v1.0.0

A3S Test 1.0.0 establishes the first stable release line for the documented
CLI, ACL, evidence, Web and TUI execution, Agent Skill, and Test Kit release
asset contracts. Test Kit keeps its independent 0.4.0 package version.
Unsupported surfaces remain explicit: Windows and Linux GUI execution are not
claimed, standalone-browser origin containment remains limited by its current
protocol, and the independent hands-on screen-reader audit remains open.

Added

• Added action protocol revision 15 with bounded visual-viewport coverage
  expectations. viewport_coverage_at_least accepts integer percentages from
  1 through 100; viewport_coverage_at_most accepts 0 through 99. The ratio is
  the intersection area of the rendered target rectangle and current
  visual viewport divided by the complete target area, so one visible pixel no
  longer proves a materially visible target. Web captures both rectangles in
  one page evaluation and Rust independently validates the geometry and
  recomputes the ratio. Stable semantic or CSS locators are required, Page
  Context refs may resolve before dispatch, browser refs and visual points fail
  admission, and GUI/TUI fail closed without equivalent visual-viewport
  evidence. Coverage classifies 2,000/2,000 Core cases and 2,000/2,000 Web
  protocol cases, accepts 100/100 sustained windows, rejects 100/100 transient
  windows, and extends the standalone Chromium matrix to 37 passing assertions
  plus 25 negative or driver-error classifications. The fixture covers exact
  threshold boundaries, one-pixel intersection, four-sided clipping, fully
  offscreen and oversized targets, open Shadow DOM, accessibility-hidden
  differences, transient geometry, exact fixture cleanup, and no private
  runtime leak.
• Added action protocol revision 14 with ten deterministic live semantic-state
  expectations: expanded/collapsed, pressed/unpressed,
  readonly/writable, required/optional, and invalid/valid. Web gives
  applicable native state priority over ARIA, reads <details>.open, native
  read-only and required properties, and Constraint Validation only when the
  control participates. ARIA fallbacks accept only defined boolean tokens;
  invalid-state ARIA additionally accepts grammar and spelling, while
  mixed pressed state and unknown tokens fail closed. The five dimensions stay
  orthogonal, so writable does not imply enabled. Stable semantic or CSS
  locators are required, Page Context refs may resolve before dispatch,
  browser refs and visual points fail admission, missing targets never prove a
  negative state, and GUI/TUI fail closed without equivalent evidence.
  Coverage classifies 1,000/1,000 deterministic Web cases, accepts 100/100
  sustained windows, rejects 100/100 transient windows, and verifies 27
  positive assertions plus 17 negative or driver-error classifications in
  standalone Chromium with native controls, ARIA, open Shadow DOM, exact
  fixture cleanup, and no private runtime leak.
• Added action protocol revision 13 with four deterministic focus-ownership
  expectations: focused, unfocused, focus_within, and focus_outside.
  Web resolves one stable target and reads the deepest active element from the
  current document and nested open shadow roots in one page evaluation. Exact
  ownership stays separate from flat-tree containment, including assigned
  slots. Semantic locators traverse open Shadow DOM and exclude
  accessibility-hidden composed ancestry; CSS retains current-document query
  semantics. ACL rejects browser refs and visual points, missing targets never
  prove a negative state, and GUI/TUI fail closed without equivalent evidence.
  Coverage classifies 600/600 deterministic Web cases, accepts 200/200
  sustained focus windows, rejects 200/200 transient windows, and verifies 17
  positive assertions plus 11 negative or driver-error classifications in
  standalone Chromium. The browser matrix includes forward and reverse Tab,
  open Shadow DOM, assigned slots, accessibility-hidden ancestry, timed focus
  movement, exact fixture cleanup, and no private runtime leak.
• Added action protocol revision 12 with orthogonal in_viewport and
  pointer_reachable expectations. Web now distinguishes positive-area
  visual-viewport intersection from pointer hit reachability instead of
  treating a rendered box as proof of either. Pointer reachability samples a
  deterministic 3 by 3 grid over the clipped target rectangle and accepts a
  hit only when deep elementFromPoint reaches the target or a composed-tree
  descendant, including open Shadow DOM. Stable semantic or CSS locators are
  required; browser refs and visual points fail admission, while current Page
  Context refs may resolve before dispatch. Missing, ambiguous, invalid, and
  malformed evidence stays driver-owned; offscreen and fully blocked targets
  become distinct assertion failures. GUI and TUI fail closed. Evidence covers
  1,000/1,000 Core geometry cases, 2,000/2,000 Web protocol
  classifications, 200/200 sustained and 200/200 transient stability windows,
  and standalone Chromium coverage with 20 positive assertions, 15 negative
  or driver-error classifications, exact fixture cleanup, and no private
  runtime leak.
• Added action protocol revision 11 with deterministic rendered-layout
  expectations between two stable targets. ACL now admits 17 explicit
  relations covering direction, containment, overlap, edge/center alignment,
  and exact size, with a bounded non-negative CSS-pixel tolerance. Web resolves
  both targets and captures both rectangles in one page evaluation, preserving
  missing, ambiguous, invalid, and malformed geometry as driver failures while
  reserving test.assert.layout for an observed relation mismatch. Semantic
  locators use the accessibility-visible plane across open Shadow DOM; CSS
  locators retain visually rendered aria-hidden elements. Both Page Context
  targets resolve before dispatch, provenance redacts both locators, GUI reads
  both frames from one fresh CUA snapshot, and TUI fails closed. Evidence covers
  3,400/3,400 deterministic Web classifications, 100/100 accepted stable layout
  windows, 100/100 transient rejections, and a standalone Chromium CLI suite
  with all 17 relations, 25 positive assertions, 15 negative/error
  classifications, exact fixture cleanup, and no private runtime leak.
• Added action protocol revision 10 with bounded rendered_texts expectations
  for the complete ordered visible text sequence produced by a stable semantic
  or CSS locator. The comparison preserves order and duplicates, normalizes
  each item independently, treats an empty match set as an observed empty
  sequence, and caps expected and observed collections at 256 items. ACL
  rejects refs and visual points, Web captures the collection in one page
  evaluation, invalid selectors remain driver failures, and only an observed
  sequence difference becomes test.assert.rendered_texts. Page Context,
