Mark
433ee280f3
Plan-checker BLOCKER B-01-14-01: original plan's must_haves truth #5 understated baseline regression risk. Adding `monitorTypeSurfaces: 'include'` as a sibling constraint in src/offscreen/recorder.ts would have dropped vitest from 98/98 GREEN to 97/98 RED because tests/offscreen/display-surface-constraint.test.ts Test 1 (line 223-226) uses strict deep-equality (toHaveBeenCalledWith, NOT expect.objectContaining) on the constraints object — the test author's intent (comment at line 221-222) is to catch future drops of ANY field. Surgical revision per references/planner-revision.md (surgeon-not-architect): - Frontmatter: add tests/offscreen/display-surface-constraint.test.ts to files_modified list. - must_haves truth #5: replace the "no existing unit test references the constraints object" claim with a positive statement that the strict-deep- equality assertion at lines 223-226 is updated in lockstep; preserves the test author's "no objectContaining" discipline; explicit no-transient-RED guarantee across commit boundaries. - must_haves artifacts: new entry for the test file documenting the in-place edit shape and the preserved test author comment. - must_haves key_links: new link entry pairing the test assertion with the source call site under the lockstep contract. - Interfaces block: add the explicit "test-expectation lockstep update" code fragment with the chosen key ordering (video → monitorTypeSurfaces → audio) so the executor lands the source change and the test update with matching shapes. - Task 1 <files>: add tests/offscreen/display-surface-constraint.test.ts. - Task 1 <action>: insert new Step 1b between Step 1 (source change) and Step 2 (offscreen-hooks bridge) — full single-line edit spec at lines 223-226, preserve toHaveBeenCalledWith contract, preserve comment block, same-commit guarantee. - Task 1 verify-block expected outputs: explicitly call out that 98/98 GREEN is preserved BECAUSE Step 1b lands (without it, 97/98 RED on the strict- deep-equality assertion). - Task 1 <done>: add line covering the lockstep test update + the no-transient- RED guarantee. - <verification> phase gate: add new check #2 (test-expectation lockstep) between source-line correctness and A23 round-trip. - <success_criteria>: add bullet for the lockstep test-expectation update. - <output> SUMMARY contract: add "Revision linkage" bullet documenting that the plan was revised once after the plan-checker flagged B-01-14-01. Untouched (per checker's preserve-verbatim list): - Source-line target (src/offscreen/recorder.ts:270) - Harness wiring references (assertA3 686, driveA14 987, __mokoshHarness 1922+1942, drivers array 289-312, Total comment 354) - FORBIDDEN_HOOK_STRINGS lockstep contract (both inventories) - `_constraints` capture path - Scope discipline (still 1 task, autonomous, no checkpoint) - Research traceability (Plan 01-10 RESEARCH §5 + §Pitfall-5 + W3C §6.1) - Threat model (T-01-14-04 mirrors Plan 01-13) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
38 KiB
phase, plan, type, wave, depends_on, files_modified, autonomous, gap_closure, requirements, tags, must_haves
| phase | plan | type | wave | depends_on | files_modified | autonomous | gap_closure | requirements | tags | must_haves | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01-stabilize-video-pipeline | 14 | execute | 1 |
|
true | false |
|
|
|
Scope Sanity Note
1 task, autonomous, single executor. This is the canonical-floor "small surgical plan" shape: one source change + one in-place test-expectation update (lockstep with the source change) + one harness regression assertion + grep-gate inventory update. Per <scope_estimation> Light context weight: ~10-15% context cost for a single executor. No split signals; no checkpoint (UAT harness coverage suffices per feedback-pre-checkpoint-bundle-gates.md — A23 + A0 grep gates are the empirical floor that replaces operator-time-spend for this enhancement).
