{
  "url": "https://auth.platorelay.com",
  "auditedAt": "2026-07-22T00:37:35.594Z",
  "mode": "report",
  "status": "completed",
  "statusDetail": "Atomic coverage complete for the single public gateway plus its representative unknown-route error state.",
  "page": {
    "appType": "spa",
    "framework": "client-rendered bundled SPA (framework not exposed in rendered signals)",
    "notes": "A single outbound gateway card. The visible entry page contains no authentication form despite the auth hostname. Distinct destination sites are external and were not audited."
  },
  "evidenceUsed": [
    "screenshot",
    "dom+computed-css",
    "layout-metrics",
    "discoverability",
    "trace",
    "har",
    "headers",
    "cookies",
    "trackers",
    "secrets",
    "images",
    "heap-summary",
    "evaluate-probe",
    "lighthouse"
  ],
  "guidanceConsulted": [
    "dark-mode",
    "accessibility",
    "same-document-transitions",
    "shrinking-header-on-scroll",
    "declarative-dialog-popover-control",
    "fluid-scaling",
    "forms",
    "performance",
    "optimize-image-priority",
    "html",
    "security",
    "privacy",
    "flicker-free-client-side-ab-testing",
    "translator",
    "declarative-button-actions",
    "deliver-optimized-decorative-images",
    "webmcp",
    "manage-recurring-intervals",
    "persistent-toast-notifications",
    "optimize-script-priority",
    "identify-heavy-scripts",
    "efficient-background-processing",
    "deprioritize-background-fetches"
  ],
  "artifacts": [
    {
      "type": "screenshot",
      "path": "evidence/desktop.png",
      "caption": "Desktop entry view",
      "condition": "viewport 1440x1000",
      "findingIds": [
        "F-COLOR",
        "F-PURPOSE"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/mobile.png",
      "caption": "Mobile entry view",
      "condition": "viewport 360x800",
      "findingIds": [
        "F-PURPOSE"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/dark.png",
      "caption": "Entry view under dark preference",
      "condition": "prefers-color-scheme: dark",
      "findingIds": [
        "F-COLOR"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/contrast.png",
      "caption": "Entry under increased contrast and forced colors",
      "condition": "prefers-contrast: more; forced-colors: active",
      "findingIds": []
    },
    {
      "type": "dom",
      "path": "evidence/dom.json",
      "caption": "Rendered DOM, CSS and selected computed styles",
      "condition": "default",
      "findingIds": [
        "F-STRUCTURE",
        "F-SEO-META",
        "F-SHARE",
        "F-PROGRESSIVE"
      ]
    },
    {
      "type": "layout",
      "path": "evidence/layout-mobile.json",
      "caption": "Mobile layout, CLS, overflow, and long-task observations",
      "condition": "viewport 360x800",
      "findingIds": []
    },
    {
      "type": "discoverability",
      "path": "evidence/discoverability.json",
      "caption": "Raw HTML versus rendered-content comparison",
      "condition": "JavaScript on/off",
      "findingIds": [
        "F-CRAWL",
        "F-PROGRESSIVE"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/discoverability-rendered.png",
      "caption": "Rendered browser view",
      "condition": "JavaScript enabled",
      "findingIds": [
        "F-CRAWL"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/discoverability-crawler.png",
      "caption": "Crawler/no-JavaScript view",
      "condition": "JavaScript disabled",
      "findingIds": [
        "F-CRAWL",
        "F-PROGRESSIVE"
      ]
    },
    {
      "type": "trace",
      "path": "evidence/load-trace.json",
      "caption": "DevTools load performance trace",
      "condition": "cold navigation",
      "findingIds": []
    },
    {
      "type": "trace-summary",
      "path": "evidence/load-trace-summary.json",
      "caption": "Compact load timing and main-thread summary",
      "condition": "cold navigation",
      "findingIds": [
        "F-CWV"
      ]
    },
    {
      "type": "har",
      "path": "evidence/network.har",
      "caption": "HAR 1.2 network capture",
      "condition": "5-second load",
      "findingIds": [
        "F-DELIVERY"
      ]
    },
    {
      "type": "har-summary",
      "path": "evidence/network-summary.json",
      "caption": "Compact request, bytes, third-party and hygiene summary",
      "condition": "5-second load",
      "findingIds": [
        "F-DELIVERY",
        "F-UNUSED",
        "F-PRIVACY",
        "F-WASTE",
        "F-THIRDPARTY"
      ]
    },
    {
      "type": "other",
      "path": "evidence/headers.json",
      "caption": "Security response-header inspection",
      "condition": "main document",
      "findingIds": [
        "F-TRANSPORT",
        "F-POLICIES"
      ]
    },
    {
      "type": "other",
      "path": "evidence/cookies.json",
      "caption": "Cookie security and retention inspection",
      "condition": "after load",
      "findingIds": [
        "F-TRANSPORT",
        "F-PRIVACY"
      ]
    },
    {
      "type": "other",
      "path": "evidence/trackers.json",
      "caption": "Third-party tracker enumeration",
      "condition": "5-second load",
      "findingIds": [
        "F-PRIVACY",
        "F-THIRDPARTY"
      ]
    },
    {
      "type": "other",
      "path": "evidence/secrets.json",
      "caption": "Client-exposed secret scan",
      "condition": "rendered HTML and scripts",
      "findingIds": []
    },
    {
      "type": "other",
      "path": "evidence/images.json",
      "caption": "Rendered image audit",
      "condition": "entry view",
      "findingIds": []
    },
    {
      "type": "heap",
      "path": "evidence/heap.json",
      "caption": "Single-state V8 heap summary",
      "condition": "after load",
      "findingIds": []
    },
    {
      "type": "other",
      "path": "evidence/probe.json",
      "caption": "Metadata, focus, platform, robots/sitemap and runtime probe",
      "condition": "entry view",
      "findingIds": [
        "F-STRUCTURE",
        "F-SEO-META",
        "F-CRAWL",
        "F-INDEXING",
        "F-SHARE"
      ]
    },
    {
      "type": "other",
      "path": "evidence/reduced-motion.json",
      "caption": "Animation probe under reduced-motion preference",
      "condition": "prefers-reduced-motion: reduce",
      "findingIds": []
    },
    {
      "type": "lighthouse",
      "path": "evidence/lighthouse.json",
      "caption": "Lighthouse performance, accessibility, best-practices, SEO and agentic-browsing run",
      "condition": "mobile simulated",
      "findingIds": [
        "F-CWV",
        "F-DELIVERY",
        "F-UNUSED",
        "F-SOURCEMAP",
        "F-SEO-META",
        "F-INDEXING",
        "F-WASTE"
      ]
    },
    {
