{
  "schemaVersion": 1,
  "type": "resource",
  "id": "headless-ui",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser"
    ],
    "summary": "Inside the official React example iframe, Space and pointer clicks toggled the Switch and restored its initial state. The disabled-control selector searched only the parent document and matched no control; iframe disabled behavior remains untested. This unmet check is a harness coverage gap, not a product defect finding.",
    "reportUrl": "/design-evaluations/resource-headless-ui.json",
    "identity": {
      "target": "https://headlessui.com/react/switch",
      "version": "Unversioned public demo observed 2026-10-19; registry snapshot @headlessui/react 2.2.10 was not locally executed.",
      "integrity": "Public document SHA-256 45a00f702037b4e21f107a3a7eca3eee0b93cea346ff6cbe91f26e385d764900; initial response only, not complete application integrity. Source snapshot eea57cf46fd6767ed1059012f7073b88eb159fba does not identify the hosted deployment."
    },
    "environment": [
      "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.",
      "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.",
      "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked."
    ],
    "tests": [
      {
        "name": "Public sample response",
        "mode": "http",
        "method": "Anonymous public GET; capture status, response-body hash and selected headers.",
        "result": "pass",
        "observation": "HTTP 200; https://headlessui.com/react/switch. Reachability only."
      },
      {
        "name": "Keyboard selection cycle",
        "mode": "browser",
        "method": "Focus the first documented checkbox/switch; press Space twice and inspect its checked state.",
        "result": "pass",
        "observation": "Checked false -> true -> false. No external form submitted."
      },
      {
        "name": "Pointer selection cycle",
        "mode": "browser",
        "method": "Click the same sample control twice and inspect state restoration.",
        "result": "pass",
        "observation": "Pointer toggled state=true; original state restored=true."
      },
      {
        "name": "Disabled sample coverage",
        "mode": "browser",
        "method": "Search the parent document for a disabled control; the selector did not enter the Switch example iframe.",
        "result": "fail",
        "observation": "The parent-document selector matched no disabled control. The working Switch was inside an iframe, which this disabled selector did not inspect. Iframe disabled behavior remains untested; this is a harness coverage gap, not an established product defect."
      }
    ],
    "security": {
      "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.",
      "findings": [
        {
          "level": "caution",
          "basis": "advice",
          "title": "A switch cannot confirm a saved preference",
          "detail": "Treat an optimistic UI change and a server-accepted preference as separate states. Add failure handling and server-side permission checks when connecting the component to an account."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Sampled response and request surface",
          "detail": "The anonymous HTTPS demo response included strict-transport-security. Requests attempted 2 additional host(s), including static.cloudflareinsights.com, rsms.me. The guard blocked 2 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Check the installed dependency graph separately",
          "detail": "The registry snapshot identifies @headlessui/react 2.2.10, but this review did not install or audit it. Lock and review the versions that actually enter your application; the hosted demo's success is not a dependency audit."
        }
      ],
      "limits": [
        "No authentication, authorization, tenant isolation, retention or backend processing was tested.",
        "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.",
        "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation."
      ]
    },
    "practicalCaveats": [
      "The hosted React demo runs in an iframe; a successful parent documentation page does not by itself verify the component.",
      "The disabled selector inspected only the parent document and matched no control. Disabled behavior inside the Switch iframe remains untested.",
      "Repository popularity does not establish current growth. Its latest recorded commit in this snapshot was April 2026."
    ],
    "limits": [
      "Only one React Switch was exercised; Vue, dialogs, menus, SSR and package integration were not tested.",
      "The parent-document disabled probe establishes a harness coverage gap only; it did not inspect disabled controls inside the example iframe. No account, preference save or backend permission was tested."
    ],
    "sources": [
      {
        "label": "Official evaluated sample",
        "url": "https://headlessui.com/react/switch"
      },
      {
        "label": "Upstream repository",
        "url": "https://github.com/tailwindlabs/headlessui"
      },
      {
        "label": "GitHub repository snapshot endpoint",
        "url": "https://api.github.com/repos/tailwindlabs/headlessui",
        "scope": "Star count and repository identity observed 2026-10-19."
      },
      {
        "label": "Sampled source revision",
        "url": "https://github.com/tailwindlabs/headlessui/commit/eea57cf46fd6767ed1059012f7073b88eb159fba",
        "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit."
      },
      {
        "label": "Package manifest snapshot",
        "url": "https://registry.npmjs.org/@headlessui/react/2.2.10",
        "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so."
      },
      {
        "label": "Official isolated React Switch demo",
        "url": "https://headlessui.com/examples/react-switch"
      }
    ]
  }
}