{ "url": "https://business.facebook.com", "auditedAt": "2026-07-28T12:10:58.253Z", "mode": "report", "status": "completed", "statusDetail": "Completed atomic audit of the public unauthenticated login gateway. Authenticated Business Suite, Ads Manager, account recovery, and credentialed destinations were excluded because no test account was provided.", "page": { "appType": "hybrid", "framework": "Meta client runtime (no public framework marker)", "notes": "The requested URL redirects to a public login gateway. The gateway and consent state were audited; authenticated product templates were not silently treated as covered." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "trace", "har", "discoverability", "headers", "cookies", "trackers", "images", "secrets", "heap-summary", "lighthouse", "Modern Web Guidance live feed" ], "guidanceConsulted": [ "dark-mode", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "scrollytelling", "physics-based-easing", "shrinking-header-on-scroll", "anchor-positioning-tab-underline", "directional-navigation-transitions", "light-dismiss-a-dialog", "declarative-dialog-popover-control", "complex-shapes", "fluid-scaling", "size-aware-styling", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "identify-inp-causes", "visually-stable-font-fallbacks", "break-up-long-tasks", "optimize-image-priority", "identify-heavy-scripts", "move-dom-element-without-losing-state", "css", "html", "security", "privacy", "passkeys", "flicker-free-client-side-ab-testing", "resilient-context-menus-and-nested-dropdowns", "persistent-toast-notifications", "translator", "support-global-calendar-systems", "coordinate-global-events", "search-hidden-content", "autofill-address-form", "autofill-payment-form", "deliver-optimized-decorative-images", "deprioritize-background-fetches", "webmcp", "language-model", "manage-recurring-intervals" ], "artifacts": [ { "type": "other", "path": "evidence/axe.json", "caption": "axe" }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies" }, { "type": "screenshot", "path": "evidence/dark.png", "caption": "dark", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler", "findingIds": [ "F17", "F18" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered", "findingIds": [ "F17" ] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "discoverability", "findingIds": [ "F17", "F18" ] }, { "type": "other", "path": "evidence/guidance-list.txt", "caption": "guidance list" }, { "type": "other", "path": "evidence/guidance-retrieved.txt", "caption": "guidance retrieved" }, { "type": "other", "path": "evidence/headers.json", "caption": "headers", "findingIds": [ "F16" ] }, { "type": "heap", "path": "evidence/heap-baseline.heapsnapshot", "caption": "heap baseline", "findingIds": [ "F24" ] }, { "type": "other", "path": "evidence/heap-comparison.json", "caption": "heap comparison" }, { "type": "heap", "path": "evidence/heap-post.heapsnapshot", "caption": "heap post" }, { "type": "other", "path": "evidence/images.json", "caption": "images", "findingIds": [ "F12", "F21", "F22" ] }, { "type": "layout", "path": "evidence/layout-mobile.json", "caption": "layout mobile", "findingIds": [ "F11" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse", "findingIds": [ "F02", "F06", "F08", "F09", "F13" ] }, { "type": "screenshot", "path": "evidence/login-desktop.png", "caption": "login desktop" }, { "type": "screenshot", "path": "evidence/login-mobile.png", "caption": "login mobile" }, { "type": "other", "path": "evidence/metadata.json", "caption": "metadata", "findingIds": [ "F14", "F15" ] }, { "type": "screenshot", "path": "evidence/mobile.png", "caption": "mobile", "condition": "viewport: 360x800", "findingIds": [ "F03", "F05", "F19", "F20" ] }, { "type": "har-summary", "path": "evidence/network-summary.json", "caption": "network summary", "findingIds": [ "F07", "F08", "F21", "F22", "F23" ] }, { "type": "har", "path": "evidence/network.har", "caption": "network", "findingIds": [ "F07", "F23" ] }, { "type": "trace-summary", "path": "evidence/performance-trace-summary.json", "caption": "performance trace summary", "findingIds": [ "F06" ] }, { "type": "trace", "path": "evidence/performance-trace.json", "caption": "performance trace", "findingIds": [ "F06" ] }, { "type": "other", "path": "evidence/post-consent-state.json", "caption": "post consent state" }, { "type": "other", "path": "evidence/recon-controls.json", "caption": "recon controls", "findingIds": [ "F04" ] }, { "type": "dom", "path": "evidence/recon-dom.json", "caption": "recon dom", "findingIds": [ "F04", "F10" ] }, { "type": "screenshot", "path": "evidence/recon.png", "caption": "recon", "findingIds": [ "F01", "F03", "F19", "F20" ] }, { "type": "other", "path": "evidence/reduced-motion.json", "caption": "reduced motion" }, { "type": "other", "path": "evidence/runtime-metrics.json", "caption": "runtime metrics", "findingIds": [ "F24" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets" }, { "type": "other", "path": "evidence/static-probe.json", "caption": "static probe", "findingIds": [ "F05", "F09", "F10", "F11", "F13" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers" } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Default and prefers-color-scheme: dark screenshot comparison", "evidence": "The dark-emulated capture retained the same white modal and light page palette as the default capture.