{ "url": "https://www.theblowers.com", "auditedAt": "2026-07-28T07:13:32.000Z", "mode": "report", "status": "blocked", "statusDetail": "Atomic audit stopped at recon as required: A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "page": { "appType": "unknown", "framework": "unknown", "notes": "The only rendered surface was Cloudflare challenge infrastructure. Sitemap indicates a multi-route, multilingual site with home, ads, map, signup, login, contact, partners, blog, security, and city-listing archetypes." }, "evidenceUsed": [ "raw-CDP screenshot", "raw-CDP DOM", "raw-CDP evaluate probe", "layout metrics", "discoverability raw-fetch/no-JS comparison", "HTTP route probes", "headers", "cookies", "trackers", "images", "secrets", "Modern Web Guidance 0.0.172" ], "guidanceConsulted": [ "accessibility", "accessible-error-announcement", "adapt-scrollbar-to-contrast-preferences", "agentic-forms", "anchor-positioning-tab-underline", "animate-to-intrinsic-sizes", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "brand-consistent-forms", "branded-select-styling", "break-up-long-tasks", "calculate-with-intrinsic-sizes", "capture-location-agnostic-data", "complex-shapes", "coordinate-global-events", "css", "dark-mode", "declarative-button-actions", "declarative-dialog-popover-control", "deliver-optimized-decorative-images", "deprioritize-background-fetches", "directional-navigation-transitions", "faster-spa-view-transitions", "flicker-free-client-side-ab-testing", "fluid-scaling", "forms", "full-session-analytics", "highlight-text-ranges", "html", "identify-heavy-scripts", "identify-inp-causes", "improve-text-layout-and-legibility", "interactive-content-reveal", "interest-triggered-action-previews", "interest-triggered-tooltips", "language-model", "light-dismiss-a-dialog", "manage-recurring-intervals", "move-dom-element-without-losing-state", "optimize-image-priority", "passkey-conditional-create", "passkey-management", "passkeys", "performance", "persistent-toast-notifications", "physics-based-easing", "privacy", "resilient-context-menus-and-nested-dropdowns", "same-document-transitions", "scrollytelling", "search-hidden-content", "security", "shrinking-header-on-scroll", "size-aware-styling", "stack-drill-down", "summarizer", "support-global-calendar-systems", "translator", "validate-input-after-interaction", "visually-stable-font-fallbacks", "webmcp" ], "artifacts": [ { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "Desktop capture showing the Cloudflare managed challenge instead of site content." }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "360x800 capture showing the Cloudflare managed challenge instead of site content.", "condition": "viewport: 360x800" }, { "type": "screenshot", "path": "evidence/home-after-20s.png", "caption": "Challenge remained after a 20-second wait." }, { "type": "screenshot", "path": "evidence/home-discoverability-rendered.png", "caption": "Browser-rendered view of the Cloudflare challenge." }, { "type": "screenshot", "path": "evidence/home-discoverability-crawler.png", "caption": "No-JavaScript crawler view of the 403 Cloudflare challenge." }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "Rendered DOM is Cloudflare challenge markup; title is “Just a moment...”." }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "Layout metrics for the challenge response, not the target application.", "condition": "viewport: 360x800" }, { "type": "discoverability", "path": "evidence/home-discoverability.json", "caption": "Raw fetch returned HTTP 403 and the rendered page remained a challenge." }, { "type": "other", "path": "evidence/home-headers.json", "caption": "Security headers observed on the challenge response." }, { "type": "other", "path": "evidence/home-cookies.json", "caption": "Cookies observed on the challenge response." }, { "type": "other", "path": "evidence/home-trackers.json", "caption": "Third-party origins observed on the challenge response." }, { "type": "other", "path": "evidence/home-images.json", "caption": "Image inventory for the challenge response." }, { "type": "other", "path": "evidence/home-secrets.json", "caption": "Secret scan of the challenge response." }, { "type": "other", "path": "evidence/challenge-after-20s.json", "caption": "Evaluation after 20 seconds confirms security-verification text and no site links." }, { "type": "other", "path": "evidence/en-route-attempt.json", "caption": "Representative locale/home route remained blocked by the challenge." }, { "type": "other", "path": "evidence/blog-route-attempt.json", "caption": "Representative content route remained blocked by the challenge." }, { "type": "other", "path": "evidence/contact-route-attempt.json", "caption": "Representative form route remained blocked by the challenge." }, { "type": "other", "path": "evidence/http-route-probes.txt", "caption": "HTTP probes show site routes challenged; robots.txt and sitemap.xml remain reachable." }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots.txt allows crawling and names the sitemap." }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "Sitemap used to discover representative route archetypes." } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 0, "blocked": 58, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": false }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "blocked", "confidence": "high", "method": "Attempted a screenshot or computed background under an emulated prefers-color-scheme: dark condition will reveal whether surfaces re-tint; the page CSS / a color-scheme declaration is corroborating evidence.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for respect-user-preferences/respects-color-scheme.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "blocked", "confidence": "high", "method": "Attempted a transition video, or an in-page probe of getAnimations()/computed animation under an emulated prefers-reduced-motion: reduce condition, can show whether motion stops.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for respect-user-preferences/respects-reduced-motion.