Manifest position 503 · CrUX rank bucket 1000

https://www.universal-credit.service.gov.uk

Partial after retries

Public surfaces were audited, but protected claimant flows and one stable form-validation state prevented full atomic completion.

Attempts

3 / 3

Judged checks

55 / 58

Blocked

Not run

This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.

All 58 atomic check outcomes

Principle / check	Status	Confidence	Evidence or reason
respect-user-preferences `respects-color-scheme`	issues	high	The dark-condition screenshot is pixel-identical in surface treatment to the desktop screenshot; the DOM reports color-scheme: normal and a white body background. F01 medium: The service remains light-only when the user requests a dark colour scheme.
respect-user-preferences `respects-reduced-motion`	pass	high	No active animations were present, so no non-essential motion remained under the requested reduced-motion condition.
respect-user-preferences `respects-contrast`	pass	high	Lighthouse contrast passed; high-visibility yellow/black focus states remained visible and prefers-contrast was active in the probe.
implement-natural-interactions `view-transitions`	pass	high	The simple server-rendered multi-page journey changes at clear document boundaries and does not contain abrupt in-page state swaps requiring animation.
implement-natural-interactions `scroll-driven-animations`	not-applicable	high	The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required.
implement-natural-interactions `physical-gestures`	not-applicable	high	The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required.
provide-guided-navigation `scroll-state-aware-chrome`	not-applicable	high	The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required.
provide-guided-navigation `anchored-positioning`	not-applicable	high	The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required.
provide-guided-navigation `directs-attention`	pass	high	Distinct H1 headings, skip link, recovery links and consistent GOV.UK navigation make the destination and next action clear.
maximize-content-reduce-noise `no-intrusive-interruptions`	pass	high	The consent region pushes content rather than obscuring it, offers equal accept/reject actions, and links to detail.
maximize-content-reduce-noise `semantic-dismissible-primitives`	not-applicable	high	The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required.
maximize-content-reduce-noise `reduced-chrome`	pass	high	The restrained GOV.UK shell uses whitespace and a narrow content column; primary content dominates after the explicit consent region.
adapt-to-the-form-factor `responsive-no-horizontal-scroll`	pass	high	scrollWidth, clientWidth and innerWidth were all 360px; horizontalOverflowPx was 0 and CLS was 0.
adapt-to-the-form-factor `component-level-responsiveness`	not-applicable	high	The sampled pages do not contain the feature this contextual check governs (no scroll-linked animation, gesture surface, positioned overlay, or reused container-sensitive component), so no implementation is required.
adapt-to-the-form-factor `input-modality-aware`	pass	high	Visible yellow/black focus treatment appeared on fields, buttons and links; primary controls were 38-40px high with generous surrounding spacing.
support-core-task-success `clear-purpose-and-primary-action`	pass	high	The H1 states Universal Credit online and the page immediately explains its uses with clearly differentiated Create an account and Sign in paths.
support-core-task-success `primary-flow-completion`	blocked	high	End-to-end account creation/claim completion requires real claimant identity and personal data; the public entry and sign-in surfaces were inspected, but protected completion was not attempted.
support-core-task-success `clear-system-state-and-recovery`	pass	high	Forgotten username/password, contact/help routes and a real 404 response provide clear recovery routes for sampled states.
be-fast-and-stable `good-core-web-vitals`	pass	high	Trace measured FCP 338ms, LCP 391ms, no long tasks and 0ms TBT; Lighthouse lab LCP was 2.3s with CLS effectively 0.
be-fast-and-stable `visual-stability`	pass	high	The layout observer measured CLS 0 with no shifts; Lighthouse also reported CLS 0.
be-fast-and-stable `efficient-main-thread`	pass	high	The trace recorded no long tasks and 0ms total blocking time; Lighthouse TBT was 10ms.
be-fast-and-stable `efficient-resource-delivery`	issues	high	The HAR records a 467,516-byte claimant script plus two other uncompressed scripts; the live DOM confirms all three external scripts have async=false, defer=false and no module type. F02 medium: Large parser-inserted scripts are delivered uncompressed and without async, defer or module semantics.
be-fast-and-stable `trim-unused-and-duplicate-code`	issues	high	Lighthouse estimates 272 KiB of unused JavaScript in claimant.js and 42 KiB of unused CSS; the HAR shows 650,809 transferred bytes for a simple text/form entry page. F03 medium: The entry page ships substantial unused JavaScript and CSS.
be-inclusive `names-roles-labels`	pass	high	Lighthouse accessibility scored 100; links/buttons had names and sign-in fields had explicit labels.
be-inclusive `sufficient-contrast`	pass	high	Lighthouse reported no colour-contrast failures.
be-inclusive `structure-and-focus`	pass	high	Logical H1/landmark structure and highly visible focus styles were observed on all sampled visible controls.
be-inclusive `legible-text`	pass	high	Text uses comfortable GOV.UK sizing, line length, spacing and strong hierarchy without clipping on sampled viewports.
be-inclusive `zoom-reflow-targets-and-media`	pass	high	Viewport permits scaling, the 360px layout reflows without overflow, and no audio/video required alternatives.
follow-best-practices `no-console-errors`	pass	high	Lighthouse found no errors logged to the console.
follow-best-practices `sound-document-and-assets`	pass	high	HTML doctype, UTF-8 charset and viewport are present; no img elements had sizing/alt defects; Lighthouse best practices scored 100.
follow-best-practices `browser-platform-hygiene`	pass	high	Lighthouse best practices scored 100; no permission prompt appeared on load and no paste prevention was observed. The no-store BFCache limitation is proportionate for a sensitive benefits service.
be-discoverable `title-and-description`	issues	high	The page probe and discoverability primitive found a descriptive title and H1 but no meta[name=description]. F07 low: The public entry document has no meta description.