Genesis note. This plan ships a Plan 01-10 RESEARCH §5 + §Pitfall-5 recommendation ("Add monitorTypeSurfaces: 'include' to the offscreen getDisplayMedia constraints. Single-line, zero-risk change that removes visual noise from the picker"). The prior attempt to ship the same change as an AMENDMENT-A.md anti-pattern was retired per 01-11-SUMMARY.md Architectural Notes — this plan replaces that improvised path with canonical GSD ceremony (plan → checker → executor → SUMMARY).
gap_closure: false — this is a research-discovered enhancement, NOT a VERIFICATION.md gap closure. The flag is set explicitly to make the distinction unambiguous: VERIFICATION-gap closure plans must verify against .planning/phases/<phase>/VERIFICATION.md; this plan's must_haves contract is the verification reference.
The change is consistent with PROJECT.md D-01 (whole-desktop only via getDisplayMedia; reject window/tab surfaces) — monitorTypeSurfaces: 'include' is the picker-UI realization of D-01's intent. D-15 post-grant validation stays as belt-and-suspenders.
Purpose: reduce operator picker friction within W3C-spec bounds; ship a research-validated single-line enhancement via canonical GSD ceremony (not amendment improvisation). Output: 1 source line + 1 in-place test-expectation update (lockstep) + A23 harness regression assertion + Tier-1 grep gate inventory update; UAT 16/16 GREEN; vitest 98/98 GREEN; production bundle hook-free.
<execution_context> @$HOME/.claude/get-shit-done/workflows/execute-plan.md @$HOME/.claude/get-shit-done/templates/summary.md </execution_context>
@.planning/PROJECT.md @.planning/ROADMAP.md @.planning/STATE.md @.planning/phases/01-stabilize-video-pipeline/01-10-RESEARCH.md @.planning/phases/01-stabilize-video-pipeline/01-13-SUMMARY.md @.planning/phases/01-stabilize-video-pipeline/01-11-SUMMARY.md @src/offscreen/recorder.ts @src/test-hooks/offscreen-hooks.ts @src/test-hooks/types.ts @tests/offscreen/display-surface-constraint.test.ts @tests/uat/extension-page-harness.ts @tests/uat/lib/harness-page-driver.ts @tests/uat/harness.test.ts @tests/background/no-test-hooks-in-prod-bundle.test.tsW3C DisplayMediaStreamOptions (per spec §6.1 — https://www.w3.org/TR/screen-capture/#dom-displaymediastreamoptions):
interface DisplayMediaStreamOptions {
video?: boolean | MediaTrackConstraints;
audio?: boolean | MediaTrackConstraints;
controller?: CaptureController;
selfBrowserSurface?: 'include' | 'exclude';
surfaceSwitching?: 'include' | 'exclude';
systemAudio?: 'include' | 'exclude';
monitorTypeSurfaces?: 'include' | 'exclude'; // <-- THIS PLAN ADDS
preferCurrentTab?: boolean;
}
Critical: monitorTypeSurfaces is a TOP-LEVEL member of DisplayMediaStreamOptions, NOT a nested member of MediaTrackConstraints (no video: { monitorTypeSurfaces }). Spec ref: https://www.w3.org/TR/screen-capture/#dom-displaymediastreamoptions-monitortypesurfaces.
Current call site (src/offscreen/recorder.ts:270):
const stream = await navigator.mediaDevices.getDisplayMedia({
video: { displaySurface: 'monitor', cursor: 'always' },
audio: false,
} as DisplayMediaStreamOptions & {
video: { displaySurface: 'monitor'; cursor: 'always' };
});
Required target (the only source change):
const stream = await navigator.mediaDevices.getDisplayMedia({
video: { displaySurface: 'monitor', cursor: 'always' },
monitorTypeSurfaces: 'include', // Plan 01-14 — Chrome ≥ 119 picker narrowing per W3C spec §6.1
audio: false,
} as DisplayMediaStreamOptions & {
video: { displaySurface: 'monitor'; cursor: 'always' };
monitorTypeSurfaces: 'include';
});
Test-expectation lockstep update (tests/offscreen/display-surface-constraint.test.ts:223-226) — Test 1's strict-deep-equality assertion grows to match the new source shape EXACTLY (no expect.objectContaining — the test author's contract preserves "catches future drops of ANY field"). The key ordering matches the source change above (between video: and audio:):
expect(getDisplayMediaSpy).toHaveBeenCalledWith({
video: { displaySurface: 'monitor', cursor: 'always' },
monitorTypeSurfaces: 'include',
audio: false,
});
Existing offscreen-hooks bridge dispatcher pattern (src/test-hooks/offscreen-hooks.ts:370-468):
chrome.runtime.onMessage.addListener((rawMessage, _sender, sendResponse) => {
// ...
