fw-12 step 02 — mini-automation, and the trust boundary

Goal

Demonstrate — do not assert — that synthetic events are not user input.

Tasks

  1. A small layer over a browser automation protocol: navigation, selectors, DOM queries, event dispatch, screenshots, network interception, console events, frames.
  2. The overlay experiment. Place a transparent overlay over a button. Dispatch new MouseEvent('click') on the button: it fires. Drive a real click through the protocol: it hits the overlay. This is the single most valuable fact about testing tools.
  3. Compare isTrusted, hit testing, compositor involvement, and user activation across both paths.
  4. Try an activation-gated API (fullscreen or clipboard write) from a synthetic event. Observe the rejection and explain the security design.
  5. Connect to bi-15's click trace: an automated click is a real opportunity to observe the full input path.

Done when

  • The overlay experiment reproduced, both paths
  • The comparison table filled from your own observations
  • One activation-gated rejection demonstrated