#Architecture and authority boundaries

A3S Test separates a test into four independently checkable responsibilities. The surface supplies facts, a planner chooses an action, the execution core decides whether that action is allowed, and evidence records what happened. Models may suggest locations or design changes, but only explicit authorization can send a suggestion into repair.

#Two planning entries, one execution core

Calling coding agent                  Closed ACL suite
  observe → decide → one action         admit → execute → assert
              \                         /
                 typed A3S Test Core
          Action · Session · Policy · Lifecycle
                           |
                Web · GUI · TUI adapters
                           |
             events · evidence · JSON · cleanup

The core does not depend on a browser, desktop perception, terminal emulation, CLI, or concrete LLM provider. It defines typed actions, observations, sessions, policy, results, and lifecycle. Injected adapters own concrete runtimes.

#Understanding happens after rendering

The browser accessibility tree is an important fact source, but it does not express component ownership, bounded source hints, multi-space geometry, visual viewport state, controlled product facts, or human repair state. Embedded Test Kit adds that information after rendering and publishes bounded Page Context under a monotonic revision.

Page context does not mutate the host DOM or replace browser observation. A3S Test checks driver semantics and the Test Kit revision inside one observation so it cannot combine state from different moments.

#Four authority layers

1. Deterministic facts: driver observations, Test Kit context, file digests, local assertions, and evidence.
2. Model advice: visual grounding, design audit, and source-to-contract candidates with provenance, budget, and confidence.
3. Human authorization: target confirmation, candidate selection, conflict decisions, and single or batch repair submission.
4. Repair execution: the workspace-owning coding agent edits source and A3S Test verifies it in a fresh browser.

Model output cannot decide a verdict, claim browser-observed state, or authorize workspace mutation. Projecting a report into the overlay never changes the runner result.

#Runtime ownership

Every launched program belongs to a process group, Windows Job, or equivalent owned tree created by A3S Test. Cancellation and timeout kill and reap the complete tree. Graceful shutdown is bounded and retains an emergency path. A3S Test never closes unrelated developer browser sessions.

Web sessions use an isolated namespace and non-zero idle timeout. Evidence paths must resolve to fresh regular files inside the session artifact root. GUI and TUI adapters carry the same exact-ownership requirement.

#Surface adapters

#Deployment-owned providers

Provider protocols define data exchange only. They do not bundle model weights or select backends with raw strings in public APIs. Deployments inject typed implementations and own model licensing, privacy, capacity, and runtime.

The HTTP adapters disable redirects and environment proxies, require HTTPS except for explicit loopback HTTP, bound request and response bodies, enforce transport and wire deadlines, and redact authorization values from errors. The surrounding services still verify identity, provenance, geometry, usage, and authority independently.