Manifest position 64 · CrUX rank bucket 1000

https://www.gov.br

Coverage complete

Atomic coverage complete across 58 checks and six representative paths. No source was supplied; critique only.

Attempts

1 / 3

Judged checks

58 / 58

Blocked

Not run

This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.

All 58 atomic check outcomes

Principle / check	Status	Confidence	Evidence or reason
respect-user-preferences `respects-color-scheme`	issues	high	With prefers-color-scheme: dark emulated, the probe reported color-scheme “normal” and white body/header backgrounds; the dark-condition screenshot remained the light theme. F01 medium: The portal ignores the user’s dark-colour preference.
respect-user-preferences `respects-reduced-motion`	pass	high	evaluate under prefers-reduced-motion: reduce found zero active animations and explicit CSS reducing transitions to 0–1 ms.
respect-user-preferences `respects-contrast`	issues	high	CSS inspection found zero forced-colors or prefers-contrast rules; the prefers-contrast screenshot was visually unchanged. F02 low: There is no explicit high-contrast or forced-colours adaptation.
implement-natural-interactions `view-transitions`	issues	high	The browser exposes document.startViewTransition, but CSS inspection found no view-transition rules across the shared portal shell. F03 low: Route and major state changes do not use View Transitions.
implement-natural-interactions `scroll-driven-animations`	pass	high	Stylesheet inspection found no animation-timeline and no main-thread scroll-linked animation; the carousel uses scroll snap rather than scroll handlers.
implement-natural-interactions `physical-gestures`	pass	high	Stylesheet inspection found three scroll-snap rules and sampled layouts retained native scrolling with no horizontal fighting on four of five templates.
provide-guided-navigation `scroll-state-aware-chrome`	pass	high	Desktop/mobile screenshots and DOM show stable shared navigation and no jarring scroll-triggered chrome; no harmful JS scroll-state toggling was observed.
provide-guided-navigation `anchored-positioning`	issues	high	Load screenshots show a custom “Para começar” coachmark fixed beneath the login button; CSS inspection found zero anchor positioning or position-try usage. F04 low: The login coachmark is manually positioned instead of anchored and collision-aware.
provide-guided-navigation `directs-attention`	pass	high	The portal provides five skip links, breadcrumbs on detail/search pages, visible focus and descriptive navigation labels.
maximize-content-reduce-noise `no-intrusive-interruptions`	issues	high	Desktop and mobile screenshots show a login coachmark plus a cookie layer dimming the page; on mobile the cookie panel occupies roughly the lower 40% and blocks the service task. F05 high: Two simultaneous load-time interruptions obscure the primary content.
maximize-content-reduce-noise `semantic-dismissible-primitives`	issues	high	DOM inspection found zero dialog, popover or details elements while screenshots show a modal-like cookie layer and coachmark. F06 medium: Transient overlays use custom elements rather than semantic platform primitives.
maximize-content-reduce-noise `reduced-chrome`	pass	high	After consent UI, screenshots show content-led lists/cards with restrained borders and a clear service-information hierarchy.
adapt-to-the-form-factor `responsive-no-horizontal-scroll`	issues	high	The services layout primitive measured scrollWidth 364 versus clientWidth 360, a 4 px horizontal overflow; other sampled templates did not overflow. F07 low: The services listing overflows slightly at a 360 px viewport.
adapt-to-the-form-factor `component-level-responsiveness`	issues	high	Computed-style and stylesheet inspection found no container-type declarations or @container rules despite cards and search components being reused across templates. F08 low: Shared components rely on viewport rules rather than container-level responsiveness.
adapt-to-the-form-factor `input-modality-aware`	issues	high	Lighthouse failed target-size with seven items; the direct probe found the 28×28 menu trigger, 38×40 voice search and 42×42 carousel controls. Keyboard focus itself was visibly outlined. F09 medium: Several controls and links are below the recommended touch target size.
support-core-task-success `clear-purpose-and-primary-action`	pass	high	Homepage H1, search field and service detail “Iniciar” CTA clearly communicate purpose and next action.
support-core-task-success `primary-flow-completion`	issues	high	On the Income Tax service detail, the green “Iniciar” action is clear but the cookie layer and login coachmark dim and intercept the first interaction until dismissed. F10 medium: The service start path is initially blocked by stacked overlays.