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/dark.png", "evidence/recon.png" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "Emulated reduced motion plus getAnimations/computed transition probe", "evidence": "prefers-reduced-motion: reduce matched; no active animations or smooth scrolling were present, and the CSS inventory contained 32 reduced-motion rules.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/reduced-motion.json", "evidence/static-probe.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "issues", "confidence": "high", "method": "Lighthouse contrast audit and visual inspection", "evidence": "Lighthouse found “Allow all cookies” at 4.23:1 instead of the required 4.5:1.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "pass", "confidence": "medium", "method": "Rendered-state and animation inspection", "evidence": "The audited gateway has no same-document route swap; the loaded consent state is stable and no jarring animated swap was observed.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/recon.png", "evidence/reduced-motion.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "high", "method": "Animation and layout inspection", "evidence": "No scroll-linked animation or parallax was present, so native scrolling is not blocked by main-thread visual effects.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/reduced-motion.json", "evidence/layout-mobile.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "medium", "method": "Mobile viewport interaction-surface inspection", "evidence": "The gateway exposes ordinary buttons and document scrolling, with no custom swipe, drag, overscroll, or pointer-driven gesture that fights platform behavior.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/mobile.png", "evidence/static-probe.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "pass", "confidence": "medium", "method": "Full-page visual and DOM inspection", "evidence": "No sticky or affixed application chrome is used on this compact gateway, so there is no static scroll chrome obscuring content.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/recon.png", "evidence/recon-dom.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "pass", "confidence": "medium", "method": "Overlay/menu DOM and mobile screenshot inspection", "evidence": "The visible consent modal remains contained at 360px with zero horizontal overflow; no detached tooltip or manually drifting anchored surface was observed.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/mobile.png", "evidence/layout-mobile.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "First-viewport screenshot and control inventory", "evidence": "Purpose copy leads directly to four clearly named authentication choices, while the modal presents two explicit consent actions.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/recon-controls.json", "evidence/mobile.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "First-load desktop and mobile screenshots", "evidence": "A modal consent wall obscures the core login page before user interaction.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/recon.png", "evidence/mobile.png" ], "findingIds": [ "F03" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Dialog semantics DOM probe", "evidence": "The overlay uses role=dialog but has no accessible name and no aria-modal; the menu trigger also lacks an accessible label.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/recon-controls.json", "evidence/recon-dom.json" ], "findingIds": [ "F04" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "medium", "method": "Underlying page visual review", "evidence": "Behind the consent layer, the gateway is content-focused: one purpose block, four account actions, and a compact footer without a persistent app frame.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/mobile.png", "evidence/post-consent-state.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Layout primitive at 360x800", "evidence": "scrollWidth, clientWidth and innerWidth were all 360px; horizontalOverflowPx was 0 and viewport metadata was present.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/layout-mobile.json", "evidence/mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "pass", "confidence": "high", "method": "CSSOM rule inventory and narrow screenshot", "evidence": "The CSSOM probe found 31 container rules, and the consent surface reflowed from a wide desktop panel to a single-column 360px layout.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/static-probe.json", "evidence/mobile.png", "evidence/recon.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Computed interactive target-size probe", "evidence": "Twenty-eight actionable footer/locale links measured only 16px high.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/static-probe.json" ], "findingIds": [ "F05" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "First-viewport content and control inventory", "evidence": "The body states “Get started with business tools from Meta” and exposes Facebook, Instagram, account creation, and managed-account actions.