      "type": "other",
      "path": "evidence/not-found.json",
      "caption": "Unknown-route text and state probe",
      "condition": "/does-not-exist",
      "findingIds": [
        "F-RECOVERY",
        "F-HTTP-STATE"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/not-found.png",
      "caption": "Unknown-route error view",
      "condition": "/does-not-exist",
      "findingIds": [
        "F-RECOVERY",
        "F-HTTP-STATE"
      ]
    }
  ],
  "config": {
    "loaded": false
  },
  "coverage": {
    "catalogVersion": "modern-web-guidance@0.0.172",
    "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7",
    "expected": 58,
    "recorded": 58,
    "judged": 58,
    "blocked": 0,
    "notRun": 0,
    "missing": 0,
    "unknown": 0,
    "duplicates": 0,
    "complete": true
  },
  "checkOutcomes": [
    {
      "principleId": "respect-user-preferences",
      "checkId": "respects-color-scheme",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "Default and prefers-color-scheme: dark screenshots are byte-identical; the DOM probe reports color-scheme: normal and no prefers-color-scheme rule.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/desktop.png",
        "evidence/dark.png"
      ],
      "findingIds": [
        "F-COLOR"
      ]
    },
    {
      "principleId": "respect-user-preferences",
      "checkId": "respects-reduced-motion",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Reduced-motion emulation matched and getAnimations() returned no active animations.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/reduced-motion.json"
      ]
    },
    {
      "principleId": "respect-user-preferences",
      "checkId": "respects-contrast",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Forced-colors/increased-contrast screenshot retains visible text, controls, borders, and focusable links.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/contrast.png"
      ]
    },
    {
      "principleId": "implement-natural-interactions",
      "checkId": "view-transitions",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "This gateway has no same-site state or route transition; its two actions leave for external destinations, so there is no controlled transition to evaluate.",
      "reason": "This gateway has no same-site state or route transition; its two actions leave for external destinations, so there is no controlled transition to evaluate.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "implement-natural-interactions",
      "checkId": "scroll-driven-animations",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "The page does not scroll and has no scroll-linked motion.",
      "reason": "The page does not scroll and has no scroll-linked motion.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "implement-natural-interactions",
      "checkId": "physical-gestures",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Available interactions use native buttons/anchors with no custom pointer or scroll handlers evident in the DOM/CSS.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/dom.json",
        "evidence/probe.json"
      ]
    },
    {
      "principleId": "provide-guided-navigation",
      "checkId": "scroll-state-aware-chrome",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "The complete page fits within one viewport and has no scrolling chrome.",
      "reason": "The complete page fits within one viewport and has no scrolling chrome.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "provide-guided-navigation",
      "checkId": "anchored-positioning",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "No tooltip, menu, popover, or other anchored overlay exists on this page.",
      "reason": "No tooltip, menu, popover, or other anchored overlay exists on this page.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "provide-guided-navigation",
      "checkId": "directs-attention",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "The centered card, heading, two prominent primary actions, underlined legal links, and visible keyboard focus clearly direct attention.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/desktop.png",
        "evidence/probe.json"
      ]
    },
    {
      "principleId": "maximize-content-reduce-noise",
      "checkId": "no-intrusive-interruptions",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Load screenshots and DOM show no popup, interstitial, banner, or content-obscuring overlay.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/desktop.png",
        "evidence/mobile.png",
        "evidence/dom.json"
      ]
    },
    {
      "principleId": "maximize-content-reduce-noise",
      "checkId": "semantic-dismissible-primitives",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "No overlay, dialog, disclosure, picker, or transient rich control exists.",
      "reason": "No overlay, dialog, disclosure, picker, or transient rich control exists.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "maximize-content-reduce-noise",
      "checkId": "reduced-chrome",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "The single compact card gives nearly all meaningful UI area to explanatory content and actions with minimal decorative chrome.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/desktop.png"
      ]
    },
    {
      "principleId": "adapt-to-the-form-factor",
      "checkId": "responsive-no-horizontal-scroll",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "At 360x800, layout reports scrollWidth=clientWidth=360, zero overflow and CLS, with a viewport meta tag.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/layout-mobile.json",
        "evidence/mobile.png"
      ]
    },
    {
      "principleId": "adapt-to-the-form-factor",
      "checkId": "component-level-responsiveness",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "The card is used in one container context only; no reused component needs container-specific variants.",
      "reason": "The card is used in one container context only; no reused component needs container-specific variants.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "adapt-to-the-form-factor",
      "checkId": "input-modality-aware",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Primary buttons are 40px high, legal links are spaced, native focus is present, and button focus has a visible two-ring box shadow.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/probe.json",
        "evidence/mobile.png"
      ]
    },
    {
      "principleId": "support-core-task-success",
      "checkId": "clear-purpose-and-primary-action",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "Desktop/mobile screenshots show an unexplained “Gateway”, mixed Plato/Platoboost naming, and the typo “check out or website”.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/desktop.png",
