Manifest position 203 · CrUX rank bucket 1000

https://www.bpexch.live

Partial after retries

The public login surface and unauthenticated error boundary were inspected. Three checks remain blocked because no valid account was supplied, so authenticated exchange, account, commercial, and post-login transition flows could not be exercised.

Attempts

3 / 3

Judged checks

55 / 58

Blocked

Not run

This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.

All 58 atomic check outcomes

Principle / check	Status	Confidence	Evidence or reason
respect-user-preferences `respects-color-scheme`	issues	high	Default and prefers-color-scheme: dark screenshots are byte-identical and the rendered CSS exposes no color-scheme preference adaptation. F01 medium: The login has one hard-coded dark appearance rather than responding to the user’s color-scheme preference.
respect-user-preferences `respects-reduced-motion`	pass	high	Under prefers-reduced-motion: reduce, matchMedia is true and document.getAnimations() returns an empty list.
respect-user-preferences `respects-contrast`	pass	high	The prefers-contrast: more capture retains visible text, icons, controls, and boundaries; Lighthouse contrast passes.
implement-natural-interactions `view-transitions`	blocked	high	Authentication was attempted only to the public validation boundary; no valid account was supplied, so the post-login route/state transition could not be exercised.
implement-natural-interactions `scroll-driven-animations`	pass	high	DOM and runtime probes find no scroll-linked animation or running animation on this static login.
implement-natural-interactions `physical-gestures`	pass	high	The reachable login uses native text entry and button activation, with no custom pointer/gesture handlers or scroll manipulation.
provide-guided-navigation `scroll-state-aware-chrome`	not-applicable	high	The public login is a single short view with no meaningful content scroll or sticky chrome.
provide-guided-navigation `anchored-positioning`	not-applicable	high	The public login contains no tooltip, popover, menu, or other anchored overlay.
provide-guided-navigation `directs-attention`	issues	high	After programmatically focusing #user_Username, computed outline is none, box-shadow is none, border is none, and the focused screenshot is visually unchanged. F02 high: Keyboard focus is not visibly exposed on the login controls.
maximize-content-reduce-noise `no-intrusive-interruptions`	pass	high	Initial desktop and mobile captures show the login directly with no popup, consent wall, banner, or obscuring interstitial.
maximize-content-reduce-noise `semantic-dismissible-primitives`	pass	high	DOM/runtime probes find no overlay or rich custom control requiring dialog, popover, details, or dismiss handling.
maximize-content-reduce-noise `reduced-chrome`	pass	high	The first viewport gives nearly all functional chrome to a compact sign-in panel with no competing navigation, ads, or banners.
adapt-to-the-form-factor `responsive-no-horizontal-scroll`	pass	high	At 360×800, layout reports scrollWidth=clientWidth=360 and 0 px horizontal overflow; the form remains usable.
adapt-to-the-form-factor `component-level-responsiveness`	not-applicable	high	The reachable page has one fixed-context login panel and no reused component shown in differently sized containers.
adapt-to-the-form-factor `input-modality-aware`	issues	high	After programmatically focusing #user_Username, computed outline is none, box-shadow is none, border is none, and the focused screenshot is visually unchanged. F02 high: Keyboard focus is not visibly exposed on the login controls.
support-core-task-success `clear-purpose-and-primary-action`	pass	high	The first viewport presents two credentials fields and one clearly labelled Login action with no competing CTA.
support-core-task-success `primary-flow-completion`	blocked	high	The primary exchange journey requires valid credentials; no account was supplied, so end-to-end task completion was attempted but blocked at authentication.
support-core-task-success `clear-system-state-and-recovery`	issues	high	The HTTP probe returns 404 and the captured route shows Chrome’s generic “page can’t be found” screen, with no BpExch navigation, sign-in link, support route, or recovery context. F08 medium: Unknown routes fall through to the browser’s bare HTTP error page with no site-level recovery path.
be-fast-and-stable `good-core-web-vitals`	issues	high	HAR records 38 requests and 808,051 transferred bytes, including 11 parser-blocking stylesheets, 15 scripts, two jQuery copies, and 328 KB of fonts. Lighthouse estimates 129 KiB unused JS and 60 KiB unused CSS, with throttled LCP 3.8 s. F06 high: A simple two-field login ships a large, mostly unused legacy front-end stack.
be-fast-and-stable `visual-stability`	pass	high	Layout and Lighthouse both measure negligible CLS (about 0.002), with no visible shift in the captured load.
