[MrDarkRoot]

Scope

Demonstration-only update for the AddSynapse negative control on issue #324. This replaces the runner-clock captions and the hardcoded grant expiry in demo/324-third-party/, then records a fresh disposable-lab run. It does not change WriteLeash runtime behavior.

References #324 and #332. Does not close either.

Invariant / Current Spec Reference

Production grant expiry rules are unchanged. create_grant still requires YYYY-MM-DD HH:MM:SS and strtotime($expires_at . ' UTC') > time(). The lab now supplies that string from WordPress UTC now plus 30 days.

The recorded plugin tree is still f8cf392ba30a40334c0f1ab67af0ee444ffaee08 at record-time commit 0e4ac6881006eabd95e34ec1530a3357401d3226, header 0.2.0. That is an unreleased repository build, not the WordPress.org 0.2.2 package.

Relevant Canonical CC-* Tests (docs/test-plan.md)

No canonical CC-* test applies. This is a disposable WooCommerce integration recording. The native PG16 suite is the ownership gate for demo/**. It does not execute this WordPress scenario.

What Changed

• Caption times come from a 48px scene marker painted on the recorded admin page and read back from the encoded video at 2 frames per second. sync_captions.py writes captions.en.vtt and rejects a cue that misses the video, overlaps, or omits the unreleased-build disclaimer. test_sync_captions.py shifts synthetic markers and checks that the cue times move with them.
• The lab grant expiry is one UTC timestamp computed at execution (utc_now_plus_30_days). This run stored 2026-11-27 05:09:46. The same string is the grant row, versions.json, and evidence.json.
• Fresh media and evidence: MP4 and WebM 68.44 s, 1440×900; GIF 15.0 s, 960×600, 30 frames; poster at the denial frame (46.0 s). Product-row hash d47112ccd9a495514863253e131da83cce406009c650bedf6e15cb2b20e4f923 on all three snapshots. Grant 6fdf6fc5-ec39-45e2-985b-bdc2a0b95512.
• QA.md records the visual pass. out/media-qa.json records 29 automated checks, 0 failed.

Media:

• https://github.com/MrDarkRoot/WriteLeash/blob/f7b4853e7aa3c7b1392dc0d9acdc2733d73cea57/demo/324-third-party/out/writeleash-addsynapse-deny.mp4
• https://github.com/MrDarkRoot/WriteLeash/blob/f7b4853e7aa3c7b1392dc0d9acdc2733d73cea57/demo/324-third-party/out/writeleash-addsynapse-deny.gif
• https://github.com/MrDarkRoot/WriteLeash/blob/f7b4853e7aa3c7b1392dc0d9acdc2733d73cea57/demo/324-third-party/out/writeleash-addsynapse-deny-poster.png

Security Impact

None in production. WriteLeash PHP, the plugin header, readme.txt, wordpress/assets/, and WordPress.org SVN were not modified. The restricted shop manager remained user 2 at woocommerce_before_product_object_save. Both Riley approve calls returned HTTP 200 with status: failed, applied: 0, failed: 1. Harborline Wool Cap stayed $40.00. Northwind Canvas Tote stayed $100.00.

No model was called. Provider cost is $0. The slash command was typed in the fixture. Riley pressed Approve, then Yes, apply the changes. This is a labeled negative control, not an AI hallucination and not a claim that AddSynapse is defective.

PostgreSQL Semantics Considered

Not applicable to this WordPress/MySQL recording. MySQL 8.0.44 InnoDB was the lab engine. MariaDB was not tested.

Adversarial / Bypass Testing

The on-camera path is the real AddSynapse approve route as the restricted shop manager, with no Execution Frame open. The unrestricted administrator control on Pilot Lantern still applied ($30.00 to $55.00). The remote AddSynapse key path was not exercised: that path switches to the administrator who minted the key.

Limitations / Unknowns

• Live model behavior, the AddSynapse remote key path, StoreHand's public chat, Hoobert's execute route, the WordPress.org 0.2.2 package, MariaDB, and Redis were not tested. StoreHand's public chat remains blocked without a WordPress AI connector.
• Full-frame OCR of every pixel was not run. The secret scan covers generated passwords in text outputs, and sampled frames were inspected.
• The first 1.5 seconds of the video are unlabeled (white frame, then an empty admin shell). The products-screen fiducial covers the Collapse menu label. The GIF palette dulls that square.
• A fresh run.sh replaces the hashes, grant id, expiry, and cue times. Do not copy this run's numbers forward.

Out-of-Scope Work Explicitly Not Included

• I did not silently expand the support envelope.
• I updated the current spec, test plan, threat model, or decisions if behavior changed. No production behavior changed, so those documents stayed as they are.
• Security-sensitive behavior has adversarial test coverage. Production authorization code was not edited. The lab asserts the existing denial.
• No secrets or credentials are included. Generated passwords stayed in gitignored runtime/secrets.json.

Recommendation only: the recorded scenario, caption sync, and media checks passed. This pull request is not merged.