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/post-consent-state.json", "evidence/recon-controls.json" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "medium", "method": "Authentication handoff inspection", "evidence": "For the auditable public gateway, all four authentication handoff choices are present, named, focusable, and wired as actions; credentialed destinations were intentionally excluded.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/recon-controls.json", "evidence/static-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "not-applicable", "confidence": "medium", "method": "Public-gateway state inventory", "evidence": "The pre-authentication gateway contains no local data-entry or submit result state; credential errors and recovery occur beyond the unauthenticated scope.", "reason": "The public gateway has no local success/error/empty workflow to exercise." }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Lighthouse and independent CDP trace", "evidence": "Lighthouse LCP was 11.6s and FCP 9.7s; the independent trace LCP was 3.25s.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/lighthouse.json", "evidence/performance-trace-summary.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Mobile layout-shift observer and Lighthouse CLS", "evidence": "Both instruments reported CLS 0 with no observed shifts.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/layout-mobile.json", "evidence/lighthouse.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "CDP trace and Lighthouse TBT", "evidence": "Trace found one 60.83ms long task and 10.83ms TBT; Lighthouse TBT was 32ms, both low.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/performance-trace-summary.json", "evidence/lighthouse.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "HAR summary plus parser-initiator evidence", "evidence": "112 requests transferred 2.14MB; 21 stylesheets included numerous parser-inserted VeryHigh-priority render-blocking candidates.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/network-summary.json", "evidence/network.har" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "HAR resource-type inventory", "evidence": "The gateway loaded 62 scripts (1.06MB) and 21 stylesheets (386KB) for a four-choice login surface.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/network-summary.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Lighthouse accessibility audits and DOM control probe", "evidence": "Lighthouse found two unnamed focusable links; the custom probe counted five unlabeled interactives.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/lighthouse.json", "evidence/static-probe.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Lighthouse color-contrast audit", "evidence": "The primary cookie acceptance control measured 4.23:1 against a 4.5:1 requirement.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F02" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Heading/landmark DOM probe", "evidence": "No H1 and no semantic landmarks were found; all detected headings were H2 elements inside consent content.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/static-probe.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Desktop/mobile visual review", "evidence": "Body copy wraps without clipping at 360px, remains readable, and the layout primitive found no overflow.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/mobile.png", "evidence/recon.png", "evidence/layout-mobile.json" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Viewport metadata, reflow, and target-size probe", "evidence": "User scaling is not disabled and reflow has no overflow, but 28 links are only 16px high.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/static-probe.json", "evidence/layout-mobile.json" ], "findingIds": [ "F11" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Lighthouse console audit and failed-resource probe", "evidence": "Lighthouse errors-in-console passed, and the resource timing probe found no response status >=400.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/lighthouse.json", "evidence/runtime-metrics.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Document metadata and image audit", "evidence": "HTML5 doctype, UTF-8 and viewport are present, but 8 of 9 images omit intrinsic dimensions and 8 use PNG.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/static-probe.json", "evidence/images.json" ], "findingIds": [ "F12" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "pass", "confidence": "medium", "method": "Lighthouse best-practices and runtime inspection", "evidence": "The page produced no console errors, no failing timed resources, and no permission prompt on load; HTTPS passed.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/lighthouse.json", "evidence/runtime-metrics.json", "evidence/recon.png" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "DOM metadata probe and Lighthouse SEO", "evidence": "A descriptive title exists, but meta description is absent.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/static-probe.json", "evidence/lighthouse.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "high", "method": "Lighthouse SEO, link inventory, and viewport check", "evidence": "Robots and crawlable-anchor audits passed; real href links and viewport metadata are present.