docs(plan): record OOPIF probe PASS verdict under M0 findings#12
Merged
Conversation
Ran the M5 OOPIF probe (apps/cdp-spike) attended on Chrome 150.0.7871.114
against the bundled oopif-test.html. Target.setAutoAttach{flatten:true}
works under chrome.debugger: the cross-site https://example.org iframe
attached as a target and was driven through its own sessionId —
Runtime.evaluate returned the iframe URL (not the file:// top frame), and
Accessibility.getFullAXTree returned the iframe's isolated 15-node tree
(heading:Example Domain, link:Learn more) without the top frame's button.
The same run re-confirmed the M0 baseline unchanged (10/11 CDP commands OK,
Target.getTargets still {-32000,"Not allowed"}).
Retires the sub-question deferred since M0. Cross-frame driver work in
apps/extension is unblocked but stays gated on a consumer actually needing
cross-origin-iframe targeting.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Records the verdict of the M5 OOPIF probe — the last deferred M0 sub-question — in
docs/technical-plan.md(both the "M0 findings" summary note and the OOPIF paragraph).Result: PASS ✅
Ran
apps/cdp-spike's OOPIF probe attended on Chrome 150.0.7871.114 (64-bit) against the bundledoopif-test.html(afile://top frame embedding a cross-sitehttps://example.orgiframe).Target.setAutoAttach{ flatten: true }works underchrome.debugger— a differentTargetmethod than the blockedgetTargets. The cross-origin iframe attached as a target and was driven through its ownsessionId:Target.setAutoAttach {flatten:true}— OKTarget.attachedToTarget— announcediframe https://example.org/Runtime.evaluatevia the iframe'ssessionId→https://example.org/(not thefile://top frame)Accessibility.getFullAXTreevia thatsessionId→ the iframe's isolated 15-node tree (heading:Example Domain, link:Learn more), without the top frame'stop-frame button(which the top frame's own 34-node tree did contain)Two
sessionIds, two isolated frames driven independently in the same tab — exactly the session routing the real driver needs. The same run re-confirmed the M0 baseline unchanged: 10/11 CDP commands OK,Target.getTargetsstill{ -32000, "Not allowed" }.Impact
The sub-question deferred since M0 is retired. Cross-frame driver work in
apps/extensionis unblocked, but stays gated on a consumer actually needing cross-origin-iframe targeting — the single-frame path remains the proven default; nothing is built on OOPIF until a consumer requires it.Docs-only; no code or package changes (no changeset needed).
🤖 Generated with Claude Code