  provenance redaction, Agent Host verification, assertion stability, and
  explicit GUI/TUI capability failures use the same typed expectation.
  Evidence covers 600/600 deterministic sequence classifications, 300/300
  consistent and 300/300 transient scalar-text/sequence/count stability
  windows, and a standalone Chromium CLI suite with 12 positive observations,
  12 negative classifications, three accepted and three rejected 100 ms
  windows, open Shadow DOM, exact cleanup, and no private runtime leak.
• Added action protocol revision 9 with target-bound rendered_text and
  stable-locator visible_count expectations. Rendered text collapses
  whitespace and requires exactly one visible target; visible count observes
  the complete match set and treats an empty set as evidence-backed zero while
  preserving invalid locators as driver errors. CSS counting
  uses visual rendered-box visibility, while semantic locators respect
  accessibility-hidden ancestors and traverse open Shadow DOM. Web returns
  dedicated product-mismatch codes, GUI and TUI fail closed, Page Context refs
  resolve before dispatch, provenance redacts targets and expected copy, and
  Agent Host deterministic verification uses the same actions. Evidence now
  covers 600/600 deterministic driver classifications, 200/200 consistent and
  200/200 transient stability windows, and a standalone Chromium CLI suite
  with 7/7 positive observations, 7/7 negative classifications, two 100 ms
  windows, and no private runtime directory leak.
• Added action protocol revision 8 with typed ACL control-state expectations:
  exact value, enabled/disabled, checked/unchecked,
  selected/unselected, and duplicate-free exact-set selected_values.
  Web assertions read live DOM properties and admitted ARIA state, preserve
  missing, ambiguous, invalid, and unsupported targets as test.driver.web.*,
  and reserve test.assert.* for observed product mismatches. GUI supports
  exact value when CUA supplies it and fails closed for boolean or
  multi-selection state; TUI continues to support visible terminal text only.
  The same expectations compose with bounded stability sampling, Page Context
  refs, provenance redaction, and Agent Host deterministic verification.
  Evidence covers 400/400 deterministic Web classifications, 100/100 stable
  and 100/100 transient state windows, and a real Chromium workflow with
  15/15 positive checks, 4/4 negative classifications, and no private runtime
  directory leak.
• Added bounded ACL wait hidden synchronization for stable targets. The
  runner reuses immediate positive visibility assertions at a fixed 50 ms
  interval, succeeds only on test.assert.visible, preserves every driver or
  target-resolution failure, retains first/last visible counter-evidence on
  terminal results, stops at the scenario deadline, cancellation, or a static
  1,201-probe limit, and reuses the revision-7 visible-action variant. Four deterministic
  100-case datasets cover initially hidden, delayed disappearance, persistent
  visibility, and driver-failure states; cancellation, probe-limit, agent-host
  verification, and real Chromium fixtures cover the remaining boundaries.
• Added negative target-visibility assertions for ACL expect steps. The new
  hidden = <stable target> condition passes when no visible match exists,
  including absent and rendered-hidden elements, and returns
  test.assert.hidden with visible counter-evidence otherwise. The runner
  owns the inversion without adding an action variant, refuses
  observation-bound refs and visual points, preserves driver failures, and
  composes with bounded stability sampling to catch targets that reappear.
  Deterministic 100-case datasets cover hidden, visible, consistently hidden,
  reappearing, and driver-failure states; real Chromium fixtures cover hidden,
  absent, visible, and microtask-driven reappearance.
• Added bounded assertion-stability sampling for ACL expect steps. A suite
  can require stable_for_ms with an optional sample_interval_ms; admission
  caps duration and planned samples, the runner remains deadline- and
  cancellation-safe, later false samples fail as test.assert.unstable, and
  JSON results retain first/last assertion data plus sampling metrics. A
  deterministic 100-case dataset and real Chromium pass/fail fixtures cover
  transient rejection, persistent acceptance, reporting, and cleanup.
• Added the nested a3s.test.ui-understanding/1 Page Context evidence
  protocol. Test Kit now derives bounded observed design tokens, typography,
  Flex/Grid/flow and stacking relationships, exact client/scroll extents,
  signed offsets, overflow/clipping state, resolved physical margin, border,
  and padding edges, box sizing, writing mode, text direction, and
  deterministic repeated-component clusters, real interaction-state
  differences, responsive conditions,
  document/scroll/view/named animation timelines and ranges, CSS/Web
  Animations, sticky, scroll-container, canvas, and media motion evidence after
  browser rendering. Every record binds an observation ID, page revision,
  viewport, scope, provenance summary, and node/state/string/byte/time budgets.
• Added strict Rust UI-understanding types and Web-driver admission. Protocol,
  revision, viewport, identifiers, confidence, geometry, box-model,
  overflow/clipping, and animation-timeline consistency, collection bounds,
  truncation metadata, JSON depth, strings, and encoded size now fail closed
  before the evidence reaches an agent. The same bounded UI evidence is
  included in explicitly submitted
  repair context without gaining action, verdict, or repair authority.
• Added an explicit --browser-microphone synthetic profile to deterministic
  Web runs, persistent and direct agent runs, and Web MCP hosts. It persists
  across agent-session turns, injects only Chromium's fake-device and
  fake-permission flags, never captures a real microphone, and defaults to
  disabled for new and legacy session metadata.
• Added a finding-level, dependency-free SVG design board after element or
  rectangular-area selection. Reviewers can draw, add rectangles and text,
  select, move and resize objects, style the canvas, use history, upload,
  paste, or drop PNG/JPEG screenshots, capture a selected region of the visible
  browser page without screen-sharing permission, annotate screenshots, and
  attach the result to the repair sent to a coding agent. The bounded editor
  runs entirely inside the Test Kit Shadow DOM without a drawing SDK, license
  key, watermark, or CDN dependency.
• Added the optional typed designReference repair field across the Test Kit,
  core model, session ledger, CLI/MCP handoff, structured export, and repair
  summaries. Web sessions materialize inline references as viewable
  repairs/<finding-id>/design-reference.png|jpg artifacts with SHA-256
  metadata before consumers receive them.