        "evidence/mobile.png"
      ],
      "findingIds": [
        "F-PURPOSE"
      ]
    },
    {
      "principleId": "support-core-task-success",
      "checkId": "primary-flow-completion",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Both destination-button click probes triggered full navigation (the CDP execution contexts closed on navigation), and all legal anchors have real href destinations.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/probe.json"
      ]
    },
    {
      "principleId": "support-core-task-success",
      "checkId": "clear-system-state-and-recovery",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "The /does-not-exist probe and screenshot show “An error occured”, technical detail/copy affordance, and legal links, but no retry, home, back, or primary destination.",
      "pathIds": [
        "error"
      ],
      "artifacts": [
        "evidence/not-found.json",
        "evidence/not-found.png"
      ],
      "findingIds": [
        "F-RECOVERY"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "good-core-web-vitals",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "Lighthouse measured FCP and LCP at 3.6 s (performance 0.82), outside the good LCP threshold; the less-throttled trace measured 1.43 s and no blocking, so network/resource delivery is the main risk.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/lighthouse.json",
        "evidence/load-trace-summary.json"
      ],
      "findingIds": [
        "F-CWV"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "visual-stability",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Mobile layout reports CLS 0 with no shifts; Lighthouse also reports CLS 0.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/layout-mobile.json",
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "efficient-main-thread",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Trace records zero long tasks and 0ms TBT; Lighthouse reports about 10ms TBT.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/load-trace-summary.json",
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "efficient-resource-delivery",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "HAR records 729,513 transferred bytes for six requests, including 554,908 bytes of first-party JS; Lighthouse estimates 411 KiB repeat-visit savings from longer caching. The module script is deferred by type=module, while the 5.8 KiB stylesheet is genuinely render blocking.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/network.har",
        "evidence/network-summary.json",
        "evidence/lighthouse.json"
      ],
      "findingIds": [
        "F-DELIVERY"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "trim-unused-and-duplicate-code",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "Lighthouse reports 504 KiB potential savings: 448,564 bytes unused in the first-party bundle (80.9%) and 67,808 bytes unused in gtag.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/lighthouse.json",
        "evidence/network-summary.json"
      ],
      "findingIds": [
        "F-UNUSED"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "names-roles-labels",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Lighthouse accessibility scored 1.0; controls use native button/anchor roles and the only icon is inline SVG adjacent to text rather than an unlabeled action.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/lighthouse.json",
        "evidence/dom.json"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "sufficient-contrast",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Lighthouse accessibility scored 1.0 and the forced-colors screenshot preserves strong text/control contrast.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/lighthouse.json",
        "evidence/contrast.png"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "structure-and-focus",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "The DOM/probe shows two nested <main> elements, no H1, an empty H3 for the icon, and the visible title as another H3.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/dom.json",
        "evidence/probe.json"
      ],
      "findingIds": [
        "F-STRUCTURE"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "legible-text",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Desktop/mobile screenshots show unclipped, centered text with a readable measure and stable system-font rendering.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/desktop.png",
        "evidence/mobile.png"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "zoom-reflow-targets-and-media",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Viewport permits scaling, mobile reflow has no overflow, Lighthouse accessibility is 1.0, and there is no media requiring captions.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/probe.json",
        "evidence/layout-mobile.json",
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "follow-best-practices",
      "checkId": "no-console-errors",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "Lighthouse best-practices scored 1.0 and did not report runtime/console failures on the entry page.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "follow-best-practices",
      "checkId": "sound-document-and-assets",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "The DOM/probe shows two nested <main> elements, no H1, an empty H3 for the icon, and the visible title as another H3.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/dom.json",
        "evidence/probe.json"
      ],
      "findingIds": [
        "F-STRUCTURE"
      ]
    },
    {
      "principleId": "follow-best-practices",
      "checkId": "browser-platform-hygiene",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "Lighthouse best-practices diagnostics report “Large JavaScript file is missing a source map” for index-d2eb3afb.js.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/lighthouse.json"
      ],
      "findingIds": [
        "F-SOURCEMAP"
      ]
    },
    {
      "principleId": "be-discoverable",
      "checkId": "title-and-description",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "DOM and Lighthouse show title “Platoboost” and no meta[name=description]; Lighthouse SEO score is 0.82.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/dom.json",
        "evidence/probe.json",
        "evidence/lighthouse.json"
      ],
      "findingIds": [
        "F-SEO-META"
      ]
    },
    {
      "principleId": "be-discoverable",
