{
  "schemaVersion": 1,
  "type": "resource",
  "id": "mantine",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser"
    ],
    "summary": "The official accordion toggled with Enter, moved to the next trigger with ArrowDown and exposed a visible panel with matching controls/label references. No Mantine package was installed and no form or import was submitted.",
    "reportUrl": "/design-evaluations/resource-mantine.json",
    "identity": {
      "target": "https://mantine.dev/core/accordion/",
      "version": "Unversioned public demo observed 2026-10-19; registry snapshot @mantine/core 9.7.3 was not locally executed.",
      "integrity": "Public document SHA-256 9e5240c5d89a7ec06d11770b7ea012c1cf50cca3c1e3350d2ee8f9b5811090f3; initial response only, not complete application integrity. Source snapshot e47e45af06427b3b2497100c2b849935c23af30d does not identify the hosted deployment."
    },
    "environment": [
      "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.",
      "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.",
      "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked."
    ],
    "tests": [
      {
        "name": "Public sample response",
        "mode": "http",
        "method": "Anonymous public GET; capture status, response-body hash and selected headers.",
        "result": "pass",
        "observation": "HTTP 200; https://mantine.dev/core/accordion/. Reachability only."
      },
      {
        "name": "Accordion keyboard expansion",
        "mode": "browser",
        "method": "Focus the first documented accordion trigger; press Enter twice and inspect aria-expanded.",
        "result": "pass",
        "observation": "Expanded true -> false -> true."
      },
      {
        "name": "Accordion arrow-key navigation",
        "mode": "browser",
        "method": "Focus the first trigger, press ArrowDown and inspect whether focus moves to the next trigger.",
        "result": "pass",
        "observation": "Focus moved to second trigger=true. Only this adjacent navigation step was exercised."
      },
      {
        "name": "Accordion panel association",
        "mode": "browser",
        "method": "Open the first trigger and verify its aria-controls target is visible with matching label reference.",
        "result": "pass",
        "observation": "{\"expanded\":\"true\",\"panelExists\":true,\"panelVisible\":true,\"labelMatches\":true}"
      }
    ],
    "security": {
      "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.",
      "findings": [
        {
          "level": "caution",
          "basis": "documented",
          "title": "Heading structure remains an application decision",
          "detail": "Mantine's Accordion documentation asks authors to set a suitable order for the page hierarchy. Its component API does not select the right heading level for your screen."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Sampled response and request surface",
          "detail": "The anonymous HTTPS demo response included none of the selected security response headers. Requests attempted 4 additional host(s), including fonts.googleapis.com, img.icons8.com, fonts.gstatic.com, www.googletagmanager.com. The guard blocked 1 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Check the installed dependency graph separately",
          "detail": "The registry snapshot identifies @mantine/core 9.7.3, but this review did not install or audit it. Lock and review the versions that actually enter your application; the hosted demo's success is not a dependency audit."
        }
      ],
      "limits": [
        "No authentication, authorization, tenant isolation, retention or backend processing was tested.",
        "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.",
        "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation."
      ]
    },
    "practicalCaveats": [
      "Older tutorials may target different React and styling requirements. Match documentation to your installed major version.",
      "Accordion heading order is application-specific and is not imposed automatically by the library.",
      "Component visibility and disabled states do not authorize imports, approvals or other backend changes."
    ],
    "limits": [
      "Only the documented accordion sample was tested; forms, dates, uploads, SSR, responsive layouts and optional packages were not exercised.",
      "Heading structure and associated labels were inspected for this sample only; no complete accessibility audit was performed."
    ],
    "sources": [
      {
        "label": "Official documentation",
        "url": "https://mantine.dev/getting-started/"
      },
      {
        "label": "Official evaluated sample",
        "url": "https://mantine.dev/core/accordion/"
      },
      {
        "label": "Upstream repository",
        "url": "https://github.com/mantinedev/mantine"
      },
      {
        "label": "GitHub repository snapshot endpoint",
        "url": "https://api.github.com/repos/mantinedev/mantine",
        "scope": "Star count and repository identity observed 2026-10-19."
      },
      {
        "label": "Sampled source revision",
        "url": "https://github.com/mantinedev/mantine/commit/e47e45af06427b3b2497100c2b849935c23af30d",
        "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit."
      },
      {
        "label": "Package manifest snapshot",
        "url": "https://registry.npmjs.org/@mantine/core/9.7.3",
        "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so."
      }
    ]
  }
}