v1.0.0

A3S Test 1.0.0 establishes the first stable release line for the documented
CLI, ACL, evidence, Web and TUI execution, Agent Skill, and Test Kit release
asset contracts. Test Kit keeps its independent 0.4.0 package version.
Unsupported surfaces remain explicit: Windows and Linux GUI execution are not
claimed, standalone-browser origin containment remains limited by its current
protocol, and the independent hands-on screen-reader audit remains open.

Added

• Added action protocol revision 15 with bounded visual-viewport coverage
  expectations. viewport_coverage_at_least accepts integer percentages from
  1 through 100; viewport_coverage_at_most accepts 0 through 99. The ratio is
  the intersection area of the rendered target rectangle and current
  visual viewport divided by the complete target area, so one visible pixel no
  longer proves a materially visible target. Web captures both rectangles in
  one page evaluation and Rust independently validates the geometry and
  recomputes the ratio. Stable semantic or CSS locators are required, Page
  Context refs may resolve before dispatch, browser refs and visual points fail
  admission, and GUI/TUI fail closed without equivalent visual-viewport
  evidence. Coverage classifies 2,000/2,000 Core cases and 2,000/2,000 Web
  protocol cases, accepts 100/100 sustained windows, rejects 100/100 transient
  windows, and extends the standalone Chromium matrix to 37 passing assertions
  plus 25 negative or driver-error classifications. The fixture covers exact
  threshold boundaries, one-pixel intersection, four-sided clipping, fully
  offscreen and oversized targets, open Shadow DOM, accessibility-hidden
  differences, transient geometry, exact fixture cleanup, and no private
  runtime leak.
• Added action protocol revision 14 with ten deterministic live semantic-state
  expectations: expanded/collapsed, pressed/unpressed,
  readonly/writable, required/optional, and invalid/valid. Web gives
  applicable native state priority over ARIA, reads <details>.open, native
  read-only and required properties, and Constraint Validation only when the
  control participates. ARIA fallbacks accept only defined boolean tokens;
  invalid-state ARIA additionally accepts grammar and spelling, while
  mixed pressed state and unknown tokens fail closed. The five dimensions stay
  orthogonal, so writable does not imply enabled. Stable semantic or CSS
  locators are required, Page Context refs may resolve before dispatch,
  browser refs and visual points fail admission, missing targets never prove a
  negative state, and GUI/TUI fail closed without equivalent evidence.
  Coverage classifies 1,000/1,000 deterministic Web cases, accepts 100/100
  sustained windows, rejects 100/100 transient windows, and verifies 27
  positive assertions plus 17 negative or driver-error classifications in
  standalone Chromium with native controls, ARIA, open Shadow DOM, exact
  fixture cleanup, and no private runtime leak.
• Added action protocol revision 13 with four deterministic focus-ownership
  expectations: focused, unfocused, focus_within, and focus_outside.
  Web resolves one stable target and reads the deepest active element from the
  current document and nested open shadow roots in one page evaluation. Exact
  ownership stays separate from flat-tree containment, including assigned
  slots. Semantic locators traverse open Shadow DOM and exclude
  accessibility-hidden composed ancestry; CSS retains current-document query
  semantics. ACL rejects browser refs and visual points, missing targets never
  prove a negative state, and GUI/TUI fail closed without equivalent evidence.
  Coverage classifies 600/600 deterministic Web cases, accepts 200/200
  sustained focus windows, rejects 200/200 transient windows, and verifies 17
  positive assertions plus 11 negative or driver-error classifications in
  standalone Chromium. The browser matrix includes forward and reverse Tab,
  open Shadow DOM, assigned slots, accessibility-hidden ancestry, timed focus
  movement, exact fixture cleanup, and no private runtime leak.
• Added action protocol revision 12 with orthogonal in_viewport and
  pointer_reachable expectations. Web now distinguishes positive-area
  visual-viewport intersection from pointer hit reachability instead of
  treating a rendered box as proof of either. Pointer reachability samples a
  deterministic 3 by 3 grid over the clipped target rectangle and accepts a
  hit only when deep elementFromPoint reaches the target or a composed-tree
  descendant, including open Shadow DOM. Stable semantic or CSS locators are
  required; browser refs and visual points fail admission, while current Page
  Context refs may resolve before dispatch. Missing, ambiguous, invalid, and
  malformed evidence stays driver-owned; offscreen and fully blocked targets
  become distinct assertion failures. GUI and TUI fail closed. Evidence covers
  1,000/1,000 Core geometry cases, 2,000/2,000 Web protocol
