Release 1.1.0

.github/requirements/publish.in

@@ -1,7 +1,7 @@
 # What the two jobs that hold the PyPI token install: `publish` in stable.yml and `publish-dev` in dev.yml.
 # Their version scripts (the inline bump in stable.yml, scripts/dev_release.py) use only the standard library.
 # publish.txt is generated from this file:
-#   uv pip compile .github/requirements/publish.in --generate-hashes --python-version 3.12 --python-platform x86_64-manylinux_2_28 --only-binary :all: --exclude-newer 2026-09-24 -o .github/requirements/publish.txt
+#   uv pip compile .github/requirements/publish.in --generate-hashes --python-version 3.12 --python-platform x86_64-manylinux_2_28 --only-binary :all: --exclude-newer 2026-10-25 -o .github/requirements/publish.txt
 # --python-version is the one both jobs set up. --exclude-newer leaves out the uploads of the last 7 days:
 # move the date when regenerating.
 build==1.6.1

.github/requirements/publish.txt

@@ -1,12 +1,12 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile .github/requirements/publish.in --generate-hashes --python-version 3.12 --python-platform x86_64-manylinux_2_28 --only-binary :all: --exclude-newer 2026-09-24 -o .github/requirements/publish.txt
+#    uv pip compile .github/requirements/publish.in --generate-hashes --python-version 3.12 --python-platform x86_64-manylinux_2_28 --only-binary :all: --exclude-newer 2026-10-25 -o .github/requirements/publish.txt
 build==1.6.1 \
     --hash=sha256:51cc11666391ab6f092070437ac747002ff46f3e4113a3622177ee6b488bfc53 \
     --hash=sha256:ecd351a4be9d35a9eaaba244a7687143c9c7d4aea6ac964e7e7ddab20cbcf4e7
-    # via -r publish.in
-certifi==2026.7.22 \
-    --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
-    --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55
+    # via -r .github/requirements/publish.in
+certifi==2026.10.23 \
+    --hash=sha256:a9895e6e2758b371e0545e321a3a8fd1fcfd9829ada8824a936dfb16aaaf36cd \
+    --hash=sha256:e9b54de76e530bb6cf0ccd036787103acb58fd42ba930ea8bf948ddbaa2f61d1
     # via requests
 cffi==2.1.1 \
     --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \
@@ -455,14 +455,14 @@ secretstorage==3.5.0 \
     --hash=sha256:0ce65888c0725fcb2c5bc0fdb8e5438eece02c523557ea40ce0703c266248137 \
     --hash=sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be
     # via keyring
-setuptools==84.0.0 \
-    --hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670 \
-    --hash=sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73
+setuptools==84.2.1 \
+    --hash=sha256:3ff8b3b5492a0aa66960f4419365a86b84e013070d4313e4d4a6894f5d64d6bc \
+    --hash=sha256:ca140b45d5325a9478f880e351484f62fef15f336462e449ca0c03c873d589c2
     # via -r .github/requirements/publish.in
 twine==7.0.0 \
     --hash=sha256:85cdb29c518efef867360ae4acd4b0dfd61c8654a22fca08e6f8539f05022177 \
     --hash=sha256:b854164df26db268af05f49aa5c0344b10e27a494343ff05b1e0bad3b135f5a7
-    # via -r publish.in
+    # via -r .github/requirements/publish.in
 urllib3==2.8.0 \
     --hash=sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3 \
     --hash=sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63