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "blocked", "confidence": "high", "method": "Attempted a screenshot under emulated prefers-contrast: more / forced-colors, or an axe/contrast probe, can show whether controls and text survive.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for respect-user-preferences/respects-contrast.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "blocked", "confidence": "high", "method": "Attempted a transition video of a route/state change shows whether it animates; the page source / ::view-transition usage corroborates.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for implement-natural-interactions/view-transitions.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "blocked", "confidence": "high", "method": "Attempted source/CSS inspection for animation-timeline: scroll()/view(); a long-task / scroll-handler probe can flag the main-thread anti-pattern.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for implement-natural-interactions/scroll-driven-animations.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "blocked", "confidence": "high", "method": "Attempted CSS inspection for scroll-snap / overscroll-behavior / physics-based easing vs custom pointermove listeners.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for implement-natural-interactions/physical-gestures.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "blocked", "confidence": "high", "method": "Attempted a transition video of scrolling, or CSS inspection for scroll-state container queries.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for provide-guided-navigation/scroll-state-aware-chrome.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "blocked", "confidence": "high", "method": "Attempted CSS inspection for anchor-name / position-anchor / position-try on overlays; a screenshot of an open overlay near a viewport edge can show drift.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for provide-guided-navigation/anchored-positioning.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "blocked", "confidence": "high", "method": "Attempted CSS inspection for ::highlight / scroll-marker; a transition video can show whether attention is cued after navigation.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for provide-guided-navigation/directs-attention.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "blocked", "confidence": "high", "method": "Attempted a screenshot on load, or a DOM probe for full-viewport overlays present before interaction.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for maximize-content-reduce-noise/no-intrusive-interruptions.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "blocked", "confidence": "high", "method": "Attempted DOM/source inspection for popover / /
vs custom overlay divs with manual dismiss handling.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for maximize-content-reduce-noise/semantic-dismissible-primitives.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "blocked", "confidence": "high", "method": "Attempted a screenshot plus layout metrics can show the proportion of the viewport given to chrome vs content.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for maximize-content-reduce-noise/reduced-chrome.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "blocked", "confidence": "high", "method": "Attempted layout metrics (scrollWidth vs innerWidth) and a screenshot at an emulated narrow mobile viewport reveal overflow.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for adapt-to-the-form-factor/responsive-no-horizontal-scroll.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "blocked", "confidence": "high", "method": "Attempted CSS inspection for @container / container-type; a computed-style probe of the same component in a wide vs narrow container shows whether it adapts.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for adapt-to-the-form-factor/component-level-responsiveness.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "blocked", "confidence": "high", "method": "Attempted a focus probe (focus an element, read the computed outline) or an axe target-size check; a screenshot of a focused control corroborates.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for adapt-to-the-form-factor/input-modality-aware.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "blocked", "confidence": "high", "method": "Attempted screenshot the first viewport and key scrolled states; inspect heading structure, nav labels, button text, and visual hierarchy; a task walkthrough can show whether the next action is obvious.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for support-core-task-success/clear-purpose-and-primary-action.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "blocked", "confidence": "high", "method": "Attempted run the flow manually with screenshots/DOM snapshots at each step; compare expected vs actual path length; inspect form requirements, navigation continuity, and blockers.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for support-core-task-success/primary-flow-completion.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "blocked", "confidence": "high", "method": "Attempted exercise network delay/failure, invalid input, empty data and success states; screenshot the state messaging and recovery controls; inspect whether browser history and focus remain sensible.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for support-core-task-success/clear-system-state-and-recovery.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "blocked", "confidence": "high", "method": "Attempted Lighthouse reports LCP/CLS/TBT directly and the model may run it; layout metrics + a layout-shift observer + a long-task observer (the evidence primitives) give the same signal first-party.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-fast-and-stable/good-core-web-vitals.