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/lighthouse.json", "evidence/recon-controls.json", "evidence/static-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Canonical/hreflang/robots metadata probe", "evidence": "The 200 public page has locale choices but no canonical or hreflang links.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/metadata.json", "evidence/discoverability.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Open Graph, Twitter Card and JSON-LD probe", "evidence": "No Open Graph, Twitter Card or JSON-LD metadata was present.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/metadata.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Security headers, cookies, HTTPS and secret scan", "evidence": "HTTPS, HSTS, nosniff and CSP are present and no client secret was found, but Referrer-Policy is absent and CSP allows inline styles.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/secrets.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "pass", "confidence": "high", "method": "Cookie, tracker, and HAR-origin inspection before consent", "evidence": "Before a consent choice, CDP found zero cookies and no known tracker domains; external requests were confined to Meta-operated facebook.com/fbcdn.net origins.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/cookies.json", "evidence/trackers.json", "evidence/network-summary.json" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "First-load screenshot and authentication control inventory", "evidence": "No browser permission prompt appeared; authentication offers Facebook, Instagram and a managed Meta account rather than exposing a local password form.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/recon.png", "evidence/recon-controls.json" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Response-header policy inspection", "evidence": "HSTS, DENY framing and Permissions-Policy are present, but Referrer-Policy is missing.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Raw HTML versus rendered DOM discoverability comparison", "evidence": "Only 11% of rendered content words were available in raw HTML without JavaScript.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png" ], "findingIds": [ "F17" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Runtime, mobile layout and console inspection", "evidence": "The modal stays within a 360px viewport with zero horizontal overflow, no console errors, and no failing resource status observed.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/layout-mobile.json", "evidence/mobile.png", "evidence/lighthouse.json" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Manifest/service-worker and site-purpose assessment", "evidence": "The audited surface is an online authentication gateway to account-bound business services; offline task completion is not meaningful.", "reason": "An unauthenticated login gateway to intrinsically online account services does not have a meaningful offline core task." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "JavaScript-disabled fallback inspection", "evidence": "When script execution is unavailable, only 11% of normal content survives and the primary rendered gateway is not preserved.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png" ], "findingIds": [ "F18" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "medium", "method": "DOM language and locale-navigation inspection", "evidence": "The document declares lang=en and exposes multiple clearly named locale choices; no forced LTR dir attribute conflicts with language selection.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/static-probe.json", "evidence/recon-controls.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Visible-content and DOM inspection", "evidence": "The gateway displays no locale-sensitive date, number, currency, duration, address, or calendar data to format.", "reason": "No locale-sensitive data appears on the audited public gateway." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Visible-content and DOM inspection", "evidence": "The gateway presents no times, events, schedules, or recurring intervals.", "reason": "No temporal data or scheduling feature appears on the audited public gateway." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "issues", "confidence": "high", "method": "First-load consent screenshots and control comparison", "evidence": "The mandatory full-screen consent detour blocks all authentication actions before they can be used.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/recon.png", "evidence/mobile.png" ], "findingIds": [ "F19" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "not-applicable", "confidence": "high", "method": "Form inventory", "evidence": "document.forms was empty and the public gateway exposes no local editable fields or validation state.", "reason": "No local form validation or error-feedback surface exists on this gateway." }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "not-applicable", "confidence": "high", "method": "Form and input inventory", "evidence": "The DOM contains no public input fields requiring autocomplete or input assistance.", "reason": "No editable inputs exist on the audited public gateway." }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "issues", "confidence": "high", "method": "Authentication and consent journey inspection", "evidence": "All account actions are blocked until the separate consent overlay is handled.