be-fast-and-stable `efficient-main-thread`	pass	high	Trace reports zero long tasks and 0 ms total blocking time over the load.
be-fast-and-stable `efficient-resource-delivery`	issues	high	HAR records 38 requests and 808,051 transferred bytes, including 11 parser-blocking stylesheets, 15 scripts, two jQuery copies, and 328 KB of fonts. Lighthouse estimates 129 KiB unused JS and 60 KiB unused CSS, with throttled LCP 3.8 s. F06 high: A simple two-field login ships a large, mostly unused legacy front-end stack.
be-fast-and-stable `trim-unused-and-duplicate-code`	issues	high	HAR records 38 requests and 808,051 transferred bytes, including 11 parser-blocking stylesheets, 15 scripts, two jQuery copies, and 328 KB of fonts. Lighthouse estimates 129 KiB unused JS and 60 KiB unused CSS, with throttled LCP 3.8 s. F06 high: A simple two-field login ships a large, mostly unused legacy front-end stack.
be-inclusive `names-roles-labels`	issues	high	axe reports a logo image without alt, two links without discernible text, no main landmark, no h1, and content outside landmarks; the two inputs use placeholders but no explicit labels. F03 high: The login omits important accessible names and document structure.
be-inclusive `sufficient-contrast`	pass	high	Lighthouse color-contrast passes and the default/contrast screenshots keep essential content legible.
be-inclusive `structure-and-focus`	issues	high	After programmatically focusing #user_Username, computed outline is none, box-shadow is none, border is none, and the focused screenshot is visually unchanged. axe reports a logo image without alt, two links without discernible text, no main landmark, no h1, and content outside landmarks; the two inputs use placeholders but no explicit labels. F02 high: Keyboard focus is not visibly exposed on the login controls. F03 high: The login omits important accessible names and document structure.
be-inclusive `legible-text`	pass	high	Desktop and mobile captures show unclipped, comfortably sized field text and CTA text.
be-inclusive `zoom-reflow-targets-and-media`	pass	high	Viewport permits scaling, mobile has no overflow, fields are 290×45 and button 120×50; no media requires captions.
follow-best-practices `no-console-errors`	pass	high	Lighthouse errors-in-console audit passes.
follow-best-practices `sound-document-and-assets`	issues	high	The images primitive reports one JPG with no width, height, srcset, or alt. Lighthouse also flags the unsized image; measured CLS remains low at 0.002. F07 low: The sole content image lacks intrinsic sizing, responsive sources, modern encoding, and alternative text.
follow-best-practices `browser-platform-hygiene`	pass	high	Lighthouse reports no console/deprecation blocker and BFCache eligibility passes; no permission prompt appears on load.
be-discoverable `title-and-description`	pass	high	DOM has descriptive title “BpExch Login” and meta description “BpExch - Web Exchange”.
be-discoverable `crawlable-and-mobile-friendly`	pass	high	Viewport meta is present, robots.txt is valid, and Lighthouse crawlable-anchor/indexing audits pass for the public boundary.
be-discoverable `canonical-and-indexing-signals`	not-applicable	high	The reachable surface is an authentication boundary rather than public content intended for search indexing.
be-discoverable `structured-and-shareable-metadata`	not-applicable	high	A private sign-in form is not a rich public entity and does not need schema.org or social-preview metadata.
be-private-and-secure `secure-transport-and-headers`	issues	high	Headers evidence finds no CSP, HSTS, nosniff, Referrer-Policy, or Permissions-Policy. The AntiForgery.WebExchange cookie is HttpOnly/SameSite=Strict but Secure=false. F04 high: The authentication boundary lacks several browser-enforced defenses and sets its anti-forgery cookie without Secure.
be-private-and-secure `data-minimisation-and-third-parties`	issues	high	Tracker and HAR evidence records three requests to wurfl.io and one Cloudflare Insights request, transferring 15,378 bytes; no known advertising tracker or third-party cookie was observed. F09 medium: The login contacts device-detection and analytics third parties before authentication.
be-private-and-secure `in-context-permissions-and-modern-auth`	issues	high	The only public authentication controls are username and password; both have an empty autocomplete attribute, and the DOM has no WebAuthn/passkey affordance. F05 medium: Sign-in is password-only and does not expose password-manager or passkey affordances.
be-private-and-secure `defensive-browser-policies`	issues	high	Headers evidence finds no CSP, HSTS, nosniff, Referrer-Policy, or Permissions-Policy. The AntiForgery.WebExchange cookie is HttpOnly/SameSite=Strict but Secure=false. F04 high: The authentication boundary lacks several browser-enforced defenses and sets its anti-forgery cookie without Secure.
