{
  "schemaVersion": 1,
  "type": "resource",
  "id": "open-props",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser",
      "local-fixture",
      "source-review"
    ],
    "summary": "Open Props 1.7.23 resolved the tested spacing, radius, color and responsive type tokens. Five local checks passed; a raw spin token kept moving under reduced motion until the consuming CSS added a media guard.",
    "reportUrl": "/design-evaluations/resource-open-props.json",
    "identity": {
      "target": "open-props",
      "version": "1.7.23",
      "integrity": "sha512-+xyrJmxV9QUBFbSwPROYhOg/FLXry+uuPr4R+B5EaE4556Oc18/8ZC/fL5A+/lbRSwNvA0Alh+C0KpyFWLmLZg=="
    },
    "environment": [
      "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.",
      "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables.",
      "Synthetic local inputs only. Package/skill source inspected before execution; no install lifecycle scripts run.",
      "Local package/CSS browser fixtures block real network. Variate additionally uses Node filesystem permissions and a no-network preload."
    ],
    "tests": [
      {
        "name": "Public document and DOM",
        "mode": "browser",
        "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay",
        "result": "pass",
        "observation": "HTTP 200; 70 captured button labels; 20 inputs; 0 canvases."
      },
      {
        "name": "Token application",
        "mode": "local-fixture",
        "method": "Apply size-4, radius-2 and blue-6 to a synthetic element",
        "result": "pass",
        "observation": "{\"padding\": \"20px\", \"borderRadius\": \"5px\", \"color\": \"rgb(34, 139, 230)\", \"fontSize\": \"16px\"}"
      },
      {
        "name": "Fluid font scale",
        "mode": "local-fixture",
        "method": "Measure font-size-fluid-1 at 320 and1280px viewports",
        "result": "pass",
        "observation": "{\"small\": 16, \"large\": 24}"
      },
      {
        "name": "Color-scheme shadow token",
        "mode": "local-fixture",
        "method": "Switch emulated color scheme and read shadow-color",
        "result": "pass",
        "observation": "{\"light\": \"220 3% 15%\", \"dark\": \"220 40% 2%\"}"
      },
      {
        "name": "Inline noise asset",
        "mode": "local-fixture",
        "method": "Apply noise-1 and inspect resolved background URL",
        "result": "pass",
        "observation": "{\"dataSvg\": true, \"outboundRequests\": 0}"
      },
      {
        "name": "Reduced motion requires consumer guard",
        "mode": "local-fixture",
        "method": "Compare raw spin token with an authored no-preference media wrapper",
        "result": "pass",
        "observation": "{\"normal\": [{\"id\": \"unguarded\", \"running\": 1}, {\"id\": \"guarded\", \"running\": 1}], \"reduced\": [{\"id\": \"unguarded\", \"running\": 1}, {\"id\": \"guarded\", \"running\": 0}], \"interpretation\": \"Observed raw animation token keeps running. The consumer media wrapper stops its own animation; this is not a claim of automatic library motion suppression.\"}"
      }
    ],
    "security": {
      "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. Also inspected pinned source and the specified synthetic fixture outputs. No active exploitation, authenticated permissions test or complete security audit.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "Animation tokens need a motion policy",
          "detail": "The same spin token ran under reduced motion. The authored no-preference wrapper stopped its own animation, showing that the consumer must decide when motion is appropriate."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Inspected package and isolated run",
          "detail": "The pinned package declares no runtime dependencies; registry SHA512 matched. The synthetic browser fixture made zero outbound requests. This does not establish all possible package behavior."
        }
      ],
      "limits": [
        "No authenticated workspace, private content, production backend permissions or data-retention verification.",
        "Only the pinned compiled CSS and representative tokens were exercised; no complete token-build, contrast or browser-compatibility audit."
      ]
    },
    "practicalCaveats": [
      "Map tokens into your own semantic names and add explicit reduced-motion rules before using animation tokens.",
      "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown."
    ],
    "limits": [
      "Only the pinned compiled CSS and representative tokens were exercised; no complete token-build, contrast or browser-compatibility audit.",
      "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures."
    ],
    "sources": [
      {
        "label": "Primary public resource",
        "url": "https://open-props.style/"
      },
      {
        "label": "Exact evaluated registry archive",
        "url": "https://registry.npmjs.org/open-props/-/open-props-1.7.23.tgz"
      }
    ]
  }
}