{
  "schemaVersion": 1,
  "type": "resource",
  "id": "a11y-project",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser",
      "source-review"
    ],
    "summary": "The public checklist loaded and one item toggled on and off with Space. This checks the reference page’s control, not the accessibility of any application or the completeness of the checklist.",
    "reportUrl": "/design-evaluations/resource-a11y-project.json",
    "identity": {
      "target": "https://www.a11yproject.com/checklist/",
      "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.",
      "integrity": "Recorded document SHA-256 0ef7aed28e1c7969902251e87a4fe3c2cc5659524ac70abed2507563e3890996. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service."
    },
    "environment": [
      "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.",
      "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.",
      "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence."
    ],
    "tests": [
      {
        "name": "Public document response",
        "mode": "http",
        "method": "Navigate to the recorded public target in a fresh anonymous browser.",
        "result": "pass",
        "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was 0ef7aed28e1c7969902251e87a4fe3c2cc5659524ac70abed2507563e3890996; this fingerprints only the recorded HTML response."
      },
      {
        "name": "Keyboard checklist toggle",
        "mode": "browser",
        "method": "Focus the plain-language checkbox in a fresh anonymous browser; press Space twice.",
        "result": "pass",
        "observation": "The checkbox changed false → true → false. The page contained 64 checkbox controls; only this control was exercised."
      },
      {
        "name": "Primary-source scope review",
        "mode": "source-review",
        "method": "Read the official pages and relevant repository or standard references linked below.",
        "result": "pass",
        "observation": "Reviewed the project’s purpose, checklist coverage and W3C’s current note that Parsing 4.1.1 was removed from WCAG 2.2."
      },
      {
        "name": "Broader workflow and assurance coverage",
        "mode": "browser",
        "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.",
        "result": "not-run",
        "observation": "No application audit, screen-reader session, checklist persistence test or full traversal of all 64 controls was performed."
      }
    ],
    "security": {
      "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.",
      "findings": [
        {
          "level": "info",
          "basis": "observed",
          "title": "Small sampled request surface",
          "detail": "The checklist sample requested its own origin and a Google Cloud Storage asset origin. No non-GET request or page error was observed during this bounded interaction."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "HTTPS response hardening",
          "detail": "The sampled checklist response included Strict-Transport-Security with max-age 31536000. This describes one response and does not establish an application-wide security posture."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Keep review evidence in your own system",
          "detail": "The public checkbox is a learning aid. Record actual findings, affected pages and sensitive screenshots in an approved internal review system rather than treating this public page as a team evidence store."
        }
      ],
      "limits": [
        "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.",
        "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling."
      ]
    },
    "practicalCaveats": [
      "Use the checklist to generate work, then record verifiable findings and owners.",
      "Map the chosen checks to the current standard and product scope; do not infer conformance from a filled checklist."
    ],
    "limits": [
      "No application audit, screen-reader session, checklist persistence test or full traversal of all 64 controls was performed.",
      "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.",
      "Proposed use-case examples in this review were not implemented as a production workflow."
    ],
    "sources": [
      {
        "label": "Project and learning resources",
        "url": "https://www.a11yproject.com/"
      },
      {
        "label": "Manual accessibility checklist",
        "url": "https://www.a11yproject.com/checklist/"
      },
      {
        "label": "Official repository",
        "url": "https://github.com/a11yproject/a11yproject.com"
      },
      {
        "label": "W3C: Parsing is obsolete and removed in WCAG 2.2",
        "url": "https://www.w3.org/WAI/WCAG22/Understanding/parsing.html"
      }
    ]
  }
}