  classifications, 200/200 sustained and 200/200 transient stability windows,
  and standalone Chromium coverage with 20 positive assertions, 15 negative
  or driver-error classifications, exact fixture cleanup, and no private
  runtime leak.
• Added action protocol revision 11 with deterministic rendered-layout
  expectations between two stable targets. ACL now admits 17 explicit
  relations covering direction, containment, overlap, edge/center alignment,
  and exact size, with a bounded non-negative CSS-pixel tolerance. Web resolves
  both targets and captures both rectangles in one page evaluation, preserving
  missing, ambiguous, invalid, and malformed geometry as driver failures while
  reserving test.assert.layout for an observed relation mismatch. Semantic
  locators use the accessibility-visible plane across open Shadow DOM; CSS
  locators retain visually rendered aria-hidden elements. Both Page Context
  targets resolve before dispatch, provenance redacts both locators, GUI reads
  both frames from one fresh CUA snapshot, and TUI fails closed. Evidence covers
  3,400/3,400 deterministic Web classifications, 100/100 accepted stable layout
  windows, 100/100 transient rejections, and a standalone Chromium CLI suite
  with all 17 relations, 25 positive assertions, 15 negative/error
  classifications, exact fixture cleanup, and no private runtime leak.
• Added action protocol revision 10 with bounded rendered_texts expectations
  for the complete ordered visible text sequence produced by a stable semantic
  or CSS locator. The comparison preserves order and duplicates, normalizes
  each item independently, treats an empty match set as an observed empty
  sequence, and caps expected and observed collections at 256 items. ACL
  rejects refs and visual points, Web captures the collection in one page
  evaluation, invalid selectors remain driver failures, and only an observed
  sequence difference becomes test.assert.rendered_texts. Page Context,
  provenance redaction, Agent Host verification, assertion stability, and
  explicit GUI/TUI capability failures use the same typed expectation.
  Evidence covers 600/600 deterministic sequence classifications, 300/300
  consistent and 300/300 transient scalar-text/sequence/count stability
  windows, and a standalone Chromium CLI suite with 12 positive observations,
  12 negative classifications, three accepted and three rejected 100 ms
  windows, open Shadow DOM, exact cleanup, and no private runtime leak.
• Added action protocol revision 9 with target-bound rendered_text and
  stable-locator visible_count expectations. Rendered text collapses
  whitespace and requires exactly one visible target; visible count observes
  the complete match set and treats an empty set as evidence-backed zero while
  preserving invalid locators as driver errors. CSS counting
  uses visual rendered-box visibility, while semantic locators respect
  accessibility-hidden ancestors and traverse open Shadow DOM. Web returns
  dedicated product-mismatch codes, GUI and TUI fail closed, Page Context refs
  resolve before dispatch, provenance redacts targets and expected copy, and
  Agent Host deterministic verification uses the same actions. Evidence now
  covers 600/600 deterministic driver classifications, 200/200 consistent and
  200/200 transient stability windows, and a standalone Chromium CLI suite
  with 7/7 positive observations, 7/7 negative classifications, two 100 ms
  windows, and no private runtime directory leak.
• Added action protocol revision 8 with typed ACL control-state expectations:
  exact value, enabled/disabled, checked/unchecked,
  selected/unselected, and duplicate-free exact-set selected_values.
  Web assertions read live DOM properties and admitted ARIA state, preserve
  missing, ambiguous, invalid, and unsupported targets as test.driver.web.*,
  and reserve test.assert.* for observed product mismatches. GUI supports
  exact value when CUA supplies it and fails closed for boolean or
  multi-selection state; TUI continues to support visible terminal text only.
  The same expectations compose with bounded stability sampling, Page Context
  refs, provenance redaction, and Agent Host deterministic verification.
  Evidence covers 400/400 deterministic Web classifications, 100/100 stable
  and 100/100 transient state windows, and a real Chromium workflow with
  15/15 positive checks, 4/4 negative classifications, and no private runtime
  directory leak.
• Added bounded ACL wait hidden synchronization for stable targets. The
  runner reuses immediate positive visibility assertions at a fixed 50 ms
  interval, succeeds only on test.assert.visible, preserves every driver or
  target-resolution failure, retains first/last visible counter-evidence on
  terminal results, stops at the scenario deadline, cancellation, or a static
  1,201-probe limit, and reuses the revision-7 visible-action variant. Four deter...

