[MrDarkRoot]

Fixes nothing in the plugin. Records the #324 seatbelt demonstration against repository commit 3be680557c476f30e93e45cf7bf0bc62009ef8c6 (plugin header 0.2.0). Do not merge this as a release and do not upload the media to WordPress.org SVN.

Scope

Disposable demo only: Docker fixtures, the scenario script, captions, database evidence, and the recorded MP4, WebM, GIF, and poster under demo/324-seatbelt/. No plugin, readme, or wordpress/assets/ change.

Invariant / Current Spec Reference

Unreleased demonstration of the tree at 3be6805. WordPress.org currently distributes 0.2.2, which was not the build on camera. The conflict is Bulk Prices optimistic concurrency on the reviewed regular price. The denial is the grant perimeter on PUT /wp-json/wc/v3/products/{id} for a restricted user, matching the #311 rest_update cell. The audit object_id is the actor user id, not the product id.

Relevant Canonical CC-* Tests (docs/test-plan.md)

None added. This PR does not change the test plan. The scenario assertions live in demo/324-seatbelt/capture.cjs and are demo evidence, not a canonical CC gate.

What Changed

• demo/324-seatbelt/run.sh builds a disposable WordPress 7.1.2 / PHP 8.2.34 / WooCommerce 11.1.2 / MySQL 8.0.44 InnoDB site, stages the distribution allowlist, seeds fictional product Northwind Canvas Tote, and tears the stack down.
• Playwright records the admin. A second shop manager sets the regular price to $120.00 after a preview of $100.00 to $80.00. Apply reports "Newer price kept" and leaves $120.00.
• Riley Agent, a shop manager restricted by a grant, sends PUT /wp-json/wc/v3/products/10 with regular_price 49.99. The response is HTTP 403 writeleash_perimeter_denied. Product-row sha256 stays eb57b6df695e52df0bba3856b7ed70c485e6233b7d22997bc49f299285ebdde9.
• Captions in out/captions.en.vtt are fitted to the 63.8 s MP4. out/scenes.json is the longer runner clock and is not the caption timeline.
• Object cache on this recording is WordPress's default non-persistent cache. MariaDB and Redis were not used.

Security Impact

No new enforcement. The clip shows the existing conflict check and the existing REST denial. It does not claim a firewall, universal protection, hostile-plugin isolation, or an agent-safe store. Passwords for the disposable users are generated per run into gitignored runtime/secrets.json. The committed evidence redacts the application password.

PostgreSQL Semantics Considered

Not applicable. The recorded engine is MySQL 8.0.44, wp_posts InnoDB.

Adversarial / Bypass Testing

The recorded request is one real REST PUT from a restricted grant actor. HTTP 403, unchanged product rows, and the debug-log denial line are in out/evidence.json. This does not add a bypass matrix.

Limitations / Unknowns

Deliverable	Result
MP4, 1440×900 H.264, 63.8 s, 5,071,159 bytes	PASS
WebM source, 1440×900 VP8, 63.8 s, 4,986,621 bytes	PASS
GIF, 960×600, 15.0 s, loop forever, 448,895 bytes	PASS
Poster PNG, 1440×900, 138,873 bytes	PASS
English captions fitted to this MP4	PASS
Docker fixtures and scenario	PASS
Before/after database evidence	PASS
Asset metadata and publication notes	PASS
WordPress.org SVN upload	NOT PERFORMED
MariaDB and Redis modes	NOT_TESTED
WordPress.org 0.2.2 zip as the recorded build	NOT_TESTED

Preview hash 833f68687def9f21c1b4874ee6a1a5d0e3558665c29dfee1c2dd82d512cfdcad at regular price 100.00. After the colleague edit, after Apply, and after the denied PUT, the hash is eb57b6df695e52df0bba3856b7ed70c485e6233b7d22997bc49f299285ebdde9 and the regular price is 120.00. Counts stay 1 post, 20 meta rows, 1 lookup row across the denial.

A fresh run.sh overwrites captions.en.vtt from the runner clock. Check that file against the new pictures before replacing these cues. The H.264 encode logs one OpenH264 cmInitParaError and the decoded MP4 frames still match the WebM.

Playable files:

• demo/324-seatbelt/out/writeleash-seatbelt-demo.mp4
• demo/324-seatbelt/out/writeleash-seatbelt-demo.webm
• demo/324-seatbelt/out/writeleash-seatbelt-loop.gif
• demo/324-seatbelt/out/writeleash-seatbelt-poster.png
• demo/324-seatbelt/out/captions.en.vtt

Out-of-Scope Work Explicitly Not Included

• I did not silently expand the support envelope.
• I updated the current spec, test plan, threat model, or decisions if behavior changed. Behavior did not change, so those docs are untouched.
• Security-sensitive behavior has adversarial test coverage. Existing coverage is unchanged. This PR adds a demo recording, not a new CC test.
• No secrets or credentials are included.

Do not merge, do not publish, and do not commit these media files to WordPress.org SVN. The GIF and poster are under the 2 MiB non-icon cap and are still not listing banners (772×250, 1544×500) or icons (128, 256).

[MrDarkRoot]

QA verdict: FAIL at e585712423368da247d0a8d1be3faa1dff2888a5.

Mergeable against main, not behind. PR_FAST, CI_COVERAGE, and native / native-pg16-security succeeded. Acceptance skipped. No plugin, readme, or wordpress/assets/ change. Disposable MySQL passwords in demo/324-seatbelt/docker-compose.yml are fixture values. Generated passwords stay in gitignored runtime/secrets.json. No production credential found in the committed text.

This does not replace merged PR #333 (f43d593, head f7b4853). #333 is the AddSynapse WC_Product::save() denial already on main. This PR still adds the older conflict-plus-REST film under demo/324-seatbelt/ plus demo/324-third-party/SOCIAL.md.

SOCIAL.md is honest: header 0.2.0 at 0e4ac688, not the WordPress.org 0.2.2 package and not a recording of public 0.3.0, not a firewall. The seatbelt evidence is not. demo/324-seatbelt/out/versions.json, demo/324-seatbelt/run.sh, and demo/324-seatbelt/out/captions.en.vtt still say the directory package is 0.2.2. The directory is 0.3.0 (zip writeleash.0.3.0.zip, 1618335 bytes). The camera build remains header 0.2.0 at 3be6805, which is also not the distributed 0.3.0 artifact. Do not merge this as the #324 proof of the released package.

Demo was not re-run here. NOT_TESTED.