      "checkId": "crawlable-and-mobile-friendly",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "Discoverability reports 0% rendered-word coverage and a blank crawler screenshot. Primary actions are <button> elements with no href, while only legal links are crawlable anchors.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/discoverability.json",
        "evidence/discoverability-rendered.png",
        "evidence/discoverability-crawler.png",
        "evidence/probe.json"
      ],
      "findingIds": [
        "F-CRAWL"
      ]
    },
    {
      "principleId": "be-discoverable",
      "checkId": "canonical-and-indexing-signals",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "The page has no canonical URL; /robots.txt and /sitemap.xml both return status 200 with the 478-byte HTML shell. Lighthouse reports 14 robots.txt syntax errors.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/probe.json",
        "evidence/lighthouse.json"
      ],
      "findingIds": [
        "F-INDEXING"
      ]
    },
    {
      "principleId": "be-discoverable",
      "checkId": "structured-and-shareable-metadata",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "DOM inspection found no canonical/description and no Open Graph, Twitter Card, or JSON-LD metadata despite presenting a product/organization gateway.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/dom.json",
        "evidence/probe.json"
      ],
      "findingIds": [
        "F-SHARE"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "checkId": "secure-transport-and-headers",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "Headers evidence reports no CSP, HSTS, or X-Content-Type-Options. Both _ga cookies are not Secure, use SameSite=None, and persist for 400 days.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/headers.json",
        "evidence/cookies.json"
      ],
      "findingIds": [
        "F-TRANSPORT"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "checkId": "data-minimisation-and-third-parties",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "Tracker/HAR evidence shows Google Tag Manager and Google Analytics on load, 166,677 third-party bytes, an immediate page_view, and two 400-day analytics cookies.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/trackers.json",
        "evidence/network-summary.json",
        "evidence/cookies.json"
      ],
      "findingIds": [
        "F-PRIVACY"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "checkId": "in-context-permissions-and-modern-auth",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "This rendered informational gateway requests no permissions and exposes no sign-in or authentication flow to assess for passkeys.",
      "reason": "This rendered informational gateway requests no permissions and exposes no sign-in or authentication flow to assess for passkeys.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "checkId": "defensive-browser-policies",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "Headers evidence reports no frame-ancestors/X-Frame-Options, Referrer-Policy, or Permissions-Policy in addition to the missing CSP/HSTS.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/headers.json"
      ],
      "findingIds": [
        "F-POLICIES"
      ]
    },
    {
      "principleId": "be-resilient",
      "checkId": "progressive-enhancement",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "The raw response is 478 bytes with only one content token; discoverability reports 0% content coverage and the crawler/no-JS screenshot is blank, while the rendered page contains 214 text characters.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/discoverability.json",
        "evidence/discoverability-crawler.png",
        "evidence/dom.json"
      ],
      "findingIds": [
        "F-PROGRESSIVE"
      ]
    },
    {
      "principleId": "be-resilient",
      "checkId": "resilient-runtime-behaviour",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "The static card has no overlays or asynchronous in-page state; DOM and mobile layout show no clipping or runtime instability.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/dom.json",
        "evidence/layout-mobile.json"
      ]
    },
    {
      "principleId": "be-resilient",
      "checkId": "offline-and-installable",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "This is a small outbound gateway rather than an app with offline user work; installability is not proportionate.",
      "reason": "This is a small outbound gateway rather than an app with offline user work; installability is not proportionate.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "be-resilient",
      "checkId": "network-and-http-failure-states",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "The tested /does-not-exist route renders “An error occured” and no retry/home/back action; it also appears within the same client shell.",
      "pathIds": [
        "error"
      ],
      "artifacts": [
        "evidence/not-found.json",
        "evidence/not-found.png"
      ],
      "findingIds": [
        "F-HTTP-STATE"
      ]
    },
    {
      "principleId": "be-internationalised",
      "checkId": "lang-dir-and-logical-properties",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "The document declares lang=en; its centered flex layout does not depend on left-to-right ordering despite compiled physical utility declarations.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/probe.json",
        "evidence/dom.json"
      ]
    },
    {
      "principleId": "be-internationalised",
      "checkId": "locale-aware-data",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "The page contains no dates, numbers, currency, durations, or other locale-sensitive data.",
      "reason": "The page contains no dates, numbers, currency, durations, or other locale-sensitive data.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "be-internationalised",
      "checkId": "time-zone-correctness",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "The page contains no times or events.",
      "reason": "The page contains no times or events.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "be-trustworthy",
      "checkId": "no-dark-patterns",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "The page shows two straightforward destinations and plainly labeled legal links, with no consent wall, forced continuity, pricing concealment, or confirmshaming.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/desktop.png",
        "evidence/dom.json"
      ]
    },
    {
      "principleId": "be-trustworthy",
      "checkId": "humane-error-handling",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "There is no user-input form on the audited gateway.",
      "reason": "There is no user-input form on the audited gateway.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "be-trustworthy",