if (op === 'get-display-surface') {
try {
if (currentStream === null) { sendResponse({ displaySurface: null }); return false; }
const track = currentStream.getVideoTracks()[0];
// ...
sendResponse({ displaySurface });
} catch (err) {
sendResponse({ ok: false, error: err instanceof Error ? err.message : String(err) });
}
return false;
}
// New A23 op handler goes here (after get-display-surface, before get-segment-count)
});
Existing installFakeDisplayMedia signature (src/test-hooks/offscreen-hooks.ts:236) — already accepts _constraints (currently unused, prefixed _ to suppress lint):
const fakeGetDisplayMedia = async (
_constraints?: DisplayMediaStreamOptions,
): Promise<MediaStream> => { ... };
Existing assertA3 pattern to mirror (tests/uat/extension-page-harness.ts:686-724) and existing driveA14 pattern to mirror (tests/uat/lib/harness-page-driver.ts:987-994) — both are direct copy-paste templates for A23's read-only assertion + driver shape.
Existing FORBIDDEN_HOOK_STRINGS inventory locations (both kept in lockstep per Plan 01-13 Wave 0 contract):
tests/background/no-test-hooks-in-prod-bundle.test.ts:105tests/uat/harness.test.ts:85
Step 1b: Lockstep test-expectation update (BLOCKER B-01-14-01 fix) — tests/offscreen/display-surface-constraint.test.ts lines 223-226. Test 1 ('1: startRecording calls getDisplayMedia with the exact D-15 constraints object') does strict deep-equality on the constraints object via expect(getDisplayMediaSpy).toHaveBeenCalledWith({...}) — NOT expect.objectContaining. The test author's intent (per the preserved comment at lines 221-222) is to catch future drops of ANY constraint field. Adding monitorTypeSurfaces: 'include' to the source call without updating this expectation will drop vitest from 98/98 GREEN to 97/98 RED.
Update the expected object at lines 223-226 in lockstep with the source change. The new expected shape:
expect(getDisplayMediaSpy).toHaveBeenCalledWith({
video: { displaySurface: 'monitor', cursor: 'always' },
monitorTypeSurfaces: 'include',
audio: false,
});
Key ordering MUST match Step 1's source change (video: → monitorTypeSurfaces: → audio:) — strict deep-equality in Vitest/Jest is structural, but matching the source ordering keeps diffs reviewable and the contract obvious.
DO NOT switch this expectation from toHaveBeenCalledWith to expect.objectContaining — the test author's "no objectContaining" discipline is the whole point of the test, and the preserved comment at 221-222 explicitly states the contract. The strict deep-equality MUST stay, just with the updated expected shape.
Leave the preserved comment block at lines 221-222 intact (or extend it with a one-line note about Plan 01-14's addition of monitorTypeSurfaces, at the implementer's discretion — if extending, keep the original "catches future drops" wording).
This edit + Step 1's source change MUST land in the same atomic commit so the 98/98 baseline never crosses a commit boundary in RED state.