.github/workflows/android-helper.yml

@@ -0,0 +1,81 @@
+name: Android device-side helper
+
+# Builds and tests native/android_helper. Stage 1 is the fence ledger, a pure Kotlin
+# state machine tested on the JVM; later stages add the instrumentation app and an
+# emulator run. Nothing here holds a secret or publishes anything.
+
+on:
+  push:
+    branches: ["dev", "main"]
+    paths:
+      - "native/android_helper/**"
+      - ".github/workflows/android-helper.yml"
+  pull_request:
+    branches: ["main"]
+    paths:
+      - "native/android_helper/**"
+      - ".github/workflows/android-helper.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: android-helper-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  fence-ledger:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - name: Set up Gradle
+        # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
+        uses: gradle/actions/setup-gradle@v4  # NOSONAR githubactions:S7637
+        with:
+          gradle-version: "8.11.1"
+
+      - name: Test the fence ledger on the JVM
+        run: gradle --no-daemon -p native/android_helper :core:test
+
+  instrumentation-app:
+    # The runner image ships the Android SDK (ANDROID_HOME); the debug APK is kept for the
+    # emulator stage. Building it proves the app compiles against the ledger and protocol.
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: "17"
+
+      - name: Set up Gradle
+        # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
+        uses: gradle/actions/setup-gradle@v4  # NOSONAR githubactions:S7637
+        with:
+          gradle-version: "8.11.1"
+
+      - name: Build the instrumentation APK
+        run: gradle --no-daemon -p native/android_helper :app:assembleDebug
+
+      - name: Keep the APK for the emulator stage
+        uses: actions/upload-artifact@v6
+        with:
+          name: android-helper-debug-apk
+          path: native/android_helper/app/build/outputs/apk/debug/app-debug.apk
+          retention-days: 7

.github/workflows/dev.yml

@@ -23,15 +23,17 @@ jobs:
     # Windows runs both ends of the supported Python range. The full nine-way
     # matrix runs on the pull request that takes dev to main.
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 30  # about 3x a square of the same suite in quality.yml
+    # Since the agent runtime landed, Windows squares take 43-48 minutes and Linux and macOS about 25
+    # (U-20261031-03), against the old limit of 30.
+    timeout-minutes: 120
     strategy:
       fail-fast: false
       matrix:
         include:
           - { os: windows-2022, python-version: "3.10" }
           - { os: windows-2022, python-version: "3.14" }
           - { os: ubuntu-22.04, python-version: "3.14" }
-          - { os: macos-14, python-version: "3.10" }
+          - { os: macos-15, python-version: "3.10" }
     steps:
       - uses: actions/checkout@v5
         with:
@@ -51,7 +53,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
-            xvfb xauth x11-utils \
+            xvfb xauth x11-utils gdb \
             libgl1 libegl1 libglib2.0-0 \
             libxkbcommon-x11-0 libdbus-1-3 \
             libxcb-cursor0 libxcb-icccm4 libxcb-image0 libxcb-keysyms1 \
@@ -82,12 +84,33 @@ jobs:
       # No path argument: the paths come from `testpaths` in pyproject.toml,
       # and an argument would drop the flow_control tests. Linux runs under a
       # real Xvfb because the X11 backend opens a display at import time.
+      - name: Verify native diagnostics runner (Linux)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: >-
+          xvfb-run -a -s "-screen 0 1280x800x24"
+          python scripts/ci_native_diagnostics.py
+          --artifact-dir "${{ runner.temp }}/autocontrol-native/preflight" --
+          python -m pytest -v --tb=short --timeout=30
+          test/unit_test/headless/test_ci_native_diagnostics.py
+
       - name: Run headless pytest suite
         shell: bash
         run: >-
           ${{ runner.os == 'Linux' && 'xvfb-run -a -s "-screen 0 1280x800x24"' || '' }}
+          python scripts/ci_native_diagnostics.py
+          --artifact-dir "${{ runner.temp }}/autocontrol-native"
+          ${{ runner.os == 'Linux' && '--native' || '' }} --
           python -m pytest -v --tb=short --timeout=120
 
+      - name: Retain native test diagnostics
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: native-${{ matrix.os }}-${{ matrix.python-version }}
+          path: ${{ runner.temp }}/autocontrol-native
+          retention-days: 7
+
   publish-dev:
     # A push to dev that passes the tests is built from dev.toml and uploaded
     # when it is still the tip of dev and ships something the newest

