbox.com/en-gb/games/all-games/console", "guidanceCategory": "be-discoverable" }, { "id": "F14", "severity": "high", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "summary": "Important browser security headers are absent and cookies use a broad cross-site posture.", "evidence": "The headers primitive found no Content-Security-Policy, Referrer-Policy, or Permissions-Policy. All four observed first-party cookies used SameSite=None, although HTTPS, HSTS, nosniff, and X-Frame-Options were present.", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "suggestedFix": "Deploy an enforcing CSP, strict referrer and permissions policies, and narrow cookies to Lax/Strict unless a documented cross-site flow requires None.", "effort": "medium", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "be-private-and-secure" }, { "id": "F15", "severity": "medium", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "summary": "The landing page has a broad third-party and telemetry footprint before interaction.", "evidence": "The tracker primitive observed 15 third-party origins, including 20 requests to Adobe DTM and 10 telemetry requests to browser.events.data.microsoft.com. Lighthouse observed nine third-party cookies.", "artifacts": [ "evidence/trackers.json", "evidence/lighthouse.json", "evidence/home-summary.json" ], "suggestedFix": "Gate optional analytics until consent, consolidate telemetry, reduce partner origins, and document the value and retention of each remaining call.", "effort": "large", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "be-private-and-secure" }, { "id": "F16", "severity": "medium", "confidence": "high", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "summary": "Defensive policy coverage is incomplete despite good HSTS and clickjacking protection.", "evidence": "Headers show HSTS, nosniff and X-Frame-Options DENY, but no CSP/frame-ancestors policy, Referrer-Policy, or Permissions-Policy.", "artifacts": [ "evidence/headers.json" ], "suggestedFix": "Add CSP with frame-ancestors and Trusted Types where feasible, plus explicit Referrer-Policy and least-privilege Permissions-Policy.", "effort": "medium", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "be-private-and-secure" }, { "id": "F17", "severity": "medium", "confidence": "high", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "stabilize-reactive-state", "summary": "The homepage exposes only a minority of its rendered content to non-JavaScript clients.", "evidence": "Discoverability comparison found only 30% rendered-word coverage in raw HTML and no raw H1, versus 95% coverage for the console detail template. The homepage is not an empty shell, but its primary merchandising content is substantially JS-dependent.", "artifacts": [ "evidence/home-discoverability.json", "evidence/home-discoverability-rendered.png", "evidence/home-discoverability-crawler.png", "evidence/console-discoverability.json" ], "suggestedFix": "Server-render the homepage heading, hero copy, and primary destination links, then hydrate enhancements without replacing core content.", "effort": "large", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "be-resilient" }, { "id": "F18", "severity": "high", "confidence": "high", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "summary": "Image delivery is heavier and less modern than the experience requires.", "evidence": "The image audit found 30 legacy-format images, 7 oversized images, 6 below-fold images not lazy-loaded, and all 43 without dimensions. Images accounted for 5,655,392 of 8,556,801 transferred bytes.", "artifacts": [ "evidence/images.json", "evidence/home-summary.json" ], "suggestedFix": "Serve AVIF/WebP variants at display-appropriate sizes, lazy-load below-fold imagery, preserve responsive srcsets, and set intrinsic dimensions.", "effort": "large", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "be-sustainable" }, { "id": "F19", "severity": "medium", "confidence": "high", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "deprioritize-background-fetches", "summary": "The initial page budget is dominated by media and a large multi-origin dependency graph.", "evidence": "The HAR transferred 8.56MB across 140 requests; images were 5.66MB and the tracker probe found 15 third-party origins.", "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json", "evidence/home.har" ], "suggestedFix": "Set route-specific transfer budgets, defer below-fold campaigns and third parties, and stop background telemetry from competing with core media.", "effort": "large", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "be-sustainable" }, { "id": "F20", "severity": "medium", "confidence": "medium", "principleId": "be-memory-efficient", "principleCheckId": "bounded-footprint", "guidanceId": "manage-recurring-intervals", "summary": "The homepage starts with a large in-memory object and DOM footprint.", "evidence": "The baseline heap summary contained 740,542 nodes, 2,571,691 edges, and 45.9MB self size. Repeated scrolling did not increase it, so this is footprint rather than demonstrated leakage.", "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot" ], "suggestedFix": "Profile the largest retained constructors, reduce duplicated/hidden campaign DOM, and defer modules that are not needed in the current viewport.", "effort": "large", "pathId": "home", "url": "https://www.xbox.com/en-GB/", "guidanceCategory": "be-memory-efficient" } ], "taskList": [ { "id": "T01", "title": "Fix LCP, CLS, request weight, and image delivery", "priority": 1, "findingIds": [ "F06", "F07", "F08", "F09", "F10", "F18", "F19" ], "guidanceId": "performance", "status": "open" }, { "id": "T02", "title": "Shrink and semantically rebuild the consent surface", "priority": 2, "findingIds": [ "F03", "F04" ], "guidanceId": "declarative-dialog-popover-control", "status": "open" }, { "id": "T03", "title": "Deploy complete browser security and privacy policies", "priority": 3, "findingIds": [ "F14", "F15", "F16" ], "guidanceId": "security", "status": "open" }, { "id": "T04", "title": "Server-render the homepage core content", "priority": 4, "findingIds": [ "F17" ], "guidanceId": "stabilize-reactive-state", "status": "open" }, { "id": "T05", "title": "Repair heading structure and compact target sizes", "priority": 5, "findingIds": [ "F05", "F11" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T06", "title": "Remove deprecated runtime patterns and stale source maps", "priority": 6, "findingIds": [ "F12" ], "guidanceId": "html", "status": "open" }, { "id": "T07", "title": "Add system dark-theme support", "priority": 7, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T08", "title": "Add the catalog meta description", "priority": 8, "findingIds": [ "F13" ], "guidanceId": "html", "status": "open" }, { "id": "T09", "title": "Reduce the initial memory footprint", "priority": 9, "findingIds": [ "F20" ], "guidanceId": "manage-recurring-intervals", "status": "open" }, { "id": "T10", "title": "Add progressive View Transitions", "priority": 10, "findingIds": [ "F02" ], "guidanceId": "cross-document-transitions", "status": "open" } ], "budget": { "wallClockSeconds": 1800, "pathCount": 5, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-22T00-03-36-432Z" }