WEBVTT

NOTE Recording provenance; full cuts and holds are in edit-manifest.json
LOCAL DEMO · workerd/native sessions · virtual passkeys · fictional synthetic data · public edge unqualified · app-user · captured still / edited hold 12s · recorded inspection 2s/snapshot · receipt b3cd58948625f9746d16b4ee78f7b360a21b4a5fc1346f8983fdb52cbbdd116a
Composer 25dc7589f7a92d5ba22eb44c49b9a774991799a3 · Guestbook e097e4dd46abe5dd49a0ee1209276cc506e601fa · Linkarooie 9e166d3c3dcc9d3746ba1680b9f74015c0b521cb
Team A · workspace 09981451-5427-41f5-b7e9-989f5fbdf648 · request a108ef66-c3e3-407f-90b5-1e1473449e06 · stack a108ef66-c3e3-407f-90b5-1e1473449e06 · resource 87952ca6-598f-4c9b-9b7e-d1f9153783e7
Team B · workspace fa1f642b-5def-4f45-8c0c-9e906c3dc391 · request 931332e1-b22d-4385-ac8f-c3e204988e0f · stack 931332e1-b22d-4385-ac8f-c3e204988e0f · resource 9fc78b5e-bec0-4996-a69e-b9b4ee67b338

NOTE Readable optional captions: concise maintained text, at most two short lines.
Consecutive identical bodies share their source span; 40ms gaps separate cues.
Full chapter headings and explanations remain in the transcript and film.

1
00:00:00.000 --> 00:00:05.600 line:10% position:50% size:90% align:center
Get Ready reads this
workspace. Its observation

2
00:00:05.640 --> 00:00:11.960 line:10% position:50% size:90% align:center
grants no provider permission
or execution authority.

3
00:00:12.000 --> 00:00:18.276 line:10% position:50% size:90% align:center
Exact Composer and app
sources are pinned. A later

4
00:00:18.316 --> 00:00:23.960 line:10% position:50% size:90% align:center
source promotion needs
its own qualification.

5
00:00:24.000 --> 00:00:32.346 line:10% position:50% size:90% align:center
A creator who owns the workspace
can set policy. An editor

6
00:00:32.386 --> 00:00:35.960 line:10% position:50% size:90% align:center
or role-10 member cannot.

7
00:00:36.000 --> 00:00:42.069 line:10% position:50% size:90% align:center
The operator opts into synthetic
member requests. Public

8
00:00:42.109 --> 00:00:47.960 line:10% position:50% size:90% align:center
guests stay closed; existing
infrastructure is reused.

9
00:00:48.000 --> 00:00:53.838 line:10% position:50% size:90% align:center
Fictional actors use
native sessions and virtual

10
00:00:53.878 --> 00:00:59.960 line:10% position:50% size:90% align:center
passkeys. Production
admission is a separate gate.

11
00:01:00.000 --> 00:01:08.047 line:10% position:50% size:90% align:center
The owner invites each creator
to a separate team. A workspace

12
00:01:08.087 --> 00:01:11.960 line:10% position:50% size:90% align:center
URL does not grant membership.

13
00:01:12.000 --> 00:01:20.600 line:10% position:50% size:90% align:center
An explicit editor invitation
enables member requests.

14
00:01:20.640 --> 00:01:23.960 line:10% position:50% size:90% align:center
Global role stays 10.

15
00:01:24.000 --> 00:01:29.488 line:10% position:50% size:90% align:center
Team A chooses member
contributions; Team

16
00:01:29.528 --> 00:01:35.960 line:10% position:50% size:90% align:center
B stays closed. Their
resources remain distinct.

17
00:01:36.000 --> 00:01:44.050 line:10% position:50% size:90% align:center
Role 10 can request, but cannot
set policy or approve. Saved

18
00:01:44.090 --> 00:01:47.960 line:10% position:50% size:90% align:center
plans cannot widen that role.

19
00:01:48.000 --> 00:01:56.268 line:10% position:50% size:90% align:center
The adapter verifies both local
pages. Completion here does not

20
00:01:56.308 --> 00:01:59.960 line:10% position:50% size:90% align:center
qualify the production edge.

21
00:02:00.000 --> 00:02:05.471 line:10% position:50% size:90% align:center
The operator grants contribute
and moderate separately, on the

22
00:02:05.511 --> 00:02:07.960 line:10% position:50% size:90% align:center
exact existing app resource.

23
00:02:08.000 --> 00:02:14.566 line:10% position:50% size:90% align:center
The canvas supplies fictional
text, PNG and consent. Trusted

24
00:02:14.606 --> 00:02:19.960 line:10% position:50% size:90% align:center
request context determines
synthetic eligibility.