v0.16.2

Fixed

• Bound the checkout-free GUI certification asset upload to the explicit
  GitHub repository so the release workflow can publish its signed evidence.
• Raised the Rust workspace patch release to 0.16.2. The unchanged Test Kit
  remains 0.3.0.

v0.16.1

Added

• Added a reusable real macOS GUI certification workflow that rebuilds the
  locked CUA source, verifies its compile-time source revision and host
  permissions, runs semantic and window-vision observations, proves exact
  fixture cleanup, and emits a3s.test.gui-host-certification/1 evidence.
• Added a detached SHA-256 record and GitHub OIDC/Sigstore provenance for the
  certification attestation. Release tags publish the record and checksum as
  release assets.

Fixed

• GUI cleanup now confirms that the exact owned application PID has stopped
  before reporting success, while preserving bounded retries and PID-reuse
  protection.

Safety

• GUI certification can run only through an explicit workflow dispatch or a
  version tag, and only on the dedicated macOS arm64 self-hosted runner label.
  Pull requests and ordinary branch pushes cannot schedule that privileged
  desktop host.
• Release creation now waits for real permission, semantic, visual, and owned
  cleanup certification. The workflow uses bounded deny-by-default CUA
  policies and removes its fixture registration and daemon on every exit path.

Changed

• Advanced the locked CUA 0.10.0 revision to the reviewed background-launch
  identity fix while retaining the existing MCP and capability contracts.
• Raised the Rust workspace patch release to 0.16.1. The unchanged Test Kit
  remains 0.3.0.

v0.16.0

Added

• Added selection-scoped insert_text to ACL suites, persistent agent CLI
  sessions, the typed action JSON contract, and the standalone Web driver. It
  inserts at the browser's current caret or replaces the current selection
  without refocusing a target.
• Added real standalone-browser coverage that focuses a semantic form field,
  creates a keyboard selection, replaces it through insert_text, and proves
  the submitted value end to end on macOS and Windows CI.

Fixed

• Accepted the current standalone browser's top-level and nested visibility
  response envelopes without weakening typed boolean admission.

Safety

• insert_text uses the existing typed text-input policy capability and
  provenance redaction. It carries no target or locator authority and can only
  affect the editing context explicitly established by an earlier browser
  action.

Changed

• Advanced the action protocol revision to 7 and raised the Rust workspace
  release to 0.16.0. The unchanged Test Kit remains 0.3.0.

v0.15.0

Added

• Added strict provider protocol a3s.test.design-audit-provider/1 for
  advisory design-quality review across hierarchy, composition, spacing,
  typography, color use, consistency, interaction clarity, content clarity,
  and responsive composition.
• Added HttpDesignAuditProvider, generated provider and HTTP-envelope
  schemas, digest-bound PNG transport, complete forensic Page Context input,
  typed page/node/normalized-region findings, and local response admission.
• Added a3s-test agent audit with ACL configuration, selected dimensions,
  latest-observation and exact-revision binding, bounded context pagination,
  post-inference revision checks, retained screenshot evidence, and optional
  projection to an embedded review surface.
• Added Test Kit protocol a3s.test.design-audit-report/1, a separate bounded
  Design Audit store, advisory markers and review UI, explicit retargeting,
  and human promotion into the existing single or batch Repair Ledger.