Step 2: offscreen-hooks bridge — src/test-hooks/offscreen-hooks.ts. (a) At module scope (near line 97 where fakeInstalled lives), declare let lastGetDisplayMediaConstraints: DisplayMediaStreamOptions | null = null; with a docstring referencing Plan 01-14 A23 contract. (b) Inside installFakeDisplayMedia's fakeGetDisplayMedia closure (line ~236 where _constraints?: DisplayMediaStreamOptions is currently received-but-unused), rename _constraints → constraints and add the first line in the function body: lastGetDisplayMediaConstraints = constraints ?? null;. (c) In the __mokoshOffscreenQuery dispatcher (line ~370), add a new if (op === 'get-last-getDisplayMedia-constraints') block AFTER the get-display-surface handler (line ~407) and BEFORE get-segment-count (line ~436). Response shape: { constraints: lastGetDisplayMediaConstraints }. Follow the existing try/catch + sendResponse pattern — no exceptions allowed to propagate to chrome.runtime.sendMessage.
Step 3: types.ts (optional) — src/test-hooks/types.ts. Only extend the surface contract IF the offscreen-hooks cross-cast at the bottom of the file (line ~322-330 area; see the MokoshTestSurface & {...} shape) requires it for clean typing. The bridge-op route uses op-string matching not surface-method dispatch, so the recorded constraints cell is a module-internal detail — types.ts probably needs no change. Read the current cross-cast and decide; if no change is needed, document the decision in the commit body.
Step 4: harness page A23 — tests/uat/extension-page-harness.ts. Add async function assertA23(): Promise<AssertionResult> BEFORE the getManifestVersion helper at line ~1906. Mirror assertA3 (line 686-724) structure exactly: call offscreenQuery<{ constraints: DisplayMediaStreamOptions | null; ok?: boolean; error?: string }>('get-last-getDisplayMedia-constraints'); push two checks: A23.1: constraints object recorded (non-null) (passed: resp.constraints !== null) and A23.2: constraints.monitorTypeSurfaces === 'include' (expected 'include', actual resp.constraints?.monitorTypeSurfaces). Standard try/catch/diag pattern.
Then extend the Window.__mokoshHarness declaration (line 1922) with assertA23: () => Promise<AssertionResult>; and the runtime export (line 1942) with assertA23,. Update the console.log (line 1965) and the status-bar text (line 1962) to reference A23.
Step 5: harness driver — tests/uat/lib/harness-page-driver.ts. Add export async function driveA23(page: Page): Promise<AssertionRecord> after driveA14 (line ~995). Mirror driveA14 (line 987-994) — single page.evaluate(() => window.__mokoshHarness.assertA23()) call. Docstring references Plan 01-14 A23 contract.
Step 6: harness orchestrator — tests/uat/harness.test.ts. (a) Add 'lastGetDisplayMediaConstraints' and 'get-last-getDisplayMedia-constraints' to FORBIDDEN_HOOK_STRINGS (line 85). (b) Add driveA23 to the import block (line ~55-69 — import from ./lib/harness-page-driver). (c) Append { name: 'A23', drive: driveA23 } to the drivers array (line 292-312, after the A14 entry on line 311). (d) Update the comment at line 354: // Total = 1 (A0) + drivers.length (A1..A14, A23) = 16.. (e) Update the header comment block (lines 1-26) — add a Plan 01-14 paragraph: A23 added as the final functional assertion (post-A14 chain; read-only inspection of last getDisplayMedia constraints from A2's setupFreshRecording; verifies monitorTypeSurfaces:'include' reached the call site).
Step 7: Tier-1 grep gate unit test — tests/background/no-test-hooks-in-prod-bundle.test.ts. Add 'lastGetDisplayMediaConstraints' and 'get-last-getDisplayMedia-constraints' to FORBIDDEN_HOOK_STRINGS (line 105). The two list locations stay in lockstep per Plan 01-13 Wave 0 architectural commitment (belt-and-suspenders per feedback-pre-checkpoint-bundle-gates.md).