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "blocked", "confidence": "high", "method": "Attempted the layout primitive's CLS observer captures shifts; a transition video of the first seconds shows content jumping.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-fast-and-stable/visual-stability.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "blocked", "confidence": "high", "method": "Attempted the layout primitive records long tasks; a heap summary shows the object population; Lighthouse reports TBT.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-fast-and-stable/efficient-main-thread.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "blocked", "confidence": "high", "method": "Attempted a HAR summary can reveal cache headers, redirects, render-blocking candidates, weight offenders and dependency shape; a trace/Lighthouse insight report can corroborate LCP discovery, render-blocking, font-display and document latency.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-fast-and-stable/efficient-resource-delivery.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "blocked", "confidence": "high", "method": "Attempted Lighthouse/trace/code-coverage style evidence can flag unused JS/CSS, duplicated JavaScript and legacy code; a HAR summary shows third-party byte cost and request count.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-fast-and-stable/trim-unused-and-duplicate-code.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "blocked", "confidence": "high", "method": "Attempted axe-core (injectable via the evaluate primitive) or Lighthouse's a11y audits enumerate these; a DOM probe of the accessibility-relevant attributes is a first-party alternative.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-inclusive/names-roles-labels.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "blocked", "confidence": "high", "method": "Attempted axe contrast rules, a Lighthouse contrast audit, or an in-page probe computing contrast ratios from computed colours.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-inclusive/sufficient-contrast.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "blocked", "confidence": "high", "method": "Attempted axe/Lighthouse structural audits; a focus-walk probe (tab through, read activeElement + computed outline) is a first-party alternative.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-inclusive/structure-and-focus.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "blocked", "confidence": "high", "method": "Attempted a screenshot of body and heading text, plus CSS inspection for text-wrap / text alignment / font fallback handling.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-inclusive/legible-text.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "blocked", "confidence": "high", "method": "Attempted Lighthouse/axe target-size, meta-viewport and media-caption audits are useful signals; screenshots at narrow and zoomed conditions plus DOM/media inspection can corroborate.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-inclusive/zoom-reflow-targets-and-media.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "blocked", "confidence": "high", "method": "Attempted capture Runtime/Log CDP events, or a probe that reads collected errors; Lighthouse reports this too.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for follow-best-practices/no-console-errors.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "blocked", "confidence": "high", "method": "Attempted a DOM/source probe for doctype/charset/img dimensions; CSS inspection for repetition; Lighthouse best-practices audits cover the rest.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for follow-best-practices/sound-document-and-assets.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "blocked", "confidence": "high", "method": "Attempted Lighthouse best-practices audits and DevTools inspector/deprecation signals can surface these; DOM/source probes can verify paste handlers and prompt timing.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for follow-best-practices/browser-platform-hygiene.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "blocked", "confidence": "high", "method": "Attempted a DOM probe reads and meta[name=description]; Lighthouse SEO audits cover the same ground.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-discoverable/title-and-description.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "blocked", "confidence": "high", "method": "Attempted a DOM probe for anchor hrefs, viewport meta, and robots; Lighthouse SEO audits corroborate.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-discoverable/crawlable-and-mobile-friendly.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "blocked", "confidence": "high", "method": "Attempted inspect response status and headers, <link rel=canonical>, hreflang links, robots meta, robots.txt and sitemap.xml; Lighthouse SEO audits cover several of these.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-discoverable/canonical-and-indexing-signals.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "blocked", "confidence": "high", "method": "Attempted inspect JSON-LD/microdata and social preview tags against visible content; Lighthouse has a manual structured-data audit, and ad-hoc probes can parse schema.org blocks.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-discoverable/structured-and-shareable-metadata.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "blocked", "confidence": "high", "method": "Attempted inspect response headers / page protocol via an evaluate probe or the network layer; Lighthouse best-practices flags HTTPS and CSP issues.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-private-and-secure/secure-transport-and-headers.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "blocked", "confidence": "high", "method": "Attempted inspect network requests and third-party origins; a probe of analytics/beacon calls.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-private-and-secure/data-minimisation-and-third-parties.