{
  "schemaVersion": 1,
  "type": "resource",
  "id": "carbon-design-system",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser",
      "source-review"
    ],
    "summary": "A public React accordion opened with Enter and closed with Space while its expanded state and visible content stayed aligned. This covers one default demo in one browser.",
    "reportUrl": "/design-evaluations/resource-carbon-design-system.json",
    "identity": {
      "target": "https://react.carbondesignsystem.com/iframe.html?id=components-accordion--default&globals=theme:white",
      "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.",
      "integrity": "Recorded document SHA-256 c18b96285d72f81918cf621af9d4c597ea3a7ddd7ca194c2283d785ef5e0102a. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service."
    },
    "environment": [
      "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.",
      "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.",
      "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence."
    ],
    "tests": [
      {
        "name": "Public document response",
        "mode": "http",
        "method": "Navigate to the recorded public target in a fresh anonymous browser.",
        "result": "pass",
        "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was c18b96285d72f81918cf621af9d4c597ea3a7ddd7ca194c2283d785ef5e0102a; this fingerprints only the recorded HTML response."
      },
      {
        "name": "Accordion keyboard operation",
        "mode": "browser",
        "method": "Focus the first button in the public default React accordion; press Enter, then Space.",
        "result": "pass",
        "observation": "The “Choose your plan” button changed aria-expanded false → true → false. Its supporting content appeared and disappeared, and focus remained on the button."
      },
      {
        "name": "Primary-source scope review",
        "mode": "source-review",
        "method": "Read the official pages and relevant repository or standard references linked below.",
        "result": "pass",
        "observation": "Reviewed IBM’s design-system overview, the dated accordion guidance and the official repository metadata. No package or installed dependency graph was evaluated."
      },
      {
        "name": "Broader workflow and assurance coverage",
        "mode": "browser",
        "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.",
        "result": "not-run",
        "observation": "No package installation, full Storybook sweep, screen-reader test, employee login or application data flow was performed."
      }
    ],
    "security": {
      "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.",
      "findings": [
        {
          "level": "info",
          "basis": "observed",
          "title": "Isolated demo request surface",
          "detail": "The standalone accordion sample requested only react.carbondesignsystem.com. No non-GET request, HTTP error or page error was observed during its toggle. The main documentation site has a different request surface."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Disclosure is not authorization",
          "detail": "Collapsing a panel hides presentation; it must not be used to protect information the current user is not allowed to receive. Apply authorization before rendering or returning sensitive content."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Review the installed implementation",
          "detail": "The public Storybook sample does not establish the security of your dependency versions, custom handlers or server data. Pin and review the components you ship."
        }
      ],
      "limits": [
        "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.",
        "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling."
      ]
    },
    "practicalCaveats": [
      "Keep essential instructions and blocking errors discoverable outside optional collapsed sections.",
      "After styling or adding content, retest state, focus, long labels and keyboard operation in the integrated page."
    ],
    "limits": [
      "No package installation, full Storybook sweep, screen-reader test, employee login or application data flow was performed.",
      "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.",
      "Proposed use-case examples in this review were not implemented as a production workflow."
    ],
    "sources": [
      {
        "label": "Carbon design system",
        "url": "https://www.carbondesignsystem.com/"
      },
      {
        "label": "Accordion guidance",
        "url": "https://www.carbondesignsystem.com/building-blocks/core/components/accordion/guidelines"
      },
      {
        "label": "Public React accordion demo",
        "url": "https://react.carbondesignsystem.com/iframe.html?id=components-accordion--default&globals=theme:white"
      },
      {
        "label": "Official repository",
        "url": "https://github.com/carbon-design-system/carbon"
      }
    ]
  }
}