      "checkId": "trustworthy-input-assistance",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "There are no input fields on the audited gateway.",
      "reason": "There are no input fields on the audited gateway.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "be-trustworthy",
      "checkId": "safe-commercial-and-account-flows",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "No checkout, subscription, consent, authentication, or account-management flow is exposed on this page.",
      "reason": "No checkout, subscription, consent, authentication, or account-management flow is exposed on this page.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "be-sustainable",
      "checkId": "optimised-assets",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "There are no img, video, canvas, or decorative raster-image assets to optimise.",
      "reason": "There are no img, video, canvas, or decorative raster-image assets to optimise.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "be-sustainable",
      "checkId": "no-wasteful-work",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "HAR transfers 729,513 bytes and Lighthouse identifies 504 KiB of unused JavaScript for a 32-element, one-card page.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/network-summary.json",
        "evidence/lighthouse.json"
      ],
      "findingIds": [
        "F-WASTE"
      ]
    },
    {
      "principleId": "be-sustainable",
      "checkId": "third-party-and-media-budget",
      "status": "issues",
      "confidence": "high",
      "method": "Direct browser evidence and guidance-backed review",
      "evidence": "Google Tag Manager transfers 166,677 bytes, about 23% of the 729,513-byte load, and triggers Analytics on this simple gateway.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/network-summary.json",
        "evidence/trackers.json"
      ],
      "findingIds": [
        "F-THIRDPARTY"
      ]
    },
    {
      "principleId": "be-agent-ready",
      "checkId": "structured-agent-capabilities",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "This 22-token outbound gateway has no meaningful transactional or content capability to expose as an agent tool.",
      "reason": "This 22-token outbound gateway has no meaningful transactional or content capability to expose as an agent tool.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "be-agent-ready",
      "checkId": "on-device-inference",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "The page has no inference use case; reporting the browser API’s presence is not evidence that the site uses it.",
      "reason": "The page has no inference use case; reporting the browser API’s presence is not evidence that the site uses it.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "be-memory-efficient",
      "checkId": "no-leak-under-repeated-interaction",
      "status": "not-applicable",
      "confidence": "high",
      "method": "Recon, DOM and interaction-surface applicability review",
      "evidence": "The page is a static gateway whose only actions navigate away; there is no real repeatable in-page interaction to exercise ten times.",
      "reason": "The page is a static gateway whose only actions navigate away; there is no real repeatable in-page interaction to exercise ten times.",
      "pathIds": [
        "entry"
      ]
    },
    {
      "principleId": "be-memory-efficient",
      "checkId": "bounded-footprint",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "The single-state heap is 8.8MB self size and the probe sees only 32 live DOM elements with about 8.8MB used JS heap, proportionate for this page.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/heap.json",
        "evidence/probe.json"
      ]
    },
    {
      "principleId": "be-memory-efficient",
      "checkId": "no-detached-dom-or-unbounded-listeners",
      "status": "pass",
      "confidence": "high",
      "method": "Direct screenshot, DOM, Lighthouse, or targeted browser probe",
      "evidence": "The heap summary’s largest constructors contain no Detached* population; the 32-element static DOM has no recurring in-page interaction, timers, or observer behavior evident.",
      "pathIds": [
        "entry"
      ],
      "artifacts": [
        "evidence/heap.json",
        "evidence/probe.json"
      ]
    }
  ],
  "principleOutcomes": [
    {
      "principleId": "respect-user-preferences",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F-COLOR"
      ]
    },
    {
      "principleId": "implement-natural-interactions",
      "expectation": "default",
      "status": "pass",
      "findingIds": []
    },
    {
      "principleId": "provide-guided-navigation",
      "expectation": "default",
      "status": "pass",
      "findingIds": []
    },
    {
      "principleId": "maximize-content-reduce-noise",
      "expectation": "default",
      "status": "pass",
      "findingIds": []
    },
    {
      "principleId": "adapt-to-the-form-factor",
      "expectation": "default",
      "status": "pass",
      "findingIds": []
    },
    {
      "principleId": "support-core-task-success",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F-PURPOSE",
        "F-RECOVERY"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F-CWV",
        "F-DELIVERY",
        "F-UNUSED"
      ]
    },
    {
      "principleId": "be-inclusive",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F-STRUCTURE"
      ]
    },
    {
      "principleId": "follow-best-practices",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F-STRUCTURE",
        "F-SOURCEMAP"
      ]
    },
    {
      "principleId": "be-discoverable",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F-SEO-META",
        "F-CRAWL",
        "F-INDEXING",
        "F-SHARE"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F-TRANSPORT",
        "F-PRIVACY",
        "F-POLICIES"
      ]
    },
    {
      "principleId": "be-resilient",
      "expectation": "contextual",
      "status": "issues",
      "findingIds": [
        "F-PROGRESSIVE",
        "F-HTTP-STATE"
      ]
    },
    {
      "principleId": "be-internationalised",
      "expectation": "contextual",
      "status": "pass",
      "findingIds": []
    },
    {
      "principleId": "be-trustworthy",
      "expectation": "default",
      "status": "pass",
      "findingIds": []
    },
    {
      "principleId": "be-sustainable",
      "expectation": "contextual",
      "status": "issues",
      "findingIds": [
        "F-WASTE",
        "F-THIRDPARTY"
      ]
    },
    {
      "principleId": "be-agent-ready",
      "expectation": "contextual",
      "status": "not-applicable",
      "findingIds": [],
      "reason": "This lightweight outbound gateway has no agent-facing capability or inference use case to assess."