Step 8: verify the build chain — npm run build (production); npm run build:test (test bundle); tsc --noEmit. Production dist/ must have zero occurrences of lastGetDisplayMediaConstraints and get-last-getDisplayMedia-constraints (the __MOKOSH_UAT__ Vite define-token dead-branch tree-shake elides them).
Step 9: verify the test chain — npm test (vitest 98/98 GREEN — Step 1b's lockstep update is what preserves the count; without it, this step would fail at 97/98 RED on the strict-deep-equality assertion at display-surface-constraint.test.ts:223); npm run test:uat (UAT 16/16 GREEN — A0 grep gate + A1..A14 + A23).
Atomic commit with message: feat(01-14): monitorTypeSurfaces:'include' — narrow picker to monitor surfaces only. Commit body includes: (a) link to Plan 01-10 RESEARCH §5 + §Pitfall-5 + W3C spec §6.1 + Chrome screen-sharing-controls doc URL; (b) D-01 + D-15 references (consistency with whole-desktop-only intent + belt-and-suspenders relationship with post-grant validation); (c) explicit mention that the source change AND the strict-deep-equality test update at tests/offscreen/display-surface-constraint.test.ts:223-226 land in the same commit (lockstep) so the 98/98 baseline never crosses a commit boundary in RED state; (d) UAT 16/16 PASS report (counts before/after); (e) vitest 98/98 PASS report; (f) Tier-1 grep gate post-build clean confirmation.
npm run build && npm run build:test && npx tsc --noEmit && npm test && npm run test:uat
Expected outputs:
npm run buildexits 0;dist/produced.npm run build:testexits 0;dist-test/produced.npx tsc --noEmitexits 0; no type errors.npm testexits 0; 98/98 vitest tests GREEN (count UNCHANGED — Step 1b's lockstep update totests/offscreen/display-surface-constraint.test.ts:223-226is what preserves this baseline; without that edit, Test 1 ofdisplay-surface-constraint.test.tswould fail at strict-deep-equality due to the newmonitorTypeSurfacessibling in the source call). The no-test-hooks-in-prod-bundle gate now greps for the two new forbidden strings against the freshly-builtdist/and confirms zero occurrences.npm run test:uatexits 0; final line readsUAT harness: 16/16 assertions passed.
Production-bundle hook-free spot-check (orchestrator may run as a sanity gate before checkpointing):
grep -rc 'monitorTypeSurfaces' /home/parf/projects/work/repremium/dist/ | grep -v ':0$' # expected: only the recorder.ts compiled chunk; the constant 'include' string is production-shipped intentionally
grep -rc 'lastGetDisplayMediaConstraints\|get-last-getDisplayMedia-constraints' /home/parf/projects/work/repremium/dist/ | grep -v ':0$' # expected: ZERO matches (every line has count 0 → grep -v ':0$' yields no output)
<threat_model>
Trust Boundaries
| Boundary | Description |
|---|---|
| operator ↔ Chrome picker UI | Operator's monitor-source selection click is the W3C-mandated consent gate. The new constraint narrows the choice surface but does NOT bypass the gate. |
| extension offscreen ↔ browser screen-capture engine | getDisplayMedia is the API boundary; constraints are advisory HINTS (per spec) for displaySurface but monitorTypeSurfaces: 'include' is a stronger filter (per Chrome 119+ implementation; spec §6.1 grammar describes it as a binary include/exclude category gate). D-15 post-grant validation remains the actual enforcement. |
| production dist/ ↔ test-hook surface | New lastGetDisplayMediaConstraints cell + get-last-getDisplayMedia-constraints bridge op live behind __MOKOSH_UAT__ Vite define-token gate; dead-branch tree-shake elides from production. Tier-1 grep gate (unit + UAT) enforces. |
STRIDE Threat Register
| Threat ID | Category | Component | Disposition | Mitigation Plan |
|---|---|---|---|---|
| T-01-14-01 | Spoofing | A web page tricks operator into thinking the picker now offers MORE surface types (e.g., adversarial extension claims Mokosh enables tab-recording) | accept | Mokosh's picker presents FEWER options than before, not more. Operator-facing surface area shrinks. No new spoofing vector. |
| T-01-14-02 | Tampering | Operator overrides the monitorTypeSurfaces: 'include' constraint via Chrome flags / DevTools / managed-policy |
accept | Spec semantics: constraints are advisory in the worst case. D-15 post-grant validation already tears down + throws wrong-display-surface if track.getSettings().displaySurface !== 'monitor' (recorder.ts:296). Belt-and-suspenders chain unchanged. |
