{
  "schemaVersion": 1,
  "type": "resource",
  "id": "inclusive-components",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "limited",
    "modes": [
      "http",
      "browser",
      "source-review"
    ],
    "summary": "The article and its component reasoning were reviewed, but its public CodePen examples did not render in the account-free session. No working component interaction is claimed.",
    "reportUrl": "/design-evaluations/resource-inclusive-components.json",
    "identity": {
      "target": "https://inclusive-components.design/collapsible-sections/",
      "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.",
      "integrity": "Recorded document SHA-256 4791e6f714d443268a46ea9fc5acacade04039427ee41da402a2a584beaf2cc3. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service."
    },
    "environment": [
      "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.",
      "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.",
      "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence."
    ],
    "tests": [
      {
        "name": "Public document response",
        "mode": "http",
        "method": "Navigate to the recorded public target in a fresh anonymous browser.",
        "result": "pass",
        "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was 4791e6f714d443268a46ea9fc5acacade04039427ee41da402a2a584beaf2cc3; this fingerprints only the recorded HTML response."
      },
      {
        "name": "Access linked public examples",
        "mode": "browser",
        "method": "Load the collapsible-sections article and scroll to its embedded demonstrations; also open the first embed directly.",
        "result": "blocked",
        "observation": "The article returned 200, but all four embed requests returned 403. The direct embed showed a challenge page; challenge POST requests remained blocked."
      },
      {
        "name": "Primary-source scope review",
        "mode": "source-review",
        "method": "Read the official pages and relevant repository or standard references linked below.",
        "result": "pass",
        "observation": "Reviewed the author/project background and the 2017 collapsible-sections article. Its button, expanded-state and progressive-enhancement reasoning was read, not runtime-validated."
      },
      {
        "name": "Broader workflow and assurance coverage",
        "mode": "browser",
        "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.",
        "result": "not-run",
        "observation": "No live disclosure toggle, local reproduction, screen-reader interaction, purchased book content or site-wide pattern audit was executed."
      }
    ],
    "security": {
      "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "Embedded host is a separate trust boundary",
          "detail": "The public article requested Google fonts and four CodePen examples. Those examples were inaccessible in this session. A working article page does not establish the availability or behavior of its external demos."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Access controls were preserved",
          "detail": "The direct CodePen embed returned a challenge page. No account, challenge bypass or non-GET request was used to try to obtain the demo."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Review code in current context",
          "detail": "Treat historical example code as material to understand and review before use. Recheck current platform behavior, sanitize application data and avoid inserting untrusted content into markup merely because an educational example uses static labels."
        }
      ],
      "limits": [
        "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.",
        "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling."
      ]
    },
    "practicalCaveats": [
      "Use the article to write behavioral requirements, then test your own current implementation.",
      "The date matters: historical browser workarounds and present-day native alternatives should be reviewed before copying a pattern."
    ],
    "limits": [
      "No live disclosure toggle, local reproduction, screen-reader interaction, purchased book content or site-wide pattern audit was executed.",
      "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.",
      "Proposed use-case examples in this review were not implemented as a production workflow."
    ],
    "sources": [
      {
        "label": "Pattern article collection",
        "url": "https://inclusive-components.design/"
      },
      {
        "label": "Author and project background",
        "url": "https://inclusive-components.design/about-the-project/"
      },
      {
        "label": "Collapsible sections, published 26 October 2017",
        "url": "https://inclusive-components.design/collapsible-sections/"
      },
      {
        "label": "Linked public CodePen example",
        "url": "https://codepen.io/heydon/pen/QqzRvQ/",
        "scope": "Example destination; its embedded runtime was blocked in this review."
      }
    ]
  }
}