    },
    {
      "principleId": "be-memory-efficient",
      "expectation": "default",
      "status": "pass",
      "findingIds": []
    }
  ],
  "paths": [
    {
      "id": "entry",
      "description": "Public gateway entry page, the site’s only visible content template and outbound-action journey. Covered desktop/mobile, preference media, keyboard/focus, no-JS, performance, network, security and memory conditions. External platoboost.app destinations were excluded because they are different-site surfaces outside this host audit.",
      "url": "https://auth.platorelay.com/",
      "conditions": [
        "desktop 1440x1000",
        "mobile 360x800",
        "prefers-color-scheme: dark",
        "prefers-reduced-motion: reduce",
        "prefers-contrast: more / forced-colors",
        "JavaScript disabled",
        "keyboard focus",
        "Lighthouse mobile simulation"
      ],
      "result": "issues"
    },
    {
      "id": "error",
      "description": "Representative unknown-route/error state at /does-not-exist to assess system-state clarity and recovery. No authenticated/account flow exists on the rendered host, so none could be covered.",
      "url": "https://auth.platorelay.com/does-not-exist",
      "conditions": [
        "mobile 360x800"
      ],
      "result": "issues"
    }
  ],
  "findings": [
    {
      "id": "F-COLOR",
      "severity": "medium",
      "confidence": "high",
      "summary": "The gateway forces one dark palette instead of following the user’s color-scheme preference.",
      "evidence": "Default and prefers-color-scheme: dark screenshots are byte-identical; the DOM probe reports color-scheme: normal and no prefers-color-scheme rule.",
      "suggestedFix": "Declare color-scheme: light dark and define preference-driven light and dark surface/text tokens with prefers-color-scheme or light-dark().",
      "principleId": "respect-user-preferences",
      "principleCheckId": "respects-color-scheme",
      "guidanceId": "dark-mode",
      "guidanceCategory": "user-experience",
      "artifacts": [
        "evidence/desktop.png",
        "evidence/dark.png"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-PURPOSE",
      "severity": "low",
      "confidence": "high",
      "summary": "The first-view copy weakens clarity and credibility.",
      "evidence": "Desktop/mobile screenshots show an unexplained “Gateway”, mixed Plato/Platoboost naming, and the typo “check out or website”.",
      "suggestedFix": "Use one product name, explain why the user landed on this gateway, and correct the copy to “check out our website”.",
      "principleId": "support-core-task-success",
      "principleCheckId": "clear-purpose-and-primary-action",
      "guidanceId": "accessibility",
      "guidanceCategory": "accessibility",
      "artifacts": [
        "evidence/desktop.png",
        "evidence/mobile.png"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-RECOVERY",
      "severity": "medium",
      "confidence": "high",
      "summary": "The not-found state does not provide a recovery action.",
      "evidence": "The /does-not-exist probe and screenshot show “An error occured”, technical detail/copy affordance, and legal links, but no retry, home, back, or primary destination.",
      "suggestedFix": "Give the state a clear 404 title, plain-language explanation, and prominent Home/Back/Retry actions while preserving context.",
      "principleId": "support-core-task-success",
      "principleCheckId": "clear-system-state-and-recovery",
      "guidanceId": "persistent-toast-notifications",
      "guidanceCategory": "user-experience",
      "artifacts": [
        "evidence/not-found.json",
        "evidence/not-found.png"
      ],
      "effort": "small",
      "pathId": "error",
      "url": "https://auth.platorelay.com/does-not-exist"
    },
    {
      "id": "F-CWV",
      "severity": "medium",
      "confidence": "high",
      "summary": "The tiny gateway paints too slowly under Lighthouse mobile conditions.",
      "evidence": "Lighthouse measured FCP and LCP at 3.6 s (performance 0.82), outside the good LCP threshold; the less-throttled trace measured 1.43 s and no blocking, so network/resource delivery is the main risk.",
      "suggestedFix": "Server-render the first viewport and remove non-critical JavaScript from the critical path; keep the LCP text in initial HTML.",
      "principleId": "be-fast-and-stable",
      "principleCheckId": "good-core-web-vitals",
      "guidanceId": "performance",
      "guidanceCategory": "performance",
      "artifacts": [
        "evidence/lighthouse.json",
        "evidence/load-trace-summary.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-DELIVERY",
      "severity": "medium",
      "confidence": "high",
      "summary": "Critical delivery is oversized and hashed assets have short cache lifetimes.",
      "evidence": "HAR records 729,513 transferred bytes for six requests, including 554,908 bytes of first-party JS; Lighthouse estimates 411 KiB repeat-visit savings from longer caching. The module script is deferred by type=module, while the 5.8 KiB stylesheet is genuinely render blocking.",
      "suggestedFix": "Ship initial HTML, split the gateway bundle, and give content-hashed JS/CSS long immutable cache lifetimes.",
      "principleId": "be-fast-and-stable",
      "principleCheckId": "efficient-resource-delivery",
      "guidanceId": "optimize-script-priority",
      "guidanceCategory": "performance",
      "artifacts": [
        "evidence/network.har",
        "evidence/network-summary.json",
        "evidence/lighthouse.json"
      ],
      "effort": "medium",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-UNUSED",
      "severity": "medium",
      "confidence": "high",
      "summary": "Most JavaScript shipped to this simple page is unused.",
      "evidence": "Lighthouse reports 504 KiB potential savings: 448,564 bytes unused in the first-party bundle (80.9%) and 67,808 bytes unused in gtag.",
      "suggestedFix": "Create a gateway-specific entry bundle, tree-shake unused application code, and defer/load analytics only after an appropriate consent and need decision.",
      "principleId": "be-fast-and-stable",
      "principleCheckId": "trim-unused-and-duplicate-code",
      "guidanceId": "identify-heavy-scripts",
      "guidanceCategory": "performance",
      "artifacts": [
        "evidence/lighthouse.json",
        "evidence/network-summary.json"
      ],
      "effort": "medium",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-STRUCTURE",
      "severity": "medium",
      "confidence": "high",