Safety

• Design-reference uploads are limited to 8 MiB and PNG/JPEG. Inline data URLs
  are limited to 384 KiB; dimensions are capped at 1,600 × 1,200 and 1,920,000
  pixels. The Web driver verifies decoded headers, declared dimensions,
  contained artifact paths, and hashes before admitting the repair.
• Design references remain scoped reviewer evidence. They do not broaden
  workspace authority, replace A3S Test-owned before/after evidence, or turn
  captured page content into hidden instructions or a verification verdict.

Changed

• Reframed the bilingual homepage around fresh rendered-page observations,
  typed actions, exploration-to-ACL regression, human-authorized repair, and
  reviewed PRD/design expectations while presenting Test Kit as an optional
  context enhancement. The current quick start now routes readers by task,
  pins staged documentation to the published installer, distinguishes
  actionable browser and Page Context refs from read-only UI evidence refs,
  and keeps the live specimen's page-local storage boundary explicit.
• Tightened the desktop Test Kit dock, tool tray, finding editor, settings,
  and batch workspace while retaining 44-pixel targets on mobile and coarse
  pointers, including 320-pixel-wide viewports.
• Aligned documentation typography, tables, inline code, and light syntax
  rendering with the A3S UI documentation system. ACL examples now use a
  dedicated presentation grammar while product parsing remains owned by
  a3s-acl.