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/recon.png", "evidence/mobile.png", "evidence/recon-controls.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Image audit and HAR weight inspection", "evidence": "Eight legacy PNG images lack dimensions; responsive sources are missing on five and below-fold consent images load eagerly.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/images.json", "evidence/network-summary.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "HAR and hidden-image inspection", "evidence": "Initial load performs 112 requests including 62 scripts and fetches offscreen consent illustrations.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/network-summary.json", "evidence/images.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "HAR origin/byte budget inspection", "evidence": "Meta CDN and related-origin traffic accounts for 101 requests and 2.08MB of 2.14MB transferred.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/network-summary.json", "evidence/network.har" ], "findingIds": [ "F23" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "WebMCP/tool probe and unauthenticated-scope assessment", "evidence": "No WebMCP capabilities are exposed, but the public gateway has no safe domain action beyond handing off to credentialed authentication.", "reason": "Agent capabilities would require authenticated, permissioned business context and are not appropriate on this unauthenticated gateway." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Built-in AI usage and feature-purpose assessment", "evidence": "The gateway performs no inference, summarisation, translation, or generative task.", "reason": "There is no inference-relevant feature on the public login gateway." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "Baseline/post heap summaries around 10 repeated consent disclosure toggles", "evidence": "After repeated disclosure clicks, node count fell by 1,022 and retained self-size changed by only +38,219 bytes, with no Detached constructor in the top post-interaction list.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot", "evidence/heap-comparison.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "issues", "confidence": "medium", "method": "Heap summary and DOM/runtime metrics", "evidence": "The baseline heap held 1,368,314 V8 nodes and 53.1MB self-size for a 716-element login gateway.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/runtime-metrics.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Baseline/post heap constructor comparison", "evidence": "Node/edge counts decreased after repetition and no Detached constructor appeared in the post-interaction top constructors.", "pathIds": [ "public-login" ], "artifacts": [ "evidence/heap-comparison.json", "evidence/heap-post.heapsnapshot" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "pass" }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F03", "F04" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F05" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F06", "F07", "F08" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F09", "F02", "F10", "F11" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F12" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F13", "F14", "F15" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F16" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F17", "F18" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F19", "F20" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F21", "F22", "F23" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "Agent capabilities would require authenticated, permissioned business context and are not appropriate on this unauthenticated gateway. There is no inference-relevant feature on the public login gateway." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F24" ] } ], "paths": [ { "id": "public-login", "description": "Public pre-authentication gateway and initial cookie-consent state, representing the only accessible template. Audited at desktop, 360x800, dark preference, reduced motion, and no-JavaScript crawler conditions. Authenticated Business Suite, Ads Manager, credential recovery, and post-login workflows were not covered because they require credentials.", "url": "https://business.facebook.com/business/loginpage/", "conditions": [ "desktop viewport", "viewport: 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "JavaScript disabled/raw HTML", "cold-load performance" ], "result": "issues" } ], "findings": [ { "id": "F01", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "severity": "medium", "confidence": "high", "summary": "The public login and consent surfaces do not adapt to dark color preference.", "evidence": "The dark-emulated screenshot is pixel-identical in palette and file size to the default capture: white modal and light page surfaces remain unchanged.", "suggestedFix": "Declare color-scheme and use preference-driven surface/text tokens, retaining tested contrast in both schemes.", "artifacts": [ "evidence/dark.png", "evidence/recon.png" ], "effort": "small" }, { "id": "F02", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "respect-user-preferences", "principleCheckId": "respects-contrast", "guidanceId": "accessibility", "severity": "low", "confidence": "high", "summary": "The primary cookie acceptance control narrowly misses minimum text contrast.", "evidence": "Lighthouse measured the 12px bold white “Allow all cookies” label at 4.23:1 against #1877f2, below 4.5:1.", "suggestedFix": "Adjust the button foreground/background token to reach at least 4.5:1 and verify forced-colors behavior.", "artifacts": [ "evidence/lighthouse.json" ], "effort": "trivial" }, { "id": "F03", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "severity": "high", "confidence": "high", "summary": "A blocking cookie interstitial obscures the core login content immediately on load.", "evidence": "Desktop and 360x800 screenshots show the consent dialog covering most of the first viewport before any user action; the underlying login actions are dimmed and unavailable.", "suggestedFix": "Use a compact, content-first consent surface that limits blocking to what is legally necessary and preserves immediate access to essential context/actions.", "artifacts": [ "evidence/recon.png", "evidence/mobile.png" ], "effort": "medium" }, { "id": "F04", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "severity": "medium", "confidence": "high", "summary": "The consent overlay lacks complete modal semantics.", "evidence": "The DOM probe found role=dialog but no accessible label and no aria-modal; the control inventory also found an unlabeled menu-style control.", "suggestedFix": "Use a native dialog or complete role=dialog semantics with aria-modal, an accessible name, focus containment, and deterministic focus return.", "artifacts": [ "evidence/recon-dom.json", "evidence/recon-controls.json" ], "effort": "small" }, { "id": "F05", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "severity": "medium", "confidence": "high", "summary": "Many footer and locale links have undersized touch hit areas.", "evidence": "The computed target probe found 28 interactive links only 16px high, including Privacy, Terms, language choices, and Help Centre.", "suggestedFix": "Increase target boxes and spacing so touch targets are at least 24px minimum, preferably 44px on mobile, while retaining visible keyboard focus.", "artifacts": [ "evidence/static-probe.json", "evidence/mobile.png" ], "effort": "small" }, { "id": "F06", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "identify-inp-causes", "severity": "high", "confidence": "high", "summary": "Cold-load paint performance is poor.", "evidence": "Lighthouse measured FCP 9.7s, LCP 11.6s, Speed Index 9.7s, and time to interactive 11.9s. A separate trace still measured LCP 3.25s, above the good threshold.", "suggestedFix": "Prioritise the actual LCP content, reduce critical CSS/script dependencies, and verify under representative mobile throttling.", "artifacts": [ "evidence/lighthouse.json", "evidence/performance-trace-summary.json", "evidence/performance-trace.json" ], "effort": "large" }, { "id": "F07", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-preload-priority", "severity": "high", "confidence": "high", "summary": "The login gateway has a long, heavy critical-resource path.", "evidence": "HAR recorded 112 requests and 2,140,487 transferred bytes, including 21 stylesheets and multiple parser-inserted VeryHigh-priority CSS candidates; 101 requests and 2.08MB came from related external origins.", "suggestedFix": "Collapse and prune critical CSS, preload only proven critical assets, defer nonessential consent illustrations and scripts, and apply durable caching.", "artifacts": [ "evidence/network-summary.json", "evidence/network.har" ], "effort": "large" }, { "id": "F08", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "severity": "medium", "confidence": "high", "summary": "The simple gateway ships disproportionate script and stylesheet volume.", "evidence": "HAR recorded 62 scripts transferring 1,057,506 bytes plus 21 stylesheets transferring 385,868 bytes for a page whose visible task is choosing one of four login methods.", "suggestedFix": "Use coverage and bundle analysis to remove unused modules and route-split consent/help code and authenticated-product code from the gateway.", "artifacts": [ "evidence/network-summary.json", "evidence/lighthouse.json" ], "effort": "large" }, { "id": "F09", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "severity": "medium", "confidence": "high", "summary": "Focusable links lack accessible names.", "evidence": "Lighthouse link-name audit failed on two tab-order anchors, including a store link and the consent menu trigger; the custom probe counted five unlabeled interactive elements.", "suggestedFix": "Give every interactive element a stable accessible name and use native button/link semantics where possible.", "artifacts": [ "evidence/lighthouse.json", "evidence/static-probe.json" ], "effort": "small" }, { "id": "F10", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "severity": "high", "confidence": "high", "summary": "The page lacks a useful top-level heading and landmark structure.", "evidence": "Rendered DOM contained no H1 and no