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "blocked", "confidence": "high", "method": "Attempted a probe for permission requests fired on load; source inspection for passkey / WebAuthn / navigator.credentials usage in auth flows.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-private-and-secure/in-context-permissions-and-modern-auth.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "blocked", "confidence": "high", "method": "Attempted inspect response headers and browser security state; Lighthouse/DevTools security audits can corroborate HSTS, clickjacking, Trusted Types, origin isolation and third-party cookie findings.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-private-and-secure/defensive-browser-policies.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "blocked", "confidence": "high", "method": "Attempted load with scripting disabled or compare a no-JS fetch of the HTML against the rendered page; check for Baseline-aware fallbacks in source.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-resilient/progressive-enhancement.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "blocked", "confidence": "high", "method": "Attempted exercise menus near viewport edges with a screenshot; a probe of async/visibility behaviour.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-resilient/resilient-runtime-behaviour.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "blocked", "confidence": "high", "method": "Attempted a probe for a service worker registration and a web app manifest; test behaviour offline.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-resilient/offline-and-installable.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "blocked", "confidence": "high", "method": "Attempted simulate failed fetches/offline mode or inspect representative 404/500 routes; screenshots and DOM snapshots of error/loading/empty states show whether recovery is possible.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-resilient/network-and-http-failure-states.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "blocked", "confidence": "high", "method": "Attempted a DOM probe for <html lang>/dir and CSS inspection for logical vs physical properties.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-internationalised/lang-dir-and-logical-properties.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "blocked", "confidence": "high", "method": "Attempted source inspection for Intl.* usage vs hand-rolled formatting; a probe of rendered dates/numbers under a different locale.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-internationalised/locale-aware-data.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "blocked", "confidence": "high", "method": "Attempted source inspection for time-zone-aware date handling vs naive local Date math.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-internationalised/time-zone-correctness.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "blocked", "confidence": "high", "method": "Attempted a screenshot of consent/upsell/cancel flows; source inspection for declarative button actions vs misleading controls.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-trustworthy/no-dark-patterns.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "blocked", "confidence": "high", "method": "Attempted exercise a form, submit invalid input, and observe timing and clarity of errors via a screenshot or a :user-invalid / aria-invalid probe.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-trustworthy/humane-error-handling.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "blocked", "confidence": "high", "method": "Attempted source/DOM inspection for autocomplete attributes on form fields; a probe of autofill affordances.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-trustworthy/trustworthy-input-assistance.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "blocked", "confidence": "high", "method": "Attempted walkthrough checkout/subscription/auth/account flows when present; screenshot pricing, confirmation, cancellation and reauthentication states; inspect passkey/autocomplete support for sign-in and payment.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-trustworthy/safe-commercial-and-account-flows.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "blocked", "confidence": "high", "method": "Attempted inspect transferred image bytes vs displayed size; source inspection for modern formats and resolution handling.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-sustainable/optimised-assets.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "blocked", "confidence": "high", "method": "Attempted a long-task / network probe for background fetches and processing while idle or backgrounded.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-sustainable/no-wasteful-work.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "blocked", "confidence": "high", "method": "Attempted a HAR summary shows third-party bytes, font/media weight and caching; screenshots/video reveal autoplay and decorative media; trace/layout evidence shows whether media/animation keeps work running.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-sustainable/third-party-and-media-budget.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "blocked", "confidence": "high", "method": "Attempted source inspection for WebMCP / agentic-tool registration and agent-readable affordances.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-agent-ready/structured-agent-capabilities.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "blocked", "confidence": "high", "method": "Attempted source inspection for built-in AI (language model / summariser) usage.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-agent-ready/on-device-inference.