Fixed

• Kept rendered UI layout graphs closed over their sampled nodes. Test Kit now
  links children through unboxed display: contents ancestors to the nearest
  sampled ancestor and omits scroll-container or offset-parent relationships
  whose source was not sampled; Core rejects missing parents or edge endpoints,
  requires every declared parent to have the matching containment edge, and
  rejects cyclic parent chains before the graph reaches an agent.
• Projected every private UI-understanding node identity into an
  observation-scoped ref before returning public Page Context observations or
  deterministic snapshot outputs. Unambiguous actionable nodes reuse @cN;
  evidence-only nodes receive non-actionable @uN refs, attempted @uN
  actions fail during ACL admission or before driver dispatch, and evidence
  that no longer fits its admitted byte budget is omitted instead of leaking
  an internal handle.
• Rejected structurally ambiguous rendered UI evidence at the Rust Web-driver
  boundary. Duplicate layout nodes or edges, missing parents or edge endpoints,
  contradictory, incomplete, or cyclic containment, repeated evidence
  references, invalid component membership, and layout counts above the
  sampled-node count now fail closed before reaching an agent.
• Restored desktop and mobile PNG evidence to the production website browser
  regression. Empty or greater-than-32-MiB Web screenshots are now rejected
  with an immediate artifact-cleanup attempt, while the pinned-runtime suite
  verifies PNG identity, viewport dimensions, media type, independent
  accessibility evidence, empty diagnostics, and cleanup.
• Replaced the homepage's indefinite Page Context loading state with an
  actionable retry message after the bounded capture deadline.
• Scrolled direct ref and CSS click targets into view before dispatch so a
  valid target below the initial viewport cannot report success without
  receiving the click.
• Kept open review-Shadow-DOM mutations and transient hover/focus evidence out
  of the page revision. Transient visual state receives its own UI observation
  ID, while semantic, layout, form, route, scroll, and viewport changes retain
  the monotonic page-revision boundary.
• Removed the forced dark documentation code theme and limited content
  typography to the real Rspress document root so sidebar labels retain their
  intended density.

Earlier staging work included in 1.0.0

Added

• Added English and Simplified Chinese review locales across visible controls,
  status labels, live announcements, and accessible names. The new
  locale="auto" | "en" | "zh-CN" option follows the page language by
  default, while typed messages overrides admit only known, non-empty values
  up to 2,048 characters. Automatic locale resolution observes live
  <html lang> changes, and the 90-entry Layout catalog presents and searches
  both English and Chinese component names.
• Added a loopback-only independent screen-reader audit fixture, canonical
  15-workflow manifest, strict revision-bound audit artifact, bounded evidence
  verifier, and separate all-passed closure gate. The shared real-browser
  fixture exposes candidate, clarification, human-review, terminal, and reset
  states without DevTools while keeping M8 open for an actual independent
  VoiceOver, NVDA, or equivalent hands-on audit.
• Added an independent axe-core WCAG A/AA gate to the real Chromium Test Kit
  suite. It scans the open review Shadow DOM across system, light, and dark
  themes plus preferences, marking and Layout editors, restored drafts,
  contract and design candidates, clarification replies, human review actions,
  and terminal repair states.
• Exposed every global Test Kit review shortcut through aria-keyshortcuts
  and a keyboard-reference section inside Review preferences. Unit and real
  Chromium coverage verify both the control metadata and accessibility-tree
  help content.

Changed

• Refined the review Dock, target editor, findings workspace, markers, and
  preferences with clearer hierarchy and typography, mutually exclusive tool
  and findings surfaces, scroll-safe short-viewport settings, 44-pixel mobile
  targets, and mobile form sizing that avoids browser zoom.
• Rebuilt the embedded review surface as a compact floating dock with a
  secondary tool tray, target-attached finding editor, pinned batch workspace,
  and one aggregate marker per multi-selection finding. Direct E, M, T,
  A, and D marking shortcuts retain editable-control ownership and are
  covered by React and website ACL regressions.
• Added a staged homepage demonstration that scans the rendered page, binds
  semantic and geometric context, opens a human finding, sends its context,
  and returns a repair-ready receipt. Its five-stage state machine has an
  explicit pause and resume control, resets off-screen, stops when the live
  review flow begins, and respects reduced-motion preferences.
• Updated the Docker Buildx and registry-login Actions to their Node.js 24
  major versions, removing the deprecated Node.js 20 runtime from runner-image
  CI and the release publishing path without changing image inputs or
  registry authority.
• Release creation now waits for a fail-closed metadata and documentation
  preflight before scheduling privileged GUI certification. The gate requires
  the tag, Rust workspace version, dated changelog section, default Rspress
  version, ordered snapshot provenance, and both locale trees to agree, then
  rebuilds and verifies the complete generated site.
• Release metadata now binds the packaged Test Kit version to the active
  documentation snapshot and requires every archived snapshot to retain its
  own semantic Test Kit version.
• Raised the Rust workspace minor release to 0.17.0 and the Test Kit minor
  release to 0.4.0, with the browser bridge deriving its reported SDK
  version directly from the package manifest.
• Shortened the repository homepage around installation, one proven Web path,
  and the shared evidence contracts. The Rspress homepage now identifies and
  preserves the selected documentation version in copyable Unix and
  PowerShell installers, while generated-site checks derive every bilingual
  route and reject broken internal references.
• Split review-overlay host lifecycle and global input policy out of the React
  overlay module so rendering, page input blocking, focus tracking, and
  shortcut dispatch retain explicit ownership below the repository file-size
  limit.