| T-01-14-03 | Repudiation | (n/a — no audit-log surface added) | n/a | — |
| T-01-14-04 | Information Disclosure | New test hook leaks the operator's getDisplayMedia constraints object into production builds |
mitigate | __MOKOSH_UAT__ Vite define-token dead-branch tree-shake elides lastGetDisplayMediaConstraints and the get-last-getDisplayMedia-constraints op handler from production. Tier-1 grep gate (unit at tests/background/no-test-hooks-in-prod-bundle.test.ts:105 + UAT mirror at tests/uat/harness.test.ts:85) extends FORBIDDEN_HOOK_STRINGS in lockstep. Verified GREEN via npm test + npm run test:uat per Task 1 verify block. |
| T-01-14-05 | Denial of Service | Chrome < 119 receives the unknown constraint and rejects getDisplayMedia with OverconstrainedError or similar, breaking the recorder for older Chromes |
accept | Per Plan 01-10 RESEARCH §Environment-Availability: target Chrome is ≥ 119 (recommended for monitorTypeSurfaces). The constraint is an OPTIONAL member of DisplayMediaStreamOptions per spec — unknown options are ignored per W3C JavaScript dictionary semantics, NOT rejected. Older Chrome (<119) silently ignores it; behavior degrades to the current (pre-Plan-01-14) state (picker shows all panes). No DoS exposure. |
| T-01-14-06 | Elevation of Privilege | New get-last-getDisplayMedia-constraints bridge op exposes a constraints-object-introspection capability to any page that can send a __mokoshOffscreenQuery message |
accept | The chrome.runtime.onMessage channel is extension-internal: only pages with the extension's runtime ID can send. The harness page (tests/uat/extension-page-harness.html) is in web_accessible_resources ONLY in the test bundle (vite.test.config.ts); production dist/ does NOT include it. Production dist/ does NOT include the bridge handler either (__MOKOSH_UAT__ dead-branch). Two-layer elision (resource list + handler code) — no production exposure surface. |
Mitigation acceptance summary: 6 threats reviewed; 1 (T-01-14-04) actively mitigated via the existing Plan 01-13 Tier-1 grep gate (extended for this plan); 5 accepted with explicit rationale. No new permissions, no new web_accessible_resources, no new manifest changes. Threat surface delta from main: ZERO permission additions; new internal test-hook surface (gated identically to Plan 01-13's hook inventory). </threat_model>
**Per-task** (Task 1's verify block): full chain `npm run build && npm run build:test && npx tsc --noEmit && npm test && npm run test:uat`.Phase gate (executor → /gsd-verify-work):
- Source-line correctness:
grep -n "monitorTypeSurfaces" src/offscreen/recorder.tsreturns the new line at the expected position. The stringmonitorTypeSurfaces: 'include'appears as a TOP-LEVEL constraint (sibling ofvideo:), NOT nested insidevideo:. (W3C spec §6.1 compliance check.) - Test-expectation lockstep:
grep -n "monitorTypeSurfaces" tests/offscreen/display-surface-constraint.test.tsreturns the updatedtoHaveBeenCalledWithexpectation; the assertion at lines 223-226 includesmonitorTypeSurfaces: 'include'betweenvideo:andaudio:;expect.objectContainingis NOT used (preserves the test author's strict-deep-equality contract). - A23 round-trips:
npm run test:uatfinal summary line shows16/16 assertions passedwith[PASS] A23in the per-assertion roll-up. - Tier-1 grep gates GREEN:
npm testshowsno-test-hooks-in-prod-bundle.test.tsGREEN with the new forbidden strings in the inventory;npm run test:uatA0 grep gate confirms zero occurrences oflastGetDisplayMediaConstraintsandget-last-getDisplayMedia-constraintsindist/. - No vitest regression: full vitest run produces 98/98 GREEN tests (no change in count from pre-plan baseline; the source change is additive AND the strict-deep-equality expectation in
display-surface-constraint.test.tsis updated in lockstep so Test 1 stays GREEN through the transition). - Type cleanliness:
npx tsc --noEmitexits 0; the typed widening cast on thegetDisplayMediaconstraints includesmonitorTypeSurfaces: 'include'explicitly. - Commit shape: single atomic commit on the working branch with the prescribed message and the documented commit body (research link, decision references, lockstep test-update note, test reports).