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "blocked", "confidence": "high", "method": "Attempted compare heap snapshots for retained growth - a baseline, then one taken after repeating the interaction with `--interact` about 10x (the memory-tracer methodology: baseline -> repeat -> post -> compare). Performance.getMetrics (JSHeapUsedSize, Nodes) across the same before/after window is corroboration. If Chrome DevTools MCP is available, follow its memory-leak-debugging skill: capture baseline, target, and final snapshots, then use memlab or the provided comparison workflow rather than reading raw .heapsnapshot files directly. The package-native `heap` primitive remains the default path. This check is only meaningful where the page has a real interaction to repeat; for a static page with none, mark it not-applicable with a rationale rather than fabricating one.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-memory-efficient/no-leak-under-repeated-interaction.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "blocked", "confidence": "high", "method": "Attempted a single `heap` summary's totals (nodeCount, totalSelfSizeBytes, constructor population) plus Performance.getMetrics (Nodes, JSHeapUsedSize) give the current footprint to judge against the page's purpose. Chrome DevTools MCP heap snapshots and memlab snapshot analysis can provide the same memory distribution when available. Read summaries or derived analysis, never raw snapshots unless a dedicated heap-analysis tool is doing the analysis.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-memory-efficient/bounded-footprint.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "blocked", "confidence": "high", "method": "Attempted the `heap` summary by constructor (Detached* nodes) compared across a before/after pair shows a growing detached-DOM population; an `evaluate` probe can sample listener/timer counts (e.g. getEventListeners-style counting, or instrumenting addEventListener/setInterval) before and after the repeated interaction to spot growth. Chrome DevTools MCP heap snapshots plus the memory-leak-debugging skill's common-leak guidance can corroborate detached DOM, listeners, closures, globals, and unbounded caches. Caveat from the memory-tracer and Chrome DevTools MCP guidance: detached nodes can be intentional caches, so judge confidence rather than asserting a bug.; navigated the homepage and sitemap-discovered representative routes with raw-CDP Chrome, plus direct HTTP probes where relevant.", "evidence": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed. This prevented target-site evidence for be-memory-efficient/no-detached-dom-or-unbounded-listeners.", "reason": "A Cloudflare managed bot challenge returned HTTP 403 and remained on “Performing security verification” after a 20-second CDP browser wait; the target application content and controls were never exposed.", "pathIds": [ "homepage", "locale-home", "blog", "contact" ], "artifacts": [ "evidence/home-after-20s.png", "evidence/challenge-after-20s.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "incomplete", "reason": "All 3 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "incomplete", "reason": "All 3 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "incomplete", "reason": "All 3 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "incomplete", "reason": "All 3 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "incomplete", "reason": "All 3 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "support-core-task-success", "expectation": "default", "status": "incomplete", "reason": "All 3 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "incomplete", "reason": "All 5 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "be-inclusive", "expectation": "default", "status": "incomplete", "reason": "All 5 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "follow-best-practices", "expectation": "default", "status": "incomplete", "reason": "All 3 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "be-discoverable", "expectation": "default", "status": "incomplete", "reason": "All 4 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "incomplete", "reason": "All 4 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "be-resilient", "expectation": "contextual", "status": "incomplete", "reason": "All 4 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "incomplete", "reason": "All 3 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "be-trustworthy", "expectation": "default", "status": "incomplete", "reason": "All 4 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "incomplete", "reason": "All 3 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "incomplete", "reason": "All 2 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "incomplete", "reason": "All 3 atomic check(s) were blocked because the managed Cloudflare challenge did not expose the target application." } ], "paths": [ { "id": "homepage", "description": "Entry page and first-viewport recon; blocked by persistent Cloudflare managed challenge.", "url": "https://www.theblowers.com", "conditions": [ "desktop", "viewport: 360x800", "20-second wait", "no-JavaScript raw fetch" ], "result": "failed" }, { "id": "locale-home", "description": "Representative localized home route discovered from sitemap; challenge persisted.", "url": "https://www.theblowers.com/en/", "conditions": [ "10-second wait" ], "result": "failed" }, { "id": "blog", "description": "Representative content/article-listing archetype discovered from sitemap; challenge persisted.", "url": "https://www.theblowers.com/en/blog", "conditions": [ "10-second wait" ], "result": "failed" }, { "id": "contact", "description": "Representative form/core contact flow discovered from sitemap; challenge persisted.", "url": "https://www.theblowers.com/en/contact", "conditions": [ "10-second wait" ], "result": "failed" }, { "id": "excluded-routes", "description": "Ads, map, signup, login, partner, security, city listing, detail, authenticated account and commercial flows were not exercised because every attempted HTML route returned the same managed challenge. Sitemap/robots were inspected only for coverage planning.", "result": "skipped" } ], "findings": [], "taskList": [], "budget": { "pathCount": 4, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-28T07-13-32-000Z" }