Safety

• Design-audit output has no verdict, expected-surface, browser-action, or
  repair authority. Even high-priority advice remains non-blocking until a
  human explicitly reviews and saves or sends it.
• Local admission binds provider/model identity, observation, surface
  revision, screenshot and canonical page-context digests, dimensions,
  complete context, current node geometry, deadline, response limits, and
  provider-reported cost. Image and context bytes are rehashed again at the
  HTTP boundary, and any later page revision expires the projected advice.
• Provider ACL and credentials are admitted before browser access. HTTPS is
  required except for explicit loopback HTTP, redirects and environment
  proxies remain disabled, authorization is redacted, and inference runtime,
  capacity, privacy, and licensing remain deployment-owned.

Changed

• Raised the Rust workspace release to 0.15.0 and @a3s-lab/testkit to
  0.3.0.
• Increased bounded Web page-context inspection from 500 to 5,000 nodes so an
  audit can assemble a complete paginated snapshot within the existing Test
  Kit protocol limit.

v0.14.0

Added

• Added exclusive GUI worker profiles backed by deployment-owned gui_host
  ACL. Worker startup now admits the fixed CUA endpoint, policy, application,
  launch or attach target, perception profile, and explicit host-permission
  declaration before accepting jobs.
• Added read-only GUI host readiness probes. Inventory protocol
  a3s.test.worker-capabilities/2 records the locked CUA contract, application
  target, configuration and policy digests, exact accessibility and
  screen_recording grant, attribution source, and permission digest without
  launching the configured application.
• Added GUI-aware deterministic sharding in
  a3s.test.distributed-run/2. GUI workers and shards have one exclusive
  desktop lane, and the coordinator requires an exact
  host_permission_digest pin for every inspected GUI worker.

Safety

• Advanced remote execution to a3s.test.remote-worker/3. GUI submissions
  must bind the exact host-permission digest from the admitted worker
  inventory; missing, mismatched, or unexpected permission bindings fail
  before input materialization or driver startup.
• Remote requests cannot select a GUI application, executable, policy,
  endpoint, target, or shell. GUI sessions revalidate the live permission
  grant before application launch or attachment, and retain the existing
  application, PID, window, and owned-cleanup checks during execution.
• Worker authorization environment variables are explicitly removed from CUA
  proxy children. Regression coverage proves the child does not inherit the
  configured value.

Changed

• a3s-test worker inventory and a3s-test worker serve now accept
  --gui-host-profile. A worker exposing GUI must use
  --max-parallel-scenarios 1; pools scale by deploying independent desktop
  workers.
• Distributed GUI plans now repeat required surfaces and the permission digest
  in each immutable shard and remote submission, and include both in the plan
  digest.
• Raised the Rust workspace release to 0.14.0. The unchanged Test Kit remains
  0.2.0.

v0.13.0

Added

• Added protocol a3s.test.distributed-run/1 with generated strict schemas for
  deterministic plans, shard bindings, run analyses, accountable quarantine,
  flake summaries, historical changes, and shard issues.
• Added a3s-test distributed schema, distributed plan <config.acl>, and
  distributed run <config.acl>. ACL configuration owns contained inputs,
  worker identity and image pins, environment-supplied authorization, bounded
  deadlines, history retention, and explicit quarantine accountability.
• Added deterministic surface-aware sharding. Scarce worker surfaces are
  scheduled first, recent exact-suite median durations replace timeout
  fallbacks when available, and stable lane balancing assigns every scenario
  exactly once.
• Added bounded concurrent dispatch, independent renewable-lease supervision,
  exact remote cancellation on interrupt, strict terminal report retrieval,
  atomic local report/history persistence, count/age retention, and exclusive
  history-root locking.
• Added real multi-worker HTTP integration coverage for planning, exact
  dispatch, quarantine, a second historical run, fixed/flake detection, and
  first-interrupt exit 130 with a retained cancelled remote job.

