{
  "schemaVersion": 1,
  "type": "resource",
  "id": "coss-ui",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser"
    ],
    "summary": "A documented accordion responded to Enter with aria-expanded false → true → false. This was the hosted sample, not a local Base UI integration.",
    "reportUrl": "/design-evaluations/resource-coss-ui.json",
    "identity": {
      "target": "https://coss.com/ui/docs/components/accordion",
      "version": "Unversioned public page checked 2026-10-19",
      "integrity": "sha256:23a635fbf6fed1a3261f527395fdacca655526368d7d0edbc5419411eccf7ca9"
    },
    "environment": [
      "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.",
      "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables."
    ],
    "tests": [
      {
        "name": "Public document and DOM",
        "mode": "browser",
        "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay",
        "result": "pass",
        "observation": "HTTP 200; 3 captured button labels; 0 inputs; 0 canvases."
      },
      {
        "name": "Accordion keyboard toggle",
        "mode": "browser",
        "method": "Focus the first accordion trigger; press Enter twice and inspect aria-expanded",
        "result": "pass",
        "observation": "aria-expanded false -> true -> false; label What is Base UI?."
      }
    ],
    "security": {
      "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "State semantics were observed in one accordion",
          "detail": "The tested trigger exposed its expanded state and accepted keyboard activation. That result does not transfer automatically to every copied component or customized wrapper."
        }
      ],
      "limits": [
        "No authenticated workspace, private content, production backend permissions or data-retention verification.",
        "No local install, full accordion key-map review or assistive-technology test."
      ]
    },
    "practicalCaveats": [
      "Keep the trigger semantics and keyboard behavior when adapting the component; test content that changes height or wraps.",
      "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown."
    ],
    "limits": [
      "No local install, full accordion key-map review or assistive-technology test.",
      "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures."
    ],
    "sources": [
      {
        "label": "Primary public resource",
        "url": "https://coss.com/ui"
      },
      {
        "label": "Evaluated public sample",
        "url": "https://coss.com/ui/docs/components/accordion"
      }
    ]
  }
}