Fixed

• Preserved free-form Layout component values across locale changes while
  translating known catalog selections, so a Chinese search such as 结账
  finds and selects 结账表单 without leaving English UI copy behind. The Web
  driver's Shadow DOM fallback now preserves the native searchbox role for
  <input type="search"> during semantic fill and visibility checks.
• Corrected localized Layout labels and made pointer multi-selection derive its
  displayed count from selected node IDs instead of parsing English copy.
• Separated staged documentation from the published install version. The
  homepage and repository README now pin the real stable release while main is
  ahead, disclose that state, and reject a version tag until both versions are
  intentionally aligned.
• Restored review Dock focus after closing with the secondary tool tray open,
  and removed transformed or filtered containing blocks that displaced compact
  Review preferences outside the viewport. The preference surface now uses
  the correct panel text color in light themes; real-browser regressions
  expand the tray and verify focus, viewport bounds, scrolling, and contrast.
• Made page-motion pause ownership-safe. Test Kit now records only running
  animations and playing media that it actually pauses, freezes motion that
  starts while review pause remains active, and resumes only that owned set;
  host animations or media that were already paused stay paused. Unit and real
  Chromium regressions cover the initial, late-starting, resumed, and
  pre-paused states. The production-website E2E now uses semantic Shadow DOM
  targets and also retains mobile Layout screenshots, accessibility output,
  and empty browser diagnostics.
• Bound screen-reader audit verification to a real Git commit and read the
  canonical workflow manifest plus Test Kit version from that revision. The
  location-independent verification v2 record now includes byte length and
  SHA-256 bindings for the audit JSON, committed manifest, every evidence file,
  and the ordered evidence set, while rejecting files replaced during hashing
  and aggregate evidence above 1 GiB.
• Raised the documentation mobile navigation and installer copy controls to a
  44-pixel minimum target without changing the compact desktop layout.
• Removed collapsed mobile documentation-menu groups from the accessibility
  tree while preserving keyboard focus restoration and disclosure semantics.
  Language, version, and resource links are now exposed only while their
  owning group is expanded.
• Raised muted text and repair-thread actor contrast to WCAG AA in system and
  light themes, and made the scrollable findings region keyboard focusable.
  The real-browser audit retains the exact failing node and rule when either
  contract regresses.
• Made the React Test Kit adapter render on Node without server-side
  useLayoutEffect warnings while retaining synchronous browser focus and
  boundary registration after hydration. Framework-neutral bridge inspection
  now returns null on Node and direct runtime enablement reports its browser
  requirement explicitly. Package and release gates now load the built ESM and
  CommonJS entries, render both React adapters on the server, type-check both
  module consumers, and require the MIT license in the tarball.
• Serialized Windows CIM process-identity queries before marker-checked
  emergency cleanup. Concurrent cold-provider lookups now retain the existing
  five-second per-query bound instead of starving one another and making
  otherwise safe process cleanup depend on a CI rerun.
• Prioritized unmodified Escape for active Test Kit marking and finding
  editors even when the event originates in an editable control. Idle host
  editors still retain Escape without closing the review panel, while
  cancelling a completed multi-selection editor now restores panel focus.
  React and real Chromium regressions cover both ownership boundaries.
• Kept keyboard multi-selection on application controls until explicit
  Shift+Enter completion. Starting or extending a selection no longer opens
  an empty editor or steals focus into the review Shadow DOM, and Escape,
  the marking Cancel control, panel toggling, and Layout Mode now discard
  incomplete candidates consistently. React and real Chromium regressions
  cover focus, selection announcements, host-action suppression, completion,
  and cancellation.
• Restored keyboard focus without scrolling to the last connected application
  control when Hide until tab restart removes the review Shadow DOM. React
  and real Chromium regressions cover the complete focus transfer.