Safety

• Advanced the execution protocol to a3s.test.remote-worker/2. Every
  submission now carries a non-empty, sorted, unique scenario ID set that is
  part of the immutable request digest. The worker filters the admitted suite
  to exactly that set and rejects missing, duplicate, or surface-drifted
  selections before driver startup.
• The coordinator accepts a report only after verifying its job, dispatch,
  immutable request digest, artifact descriptor, chunk offsets and EOF,
  canonical Base64, complete SHA-256, size, media type, suite, run ID, status,
  counts, exact scenario set, and surface mapping.
• Quarantine can suppress only explicit test.assert.* failures and proven
  Surface Contract mismatches. Driver, cleanup, inconclusive-contract,
  transport, report, timeout, cancellation, interruption, and other
  infrastructure failures remain required.
• Distributed config, suite inputs, contract provenance, history, report
  writes, pruning, and remote upload rebinding reject symbolic links, Windows
  reparse points, containment escapes, unsafe replacement, oversized data, and
  conflicting immutable IDs. HTTP requires HTTPS except for loopback, disables
  redirects and environment proxies, and never serializes credentials.

Changed

• Historical change comparison now uses the latest retained run, including
  across suite revisions. Flake accounting and scheduling durations remain
  restricted to the exact suite digest so changed test semantics do not enter
  reliability statistics.
• Raised the Rust workspace release to 0.13.0. The unchanged Test Kit remains
  0.2.0.

v0.12.0

Added

• Added the independent a3s.test.remote-artifacts/1 protocol with generated
  strict schemas for service inspection, bounded terminal-report queries,
  paginated artifact descriptors, and chunked report or evidence reads.
• Added a3s-test worker artifacts schema and authenticated
  POST /v1/artifacts support to the loopback reference host. Readiness now
  reports both execution and artifact descriptors.
• Added deployment-owned two-tier retention. Complete inputs, reports, and
  evidence are bounded by job count, aggregate bytes, and age; compact report
  indexes have independent longer count and age windows. Age limits continue
  to run while the worker is idle.
• Added restart reconstruction, crash-recoverable retained to pruning to
  pruned transitions, and bounded full-index garbage collection.

Safety

• Artifact lists and reads bind job ID, dispatch ID, immutable request digest,
  and canonical bounded cursors. Reads additionally bind the artifact SHA-256,
  exact indexed path, offset, and maximum chunk size.
• Artifact scans and reads reject symbolic links, Windows reparse points,
  containment escapes, non-regular or empty evidence, ASCII case-folded path
  collisions, file replacement, digest drift, oversized trees, and corrupted
  persisted indexes.
• Unsafe evidence cannot leave a successful terminal result. The worker
  records a durable failure, removes only the owned payload, preserves any
  external link target, and fails closed to new submissions if durable
  retention becomes unhealthy.

Changed

• Raised the Rust workspace release to 0.12.0. The unchanged Test Kit remains
  0.2.0.
• Kept artifact transport out of a3s.test.remote-worker/1; execution and
  retained-byte access remain independently versioned authority boundaries.

v0.11.0

Added

• Added transport-neutral protocol a3s.test.remote-worker/1 with generated
  strict request, response, and descriptor schemas. Every dispatch binds one
  exact worker instance, externally supplied image digest, complete capability
  inventory digest, absolute deadline, renewable lease, required surfaces,
  and immutable request digest.
• Added bounded, sorted, SHA-256-verified inline input bundles with portable
  paths and canonical Base64 admission before any private materialization.
• Added a persistent sequential remote worker service with bounded queueing,
  idempotent dispatch, conflict rejection, lease renewal, queued and running
  cancellation, deadline enforcement, bounded cleanup, append-only job state,
  exclusive descriptor-bound state roots, and restart interruption recovery.
• Added a3s-test worker remote schema and the a3s-test worker serve
  reference host. It serves one strict HTTP endpoint on loopback, requires an
  exact environment-supplied Authorization header, and executes only
  deployment-owned Web and TUI profiles.
• Added digest-bound terminal report summaries and private per-job Runner
  artifact roots. A real HTTP/TUI integration test proves authentication,
  dispatch, PTY execution, report persistence, evidence containment, SIGINT
  shutdown, and exact owned cleanup.

