Evidence Engine — Evidence Pack

Site:        http://127.0.0.1:61546
Scan id:     0a66af8d-0518-4874-a029-1e9a547381a3
Scan started: 2026-10-29T16:53:46.121Z
Scan status: completed
Generated:   2026-10-29T16:54:46.494Z
App:         Evidence Engine v0.2.0 (build 0a8c9ca0)

What was tested
  Discoverable site scan within configured scope (profile: bounded_site, up to 4 page(s), up to 6 link target(s)). Checks run: Page availability, Link target availability, Resource (image/script/etc.) failures, Uncaught JavaScript exceptions, Console errors (console.error only), Horizontal overflow. Not run: Accessibility (automated, axe-core), Visual comparison (local). Viewports: desktop 1280x800; phone browser not run. Crawling cannot establish coverage of every application state, role, hidden route, or business workflow.
  Network scope: links to other sites and sitemap entries on other sites are listed but not requested. If a page on the site redirects to another site, the scan's browser follows that redirect and loads the other site's page once, without the scan's Basic Auth login or cookies, and the result is reported as a redirect. Every page the scan opens also loads its own images, scripts and fonts from wherever the page points, as any browser would.
  Addresses: in this app, in exports and in the saved database, query and fragment values are hidden unless they are plainly harmless (a short number, or a value such as page or sort). A hidden value shows as a short tag, so the same address always shows the same tag. The exact address of a finding is kept in one copy, protected with Windows, and is used only to recheck that finding. This is best effort: a secret inside the path of an address, in page text or in a screenshot is not removed.
  Links seen but not requested because the limit was reached are not tests and not passes.

Export completeness
  2 findings in scan, 2 exported
  16 audit rows, 16 exported
  Findings show each finding's recorded state at the time of this export (its latest observation, outcome and rechecks). They are not a reconstruction of how the findings stood when this scan finished. The audit rows are the original record of this scan.

Severity
  Severity is derived from stored scan data only: high = 5xx page/link response or uncaught JavaScript exception; medium = 4xx page/link response or console.error; low = failed sub-resource or horizontal overflow. A later recheck changes the outcome, never the severity recorded for an earlier observation.

Technical audit (judged as Staging or pre-launch copy)
  site-analysis/index.html
  site-analysis/pages.csv
  site-analysis/audit.csv
  site-analysis/site-analysis.json
  Judged as: Staging or pre-launch copy. Pages that ask search engines not to index them are expected here and are listed for information only. A staging page that search engines could index is flagged for review.
  Computed when this export was made, from the page facts stored at scan time, by the rules of Evidence Engine v0.2.0 (build 0a8c9ca0). The results are not frozen at scan time: a later build, or different thresholds, may judge the same stored scan differently.
  Thresholds used: titles 15-60 characters, meta descriptions 70-160 characters, near-duplicate content from an estimated 90% text similarity, pages under 30 words not compared. These are conventions, not rules.
  Items marked heuristic are judgement calls or estimates (length guidelines, similarity estimates, touch-target and text sizes, structured-data eligibility); they are for review and are not defects. Only items in the first group, Confirmed problems, are observed contradictions.
  Coverage: 3 pages judged; 1 not judged (not a loaded web page); 0 section links checked; 0 pages compared for duplicate text; 3 not compared (too little text, text cut at the read limit, or beyond the comparison limit); 0 JSON-LD blocks read (Microdata and RDFa are not read); 3 not read in the phone browser (the phone check is optional and needs the horizontal-overflow check).
  Custom search results say 'not evaluated' where a page's HTML was cut at the read limit and nothing was found in what was read, where a pattern timed out, or where a page could not be read. None of those is reported as absent or clean.
  The audit judges the pages the scan reached and loaded. It is not a complete audit of the site. Whether the scan applied robots.txt is stated in the coverage record (older settings do not apply it).

Contents
  handoff/index.html  Offline viewer: open it by double-click in any browser. Findings, audit log and evidence in one page; it makes no network request.
  evidence-report.pdf  Findings (most severe first), coverage, and what was not tested.
  audit.csv            Every check this scan attempted or skipped (16 rows).
  audit.json           The same audit trail plus scan configuration, coverage and 2 current-run finding(s).
  screenshots/         2 screenshot(s), named by the evidence id used in the CSV/JSON/PDF.
  MANIFEST-SHA256.txt  SHA-256 of every file in this pack.

Error coverage: JavaScript exception and console-error capture covers the page load only. An error raised later (a timer, or after a click or scroll) may be missed.

Accessibility check (automated): not run for this scan.

Visual comparison (local): not run for this scan.

Accessibility engine: axe-core (Deque Systems, MPL-2.0), shipped unmodified; source and licence: https://github.com/dequelabs/axe-core

This pack was produced on the scanning machine. Nothing in it was uploaded anywhere.
It is a local record, not a tamper-proof or compliance-certified one.