.github/workflows/ei-lifecycle.yml

@@ -0,0 +1,90 @@
+name: AutoControl EI lifecycle evidence
+
+on:
+  push:
+    branches: ["dev"]
+    paths:
+      - "je_auto_control/linux_wayland/**"
+      - "docker/Dockerfile.eis"
+      - "docker/libei_verify.py"
+      - "docker/eis_verify.py"
+      - "docker/eis_server.py"
+      - "pyproject.toml"
+      - ".github/workflows/ei-lifecycle.yml"
+      - "test/unit_test/headless/test_ei_native_verification.py"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ei-lifecycle-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  ei-lifecycle:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+
+      - name: Prepare evidence directory
+        run: mkdir -p native-ei
+
+      - name: Set up Docker Buildx
+        # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
+        uses: docker/setup-buildx-action@v4  # NOSONAR githubactions:S7637
+
+      - name: Build the isolated EI image
+        id: build
+        # nosemgrep: yaml.github-actions.security.third-party-action-not-pinned-to-commit-sha.third-party-action-not-pinned-to-commit-sha
+        uses: docker/build-push-action@v7  # NOSONAR githubactions:S7637
+        with:
+          context: .
+          file: docker/Dockerfile.eis
+          tags: autocontrol-ei-lifecycle:ci
+          load: true
+          cache-from: type=gha,scope=ei-lifecycle
+          cache-to: type=gha,scope=ei-lifecycle,mode=max
+
+      - name: Record native versions
+        shell: bash
+        run: |
+          docker run --rm --entrypoint sh autocontrol-ei-lifecycle:ci \
+            -c 'python -VV && dpkg-query -W libei1 libeis1' 2>&1 | tee native-ei/versions.log
+
+      - name: Verify half-open teardown and native refusal
+        if: always() && steps.build.outcome == 'success'
+        timeout-minutes: 5
+        shell: bash
+        run: |
+          docker run --rm --name ac-libei-probe --stop-timeout 5 --entrypoint python \
+            autocontrol-ei-lifecycle:ci /opt/verify/libei_verify.py 2>&1 | tee native-ei/libei.log
+
+      - name: Verify the live EIS peer independently
+        if: always() && steps.build.outcome == 'success'
+        timeout-minutes: 5
+        shell: bash
+        run: |
+          docker run --rm --name ac-eis-peer --stop-timeout 5 --entrypoint python \
+            autocontrol-ei-lifecycle:ci /opt/verify/eis_verify.py 2>&1 | tee native-ei/eis.log
+
+      - name: Remove owned verification containers
+        if: always()
+        shell: bash
+        run: |
+          for name in ac-libei-probe ac-eis-peer; do
+            if docker container inspect "$name" >/dev/null 2>&1; then
+              docker rm -f "$name"
+            fi
+          done
+
+      - name: Retain native EI evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: ei-lifecycle-${{ github.run_id }}-${{ github.run_attempt }}
+          path: native-ei/
+          retention-days: 14

.github/workflows/platform-smoke.yml

@@ -15,7 +15,7 @@ jobs:
       fail-fast: false
       matrix:
         # arm64 is not a rounding error on the desktop any more, and the
-        # dependency set is where it shows. macos-14 is already arm64;
+        # dependency set is where it shows. macos-15 is arm64;
         # ubuntu-22.04-arm adds Linux, and windows-11-arm is back.
         #
         # windows-11-arm installs a smaller dependency set than every other
@@ -42,7 +42,7 @@ jobs:
         #       'opencv-python>=4.8,<6' 'cryptography>=50.0.0'
         #
         # When both resolve, drop the markers from pyproject.toml.
-        os: [windows-2022, ubuntu-22.04, macos-14, ubuntu-22.04-arm, windows-11-arm]
+        os: [windows-2022, ubuntu-22.04, macos-15, ubuntu-22.04-arm, windows-11-arm]
         python-version: ["3.10", "3.14"]
         exclude:
           # CPython's official Windows arm64 builds start at 3.11, so
@@ -163,7 +163,7 @@ jobs:
             DISPLAY=:99 PYTHONPATH="$(pwd)" python3.11 test/verify/freebsd_verify.py
   macos-capabilities:
     name: What a real macOS runner permits
-    runs-on: macos-14
+    runs-on: macos-15
 
     steps:
       - uses: actions/checkout@v5
@@ -196,6 +196,10 @@ jobs:
       # holds what was measured, and a capability appearing or disappearing
       # turns this red and names which one.
       #
+      # That measurement was on macos-14, which GitHub retires on 2026-11-02;
+      # the job moved to macos-15 with EXPECTED unchanged, so this gate is
+      # also what confirms the newer image grants the same.
+      #
       # Three of the probes (the click-state read-back, the by-id lookup of a
       # minimised window, and the point-based `grab_logical`) were measured on
       # this runner on 2026-10-09 and are asserted since. The first two re-run

