{
  "schemaVersion": 1,
  "type": "resource",
  "id": "ark-ui",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser"
    ],
    "summary": "In the official React accordion, Enter switched the open panel and restored it, ArrowDown moved focus, and the visible panel's label/control references matched. The first single-panel collapse probe was corrected after inspecting the sample's single-open behavior.",
    "reportUrl": "/design-evaluations/resource-ark-ui.json",
    "identity": {
      "target": "https://ark-ui.com/docs/components/accordion",
      "version": "Unversioned public demo observed 2026-10-19; registry snapshot @ark-ui/react 5.39.3 was not locally executed.",
      "integrity": "Public document SHA-256 94585a0dbf699c72341b2cff348a0b4814c4fe99d88e22d3b2a9377473a909fd; initial response only, not complete application integrity. Source snapshot 300f6f39e9ec97a5924b5f816ac73aa484dd196d does not identify the hosted deployment."
    },
    "environment": [
      "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.",
      "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.",
      "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked."
    ],
    "tests": [
      {
        "name": "Public sample response",
        "mode": "http",
        "method": "Anonymous public GET; capture status, response-body hash and selected headers.",
        "result": "pass",
        "observation": "HTTP 200; https://ark-ui.com/docs/components/accordion. Reachability only."
      },
      {
        "name": "Accordion keyboard expansion",
        "mode": "browser",
        "method": "Use Enter to change the documented accordion state and restore it; single-open samples switch between two panels.",
        "result": "pass",
        "observation": "Exclusive selection states [\"false\",\"true\"] then [\"true\",\"false\"]; this sample does not collapse the only open panel."
      },
      {
        "name": "Accordion arrow-key navigation",
        "mode": "browser",
        "method": "Focus the first trigger, press ArrowDown and inspect whether focus moves to the next trigger.",
        "result": "pass",
        "observation": "Focus moved to second trigger=true. Only this adjacent navigation step was exercised."
      },
      {
        "name": "Accordion panel association",
        "mode": "browser",
        "method": "Open the first trigger and verify its aria-controls target is visible with matching label reference.",
        "result": "pass",
        "observation": "{\"expanded\":\"true\",\"panelExists\":true,\"panelVisible\":true,\"labelMatches\":true}"
      }
    ],
    "security": {
      "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "Accordion configuration changes the contract",
          "detail": "The first accordion kept its only open panel expanded when Enter was pressed again. Selecting another item changed the open panel as expected. Choose and test single-open, multiple-open and collapsible behavior explicitly."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Sampled response and request surface",
          "detail": "The anonymous HTTPS demo response included strict-transport-security. Requests attempted 1 additional host(s), including plausible.io. The guard blocked 1 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Check the installed dependency graph separately",
          "detail": "The registry snapshot identifies @ark-ui/react 5.39.3, but this review did not install or audit it. Lock and review the versions that actually enter your application; the hosted demo's success is not a dependency audit."
        }
      ],
      "limits": [
        "No authentication, authorization, tenant isolation, retention or backend processing was tested.",
        "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.",
        "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation."
      ]
    },
    "practicalCaveats": [
      "A multi-framework offering does not prove every adapter behaves identically in your app.",
      "Single-open and collapsible accordion settings change what Enter does. Match the configuration to the intended task.",
      "State-machine transitions organize UI behavior; they do not provide backend authorization or sanitize untrusted content."
    ],
    "limits": [
      "Only the public React accordion was exercised. No local adapter was installed and no Vue, Solid or Svelte parity claim was tested.",
      "Collections, file uploads, floating panels, SSR, performance and assistive technologies were outside the sample scope."
    ],
    "sources": [
      {
        "label": "Official documentation",
        "url": "https://ark-ui.com/docs/overview/getting-started"
      },
      {
        "label": "Official evaluated sample",
        "url": "https://ark-ui.com/docs/components/accordion"
      },
      {
        "label": "Upstream repository",
        "url": "https://github.com/chakra-ui/ark"
      },
      {
        "label": "GitHub repository snapshot endpoint",
        "url": "https://api.github.com/repos/chakra-ui/ark",
        "scope": "Star count and repository identity observed 2026-10-19."
      },
      {
        "label": "Sampled source revision",
        "url": "https://github.com/chakra-ui/ark/commit/300f6f39e9ec97a5924b5f816ac73aa484dd196d",
        "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit."
      },
      {
        "label": "Package manifest snapshot",
        "url": "https://registry.npmjs.org/@ark-ui/react/5.39.3",
        "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so."
      },
      {
        "label": "Framework and state-machine overview",
        "url": "https://ark-ui.com/docs/overview/about"
      }
    ]
  }
}