support-core-task-success `clear-system-state-and-recovery`	issues	high	The synthetic missing route showed “Desculpe…” but document.title was empty and the main area offered only an Administration contact link, not search, home or back recovery. F11 medium: The 404 state gives weak recovery and has an empty document title.
be-fast-and-stable `good-core-web-vitals`	issues	high	Lighthouse measured FCP 8.31 s, LCP 21.09 s and performance 0.47; the raw CDP trace corroborated LCP 6.56 s even under a different run. F12 high: Cold-load performance is poor, especially LCP.
be-fast-and-stable `visual-stability`	issues	high	Homepage mobile CLS was 0.212, Lighthouse CLS was 0.183, and search CLS reached 0.705; all exceed the good threshold of 0.1. F13 high: Late content causes substantial layout movement.
be-fast-and-stable `efficient-main-thread`	pass	high	Trace found one 84 ms long task and only 34 ms TBT; Lighthouse TBT was 40 ms, indicating low blocking despite slow loading.
be-fast-and-stable `efficient-resource-delivery`	issues	high	HAR captured 111 requests and 6.23 MB transferred, including 19 stylesheets and 34 scripts; DOM confirms many classic scripts have neither async nor defer and the HAR lists numerous VeryHigh parser-inserted stylesheets. F14 high: The critical resource graph is large and parser-blocking.
be-fast-and-stable `trim-unused-and-duplicate-code`	issues	high	The shell loads both Font Awesome 5.15.4 and 6.7.1, Swiper 3.4.2 and many page-wide Plone bundles; Lighthouse also reports missing source maps for three large first-party scripts. F15 medium: Legacy and duplicated libraries inflate every portal page.
be-inclusive `names-roles-labels`	issues	high	Lighthouse failed button-name and label-content-name-mismatch; direct inspection showed the submit and clear search buttons have no text or aria-label. F16 medium: At least one search button lacks an accessible name.
be-inclusive `sufficient-contrast`	pass	high	Lighthouse accessibility score was 0.92 and did not report a colour-contrast failure; sampled light-theme text and controls remain visibly legible.
be-inclusive `structure-and-focus`	pass	high	DOM has one main plus nav/header/footer landmarks, a single H1 and ordered H2/H3s; keyboard focus on the first skip link showed a 2 px solid outline.
be-inclusive `legible-text`	pass	high	Representative mobile and desktop screenshots show readable 16 px body text, clear headings and no clipping once interruption layers are excluded.
be-inclusive `zoom-reflow-targets-and-media`	issues	high	Lighthouse identified seven insufficiently sized/spaced targets, corroborated by direct measurements down to 28×28 px. Viewport scaling itself is not disabled. F17 medium: Touch target sizing reduces inclusive operability.
follow-best-practices `no-console-errors`	pass	high	Lighthouse did not report runtime JavaScript errors or uncaught exceptions during the audited load.
follow-best-practices `sound-document-and-assets`	pass	high	Direct probe confirmed HTML doctype, UTF-8 charset and responsive viewport; image audit identified asset sizing defects recorded as F23.
follow-best-practices `browser-platform-hygiene`	issues	high	Lighthouse reports broken/missing source maps, two Inspector Issues and a BFCache blocker; the loaded Swiper 3.4.2 stack is also notably old. F18 medium: The page has browser-platform hygiene failures.
be-discoverable `title-and-description`	pass	high	Homepage has title “GOV.BR” and a descriptive Portuguese meta description; sampled service/news pages also expose titles.
be-discoverable `crawlable-and-mobile-friendly`	pass	high	Raw/rendered comparison retained 91% of homepage content, viewport meta is present, links use hrefs and robots permits ordinary public content.
be-discoverable `canonical-and-indexing-signals`	issues	high	robots.txt advertises sitemap.xml.gz, while a direct sitemap.xml request returned a 403 HTML error. Homepage canonical and indexing otherwise appear correct. F22 low: The sitemap advertised to crawlers is not directly retrievable at its plain URL.
be-discoverable `structured-and-shareable-metadata`	pass	high	Homepage contains two JSON-LD blocks and seven Open Graph tags consistent with the visible government portal entity.
be-private-and-secure `secure-transport-and-headers`	issues	high	The headers primitive found no CSP, HSTS, nosniff, frame protection, Referrer-Policy or Permissions-Policy. Two first-party cookies were not Secure and all three used SameSite=None. F19 high: Core transport defenses and cookie attributes are missing.
be-private-and-secure `data-minimisation-and-third-parties`	issues	high	HAR measured 28 third-party requests and 1.28 MB across seven origins. No known tracker domains or exposed secrets were found, but third-party CDNs and widgets execute before user choice. F20 medium: The shared shell has a large third-party footprint.