.github/workflows/quality.yml

@@ -36,6 +36,9 @@ jobs:
           python-version: "3.12"
           cache: "pip"
 
+      - name: Verify generated facade exports
+        run: python scripts/generate_facade_exports.py --check
+
       - name: Install ruff
         run: "pip install --only-binary :all: ruff==0.16.0"
 
@@ -78,8 +81,8 @@ jobs:
           - { os: windows-2022, python-version: "3.14" }
           - { os: ubuntu-22.04, python-version: "3.10" }
           - { os: ubuntu-22.04, python-version: "3.14" }
-          - { os: macos-14, python-version: "3.10" }
-          - { os: macos-14, python-version: "3.14" }
+          - { os: macos-15, python-version: "3.10" }
+          - { os: macos-15, python-version: "3.14" }
     steps:
       - uses: actions/checkout@v5
 
@@ -99,7 +102,7 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
-            xvfb xauth x11-utils \
+            xvfb xauth x11-utils gdb \
             libgl1 libegl1 libglib2.0-0 \
             libxkbcommon-x11-0 libdbus-1-3 \
             libxcb-cursor0 libxcb-icccm4 libxcb-image0 libxcb-keysyms1 \
@@ -149,6 +152,16 @@ jobs:
         # scalar, which YAML reads as a mapping and refuses.
         run: "pip install --only-binary :all: ruff==0.16.0 bandit==1.9.4 pytest==9.1.1 pytest-timeout==2.4.0 pytest-rerunfailures==16.7 coverage==7.15.4 PySide6==6.11.2 radon==6.0.1 fastapi==0.143.0 starlette==1.7.0 uvicorn==0.54.0 httpx==0.28.1"
 
+      - name: Verify native diagnostics runner (Linux)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: >-
+          xvfb-run -a -s "-screen 0 1280x800x24"
+          python scripts/ci_native_diagnostics.py
+          --artifact-dir "${{ runner.temp }}/autocontrol-native/preflight" --
+          python -m pytest -v --tb=short --timeout=30
+          test/unit_test/headless/test_ci_native_diagnostics.py
+
       # Paths come from `testpaths` in pyproject.toml. Do NOT pass an explicit
       # path here: an argument overrides testpaths, which previously meant the
       # flow_control tests were configured to run but silently never did.
@@ -184,6 +197,9 @@ jobs:
           PYTHONFAULTHANDLER: "1"
         run: >-
           ${{ runner.os == 'Linux' && 'xvfb-run -a -s "-screen 0 1280x800x24"' || '' }}
+          python scripts/ci_native_diagnostics.py
+          --artifact-dir "${{ runner.temp }}/autocontrol-native"
+          ${{ runner.os == 'Linux' && '--native' || '' }} --
           python -m coverage run -m pytest -v --tb=short --timeout=120
 
       # XML before the floor check, so a square that fails the floor still
@@ -203,6 +219,14 @@ jobs:
           name: coverage-${{ matrix.os }}-${{ matrix.python-version }}
           path: coverage.xml
 
+      - name: Retain native test diagnostics
+        if: always()
+        uses: actions/upload-artifact@v6
+        with:
+          name: native-${{ matrix.os }}-${{ matrix.python-version }}
+          path: ${{ runner.temp }}/autocontrol-native
+          retention-days: 7
+
   # The job id is still `typing-stable-api` because it is a required check and
   # renaming it silently drops the requirement, but the scope is no longer the
   # stable API alone: mypy now checks the whole package, minus the shrink-only