Phase 1 spike

1 · Cross-origin iframe auth

A framed client app receives a working, origin-bound identity. The postMessage token is primary; the cookie question is only whether it is available as an optimisation.

1. Open pane 2 (Test App 1). Member number and name must appear.
2. "Token aud" must equal https://app1.muster.calab.vip.
3. Note whether "Cookie visible here" shows anything — that is the ITP answer.

2 · Gesture forwarding

Edge gutters first — they need no cooperation and keep working if pane.js is stale. Then pane.js forwarding on app1 (swipe:"full").

1. From a pane, drag from the extreme left/right ~24 px edge: the rail moves.
2. In app1, swipe horizontally anywhere: the rail moves (forwarding).
3. In app1, scroll the filler vertically: the rail must not move.
4. In app2 (swipe:"none"), drag the horizontal strip: the rail must not move, and you must still be able to leave via the gutters or dots.

3 · Brokered push to a framed client app

A framed app cannot get its own push on iOS — that is what forces the broker. Prove the brokered path, and prove the registry gate.

1. Install to the home screen and open from there (iOS: push only works installed).
2. Home → Enable push → allow.
3. Home → Send test push. Then close the app and send again from another device.
4. App1 → "Notify from this pane" → notification arrives (registry allows it).
5. App2 → "Try brigade.notify()" → 403, no notification (registry denies it).

4 · Media session containment

Defensive check, not an architectural fork — the host app is top-level and owns the session. Confirm a framed client app cannot steal the lock-screen controls.

1. Home → Play tone. Lock the phone: the lock screen shows Muster.
2. Press next / previous: they log here as media-control events.
3. Press next twice quickly: it should register as a double and change screen.
4. Home → Switch to silence: the session must be held (still on the lock screen).
5. App2 → "Steal media session", lock again: it must still say Muster.

Probes

Open app2 — the probes run on load and log themselves. Every row should read refused, except the own-origin service worker, which is meant to succeed because isolation is by origin.