<success_criteria>
- Operator picker dialog presents ONLY monitor surfaces under Chrome ≥ 119 (W3C
monitorTypeSurfaces: 'include'semantics). Verified empirically via the UAT A23 assertion's bridge-inspection of the recorded constraints object. The 1-click W3C consent gate remains (spec floor; not bypassable in unmanaged Chrome per Plan 01-10 RESEARCH). - The change is consistent with PROJECT.md D-01 (whole-desktop only via getDisplayMedia; reject window/tab surfaces) — the new constraint is the picker-UI realization of D-01's intent.
- D-15 post-grant validation block (recorder.ts:294-307) is UNCHANGED; belt-and-suspenders chain preserved.
- Lockstep test-expectation update at
tests/offscreen/display-surface-constraint.test.ts:223-226preserves the strict-deep-equality contract under the new constraints shape — test author's "no objectContaining" discipline is honored. - UAT harness exits 0 with
16/16 assertions passed. - vitest exits 0 with 98/98 GREEN (baseline preserved through the lockstep edit); production-bundle Tier-1 grep gate confirms zero hook-surface leakage.
- TypeScript compilation clean (
tsc --noEmitexit 0). - Single atomic commit on the working branch (no fixup/squash commits, no transient RED state at commit boundaries). </success_criteria>
- What shipped — the single source line + lockstep test-expectation update at
tests/offscreen/display-surface-constraint.test.ts:223-226+ A23 harness assertion + grep gate inventory updates + commit SHA. - Verification evidence —
npm testcount (98/98),npm run test:uatcount (16/16),tsc --noEmitclean, production-bundle grep-gate clean. - Research linkage — citation to Plan 01-10 RESEARCH §5, §Pitfall-5, §Environment-Availability + W3C spec §6.1 + Chrome screen-sharing-controls doc URL.
- Decision linkage — D-01 (consistency: monitor-only intent realized at the picker UI level); D-15 (relationship: monitorTypeSurfaces is picker-UI belt; D-15 post-grant validation is the enforcement suspenders).
- Ceremony note — confirm this plan replaces the prior AMENDMENT-A.md improvisation path retired per 01-11-SUMMARY Architectural Notes; canonical GSD ceremony (plan → checker → executor → summary) is what landed.
- Revision linkage — note that the plan was revised once after the plan-checker flagged BLOCKER B-01-14-01 (the original plan's must_haves truth #5 understated baseline regression risk; the revision added Step 1b lockstep test-expectation update + corresponding frontmatter/file/key-link entries).
- Architectural delta — ZERO new permissions; ZERO new manifest changes; ZERO new web_accessible_resources; new internal test-hook surface gated identically to Plan 01-13's inventory.
- What did not change — D-15 post-grant validation block; Plan 01-09 toolbar
onClickedchain; Plan 01-10 welcome-page architecture; Plan 01-12 design-integration scope; Plan 01-13 harness architecture (the 14 existing assertions are unmodified; A23 is purely additive).