      "summary": "The document has an illogical heading and landmark structure.",
      "evidence": "The DOM/probe shows two nested <main> elements, no H1, an empty H3 for the icon, and the visible title as another H3.",
      "suggestedFix": "Use one <main>, make “Welcome to the Gateway” the H1, and mark the decorative icon aria-hidden rather than representing it as an empty heading.",
      "principleId": "be-inclusive",
      "principleCheckId": "structure-and-focus",
      "guidanceId": "accessibility",
      "guidanceCategory": "accessibility",
      "artifacts": [
        "evidence/dom.json",
        "evidence/probe.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-SOURCEMAP",
      "severity": "low",
      "confidence": "high",
      "summary": "The large first-party JavaScript bundle has no valid source map.",
      "evidence": "Lighthouse best-practices diagnostics report “Large JavaScript file is missing a source map” for index-d2eb3afb.js.",
      "suggestedFix": "Generate and deploy a matching production source map, or intentionally upload it to the error-monitoring service while configuring deployment diagnostics accordingly.",
      "principleId": "follow-best-practices",
      "principleCheckId": "browser-platform-hygiene",
      "guidanceId": "html",
      "guidanceCategory": "html",
      "artifacts": [
        "evidence/lighthouse.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-SEO-META",
      "severity": "medium",
      "confidence": "high",
      "summary": "The page lacks a meta description and its title is only a brand name.",
      "evidence": "DOM and Lighthouse show title “Platoboost” and no meta[name=description]; Lighthouse SEO score is 0.82.",
      "suggestedFix": "Use a descriptive title such as “Platoboost creator monetization gateway” and add a concise description matching visible content.",
      "principleId": "be-discoverable",
      "principleCheckId": "title-and-description",
      "guidanceId": "html",
      "guidanceCategory": "html",
      "artifacts": [
        "evidence/dom.json",
        "evidence/probe.json",
        "evidence/lighthouse.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-CRAWL",
      "severity": "high",
      "confidence": "high",
      "summary": "Core content and primary destinations disappear for non-JavaScript crawlers.",
      "evidence": "Discoverability reports 0% rendered-word coverage and a blank crawler screenshot. Primary actions are <button> elements with no href, while only legal links are crawlable anchors.",
      "suggestedFix": "Render the gateway content in server HTML and implement destination actions as descriptive <a href> links, enhancing them with JavaScript only when needed.",
      "principleId": "be-discoverable",
      "principleCheckId": "crawlable-and-mobile-friendly",
      "guidanceId": "html",
      "guidanceCategory": "html",
      "artifacts": [
        "evidence/discoverability.json",
        "evidence/discoverability-rendered.png",
        "evidence/discoverability-crawler.png",
        "evidence/probe.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-INDEXING",
      "severity": "medium",
      "confidence": "high",
      "summary": "Indexing signals are incomplete and robots/sitemap endpoints serve the app shell.",
      "evidence": "The page has no canonical URL; /robots.txt and /sitemap.xml both return status 200 with the 478-byte HTML shell. Lighthouse reports 14 robots.txt syntax errors.",
      "suggestedFix": "Serve valid text/plain robots.txt and XML sitemap responses, add a self-referencing canonical, and align indexing policy with this public gateway.",
      "principleId": "be-discoverable",
      "principleCheckId": "canonical-and-indexing-signals",
      "guidanceId": "html",
      "guidanceCategory": "html",
      "artifacts": [
        "evidence/probe.json",
        "evidence/lighthouse.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-SHARE",
      "severity": "low",
      "confidence": "high",
      "summary": "The gateway has no social preview or structured entity metadata.",
      "evidence": "DOM inspection found no canonical/description and no Open Graph, Twitter Card, or JSON-LD metadata despite presenting a product/organization gateway.",
      "suggestedFix": "Add accurate Open Graph/Twitter metadata and minimal Organization or SoftwareApplication JSON-LD that matches the visible page.",
      "principleId": "be-discoverable",
      "principleCheckId": "structured-and-shareable-metadata",
      "guidanceId": "html",
      "guidanceCategory": "html",
      "artifacts": [
        "evidence/dom.json",
        "evidence/probe.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-TRANSPORT",
      "severity": "high",
      "confidence": "high",
      "summary": "Transport is HTTPS, but baseline XSS/header protection and cookie flags are missing.",
      "evidence": "Headers evidence reports no CSP, HSTS, or X-Content-Type-Options. Both _ga cookies are not Secure, use SameSite=None, and persist for 400 days.",
      "suggestedFix": "Add HSTS, a restrictive nonce/hash-based CSP, nosniff, and set analytics cookies Secure with an appropriate SameSite policy and shorter retention.",
      "principleId": "be-private-and-secure",
      "principleCheckId": "secure-transport-and-headers",
      "guidanceId": "security",
      "guidanceCategory": "security",
      "artifacts": [
        "evidence/headers.json",
        "evidence/cookies.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-PRIVACY",
      "severity": "medium",
      "confidence": "high",
      "summary": "Google tracking runs immediately on a one-screen gateway.",
      "evidence": "Tracker/HAR evidence shows Google Tag Manager and Google Analytics on load, 166,677 third-party bytes, an immediate page_view, and two 400-day analytics cookies.",
      "suggestedFix": "Decide whether analytics is necessary here; if retained, load a minimal privacy-preserving setup after valid consent, minimise fields/retention, and batch events.",
      "principleId": "be-private-and-secure",
      "principleCheckId": "data-minimisation-and-third-parties",
      "guidanceId": "privacy",
      "guidanceCategory": "privacy",
      "artifacts": [
        "evidence/trackers.json",
        "evidence/network-summary.json",
        "evidence/cookies.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-POLICIES",
      "severity": "high",
      "confidence": "high",
      "summary": "Browser-enforced framing, referrer, and permission defenses are absent.",