25
00:02:20.000 --> 00:02:26.460 line:10% position:50% size:90% align:center
Guestbook checks source,
configuration and operation

26
00:02:26.500 --> 00:02:31.960 line:10% position:50% size:90% align:center
identity. Pending private
media returns 404.

27
00:02:32.000 --> 00:02:42.509 line:10% position:50% size:90% align:center
The authorised creator reviews
and approves. The contributor

28
00:02:42.549 --> 00:02:47.960 line:10% position:50% size:90% align:center
and other team cannot moderate.

29
00:02:48.000 --> 00:02:54.263 line:10% position:50% size:90% align:center
Hide removes public media
access; reapprove restores

30
00:02:54.303 --> 00:02:59.960 line:10% position:50% size:90% align:center
the same bytes. This is
not lost-data recovery.

31
00:03:00.000 --> 00:03:03.960 line:10% position:50% size:90% align:center
Team A keeps the same request,
stack and application resource.

32
00:03:04.000 --> 00:03:10.710 line:10% position:50% size:90% align:center
The server rechecks the
update against current source,

33
00:03:10.750 --> 00:03:17.960 line:10% position:50% size:90% align:center
policy and revision. Earlier
completion is not permission.

34
00:03:18.000 --> 00:03:27.293 line:10% position:50% size:90% align:center
The title changes; content,
moderation and media

35
00:03:27.333 --> 00:03:31.960 line:10% position:50% size:90% align:center
digest remain unchanged.

36
00:03:32.000 --> 00:03:39.389 line:10% position:50% size:90% align:center
Team B is checked unchanged
and remains closed. This

37
00:03:39.429 --> 00:03:45.960 line:10% position:50% size:90% align:center
is a two-team check, not
portfolio acceptance.

38
00:03:46.000 --> 00:03:52.823 line:10% position:50% size:90% align:center
An anonymous browser reads
both teams. These local

39
00:03:52.863 --> 00:03:59.960 line:10% position:50% size:90% align:center
observations do not qualify
the production hostname.

40
00:04:00.000 --> 00:04:05.507 line:10% position:50% size:90% align:center
Other-team reads, writes
and resource lookups are

41
00:04:05.547 --> 00:04:11.960 line:10% position:50% size:90% align:center
denied. Current scope and app
grants are separate checks.

42
00:04:12.000 --> 00:04:17.593 line:10% position:50% size:90% align:center
A sensitive-labelled
request is refused before

43
00:04:17.633 --> 00:04:23.960 line:10% position:50% size:90% align:center
allocation. All actors and
content remain fictional.

44
00:04:24.000 --> 00:04:30.200 line:10% position:50% size:90% align:center
Keep the original operation
and payload. Inspect its

45
00:04:30.240 --> 00:04:35.960 line:10% position:50% size:90% align:center
receipt before retrying
an uncertain submission.

46
00:04:36.000 --> 00:04:41.738 line:10% position:50% size:90% align:center
Tests cover interrupted
work and duplicate receipts.

47
00:04:41.778 --> 00:04:47.960 line:10% position:50% size:90% align:center
These stills do not show an
outage or incident recovery.

48
00:04:48.000 --> 00:04:53.899 line:10% position:50% size:90% align:center
Public guest admission
stays separate from member

49
00:04:53.939 --> 00:04:59.960 line:10% position:50% size:90% align:center
access. Private states and
moderation still apply.

50
00:05:00.000 --> 00:05:06.085 line:10% position:50% size:90% align:center
Local workerd, native
sessions and fictional data

51
00:05:06.125 --> 00:05:11.960 line:10% position:50% size:90% align:center
only. TLS and self-binding
seams are disclosed.

52
00:05:12.000 --> 00:05:17.644 line:10% position:50% size:90% align:center
Recording and renderer
sources stay separate.

53
00:05:17.684 --> 00:05:23.960 line:10% position:50% size:90% align:center
Source hashes alone grant
no deployment authority.

54
00:05:24.000 --> 00:05:29.674 line:10% position:50% size:90% align:center
Cuts and genuine still
holds are declared. Missing

55
00:05:29.714 --> 00:05:35.960 line:10% position:50% size:90% align:center
actions are never replaced
by generated success frames.

56
00:05:36.000 --> 00:05:42.146 line:10% position:50% size:90% align:center
SSO, provider onboarding,
Australian-only storage,

57
00:05:42.186 --> 00:05:47.960 line:10% position:50% size:90% align:center
full restore and retirement
remain unqualified.

58
00:05:48.000 --> 00:05:53.254 line:10% position:50% size:90% align:center
Keep raw native evidence
private. Publish the

59
00:05:53.294 --> 00:05:59.960 line:10% position:50% size:90% align:center
reviewed films, captions,
transcripts and source receipt.