be-private-and-secure `in-context-permissions-and-modern-auth`	pass	high	No notification/geolocation prompt appeared on load; the sampled public portal does not itself present a password form, and authentication is handed to the gov.br account service.
be-private-and-secure `defensive-browser-policies`	issues	high	The main response lacks HSTS, clickjacking protection, Referrer-Policy and Permissions-Policy, with no CSP frame-ancestors fallback. F21 medium: Browser-enforced defensive policies are absent.
be-resilient `progressive-enhancement`	pass	high	Discoverability comparison found 91% homepage and 100% news content in raw HTML, not JS shells; no-JS users receive a warning while core links/content remain.
be-resilient `resilient-runtime-behaviour`	pass	high	Sampled listing/detail/search pages rendered stable complete DOM states; menus and consent controls remained within the mobile viewport, though intrusive size is separately reported.
be-resilient `offline-and-installable`	not-applicable	high	The sampled public informational portal is an MPA, not an installable app; offline installation is not a required core task.
be-resilient `network-and-http-failure-states`	pass	high	A synthetic missing URL returned an explicit Portuguese error heading rather than a blank shell; weak recovery/title is recorded as F11.
be-internationalised `lang-dir-and-logical-properties`	not-applicable	high	The audited portal is explicitly scoped to Brazilian Portuguese (html lang=pt-br) and no alternate-locale surface was offered in the representative paths.
be-internationalised `locale-aware-data`	not-applicable	high	The sampled public pages contain no user-entered locale-sensitive dates, currencies or calendar transactions to evaluate across locales.
be-internationalised `time-zone-correctness`	not-applicable	high	The sampled paths expose no scheduled cross-time-zone event or time-entry flow.
be-trustworthy `no-dark-patterns`	pass	high	Consent presents equally prominent Reject and Accept controls and a Manage option; no preselected paid continuity or disguised advertising appeared on sampled public paths.
be-trustworthy `humane-error-handling`	not-applicable	high	The sampled search has no required fields and the service feedback survey is optional; no required-field validation flow applies.
be-trustworthy `trustworthy-input-assistance`	pass	high	The sampled site-level search is type=search and intentionally disables history autocomplete; service feedback radio/textarea controls have explicit labels.
be-trustworthy `safe-commercial-and-account-flows`	not-applicable	high	No checkout, subscription or account-management flow is hosted on the sampled www.gov.br paths; service authentication is handed off to a separate identity system.
be-sustainable `optimised-assets`	issues	high	Images transferred 3.72 MB. The image audit found 18 legacy-format images, 12 without dimensions, 10 without srcset, nine below-fold images not lazy-loaded and four oversized images. F23 high: Image delivery is disproportionately heavy for a portal homepage.
be-sustainable `no-wasteful-work`	pass	high	Trace showed only one short long task and no continuous media/animation work; no known analytics tracker was detected, although network weight is reported separately.
be-sustainable `third-party-and-media-budget`	issues	high	The HAR transferred 1.43 MB of fonts and 1.28 MB from third parties before interaction, including duplicate Font Awesome generations. F24 medium: Fonts and third-party resources consume a large baseline budget.
be-agent-ready `structured-agent-capabilities`	not-applicable	high	No declared agent-facing scope or WebMCP capability exists; this emerging check is an opportunity rather than a requirement for the public portal run.
be-agent-ready `on-device-inference`	not-applicable	high	No user task in the sampled public portal calls for on-device language-model or summarisation inference.
be-memory-efficient `no-leak-under-repeated-interaction`	pass	medium	After ten cookie-settings open/close cycles, heap self-size rose only 1.5% (28.81 MB to 29.24 MB) and a separate memory probe showed used heap lower post-interaction.
be-memory-efficient `bounded-footprint`	pass	medium	Baseline heap was 28.81 MB with 455,601 snapshot nodes, proportionate for the large legacy portal shell though heavier than ideal.
be-memory-efficient `no-detached-dom-or-unbounded-listeners`	pass	medium	Heap summaries exposed no top Detached* constructor and DOM count stayed 5,675 before/after the repeated cookie interaction; no accumulating visible state remained.

Provenance

Canonical report: results/atomic/reports/0064-www_gov_br.json
Report SHA-256: e8ee2a5adb87e88ed03642ae01261d9a8622b22a8d9081b9b68efb972420c454
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_gov_br/2026-07-18T03-58-57-364Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_gov_br/2026-07-18T03-58-57-364Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7

Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.