      "evidence": "Headers evidence reports no frame-ancestors/X-Frame-Options, Referrer-Policy, or Permissions-Policy in addition to the missing CSP/HSTS.",
      "suggestedFix": "Set CSP frame-ancestors, Referrer-Policy, and a least-privilege Permissions-Policy; use X-Frame-Options as a legacy fallback where appropriate.",
      "principleId": "be-private-and-secure",
      "principleCheckId": "defensive-browser-policies",
      "guidanceId": "security",
      "guidanceCategory": "security",
      "artifacts": [
        "evidence/headers.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-PROGRESSIVE",
      "severity": "high",
      "confidence": "high",
      "summary": "The gateway is a client-rendered shell with no usable no-JavaScript fallback.",
      "evidence": "The raw response is 478 bytes with only one content token; discoverability reports 0% content coverage and the crawler/no-JS screenshot is blank, while the rendered page contains 214 text characters.",
      "suggestedFix": "Server-render or statically emit the heading, explanation, destination links, and legal links; layer client behavior on top.",
      "principleId": "be-resilient",
      "principleCheckId": "progressive-enhancement",
      "guidanceId": "flicker-free-client-side-ab-testing",
      "guidanceCategory": "performance",
      "artifacts": [
        "evidence/discoverability.json",
        "evidence/discoverability-crawler.png",
        "evidence/dom.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-HTTP-STATE",
      "severity": "medium",
      "confidence": "high",
      "summary": "Unknown routes render a generic error without useful recovery.",
      "evidence": "The tested /does-not-exist route renders “An error occured” and no retry/home/back action; it also appears within the same client shell.",
      "suggestedFix": "Return an intentional HTTP 404 page with a clear message, recovery links, and a server-rendered fallback.",
      "principleId": "be-resilient",
      "principleCheckId": "network-and-http-failure-states",
      "guidanceId": "persistent-toast-notifications",
      "guidanceCategory": "user-experience",
      "artifacts": [
        "evidence/not-found.json",
        "evidence/not-found.png"
      ],
      "effort": "small",
      "pathId": "error",
      "url": "https://auth.platorelay.com/does-not-exist"
    },
    {
      "id": "F-WASTE",
      "severity": "medium",
      "confidence": "high",
      "summary": "The resource footprint is disproportionate to 22 rendered content tokens.",
      "evidence": "HAR transfers 729,513 bytes and Lighthouse identifies 504 KiB of unused JavaScript for a 32-element, one-card page.",
      "suggestedFix": "Replace the shared application bundle with static HTML/CSS and a tiny optional module for only the interactions this gateway needs.",
      "principleId": "be-sustainable",
      "principleCheckId": "no-wasteful-work",
      "guidanceId": "efficient-background-processing",
      "guidanceCategory": "performance",
      "artifacts": [
        "evidence/network-summary.json",
        "evidence/lighthouse.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    },
    {
      "id": "F-THIRDPARTY",
      "severity": "medium",
      "confidence": "high",
      "summary": "Analytics accounts for a large share of page weight without visible user value.",
      "evidence": "Google Tag Manager transfers 166,677 bytes, about 23% of the 729,513-byte load, and triggers Analytics on this simple gateway.",
      "suggestedFix": "Remove analytics from the gateway or defer a smaller privacy-preserving measurement path until needed and consented.",
      "principleId": "be-sustainable",
      "principleCheckId": "third-party-and-media-budget",
      "guidanceId": "deprioritize-background-fetches",
      "guidanceCategory": "performance",
      "artifacts": [
        "evidence/network-summary.json",
        "evidence/trackers.json"
      ],
      "effort": "small",
      "pathId": "entry",
      "url": "https://auth.platorelay.com/"
    }
  ],
  "taskList": [
    {
      "id": "T1",
      "title": "Render meaningful HTML and crawlable primary links",
      "priority": 1,
      "findingIds": [
        "F-CRAWL",
        "F-PROGRESSIVE",
        "F-CWV"
      ],
      "guidanceId": "html",
      "status": "open"
    },
    {
      "id": "T2",
      "title": "Remove the oversized shared bundle and defer analytics",
      "priority": 2,
      "findingIds": [
        "F-UNUSED",
        "F-WASTE",
        "F-THIRDPARTY",
        "F-DELIVERY"
      ],
      "guidanceId": "identify-heavy-scripts",
      "status": "open"
    },
    {
      "id": "T3",
      "title": "Add CSP, HSTS and defensive browser policies",
      "priority": 3,
      "findingIds": [
        "F-TRANSPORT",
        "F-POLICIES"
      ],
      "guidanceId": "security",
      "status": "open"
    },
    {
      "id": "T4",
      "title": "Minimise analytics and correct cookie security/retention",
      "priority": 4,
      "findingIds": [
        "F-PRIVACY",
        "F-TRANSPORT"
      ],
      "guidanceId": "privacy",
      "status": "open"
    },
    {
      "id": "T5",
      "title": "Fix title, description, robots, sitemap, canonical and share metadata",
      "priority": 5,
      "findingIds": [
        "F-SEO-META",
        "F-INDEXING",
        "F-SHARE"
      ],
      "guidanceId": "html",
      "status": "open"
    },
    {
      "id": "T6",
      "title": "Use one main landmark and a real H1",
      "priority": 6,
      "findingIds": [
        "F-STRUCTURE"
      ],
      "guidanceId": "accessibility",
      "status": "open"
    },
    {
      "id": "T7",
      "title": "Add a useful server-rendered 404 recovery state",
      "priority": 7,
      "findingIds": [
        "F-RECOVERY",
        "F-HTTP-STATE"
      ],
      "guidanceId": "persistent-toast-notifications",
      "status": "open"
    },
    {
      "id": "T8",
      "title": "Respect the user color-scheme preference",
      "priority": 8,
      "findingIds": [
        "F-COLOR"
      ],
      "guidanceId": "dark-mode",
      "status": "open"
    },
    {
      "id": "T9",
      "title": "Clarify and proofread the gateway copy",
      "priority": 9,
      "findingIds": [
        "F-PURPOSE"
      ],
      "guidanceId": "accessibility",
      "status": "open"
    },
    {
      "id": "T10",
      "title": "Publish production source maps",
      "priority": 10,
      "findingIds": [
        "F-SOURCEMAP"
      ],
      "guidanceId": "html",
      "status": "open"
    }
  ],
  "budget": {
    "pathCount": 2,
    "auditPasses": 1
  },
  "agent": "pi",
  "runId": "2026-07-22T00-37-35-594Z"
}