main, nav, header, footer, aside, or equivalent role landmarks; only consent-content H2 elements were detected.", "suggestedFix": "Add a single descriptive H1 and semantic main/nav/footer landmarks, then verify focus enters and exits the modal predictably.", "artifacts": [ "evidence/static-probe.json", "evidence/recon-dom.json" ], "effort": "medium" }, { "id": "F11", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "accessibility", "severity": "medium", "confidence": "high", "summary": "Interactive footer and language targets are too short for reliable touch use.", "evidence": "The target-size probe measured 28 actionable links at 16px high. Mobile reflow itself had no horizontal overflow, so the failure is target sizing rather than layout width.", "suggestedFix": "Expand clickable padding without preventing zoom and retest at 200% zoom and 360px reflow.", "artifacts": [ "evidence/static-probe.json", "evidence/layout-mobile.json" ], "effort": "small" }, { "id": "F12", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "optimize-image-priority", "severity": "low", "confidence": "high", "summary": "Most consent illustrations omit intrinsic dimensions and use legacy PNG delivery.", "evidence": "The image audit found 8 of 9 images without width/height, 8 PNG assets, 5 without responsive sources, and 2 below-fold images not lazy-loaded.", "suggestedFix": "Set intrinsic dimensions, lazy-load below-fold illustrations, and serve appropriately sized AVIF/WebP responsive sources.", "artifacts": [ "evidence/images.json" ], "effort": "medium" }, { "id": "F13", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "html", "severity": "medium", "confidence": "high", "summary": "The public gateway has no meta description.", "evidence": "The DOM probe and Lighthouse agree that the title exists but meta[name=description] is absent.", "suggestedFix": "Add a concise, unique description explaining that this page signs users into Meta business tools.", "artifacts": [ "evidence/static-probe.json", "evidence/lighthouse.json" ], "effort": "trivial" }, { "id": "F14", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "severity": "low", "confidence": "high", "summary": "Localized login URLs have no canonical or hreflang signals.", "evidence": "Metadata inspection found no canonical link, no alternate hreflang links, and no robots meta despite a visible locale selector.", "suggestedFix": "Publish a stable canonical and reciprocal hreflang alternates for indexable locale variants, aligned with sitemap and robots policy.", "artifacts": [ "evidence/metadata.json" ], "effort": "small" }, { "id": "F15", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "html", "severity": "low", "confidence": "high", "summary": "The public organization/login page has no share-preview or structured entity metadata.", "evidence": "Metadata inspection found no Open Graph tags, Twitter card tags, or JSON-LD.", "suggestedFix": "Add accurate Organization/WebSite JSON-LD and minimal Open Graph metadata matching visible content.", "artifacts": [ "evidence/metadata.json" ], "effort": "small" }, { "id": "F16", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "severity": "low", "confidence": "high", "summary": "The response omits Referrer-Policy and permits inline styles in CSP.", "evidence": "Header inspection found HTTPS, HSTS, nosniff, X-Frame-Options DENY and Permissions-Policy, but no Referrer-Policy; CSP style-src includes unsafe-inline.", "suggestedFix": "Set an explicit privacy-preserving Referrer-Policy and continue reducing CSP unsafe-inline usage with hashes/nonces where feasible.", "artifacts": [ "evidence/headers.json" ], "effort": "medium" }, { "id": "F17", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "flicker-free-client-side-ab-testing", "severity": "high", "confidence": "high", "summary": "Most meaningful gateway content is unavailable without JavaScript.", "evidence": "Discoverability measured only 11% rendered-word coverage in raw HTML: 37 raw content tokens versus 185 rendered, with crawler and rendered screenshots materially different.", "suggestedFix": "Server-render the purpose, login choices, and essential consent text/actions; hydrate only interaction enhancements.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png" ], "effort": "large" }, { "id": "F18", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "resilient-context-menus-and-nested-dropdowns", "severity": "medium", "confidence": "high", "summary": "The JavaScript-disabled/network-degraded state loses most of the primary experience.", "evidence": "The no-JavaScript crawler capture retained only 11% of rendered content, demonstrating that a failed script delivery removes the normal login gateway rather than presenting a useful fallback.", "suggestedFix": "Provide server-rendered fallback login links and an actionable retry/status message when required client resources fail.