Safety

• Remote requests cannot select commands, browser integrations, TUI backends,
  arguments, credentials, or network policy. Web origins and domains and the
  TUI executable are fixed when the host starts. Selecting a shell or an
  application with shell escapes remains an explicit deployment grant to
  authenticated jobs.
• The reference HTTP host rejects non-loopback binds, oversized or non-JSON
  bodies, and missing or incorrect authorization. TLS termination and external
  authentication policy remain deployment responsibilities, and configured
  authorization values are never printed or inherited by browser probes, Web
  commands, or TUI child processes.
• Remote command/body, browser-idle, cleanup, and retry-backoff settings have
  explicit startup bounds, so capability probing cannot be configured with an
  effectively unbounded deadline.
• Failed identity, capability, time, path, size, Base64, or digest admission
  writes no job input. Exact duplicate dispatches return their durable state;
  conflicting reuse fails closed. Non-terminal durable state is never resumed
  speculatively after restart.
• Reports and surface evidence remain private worker files. Remote responses
  expose only bounded counts and a media-type, byte-length, and SHA-256 report
  descriptor; artifact transport remains a separate milestone.
• Dropping the final remote service handle cancels its worker loop, preventing
  an embedding process from retaining the exclusive state-root lock through a
  detached task.

Changed

• Added a configurable Runner artifact root so remote jobs do not mutate the
  process-wide working directory.
• Raised the Rust workspace release to 0.11.0. The unchanged Test Kit remains
  0.2.0.

v0.10.0

Added

• Added a Linux/amd64 hermetic runner image with the matching CLI, standalone
  browser 0.26.0, pinned Chrome Headless Shell, and the native Unix PTY
  backend. CI exercises Web and TUI ACL suites inside the restricted image and
  release automation publishes it as
  ghcr.io/a3s-lab/a3s-test-runner:<version>.
• Added a3s-test-worker and protocol
  a3s.test.worker-capabilities/1 for strict, canonically ordered scheduling
  evidence covering runtime identity, concurrency, Web capabilities, TUI
  capabilities, backend features, and hard limits.
• Added a3s-test worker inventory and a3s-test worker schema. Web is
  advertised only after an explicitly selected real executable passes its
  version probe; the compiled TUI projection is available by default.
• Added strict JSON Schemas and local admission for Web and TUI capability
  projections. Standalone browser 0.26.x cannot overclaim exact-origin
  containment, and the runner image does not claim GUI execution.
• Each release now includes a3s-test-runner-image.txt with the immutable GHCR
  manifest reference used to bind the published runner independently of its
  mutable tag.

Safety

• Runner inputs bind the Dockerfile frontend and Rust and Node base-image
  digests, fixed Debian snapshots, npm integrity, and the Chrome archive
  SHA-256. The final image runs as a non-root user and supports a read-only
  root filesystem.
• Image smoke tests use no external network, drop every Linux capability,
  enable no-new-privileges, bound PIDs, memory, CPU, and temporary storage,
  and verify screenshot, accessibility, and terminal evidence plus complete
  process, socket, and runtime cleanup.
• Worker inventories explicitly declare that they are self-reported,
  unauthenticated scheduling evidence and cannot authorize execution. A
  scheduler must independently bind the image digest and execution policy.
• Requested Web probes fail closed instead of silently omitting a surface, and
  unknown fields, duplicate surfaces, feature overclaims, invalid protocol
  revisions, and concurrency outside 1 through 64 are rejected.

Changed

• Raised the Rust workspace release to 0.10.0. The unchanged Test Kit remains
  0.2.0.