be-discoverable `crawlable-and-mobile-friendly`	pass	high	Links use real href values, the viewport meta is correct, and robots Disallow plus noindex are consistent with this deliberately gated account service rather than accidental indexing loss.
be-discoverable `canonical-and-indexing-signals`	pass	high	The entry document returns 200 and its robots/noindex signals consistently exclude the private application; the absence of a sitemap is intentional for the gated service.
be-discoverable `structured-and-shareable-metadata`	not-applicable	high	This authenticated benefits application explicitly returns robots Disallow: / and page-level noindex; public indexing, rich metadata and share previews are intentionally out of scope.
be-private-and-secure `secure-transport-and-headers`	pass	high	HTTPS, one-year HSTS, nonce/hash CSP, frame-ancestors DENY, nosniff, Secure+HttpOnly cookies and zero exposed secrets were observed.
be-private-and-secure `data-minimisation-and-third-parties`	pass	high	No third-party origin, tracker or third-party byte was requested before analytics consent.
be-private-and-secure `in-context-permissions-and-modern-auth`	issues	high	The sign-in DOM contains username and password controls; the auth probe found no navigator.credentials usage or other passkey affordance on the page. F04 high: The public sign-in surface exposes password-only authentication with no passkey option.
be-private-and-secure `defensive-browser-policies`	issues	high	The final /start response has HSTS, nosniff, DENY/frame-ancestors and a nonce/hash CSP, but script-src includes unsafe-eval and no Referrer-Policy or Permissions-Policy headers are present. F05 medium: The otherwise strong browser-security headers retain unsafe-eval and omit Referrer-Policy and Permissions-Policy.
be-resilient `progressive-enhancement`	pass	high	Raw HTML retained 100% of rendered content words with title and H1 present; the site is not a JS shell.
be-resilient `resilient-runtime-behaviour`	pass	high	Simple server-rendered pages, native links/forms and no custom overlay positioning reduced runtime fragility on sampled public routes.
be-resilient `offline-and-installable`	not-applicable	high	This benefits account service is intrinsically online and handles live private account state; offline/installable behavior is not a reasonable requirement for the sampled public surface.
be-resilient `network-and-http-failure-states`	pass	high	A non-existent route returned HTTP 404 with a Page not found document rather than a blank shell.
be-internationalised `lang-dir-and-logical-properties`	not-applicable	high	The sampled public service is deliberately UK English (en-GB) and contains no locale-sensitive dates, numbers, currencies or time-zone data; multilingual/localized operation was not part of the public surface.
be-internationalised `locale-aware-data`	not-applicable	high	The sampled public service is deliberately UK English (en-GB) and contains no locale-sensitive dates, numbers, currencies or time-zone data; multilingual/localized operation was not part of the public surface.
be-internationalised `time-zone-correctness`	not-applicable	high	The sampled public service is deliberately UK English (en-GB) and contains no locale-sensitive dates, numbers, currencies or time-zone data; multilingual/localized operation was not part of the public surface.
be-trustworthy `no-dark-patterns`	pass	high	Accept and Reject analytics choices have equal visual weight; no forced continuity, disguised advertising or confirmshaming was observed.
be-trustworthy `humane-error-handling`	blocked	high	A blank-submit interaction was attempted, but the evidence primitive did not capture a stable post-validation state before browser teardown; no pass or failure is asserted.
be-trustworthy `trustworthy-input-assistance`	issues	high	The auth and sign-in probes show no autocomplete attribute on either userName or password. F06 medium: The sign-in fields omit standard autocomplete tokens.
be-trustworthy `safe-commercial-and-account-flows`	blocked	high	Protected account-management and reauthentication states require a real claimant account and credentials, which were unavailable and were not fabricated.
be-sustainable `optimised-assets`	pass	high	No img elements were shipped; the only image resource is a reusable vector crest and there is no heavy media.
be-sustainable `no-wasteful-work`	pass	high	No long tasks, background third-party calls or media work ran during the sampled load.
be-sustainable `third-party-and-media-budget`	pass	high	Zero third-party bytes and no audio/video were observed; fonts and the crest are first-party.
be-agent-ready `structured-agent-capabilities`	not-applicable	high	No declared agent-facing intent exists for this sensitive benefits/account service; exposing transactional tools is an emerging contextual capability, not assumed safe.
be-agent-ready `on-device-inference`	not-applicable	high	No declared agent-facing intent exists for this sensitive benefits/account service; exposing transactional tools is an emerging contextual capability, not assumed safe.
be-memory-efficient `no-leak-under-repeated-interaction`	not-applicable	high	No safe, repeatable client-side interaction exists on the sampled server-rendered public pages; account submission requires real claimant data, so a synthetic ten-cycle interaction was not fabricated.
be-memory-efficient `bounded-footprint`	pass	high	The static entry page used about 5.8MB self size with 113,959 heap nodes, proportionate to the simple page and with no dominant application-object population.
be-memory-efficient `no-detached-dom-or-unbounded-listeners`	pass	high	Baseline and post-attempt snapshots were close (5,818,314 vs 5,862,606 bytes; 113,959 vs 114,487 nodes) and no Detached* constructor appeared among retained top constructors.

Provenance

Canonical report: results/atomic/reports/0503-www_universal-credit_service_gov_uk.json
Report SHA-256: 31fbd5fd729434bbb18ccea78aff55eff87f097f3e86eabdb7dc9d3145f403b2
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_universal-credit_service_gov_uk/2026-07-28T01-02-19-668Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/www_universal-credit_service_gov_uk/2026-07-28T01-02-19-668Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7

Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.