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png" ], "effort": "large" }, { "id": "F19", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-trustworthy", "principleCheckId": "no-dark-patterns", "guidanceId": "privacy", "severity": "high", "confidence": "high", "summary": "Consent blocks the account task before the user can proceed.", "evidence": "On both desktop and mobile the consent wall appears first and disables the underlying sign-in choices; mobile dedicates nearly the full viewport to the prompt. Decline and allow controls are visually similar, but the interruption remains coercive by placement.", "suggestedFix": "Minimise the blocking surface, make essential use possible without optional consent, and keep decline/revisit controls as direct and durable as acceptance.", "artifacts": [ "evidence/recon.png", "evidence/mobile.png" ], "effort": "medium" }, { "id": "F20", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-trustworthy", "principleCheckId": "safe-commercial-and-account-flows", "guidanceId": "privacy", "severity": "medium", "confidence": "high", "summary": "The authentication entry is gated behind a separate full-screen consent decision.", "evidence": "The first-load screenshots show all four account actions dimmed beneath the consent overlay, adding a mandatory detour before authentication.", "suggestedFix": "Keep privacy choice clear but decouple optional-cookie consent from access to essential authentication wherever policy permits.", "artifacts": [ "evidence/recon.png", "evidence/mobile.png" ], "effort": "medium" }, { "id": "F21", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "severity": "medium", "confidence": "high", "summary": "Consent artwork is delivered inefficiently.", "evidence": "Image audit found 8 legacy PNGs, 8 images without dimensions, 5 without responsive sources, and two below-fold images loaded eagerly.", "suggestedFix": "Convert decorative illustrations to modern formats, add responsive sources/intrinsic sizes, and defer assets outside the visible consent panel.", "artifacts": [ "evidence/images.json", "evidence/network-summary.json" ], "effort": "medium" }, { "id": "F22", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "deprioritize-background-fetches", "severity": "medium", "confidence": "high", "summary": "The gateway performs substantial work unrelated to its visible task.", "evidence": "HAR shows 112 requests, 62 scripts and 21 stylesheets; several offscreen consent-card images are fetched on initial load.", "suggestedFix": "Defer hidden consent detail assets and noncritical modules until requested, and deprioritise background work.", "artifacts": [ "evidence/network-summary.json", "evidence/images.json" ], "effort": "large" }, { "id": "F23", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "deprioritize-background-fetches", "severity": "medium", "confidence": "high", "summary": "Related-origin CDN traffic dominates the page budget.", "evidence": "101 of 112 requests and 2,079,503 of 2,140,487 transferred bytes came from static.xx.fbcdn.net or www.facebook.com. Even treating these as Meta-operated infrastructure, the transfer is disproportionate for a login chooser.", "suggestedFix": "Set a strict route budget, remove nonessential dependencies, and defer media/help assets until opened.", "artifacts": [ "evidence/network-summary.json", "evidence/network.har" ], "effort": "large" }, { "id": "F24", "pathId": "public-login", "url": "https://business.facebook.com/business/loginpage/", "principleId": "be-memory-efficient", "principleCheckId": "bounded-footprint", "guidanceId": "performance", "severity": "medium", "confidence": "medium", "summary": "The baseline JavaScript heap is large for a pre-authentication gateway.", "evidence": "Heap summary reported 1,368,314 V8 nodes, 4,244,945 edges and 53,144,077 self-size bytes while the rendered DOM contained only 716 elements.", "suggestedFix": "Profile retained native/object populations and avoid loading authenticated-product runtime and hidden consent content before it is needed.", "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/runtime-metrics.json" ], "effort": "large" } ], "taskList": [ { "id": "T01", "title": "Make the primary gateway server-rendered and resilient", "priority": 1, "findingIds": [ "F17", "F18" ], "guidanceId": "flicker-free-client-side-ab-testing", "status": "open" }, { "id": "T02", "title": "Cut the login route critical path and bundle budget", "priority": 2, "findingIds": [ "F06", "F07", "F08", "F22", "F23", "F24" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T03", "title": "Replace the blocking consent experience with an accessible, proportionate flow", "priority": 3, "findingIds": [ "F03", "F04", "F19", "F20" ], "guidanceId": "light-dismiss-a-dialog", "status": "open" }, { "id": "T04", "title": "Restore semantic structure, names, contrast, and target sizing", "priority": 4, "findingIds": [ "F02", "F05", "F09", "F10", "F11" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T05", "title": "Optimise and defer consent artwork", "priority": 5, "findingIds": [ "F12", "F21" ], "guidanceId": "deliver-optimized-decorative-images", "status": "open" }, { "id": "T06", "title": "Complete search and sharing metadata", "priority": 6, "findingIds": [ "F13", "F14", "F15" ], "guidanceId": "html", "status": "open" }, { "id": "T07", "title": "Add preference-driven dark styling and tighten response policies", "priority": 7, "findingIds": [ "F01", "F16" ], "guidanceId": "dark-mode", "status": "open" } ], "budget": { "wallClockSeconds": 420, "pathCount": 1, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-28T12-10-58-253Z" }