be-resilient `progressive-enhancement`	pass	high	Raw server HTML is a complete ASP.NET sign-in form rather than an empty JS shell; title and description survive without JS.
be-resilient `resilient-runtime-behaviour`	pass	high	The simple public form has no overlays or async UI that clip or lose state; native required validation focuses the missing field.
be-resilient `offline-and-installable`	not-applicable	high	A live exchange/authentication service is intrinsically online; installability and offline transaction support are not appropriate for this public boundary.
be-resilient `network-and-http-failure-states`	issues	high	The HTTP probe returns 404 and the captured route shows Chrome’s generic “page can’t be found” screen, with no BpExch navigation, sign-in link, support route, or recovery context. F08 medium: Unknown routes fall through to the browser’s bare HTTP error page with no site-level recovery path.
be-internationalised `lang-dir-and-logical-properties`	pass	high	The rendered document declares html lang="en"; no bidirectional or translated content is exposed on this single-locale form.
be-internationalised `locale-aware-data`	not-applicable	high	The reachable sign-in form renders no dates, numbers, currencies, durations, or calendars.
be-internationalised `time-zone-correctness`	not-applicable	high	The reachable sign-in form exposes no time or event data.
be-trustworthy `no-dark-patterns`	pass	high	The public boundary shows one direct sign-in action with no upsell, consent manipulation, pricing, disguised advertising, or forced continuity.
be-trustworthy `humane-error-handling`	pass	high	Blank submission is prevented by native required validation, focuses username, and provides “Please fill in this field.” without premature errors.
be-trustworthy `trustworthy-input-assistance`	issues	high	The only public authentication controls are username and password; both have an empty autocomplete attribute, and the DOM has no WebAuthn/passkey affordance. F05 medium: Sign-in is password-only and does not expose password-manager or passkey affordances.
be-trustworthy `safe-commercial-and-account-flows`	blocked	high	Checkout, betting, account, cancellation, and sensitive-action flows are behind authentication; no valid account was supplied.
be-sustainable `optimised-assets`	issues	high	The images primitive reports one JPG with no width, height, srcset, or alt. Lighthouse also flags the unsized image; measured CLS remains low at 0.002. F07 low: The sole content image lacks intrinsic sizing, responsive sources, modern encoding, and alternative text.
be-sustainable `no-wasteful-work`	issues	high	HAR records 38 requests and 808,051 transferred bytes, including 11 parser-blocking stylesheets, 15 scripts, two jQuery copies, and 328 KB of fonts. Lighthouse estimates 129 KiB unused JS and 60 KiB unused CSS, with throttled LCP 3.8 s. F06 high: A simple two-field login ships a large, mostly unused legacy front-end stack.
be-sustainable `third-party-and-media-budget`	issues	high	HAR records 38 requests and 808,051 transferred bytes, including 11 parser-blocking stylesheets, 15 scripts, two jQuery copies, and 328 KB of fonts. Lighthouse estimates 129 KiB unused JS and 60 KiB unused CSS, with throttled LCP 3.8 s. F06 high: A simple two-field login ships a large, mostly unused legacy front-end stack.
be-agent-ready `structured-agent-capabilities`	not-applicable	high	This authenticated exchange exposes no declared agent-facing intent; emerging WebMCP capability is therefore out of scope.
be-agent-ready `on-device-inference`	not-applicable	high	The simple sign-in task has no appropriate summarisation, translation, or language-model use case.
be-memory-efficient `no-leak-under-repeated-interaction`	pass	high	After 10 representative focus/input/clear cycles, the independent post snapshot is 9.05 MB, only ~118 KB above baseline; no unbounded growth signal is visible.
be-memory-efficient `bounded-footprint`	pass	high	Baseline heap is 8.94 MB self size / 165,479 nodes, proportionate though somewhat library-heavy for a simple page.
be-memory-efficient `no-detached-dom-or-unbounded-listeners`	pass	medium	Neither heap summary exposes Detached* among retained constructors; 10 input cycles add only 12 closures and 9 arrays. Confidence is medium because raw retaining paths were not analysed.

Provenance

Canonical report: results/atomic/reports/0203-www_bpexch_live.json
Report SHA-256: b75626788a2768e7377e731dba5063c68e8f11454aa5b6056e0501ba2389fe4f
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_bpexch_live/2026-07-27T17-08-23-950Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_bpexch_live/2026-07-27T17-08-23-950Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7

Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.